Home | History | Annotate | Line # | Download | only in dist
      1 
      2  OpenSSL CHANGES
      3  _______________
      4 
      5  Changes between 1.0.2j and 1.0.2k [26 Jan 2017]
      6 
      7   *) Truncated packet could crash via OOB read
      8 
      9      If one side of an SSL/TLS path is running on a 32-bit host and a specific
     10      cipher is being used, then a truncated packet can cause that host to
     11      perform an out-of-bounds read, usually resulting in a crash.
     12 
     13      This issue was reported to OpenSSL by Robert wicki of Google.
     14      (CVE-2017-3731)
     15      [Andy Polyakov]
     16 
     17   *) BN_mod_exp may produce incorrect results on x86_64
     18 
     19      There is a carry propagating bug in the x86_64 Montgomery squaring
     20      procedure. No EC algorithms are affected. Analysis suggests that attacks
     21      against RSA and DSA as a result of this defect would be very difficult to
     22      perform and are not believed likely. Attacks against DH are considered just
     23      feasible (although very difficult) because most of the work necessary to
     24      deduce information about a private key may be performed offline. The amount
     25      of resources required for such an attack would be very significant and
     26      likely only accessible to a limited number of attackers. An attacker would
     27      additionally need online access to an unpatched system using the target
     28      private key in a scenario with persistent DH parameters and a private
     29      key that is shared between multiple clients. For example this can occur by
     30      default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
     31      similar to CVE-2015-3193 but must be treated as a separate problem.
     32 
     33      This issue was reported to OpenSSL by the OSS-Fuzz project.
     34      (CVE-2017-3732)
     35      [Andy Polyakov]
     36 
     37   *) Montgomery multiplication may produce incorrect results
     38 
     39      There is a carry propagating bug in the Broadwell-specific Montgomery
     40      multiplication procedure that handles input lengths divisible by, but
     41      longer than 256 bits. Analysis suggests that attacks against RSA, DSA
     42      and DH private keys are impossible. This is because the subroutine in
     43      question is not used in operations with the private key itself and an input
     44      of the attacker's direct choice. Otherwise the bug can manifest itself as
     45      transient authentication and key negotiation failures or reproducible
     46      erroneous outcome of public-key operations with specially crafted input.
     47      Among EC algorithms only Brainpool P-512 curves are affected and one
     48      presumably can attack ECDH key negotiation. Impact was not analyzed in
     49      detail, because pre-requisites for attack are considered unlikely. Namely
     50      multiple clients have to choose the curve in question and the server has to
     51      share the private key among them, neither of which is default behaviour.
     52      Even then only clients that chose the curve will be affected.
     53 
     54      This issue was publicly reported as transient failures and was not
     55      initially recognized as a security issue. Thanks to Richard Morgan for
     56      providing reproducible case.
     57      (CVE-2016-7055)
     58      [Andy Polyakov]
     59 
     60   *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
     61      or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
     62      prevent issues where no progress is being made and the peer continually
     63      sends unrecognised record types, using up resources processing them.
     64      [Matt Caswell]
     65 
     66  Changes between 1.0.2i and 1.0.2j [26 Sep 2016]
     67 
     68   *) Missing CRL sanity check
     69 
     70      A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
     71      but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
     72      CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
     73 
     74      This issue only affects the OpenSSL 1.0.2i
     75      (CVE-2016-7052)
     76      [Matt Caswell]
     77 
     78  Changes between 1.0.2h and 1.0.2i [22 Sep 2016]
     79 
     80   *) OCSP Status Request extension unbounded memory growth
     81 
     82      A malicious client can send an excessively large OCSP Status Request
     83      extension. If that client continually requests renegotiation, sending a
     84      large OCSP Status Request extension each time, then there will be unbounded
     85      memory growth on the server. This will eventually lead to a Denial Of
     86      Service attack through memory exhaustion. Servers with a default
     87      configuration are vulnerable even if they do not support OCSP. Builds using
     88      the "no-ocsp" build time option are not affected.
     89 
     90      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
     91      (CVE-2016-6304)
     92      [Matt Caswell]
     93 
     94   *) In order to mitigate the SWEET32 attack, the DES ciphers were moved from
     95      HIGH to MEDIUM.
     96 
     97      This issue was reported to OpenSSL Karthikeyan Bhargavan and Gaetan
     98      Leurent (INRIA)
     99      (CVE-2016-2183)
    100      [Rich Salz]
    101 
    102   *) OOB write in MDC2_Update()
    103 
    104      An overflow can occur in MDC2_Update() either if called directly or
    105      through the EVP_DigestUpdate() function using MDC2. If an attacker
    106      is able to supply very large amounts of input data after a previous
    107      call to EVP_EncryptUpdate() with a partial block then a length check
    108      can overflow resulting in a heap corruption.
    109 
    110      The amount of data needed is comparable to SIZE_MAX which is impractical
    111      on most platforms.
    112 
    113      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    114      (CVE-2016-6303)
    115      [Stephen Henson]
    116 
    117   *) Malformed SHA512 ticket DoS
    118 
    119      If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
    120      DoS attack where a malformed ticket will result in an OOB read which will
    121      ultimately crash.
    122 
    123      The use of SHA512 in TLS session tickets is comparatively rare as it requires
    124      a custom server callback and ticket lookup mechanism.
    125 
    126      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    127      (CVE-2016-6302)
    128      [Stephen Henson]
    129 
    130   *) OOB write in BN_bn2dec()
    131 
    132      The function BN_bn2dec() does not check the return value of BN_div_word().
    133      This can cause an OOB write if an application uses this function with an
    134      overly large BIGNUM. This could be a problem if an overly large certificate
    135      or CRL is printed out from an untrusted source. TLS is not affected because
    136      record limits will reject an oversized certificate before it is parsed.
    137 
    138      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    139      (CVE-2016-2182)
    140      [Stephen Henson]
    141 
    142   *) OOB read in TS_OBJ_print_bio()
    143 
    144      The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
    145      the total length the OID text representation would use and not the amount
    146      of data written. This will result in OOB reads when large OIDs are
    147      presented.
    148 
    149      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    150      (CVE-2016-2180)
    151      [Stephen Henson]
    152 
    153   *) Pointer arithmetic undefined behaviour
    154 
    155      Avoid some undefined pointer arithmetic
    156 
    157      A common idiom in the codebase is to check limits in the following manner:
    158      "p + len > limit"
    159 
    160      Where "p" points to some malloc'd data of SIZE bytes and
    161      limit == p + SIZE
    162 
    163      "len" here could be from some externally supplied data (e.g. from a TLS
    164      message).
    165 
    166      The rules of C pointer arithmetic are such that "p + len" is only well
    167      defined where len <= SIZE. Therefore the above idiom is actually
    168      undefined behaviour.
    169 
    170      For example this could cause problems if some malloc implementation
    171      provides an address for "p" such that "p + len" actually overflows for
    172      values of len that are too big and therefore p + len < limit.
    173 
    174      This issue was reported to OpenSSL by Guido Vranken
    175      (CVE-2016-2177)
    176      [Matt Caswell]
    177 
    178   *) Constant time flag not preserved in DSA signing
    179 
    180      Operations in the DSA signing algorithm should run in constant time in
    181      order to avoid side channel attacks. A flaw in the OpenSSL DSA
    182      implementation means that a non-constant time codepath is followed for
    183      certain operations. This has been demonstrated through a cache-timing
    184      attack to be sufficient for an attacker to recover the private DSA key.
    185 
    186      This issue was reported by Csar Pereida (Aalto University), Billy Brumley
    187      (Tampere University of Technology), and Yuval Yarom (The University of
    188      Adelaide and NICTA).
    189      (CVE-2016-2178)
    190      [Csar Pereida]
    191 
    192   *) DTLS buffered message DoS
    193 
    194      In a DTLS connection where handshake messages are delivered out-of-order
    195      those messages that OpenSSL is not yet ready to process will be buffered
    196      for later use. Under certain circumstances, a flaw in the logic means that
    197      those messages do not get removed from the buffer even though the handshake
    198      has been completed. An attacker could force up to approx. 15 messages to
    199      remain in the buffer when they are no longer required. These messages will
    200      be cleared when the DTLS connection is closed. The default maximum size for
    201      a message is 100k. Therefore the attacker could force an additional 1500k
    202      to be consumed per connection. By opening many simulataneous connections an
    203      attacker could cause a DoS attack through memory exhaustion.
    204 
    205      This issue was reported to OpenSSL by Quan Luo.
    206      (CVE-2016-2179)
    207      [Matt Caswell]
    208 
    209   *) DTLS replay protection DoS
    210 
    211      A flaw in the DTLS replay attack protection mechanism means that records
    212      that arrive for future epochs update the replay protection "window" before
    213      the MAC for the record has been validated. This could be exploited by an
    214      attacker by sending a record for the next epoch (which does not have to
    215      decrypt or have a valid MAC), with a very large sequence number. This means
    216      that all subsequent legitimate packets are dropped causing a denial of
    217      service for a specific DTLS connection.
    218 
    219      This issue was reported to OpenSSL by the OCAP audit team.
    220      (CVE-2016-2181)
    221      [Matt Caswell]
    222 
    223   *) Certificate message OOB reads
    224 
    225      In OpenSSL 1.0.2 and earlier some missing message length checks can result
    226      in OOB reads of up to 2 bytes beyond an allocated buffer. There is a
    227      theoretical DoS risk but this has not been observed in practice on common
    228      platforms.
    229 
    230      The messages affected are client certificate, client certificate request
    231      and server certificate. As a result the attack can only be performed
    232      against a client or a server which enables client authentication.
    233 
    234      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    235      (CVE-2016-6306)
    236      [Stephen Henson]
    237 
    238  Changes between 1.0.2g and 1.0.2h [3 May 2016]
    239 
    240   *) Prevent padding oracle in AES-NI CBC MAC check
    241 
    242      A MITM attacker can use a padding oracle attack to decrypt traffic
    243      when the connection uses an AES CBC cipher and the server support
    244      AES-NI.
    245 
    246      This issue was introduced as part of the fix for Lucky 13 padding
    247      attack (CVE-2013-0169). The padding check was rewritten to be in
    248      constant time by making sure that always the same bytes are read and
    249      compared against either the MAC or padding bytes. But it no longer
    250      checked that there was enough data to have both the MAC and padding
    251      bytes.
    252 
    253      This issue was reported by Juraj Somorovsky using TLS-Attacker.
    254      (CVE-2016-2107)
    255      [Kurt Roeckx]
    256 
    257   *) Fix EVP_EncodeUpdate overflow
    258 
    259      An overflow can occur in the EVP_EncodeUpdate() function which is used for
    260      Base64 encoding of binary data. If an attacker is able to supply very large
    261      amounts of input data then a length check can overflow resulting in a heap
    262      corruption.
    263 
    264      Internally to OpenSSL the EVP_EncodeUpdate() function is primarly used by
    265      the PEM_write_bio* family of functions. These are mainly used within the
    266      OpenSSL command line applications, so any application which processes data
    267      from an untrusted source and outputs it as a PEM file should be considered
    268      vulnerable to this issue. User applications that call these APIs directly
    269      with large amounts of untrusted data may also be vulnerable.
    270 
    271      This issue was reported by Guido Vranken.
    272      (CVE-2016-2105)
    273      [Matt Caswell]
    274 
    275   *) Fix EVP_EncryptUpdate overflow
    276 
    277      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
    278      is able to supply very large amounts of input data after a previous call to
    279      EVP_EncryptUpdate() with a partial block then a length check can overflow
    280      resulting in a heap corruption. Following an analysis of all OpenSSL
    281      internal usage of the EVP_EncryptUpdate() function all usage is one of two
    282      forms. The first form is where the EVP_EncryptUpdate() call is known to be
    283      the first called function after an EVP_EncryptInit(), and therefore that
    284      specific call must be safe. The second form is where the length passed to
    285      EVP_EncryptUpdate() can be seen from the code to be some small value and
    286      therefore there is no possibility of an overflow. Since all instances are
    287      one of these two forms, it is believed that there can be no overflows in
    288      internal code due to this problem. It should be noted that
    289      EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
    290      Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
    291      of these calls have also been analysed too and it is believed there are no
    292      instances in internal usage where an overflow could occur.
    293 
    294      This issue was reported by Guido Vranken.
    295      (CVE-2016-2106)
    296      [Matt Caswell]
    297 
    298   *) Prevent ASN.1 BIO excessive memory allocation
    299 
    300      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
    301      a short invalid encoding can casuse allocation of large amounts of memory
    302      potentially consuming excessive resources or exhausting memory.
    303 
    304      Any application parsing untrusted data through d2i BIO functions is
    305      affected. The memory based functions such as d2i_X509() are *not* affected.
    306      Since the memory based functions are used by the TLS library, TLS
    307      applications are not affected.
    308 
    309      This issue was reported by Brian Carpenter.
    310      (CVE-2016-2109)
    311      [Stephen Henson]
    312 
    313   *) EBCDIC overread
    314 
    315      ASN1 Strings that are over 1024 bytes can cause an overread in applications
    316      using the X509_NAME_oneline() function on EBCDIC systems. This could result
    317      in arbitrary stack data being returned in the buffer.
    318 
    319      This issue was reported by Guido Vranken.
    320      (CVE-2016-2176)
    321      [Matt Caswell]
    322 
    323   *) Modify behavior of ALPN to invoke callback after SNI/servername
    324      callback, such that updates to the SSL_CTX affect ALPN.
    325      [Todd Short]
    326 
    327   *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
    328      default.
    329      [Kurt Roeckx]
    330 
    331   *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
    332      methods are enabled and ssl2 is disabled the methods return NULL.
    333      [Kurt Roeckx]
    334 
    335  Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
    336 
    337   * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
    338     Builds that are not configured with "enable-weak-ssl-ciphers" will not
    339     provide any "EXPORT" or "LOW" strength ciphers.
    340     [Viktor Dukhovni]
    341 
    342   * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
    343     is by default disabled at build-time.  Builds that are not configured with
    344     "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
    345     users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
    346     will need to explicitly call either of:
    347 
    348         SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
    349     or
    350         SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
    351 
    352     as appropriate.  Even if either of those is used, or the application
    353     explicitly uses the version-specific SSLv2_method() or its client and
    354     server variants, SSLv2 ciphers vulnerable to exhaustive search key
    355     recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
    356     ciphers, and SSLv2 56-bit DES are no longer available.
    357     (CVE-2016-0800)
    358     [Viktor Dukhovni]
    359 
    360   *) Fix a double-free in DSA code
    361 
    362      A double free bug was discovered when OpenSSL parses malformed DSA private
    363      keys and could lead to a DoS attack or memory corruption for applications
    364      that receive DSA private keys from untrusted sources.  This scenario is
    365      considered rare.
    366 
    367      This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
    368      libFuzzer.
    369      (CVE-2016-0705)
    370      [Stephen Henson]
    371 
    372   *) Disable SRP fake user seed to address a server memory leak.
    373 
    374      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
    375 
    376      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
    377      In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
    378      was changed to ignore the "fake user" SRP seed, even if the seed
    379      is configured.
    380 
    381      Users should use SRP_VBASE_get1_by_user instead. Note that in
    382      SRP_VBASE_get1_by_user, caller must free the returned value. Note
    383      also that even though configuring the SRP seed attempts to hide
    384      invalid usernames by continuing the handshake with fake
    385      credentials, this behaviour is not constant time and no strong
    386      guarantees are made that the handshake is indistinguishable from
    387      that of a valid user.
    388      (CVE-2016-0798)
    389      [Emilia Ksper]
    390 
    391   *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
    392 
    393      In the BN_hex2bn function the number of hex digits is calculated using an
    394      int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
    395      large values of |i| this can result in |bn_expand| not allocating any
    396      memory because |i * 4| is negative. This can leave the internal BIGNUM data
    397      field as NULL leading to a subsequent NULL ptr deref. For very large values
    398      of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
    399      In this case memory is allocated to the internal BIGNUM data field, but it
    400      is insufficiently sized leading to heap corruption. A similar issue exists
    401      in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
    402      is ever called by user applications with very large untrusted hex/dec data.
    403      This is anticipated to be a rare occurrence.
    404 
    405      All OpenSSL internal usage of these functions use data that is not expected
    406      to be untrusted, e.g. config file data or application command line
    407      arguments. If user developed applications generate config file data based
    408      on untrusted data then it is possible that this could also lead to security
    409      consequences. This is also anticipated to be rare.
    410 
    411      This issue was reported to OpenSSL by Guido Vranken.
    412      (CVE-2016-0797)
    413      [Matt Caswell]
    414 
    415   *) Fix memory issues in BIO_*printf functions
    416 
    417      The internal |fmtstr| function used in processing a "%s" format string in
    418      the BIO_*printf functions could overflow while calculating the length of a
    419      string and cause an OOB read when printing very long strings.
    420 
    421      Additionally the internal |doapr_outch| function can attempt to write to an
    422      OOB memory location (at an offset from the NULL pointer) in the event of a
    423      memory allocation failure. In 1.0.2 and below this could be caused where
    424      the size of a buffer to be allocated is greater than INT_MAX. E.g. this
    425      could be in processing a very long "%s" format string. Memory leaks can
    426      also occur.
    427 
    428      The first issue may mask the second issue dependent on compiler behaviour.
    429      These problems could enable attacks where large amounts of untrusted data
    430      is passed to the BIO_*printf functions. If applications use these functions
    431      in this way then they could be vulnerable. OpenSSL itself uses these
    432      functions when printing out human-readable dumps of ASN.1 data. Therefore
    433      applications that print this data could be vulnerable if the data is from
    434      untrusted sources. OpenSSL command line applications could also be
    435      vulnerable where they print out ASN.1 data, or if untrusted data is passed
    436      as command line arguments.
    437 
    438      Libssl is not considered directly vulnerable. Additionally certificates etc
    439      received via remote connections via libssl are also unlikely to be able to
    440      trigger these issues because of message size limits enforced within libssl.
    441 
    442      This issue was reported to OpenSSL Guido Vranken.
    443      (CVE-2016-0799)
    444      [Matt Caswell]
    445 
    446   *) Side channel attack on modular exponentiation
    447 
    448      A side-channel attack was found which makes use of cache-bank conflicts on
    449      the Intel Sandy-Bridge microarchitecture which could lead to the recovery
    450      of RSA keys.  The ability to exploit this issue is limited as it relies on
    451      an attacker who has control of code in a thread running on the same
    452      hyper-threaded core as the victim thread which is performing decryptions.
    453 
    454      This issue was reported to OpenSSL by Yuval Yarom, The University of
    455      Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
    456      Nadia Heninger, University of Pennsylvania with more information at
    457      http://cachebleed.info.
    458      (CVE-2016-0702)
    459      [Andy Polyakov]
    460 
    461   *) Change the req app to generate a 2048-bit RSA/DSA key by default,
    462      if no keysize is specified with default_bits. This fixes an
    463      omission in an earlier change that changed all RSA/DSA key generation
    464      apps to use 2048 bits by default.
    465      [Emilia Ksper]
    466 
    467  Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
    468 
    469   *) DH small subgroups
    470 
    471      Historically OpenSSL only ever generated DH parameters based on "safe"
    472      primes. More recently (in version 1.0.2) support was provided for
    473      generating X9.42 style parameter files such as those required for RFC 5114
    474      support. The primes used in such files may not be "safe". Where an
    475      application is using DH configured with parameters based on primes that are
    476      not "safe" then an attacker could use this fact to find a peer's private
    477      DH exponent. This attack requires that the attacker complete multiple
    478      handshakes in which the peer uses the same private DH exponent. For example
    479      this could be used to discover a TLS server's private DH exponent if it's
    480      reusing the private DH exponent or it's using a static DH ciphersuite.
    481 
    482      OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
    483      TLS. It is not on by default. If the option is not set then the server
    484      reuses the same private DH exponent for the life of the server process and
    485      would be vulnerable to this attack. It is believed that many popular
    486      applications do set this option and would therefore not be at risk.
    487 
    488      The fix for this issue adds an additional check where a "q" parameter is
    489      available (as is the case in X9.42 based parameters). This detects the
    490      only known attack, and is the only possible defense for static DH
    491      ciphersuites. This could have some performance impact.
    492 
    493      Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
    494      default and cannot be disabled. This could have some performance impact.
    495 
    496      This issue was reported to OpenSSL by Antonio Sanso (Adobe).
    497      (CVE-2016-0701)
    498      [Matt Caswell]
    499 
    500   *) SSLv2 doesn't block disabled ciphers
    501 
    502      A malicious client can negotiate SSLv2 ciphers that have been disabled on
    503      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
    504      been disabled, provided that the SSLv2 protocol was not also disabled via
    505      SSL_OP_NO_SSLv2.
    506 
    507      This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
    508      and Sebastian Schinzel.
    509      (CVE-2015-3197)
    510      [Viktor Dukhovni]
    511 
    512   *) Reject DH handshakes with parameters shorter than 1024 bits.
    513      [Kurt Roeckx]
    514 
    515  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
    516 
    517   *) BN_mod_exp may produce incorrect results on x86_64
    518 
    519      There is a carry propagating bug in the x86_64 Montgomery squaring
    520      procedure. No EC algorithms are affected. Analysis suggests that attacks
    521      against RSA and DSA as a result of this defect would be very difficult to
    522      perform and are not believed likely. Attacks against DH are considered just
    523      feasible (although very difficult) because most of the work necessary to
    524      deduce information about a private key may be performed offline. The amount
    525      of resources required for such an attack would be very significant and
    526      likely only accessible to a limited number of attackers. An attacker would
    527      additionally need online access to an unpatched system using the target
    528      private key in a scenario with persistent DH parameters and a private
    529      key that is shared between multiple clients. For example this can occur by
    530      default in OpenSSL DHE based SSL/TLS ciphersuites.
    531 
    532      This issue was reported to OpenSSL by Hanno Bck.
    533      (CVE-2015-3193)
    534      [Andy Polyakov]
    535 
    536   *) Certificate verify crash with missing PSS parameter
    537 
    538      The signature verification routines will crash with a NULL pointer
    539      dereference if presented with an ASN.1 signature using the RSA PSS
    540      algorithm and absent mask generation function parameter. Since these
    541      routines are used to verify certificate signature algorithms this can be
    542      used to crash any certificate verification operation and exploited in a
    543      DoS attack. Any application which performs certificate verification is
    544      vulnerable including OpenSSL clients and servers which enable client
    545      authentication.
    546 
    547      This issue was reported to OpenSSL by Loc Jonas Etienne (Qnective AG).
    548      (CVE-2015-3194)
    549      [Stephen Henson]
    550 
    551   *) X509_ATTRIBUTE memory leak
    552 
    553      When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
    554      memory. This structure is used by the PKCS#7 and CMS routines so any
    555      application which reads PKCS#7 or CMS data from untrusted sources is
    556      affected. SSL/TLS is not affected.
    557 
    558      This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
    559      libFuzzer.
    560      (CVE-2015-3195)
    561      [Stephen Henson]
    562 
    563   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
    564      This changes the decoding behaviour for some invalid messages,
    565      though the change is mostly in the more lenient direction, and
    566      legacy behaviour is preserved as much as possible.
    567      [Emilia Ksper]
    568 
    569   *) In DSA_generate_parameters_ex, if the provided seed is too short,
    570      use a random seed, as already documented.
    571      [Rich Salz and Ismo Puustinen <ismo.puustinen (a] intel.com>]
    572 
    573  Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
    574 
    575   *) Alternate chains certificate forgery
    576 
    577      During certificate verfification, OpenSSL will attempt to find an
    578      alternative certificate chain if the first attempt to build such a chain
    579      fails. An error in the implementation of this logic can mean that an
    580      attacker could cause certain checks on untrusted certificates to be
    581      bypassed, such as the CA flag, enabling them to use a valid leaf
    582      certificate to act as a CA and "issue" an invalid certificate.
    583 
    584      This issue was reported to OpenSSL by Adam Langley/David Benjamin
    585      (Google/BoringSSL).
    586      (CVE-2015-1793)
    587      [Matt Caswell]
    588 
    589   *) Race condition handling PSK identify hint
    590 
    591      If PSK identity hints are received by a multi-threaded client then
    592      the values are wrongly updated in the parent SSL_CTX structure. This can
    593      result in a race condition potentially leading to a double free of the
    594      identify hint data.
    595      (CVE-2015-3196)
    596      [Stephen Henson]
    597 
    598  Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
    599 
    600   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
    601      incompatibility in the handling of HMAC. The previous ABI has now been
    602      restored.
    603 
    604  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
    605 
    606   *) Malformed ECParameters causes infinite loop
    607 
    608      When processing an ECParameters structure OpenSSL enters an infinite loop
    609      if the curve specified is over a specially malformed binary polynomial
    610      field.
    611 
    612      This can be used to perform denial of service against any
    613      system which processes public keys, certificate requests or
    614      certificates.  This includes TLS clients and TLS servers with
    615      client authentication enabled.
    616 
    617      This issue was reported to OpenSSL by Joseph Barr-Pixton.
    618      (CVE-2015-1788)
    619      [Andy Polyakov]
    620 
    621   *) Exploitable out-of-bounds read in X509_cmp_time
    622 
    623      X509_cmp_time does not properly check the length of the ASN1_TIME
    624      string and can read a few bytes out of bounds. In addition,
    625      X509_cmp_time accepts an arbitrary number of fractional seconds in the
    626      time string.
    627 
    628      An attacker can use this to craft malformed certificates and CRLs of
    629      various sizes and potentially cause a segmentation fault, resulting in
    630      a DoS on applications that verify certificates or CRLs. TLS clients
    631      that verify CRLs are affected. TLS clients and servers with client
    632      authentication enabled may be affected if they use custom verification
    633      callbacks.
    634 
    635      This issue was reported to OpenSSL by Robert Swiecki (Google), and
    636      independently by Hanno Bck.
    637      (CVE-2015-1789)
    638      [Emilia Ksper]
    639 
    640   *) PKCS7 crash with missing EnvelopedContent
    641 
    642      The PKCS#7 parsing code does not handle missing inner EncryptedContent
    643      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
    644      with missing content and trigger a NULL pointer dereference on parsing.
    645 
    646      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
    647      structures from untrusted sources are affected. OpenSSL clients and
    648      servers are not affected.
    649 
    650      This issue was reported to OpenSSL by Michal Zalewski (Google).
    651      (CVE-2015-1790)
    652      [Emilia Ksper]
    653 
    654   *) CMS verify infinite loop with unknown hash function
    655 
    656      When verifying a signedData message the CMS code can enter an infinite loop
    657      if presented with an unknown hash function OID. This can be used to perform
    658      denial of service against any system which verifies signedData messages using
    659      the CMS code.
    660      This issue was reported to OpenSSL by Johannes Bauer.
    661      (CVE-2015-1792)
    662      [Stephen Henson]
    663 
    664   *) Race condition handling NewSessionTicket
    665 
    666      If a NewSessionTicket is received by a multi-threaded client when attempting to
    667      reuse a previous ticket then a race condition can occur potentially leading to
    668      a double free of the ticket data.
    669      (CVE-2015-1791)
    670      [Matt Caswell]
    671 
    672   *) Removed support for the two export grade static DH ciphersuites
    673      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
    674      were newly added (along with a number of other static DH ciphersuites) to
    675      1.0.2. However the two export ones have *never* worked since they were
    676      introduced. It seems strange in any case to be adding new export
    677      ciphersuites, and given "logjam" it also does not seem correct to fix them.
    678      [Matt Caswell]
    679 
    680   *) Only support 256-bit or stronger elliptic curves with the
    681      'ecdh_auto' setting (server) or by default (client). Of supported
    682      curves, prefer P-256 (both).
    683      [Emilia Kasper]
    684 
    685   *) Reject DH handshakes with parameters shorter than 768 bits.
    686      [Kurt Roeckx and Emilia Kasper]
    687 
    688  Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
    689 
    690   *) ClientHello sigalgs DoS fix
    691 
    692      If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
    693      invalid signature algorithms extension a NULL pointer dereference will
    694      occur. This can be exploited in a DoS attack against the server.
    695 
    696      This issue was was reported to OpenSSL by David Ramos of Stanford
    697      University.
    698      (CVE-2015-0291)
    699      [Stephen Henson and Matt Caswell]
    700 
    701   *) Multiblock corrupted pointer fix
    702 
    703      OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
    704      feature only applies on 64 bit x86 architecture platforms that support AES
    705      NI instructions. A defect in the implementation of "multiblock" can cause
    706      OpenSSL's internal write buffer to become incorrectly set to NULL when
    707      using non-blocking IO. Typically, when the user application is using a
    708      socket BIO for writing, this will only result in a failed connection.
    709      However if some other BIO is used then it is likely that a segmentation
    710      fault will be triggered, thus enabling a potential DoS attack.
    711 
    712      This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
    713      (CVE-2015-0290)
    714      [Matt Caswell]
    715 
    716   *) Segmentation fault in DTLSv1_listen fix
    717 
    718      The DTLSv1_listen function is intended to be stateless and processes the
    719      initial ClientHello from many peers. It is common for user code to loop
    720      over the call to DTLSv1_listen until a valid ClientHello is received with
    721      an associated cookie. A defect in the implementation of DTLSv1_listen means
    722      that state is preserved in the SSL object from one invocation to the next
    723      that can lead to a segmentation fault. Errors processing the initial
    724      ClientHello can trigger this scenario. An example of such an error could be
    725      that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
    726      server.
    727 
    728      This issue was reported to OpenSSL by Per Allansson.
    729      (CVE-2015-0207)
    730      [Matt Caswell]
    731 
    732   *) Segmentation fault in ASN1_TYPE_cmp fix
    733 
    734      The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
    735      made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
    736      certificate signature algorithm consistency this can be used to crash any
    737      certificate verification operation and exploited in a DoS attack. Any
    738      application which performs certificate verification is vulnerable including
    739      OpenSSL clients and servers which enable client authentication.
    740      (CVE-2015-0286)
    741      [Stephen Henson]
    742 
    743   *) Segmentation fault for invalid PSS parameters fix
    744 
    745      The signature verification routines will crash with a NULL pointer
    746      dereference if presented with an ASN.1 signature using the RSA PSS
    747      algorithm and invalid parameters. Since these routines are used to verify
    748      certificate signature algorithms this can be used to crash any
    749      certificate verification operation and exploited in a DoS attack. Any
    750      application which performs certificate verification is vulnerable including
    751      OpenSSL clients and servers which enable client authentication.
    752 
    753      This issue was was reported to OpenSSL by Brian Carpenter.
    754      (CVE-2015-0208)
    755      [Stephen Henson]
    756 
    757   *) ASN.1 structure reuse memory corruption fix
    758 
    759      Reusing a structure in ASN.1 parsing may allow an attacker to cause
    760      memory corruption via an invalid write. Such reuse is and has been
    761      strongly discouraged and is believed to be rare.
    762 
    763      Applications that parse structures containing CHOICE or ANY DEFINED BY
    764      components may be affected. Certificate parsing (d2i_X509 and related
    765      functions) are however not affected. OpenSSL clients and servers are
    766      not affected.
    767      (CVE-2015-0287)
    768      [Stephen Henson]
    769 
    770   *) PKCS7 NULL pointer dereferences fix
    771 
    772      The PKCS#7 parsing code does not handle missing outer ContentInfo
    773      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
    774      missing content and trigger a NULL pointer dereference on parsing.
    775 
    776      Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
    777      otherwise parse PKCS#7 structures from untrusted sources are
    778      affected. OpenSSL clients and servers are not affected.
    779 
    780      This issue was reported to OpenSSL by Michal Zalewski (Google).
    781      (CVE-2015-0289)
    782      [Emilia Ksper]
    783 
    784   *) DoS via reachable assert in SSLv2 servers fix
    785 
    786      A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
    787      servers that both support SSLv2 and enable export cipher suites by sending
    788      a specially crafted SSLv2 CLIENT-MASTER-KEY message.
    789 
    790      This issue was discovered by Sean Burford (Google) and Emilia Ksper
    791      (OpenSSL development team).
    792      (CVE-2015-0293)
    793      [Emilia Ksper]
    794 
    795   *) Empty CKE with client auth and DHE fix
    796 
    797      If client auth is used then a server can seg fault in the event of a DHE
    798      ciphersuite being selected and a zero length ClientKeyExchange message
    799      being sent by the client. This could be exploited in a DoS attack.
    800      (CVE-2015-1787)
    801      [Matt Caswell]
    802 
    803   *) Handshake with unseeded PRNG fix
    804 
    805      Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
    806      with an unseeded PRNG. The conditions are:
    807      - The client is on a platform where the PRNG has not been seeded
    808      automatically, and the user has not seeded manually
    809      - A protocol specific client method version has been used (i.e. not
    810      SSL_client_methodv23)
    811      - A ciphersuite is used that does not require additional random data from
    812      the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
    813 
    814      If the handshake succeeds then the client random that has been used will
    815      have been generated from a PRNG with insufficient entropy and therefore the
    816      output may be predictable.
    817 
    818      For example using the following command with an unseeded openssl will
    819      succeed on an unpatched platform:
    820 
    821      openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
    822      (CVE-2015-0285)
    823      [Matt Caswell]
    824 
    825   *) Use After Free following d2i_ECPrivatekey error fix
    826 
    827      A malformed EC private key file consumed via the d2i_ECPrivateKey function
    828      could cause a use after free condition. This, in turn, could cause a double
    829      free in several private key parsing functions (such as d2i_PrivateKey
    830      or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
    831      for applications that receive EC private keys from untrusted
    832      sources. This scenario is considered rare.
    833 
    834      This issue was discovered by the BoringSSL project and fixed in their
    835      commit 517073cd4b.
    836      (CVE-2015-0209)
    837      [Matt Caswell]
    838 
    839   *) X509_to_X509_REQ NULL pointer deref fix
    840 
    841      The function X509_to_X509_REQ will crash with a NULL pointer dereference if
    842      the certificate key is invalid. This function is rarely used in practice.
    843 
    844      This issue was discovered by Brian Carpenter.
    845      (CVE-2015-0288)
    846      [Stephen Henson]
    847 
    848   *) Removed the export ciphers from the DEFAULT ciphers
    849      [Kurt Roeckx]
    850 
    851  Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
    852 
    853   *) Change RSA and DH/DSA key generation apps to generate 2048-bit
    854      keys by default.
    855      [Kurt Roeckx]
    856 
    857   *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
    858      ARMv5 through ARMv8, as opposite to "locking" it to single one.
    859      So far those who have to target multiple plaforms would compromise
    860      and argue that binary targeting say ARMv5 would still execute on
    861      ARMv8. "Universal" build resolves this compromise by providing
    862      near-optimal performance even on newer platforms.
    863      [Andy Polyakov]
    864 
    865   *) Accelerated NIST P-256 elliptic curve implementation for x86_64
    866      (other platforms pending).
    867      [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
    868 
    869   *) Add support for the SignedCertificateTimestampList certificate and
    870      OCSP response extensions from RFC6962.
    871      [Rob Stradling]
    872 
    873   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
    874      for corner cases. (Certain input points at infinity could lead to
    875      bogus results, with non-infinity inputs mapped to infinity too.)
    876      [Bodo Moeller]
    877 
    878   *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
    879      This covers AES, SHA256/512 and GHASH. "Initial" means that most
    880      common cases are optimized and there still is room for further
    881      improvements. Vector Permutation AES for Altivec is also added.
    882      [Andy Polyakov]
    883 
    884   *) Add support for little-endian ppc64 Linux target.
    885      [Marcelo Cerri (IBM)]
    886 
    887   *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
    888      SHA1, SHA256 and GHASH. "Initial" means that most common cases
    889      are optimized and there still is room for further improvements.
    890      Both 32- and 64-bit modes are supported.
    891      [Andy Polyakov, Ard Biesheuvel (Linaro)]
    892 
    893   *) Improved ARMv7 NEON support.
    894      [Andy Polyakov]
    895 
    896   *) Support for SPARC Architecture 2011 crypto extensions, first
    897      implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
    898      SHA256/512, MD5, GHASH and modular exponentiation.
    899      [Andy Polyakov, David Miller]
    900 
    901   *) Accelerated modular exponentiation for Intel processors, a.k.a.
    902      RSAZ.
    903      [Shay Gueron & Vlad Krasnov (Intel Corp)]
    904 
    905   *) Support for new and upcoming Intel processors, including AVX2,
    906      BMI and SHA ISA extensions. This includes additional "stitched"
    907      implementations, AESNI-SHA256 and GCM, and multi-buffer support
    908      for TLS encrypt.
    909 
    910      This work was sponsored by Intel Corp.
    911      [Andy Polyakov]
    912 
    913   *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
    914      supports both DTLS 1.2 and 1.0 and should use whatever version the peer
    915      supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
    916      [Steve Henson]
    917 
    918   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
    919      this fixes a limiation in previous versions of OpenSSL.
    920      [Steve Henson]
    921 
    922   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
    923      MGF1 digest and OAEP label.
    924      [Steve Henson]
    925 
    926   *) Add EVP support for key wrapping algorithms, to avoid problems with
    927      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
    928      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
    929      algorithms and include tests cases.
    930      [Steve Henson]
    931 
    932   *) Add functions to allocate and set the fields of an ECDSA_METHOD
    933      structure.
    934      [Douglas E. Engert, Steve Henson]
    935 
    936   *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
    937      difference in days and seconds between two tm or ASN1_TIME structures.
    938      [Steve Henson]
    939 
    940   *) Add -rev test option to s_server to just reverse order of characters
    941      received by client and send back to server. Also prints an abbreviated
    942      summary of the connection parameters.
    943      [Steve Henson]
    944 
    945   *) New option -brief for s_client and s_server to print out a brief summary
    946      of connection parameters.
    947      [Steve Henson]
    948 
    949   *) Add callbacks for arbitrary TLS extensions.
    950      [Trevor Perrin <trevp (a] trevp.net> and Ben Laurie]
    951 
    952   *) New option -crl_download in several openssl utilities to download CRLs
    953      from CRLDP extension in certificates.
    954      [Steve Henson]
    955 
    956   *) New options -CRL and -CRLform for s_client and s_server for CRLs.
    957      [Steve Henson]
    958 
    959   *) New function X509_CRL_diff to generate a delta CRL from the difference
    960      of two full CRLs. Add support to "crl" utility.
    961      [Steve Henson]
    962 
    963   *) New functions to set lookup_crls function and to retrieve
    964      X509_STORE from X509_STORE_CTX.
    965      [Steve Henson]
    966 
    967   *) Print out deprecated issuer and subject unique ID fields in
    968      certificates.
    969      [Steve Henson]
    970 
    971   *) Extend OCSP I/O functions so they can be used for simple general purpose
    972      HTTP as well as OCSP. New wrapper function which can be used to download
    973      CRLs using the OCSP API.
    974      [Steve Henson]
    975 
    976   *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
    977      [Steve Henson]
    978 
    979   *) SSL_CONF* functions. These provide a common framework for application
    980      configuration using configuration files or command lines.
    981      [Steve Henson]
    982 
    983   *) SSL/TLS tracing code. This parses out SSL/TLS records using the
    984      message callback and prints the results. Needs compile time option
    985      "enable-ssl-trace". New options to s_client and s_server to enable
    986      tracing.
    987      [Steve Henson]
    988 
    989   *) New ctrl and macro to retrieve supported points extensions.
    990      Print out extension in s_server and s_client.
    991      [Steve Henson]
    992 
    993   *) New functions to retrieve certificate signature and signature
    994      OID NID.
    995      [Steve Henson]
    996 
    997   *) Add functions to retrieve and manipulate the raw cipherlist sent by a
    998      client to OpenSSL.
    999      [Steve Henson]
   1000 
   1001   *) New Suite B modes for TLS code. These use and enforce the requirements
   1002      of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
   1003      only use Suite B curves. The Suite B modes can be set by using the
   1004      strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
   1005      [Steve Henson]
   1006 
   1007   *) New chain verification flags for Suite B levels of security. Check
   1008      algorithms are acceptable when flags are set in X509_verify_cert.
   1009      [Steve Henson]
   1010 
   1011   *) Make tls1_check_chain return a set of flags indicating checks passed
   1012      by a certificate chain. Add additional tests to handle client
   1013      certificates: checks for matching certificate type and issuer name
   1014      comparison.
   1015      [Steve Henson]
   1016 
   1017   *) If an attempt is made to use a signature algorithm not in the peer
   1018      preference list abort the handshake. If client has no suitable
   1019      signature algorithms in response to a certificate request do not
   1020      use the certificate.
   1021      [Steve Henson]
   1022 
   1023   *) If server EC tmp key is not in client preference list abort handshake.
   1024      [Steve Henson]
   1025 
   1026   *) Add support for certificate stores in CERT structure. This makes it
   1027      possible to have different stores per SSL structure or one store in
   1028      the parent SSL_CTX. Include distint stores for certificate chain
   1029      verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
   1030      to build and store a certificate chain in CERT structure: returing
   1031      an error if the chain cannot be built: this will allow applications
   1032      to test if a chain is correctly configured.
   1033 
   1034      Note: if the CERT based stores are not set then the parent SSL_CTX
   1035      store is used to retain compatibility with existing behaviour.
   1036 
   1037      [Steve Henson]
   1038 
   1039   *) New function ssl_set_client_disabled to set a ciphersuite disabled
   1040      mask based on the current session, check mask when sending client
   1041      hello and checking the requested ciphersuite.
   1042      [Steve Henson]
   1043 
   1044   *) New ctrls to retrieve and set certificate types in a certificate
   1045      request message. Print out received values in s_client. If certificate
   1046      types is not set with custom values set sensible values based on
   1047      supported signature algorithms.
   1048      [Steve Henson]
   1049 
   1050   *) Support for distinct client and server supported signature algorithms.
   1051      [Steve Henson]
   1052 
   1053   *) Add certificate callback. If set this is called whenever a certificate
   1054      is required by client or server. An application can decide which
   1055      certificate chain to present based on arbitrary criteria: for example
   1056      supported signature algorithms. Add very simple example to s_server.
   1057      This fixes many of the problems and restrictions of the existing client
   1058      certificate callback: for example you can now clear an existing
   1059      certificate and specify the whole chain.
   1060      [Steve Henson]
   1061 
   1062   *) Add new "valid_flags" field to CERT_PKEY structure which determines what
   1063      the certificate can be used for (if anything). Set valid_flags field 
   1064      in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
   1065      to have similar checks in it.
   1066 
   1067      Add new "cert_flags" field to CERT structure and include a "strict mode".
   1068      This enforces some TLS certificate requirements (such as only permitting
   1069      certificate signature algorithms contained in the supported algorithms
   1070      extension) which some implementations ignore: this option should be used
   1071      with caution as it could cause interoperability issues.
   1072      [Steve Henson]
   1073 
   1074   *) Update and tidy signature algorithm extension processing. Work out
   1075      shared signature algorithms based on preferences and peer algorithms
   1076      and print them out in s_client and s_server. Abort handshake if no
   1077      shared signature algorithms.
   1078      [Steve Henson]
   1079 
   1080   *) Add new functions to allow customised supported signature algorithms
   1081      for SSL and SSL_CTX structures. Add options to s_client and s_server
   1082      to support them.
   1083      [Steve Henson]
   1084 
   1085   *) New function SSL_certs_clear() to delete all references to certificates
   1086      from an SSL structure. Before this once a certificate had been added
   1087      it couldn't be removed.
   1088      [Steve Henson]
   1089 
   1090   *) Integrate hostname, email address and IP address checking with certificate
   1091      verification. New verify options supporting checking in opensl utility.
   1092      [Steve Henson]
   1093 
   1094   *) Fixes and wildcard matching support to hostname and email checking
   1095      functions. Add manual page.
   1096      [Florian Weimer (Red Hat Product Security Team)]
   1097 
   1098   *) New functions to check a hostname email or IP address against a
   1099      certificate. Add options x509 utility to print results of checks against
   1100      a certificate.
   1101      [Steve Henson]
   1102 
   1103   *) Fix OCSP checking.
   1104      [Rob Stradling <rob.stradling (a] comodo.com> and Ben Laurie]
   1105 
   1106   *) Initial experimental support for explicitly trusted non-root CAs. 
   1107      OpenSSL still tries to build a complete chain to a root but if an
   1108      intermediate CA has a trust setting included that is used. The first
   1109      setting is used: whether to trust (e.g., -addtrust option to the x509
   1110      utility) or reject.
   1111      [Steve Henson]
   1112 
   1113   *) Add -trusted_first option which attempts to find certificates in the
   1114      trusted store even if an untrusted chain is also supplied.
   1115      [Steve Henson]
   1116 
   1117   *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
   1118      platform support for Linux and Android.
   1119      [Andy Polyakov]
   1120 
   1121   *) Support for linux-x32, ILP32 environment in x86_64 framework.
   1122      [Andy Polyakov]
   1123 
   1124   *) Experimental multi-implementation support for FIPS capable OpenSSL.
   1125      When in FIPS mode the approved implementations are used as normal,
   1126      when not in FIPS mode the internal unapproved versions are used instead.
   1127      This means that the FIPS capable OpenSSL isn't forced to use the
   1128      (often lower perfomance) FIPS implementations outside FIPS mode.
   1129      [Steve Henson]
   1130 
   1131   *) Transparently support X9.42 DH parameters when calling
   1132      PEM_read_bio_DHparameters. This means existing applications can handle
   1133      the new parameter format automatically.
   1134      [Steve Henson]
   1135 
   1136   *) Initial experimental support for X9.42 DH parameter format: mainly
   1137      to support use of 'q' parameter for RFC5114 parameters.
   1138      [Steve Henson]
   1139 
   1140   *) Add DH parameters from RFC5114 including test data to dhtest.
   1141      [Steve Henson]
   1142 
   1143   *) Support for automatic EC temporary key parameter selection. If enabled
   1144      the most preferred EC parameters are automatically used instead of
   1145      hardcoded fixed parameters. Now a server just has to call:
   1146      SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
   1147      support ECDH and use the most appropriate parameters.
   1148      [Steve Henson]
   1149 
   1150   *) Enhance and tidy EC curve and point format TLS extension code. Use
   1151      static structures instead of allocation if default values are used.
   1152      New ctrls to set curves we wish to support and to retrieve shared curves.
   1153      Print out shared curves in s_server. New options to s_server and s_client
   1154      to set list of supported curves.
   1155      [Steve Henson]
   1156 
   1157   *) New ctrls to retrieve supported signature algorithms and 
   1158      supported curve values as an array of NIDs. Extend openssl utility
   1159      to print out received values.
   1160      [Steve Henson]
   1161 
   1162   *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
   1163      between NIDs and the more common NIST names such as "P-256". Enhance
   1164      ecparam utility and ECC method to recognise the NIST names for curves.
   1165      [Steve Henson]
   1166 
   1167   *) Enhance SSL/TLS certificate chain handling to support different
   1168      chains for each certificate instead of one chain in the parent SSL_CTX.
   1169      [Steve Henson]
   1170 
   1171   *) Support for fixed DH ciphersuite client authentication: where both
   1172      server and client use DH certificates with common parameters.
   1173      [Steve Henson]
   1174 
   1175   *) Support for fixed DH ciphersuites: those requiring DH server
   1176      certificates.
   1177      [Steve Henson]
   1178 
   1179   *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
   1180      the certificate.
   1181      Note: Related 1.0.2-beta specific macros X509_get_cert_info,
   1182      X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
   1183      X509_CINF_get_signature were reverted post internal team review.
   1184 
   1185  Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
   1186 
   1187   *) Build fixes for the Windows and OpenVMS platforms
   1188      [Matt Caswell and Richard Levitte]
   1189 
   1190  Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
   1191 
   1192   *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
   1193      message can cause a segmentation fault in OpenSSL due to a NULL pointer
   1194      dereference. This could lead to a Denial Of Service attack. Thanks to
   1195      Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
   1196      (CVE-2014-3571)
   1197      [Steve Henson]
   1198 
   1199   *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
   1200      dtls1_buffer_record function under certain conditions. In particular this
   1201      could occur if an attacker sent repeated DTLS records with the same
   1202      sequence number but for the next epoch. The memory leak could be exploited
   1203      by an attacker in a Denial of Service attack through memory exhaustion.
   1204      Thanks to Chris Mueller for reporting this issue.
   1205      (CVE-2015-0206)
   1206      [Matt Caswell]
   1207 
   1208   *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
   1209      built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
   1210      method would be set to NULL which could later result in a NULL pointer
   1211      dereference. Thanks to Frank Schmirler for reporting this issue.
   1212      (CVE-2014-3569)
   1213      [Kurt Roeckx]
   1214 
   1215   *) Abort handshake if server key exchange message is omitted for ephemeral
   1216      ECDH ciphersuites.
   1217 
   1218      Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
   1219      reporting this issue.
   1220      (CVE-2014-3572)
   1221      [Steve Henson]
   1222 
   1223   *) Remove non-export ephemeral RSA code on client and server. This code
   1224      violated the TLS standard by allowing the use of temporary RSA keys in
   1225      non-export ciphersuites and could be used by a server to effectively
   1226      downgrade the RSA key length used to a value smaller than the server
   1227      certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
   1228      INRIA or reporting this issue.
   1229      (CVE-2015-0204)
   1230      [Steve Henson]
   1231 
   1232   *) Fixed issue where DH client certificates are accepted without verification.
   1233      An OpenSSL server will accept a DH certificate for client authentication
   1234      without the certificate verify message. This effectively allows a client to
   1235      authenticate without the use of a private key. This only affects servers
   1236      which trust a client certificate authority which issues certificates
   1237      containing DH keys: these are extremely rare and hardly ever encountered.
   1238      Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
   1239      this issue.
   1240      (CVE-2015-0205)
   1241      [Steve Henson]
   1242 
   1243   *) Ensure that the session ID context of an SSL is updated when its
   1244      SSL_CTX is updated via SSL_set_SSL_CTX.
   1245 
   1246      The session ID context is typically set from the parent SSL_CTX,
   1247      and can vary with the CTX.
   1248      [Adam Langley]
   1249 
   1250   *) Fix various certificate fingerprint issues.
   1251 
   1252      By using non-DER or invalid encodings outside the signed portion of a
   1253      certificate the fingerprint can be changed without breaking the signature.
   1254      Although no details of the signed portion of the certificate can be changed
   1255      this can cause problems with some applications: e.g. those using the
   1256      certificate fingerprint for blacklists.
   1257 
   1258      1. Reject signatures with non zero unused bits.
   1259 
   1260      If the BIT STRING containing the signature has non zero unused bits reject
   1261      the signature. All current signature algorithms require zero unused bits.
   1262 
   1263      2. Check certificate algorithm consistency.
   1264 
   1265      Check the AlgorithmIdentifier inside TBS matches the one in the
   1266      certificate signature. NB: this will result in signature failure
   1267      errors for some broken certificates.
   1268 
   1269      Thanks to Konrad Kraszewski from Google for reporting this issue.
   1270 
   1271      3. Check DSA/ECDSA signatures use DER.
   1272 
   1273      Reencode DSA/ECDSA signatures and compare with the original received
   1274      signature. Return an error if there is a mismatch.
   1275 
   1276      This will reject various cases including garbage after signature
   1277      (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
   1278      program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
   1279      (negative or with leading zeroes).
   1280 
   1281      Further analysis was conducted and fixes were developed by Stephen Henson
   1282      of the OpenSSL core team.
   1283 
   1284      (CVE-2014-8275)
   1285      [Steve Henson]
   1286 
   1287    *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
   1288       results on some platforms, including x86_64. This bug occurs at random
   1289       with a very low probability, and is not known to be exploitable in any
   1290       way, though its exact impact is difficult to determine. Thanks to Pieter
   1291       Wuille (Blockstream) who reported this issue and also suggested an initial
   1292       fix. Further analysis was conducted by the OpenSSL development team and
   1293       Adam Langley of Google. The final fix was developed by Andy Polyakov of
   1294       the OpenSSL core team.
   1295       (CVE-2014-3570)
   1296       [Andy Polyakov]
   1297 
   1298    *) Do not resume sessions on the server if the negotiated protocol
   1299       version does not match the session's version. Resuming with a different
   1300       version, while not strictly forbidden by the RFC, is of questionable
   1301       sanity and breaks all known clients.
   1302       [David Benjamin, Emilia Ksper]
   1303 
   1304    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
   1305       early CCS messages during renegotiation. (Note that because
   1306       renegotiation is encrypted, this early CCS was not exploitable.)
   1307       [Emilia Ksper]
   1308 
   1309    *) Tighten client-side session ticket handling during renegotiation:
   1310       ensure that the client only accepts a session ticket if the server sends
   1311       the extension anew in the ServerHello. Previously, a TLS client would
   1312       reuse the old extension state and thus accept a session ticket if one was
   1313       announced in the initial ServerHello.
   1314 
   1315       Similarly, ensure that the client requires a session ticket if one
   1316       was advertised in the ServerHello. Previously, a TLS client would
   1317       ignore a missing NewSessionTicket message.
   1318       [Emilia Ksper]
   1319 
   1320  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
   1321 
   1322   *) SRTP Memory Leak.
   1323 
   1324      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
   1325      sends a carefully crafted handshake message, to cause OpenSSL to fail
   1326      to free up to 64k of memory causing a memory leak. This could be
   1327      exploited in a Denial Of Service attack. This issue affects OpenSSL
   1328      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
   1329      whether SRTP is used or configured. Implementations of OpenSSL that
   1330      have been compiled with OPENSSL_NO_SRTP defined are not affected.
   1331 
   1332      The fix was developed by the OpenSSL team.
   1333      (CVE-2014-3513)
   1334      [OpenSSL team]
   1335 
   1336   *) Session Ticket Memory Leak.
   1337 
   1338      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
   1339      integrity of that ticket is first verified. In the event of a session
   1340      ticket integrity check failing, OpenSSL will fail to free memory
   1341      causing a memory leak. By sending a large number of invalid session
   1342      tickets an attacker could exploit this issue in a Denial Of Service
   1343      attack.
   1344      (CVE-2014-3567)
   1345      [Steve Henson]
   1346 
   1347   *) Build option no-ssl3 is incomplete.
   1348 
   1349      When OpenSSL is configured with "no-ssl3" as a build option, servers
   1350      could accept and complete a SSL 3.0 handshake, and clients could be
   1351      configured to send them.
   1352      (CVE-2014-3568)
   1353      [Akamai and the OpenSSL team]
   1354 
   1355   *) Add support for TLS_FALLBACK_SCSV.
   1356      Client applications doing fallback retries should call
   1357      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
   1358      (CVE-2014-3566)
   1359      [Adam Langley, Bodo Moeller]
   1360 
   1361   *) Add additional DigestInfo checks.
   1362  
   1363      Reencode DigestInto in DER and check against the original when
   1364      verifying RSA signature: this will reject any improperly encoded
   1365      DigestInfo structures.
   1366 
   1367      Note: this is a precautionary measure and no attacks are currently known.
   1368 
   1369      [Steve Henson]
   1370 
   1371  Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
   1372 
   1373   *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
   1374      SRP code can be overrun an internal buffer. Add sanity check that
   1375      g, A, B < N to SRP code.
   1376 
   1377      Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
   1378      Group for discovering this issue.
   1379      (CVE-2014-3512)
   1380      [Steve Henson]
   1381 
   1382   *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
   1383      TLS 1.0 instead of higher protocol versions when the ClientHello message
   1384      is badly fragmented. This allows a man-in-the-middle attacker to force a
   1385      downgrade to TLS 1.0 even if both the server and the client support a
   1386      higher protocol version, by modifying the client's TLS records.
   1387 
   1388      Thanks to David Benjamin and Adam Langley (Google) for discovering and
   1389      researching this issue.
   1390      (CVE-2014-3511)
   1391      [David Benjamin]
   1392 
   1393   *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
   1394      to a denial of service attack. A malicious server can crash the client
   1395      with a null pointer dereference (read) by specifying an anonymous (EC)DH
   1396      ciphersuite and sending carefully crafted handshake messages.
   1397 
   1398      Thanks to Felix Grbert (Google) for discovering and researching this
   1399      issue.
   1400      (CVE-2014-3510)
   1401      [Emilia Ksper]
   1402 
   1403   *) By sending carefully crafted DTLS packets an attacker could cause openssl
   1404      to leak memory. This can be exploited through a Denial of Service attack.
   1405      Thanks to Adam Langley for discovering and researching this issue.
   1406      (CVE-2014-3507)
   1407      [Adam Langley]
   1408 
   1409   *) An attacker can force openssl to consume large amounts of memory whilst
   1410      processing DTLS handshake messages. This can be exploited through a
   1411      Denial of Service attack.
   1412      Thanks to Adam Langley for discovering and researching this issue.
   1413      (CVE-2014-3506)
   1414      [Adam Langley]
   1415 
   1416   *) An attacker can force an error condition which causes openssl to crash
   1417      whilst processing DTLS packets due to memory being freed twice. This
   1418      can be exploited through a Denial of Service attack.
   1419      Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
   1420      this issue.
   1421      (CVE-2014-3505)
   1422      [Adam Langley]
   1423 
   1424   *) If a multithreaded client connects to a malicious server using a resumed
   1425      session and the server sends an ec point format extension it could write
   1426      up to 255 bytes to freed memory.
   1427 
   1428      Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
   1429      issue.
   1430      (CVE-2014-3509)
   1431      [Gabor Tyukasz]
   1432 
   1433   *) A malicious server can crash an OpenSSL client with a null pointer
   1434      dereference (read) by specifying an SRP ciphersuite even though it was not
   1435      properly negotiated with the client. This can be exploited through a
   1436      Denial of Service attack.
   1437 
   1438      Thanks to Joonas Kuorilehto and Riku Hietamki (Codenomicon) for
   1439      discovering and researching this issue.
   1440      (CVE-2014-5139)
   1441      [Steve Henson]
   1442 
   1443   *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
   1444      X509_name_oneline, X509_name_print_ex et al. to leak some information
   1445      from the stack. Applications may be affected if they echo pretty printing
   1446      output to the attacker.
   1447 
   1448      Thanks to Ivan Fratric (Google) for discovering this issue.
   1449      (CVE-2014-3508)
   1450      [Emilia Ksper, and Steve Henson]
   1451 
   1452   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
   1453      for corner cases. (Certain input points at infinity could lead to
   1454      bogus results, with non-infinity inputs mapped to infinity too.)
   1455      [Bodo Moeller]
   1456 
   1457  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
   1458 
   1459   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
   1460      handshake can force the use of weak keying material in OpenSSL
   1461      SSL/TLS clients and servers.
   1462 
   1463      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
   1464      researching this issue. (CVE-2014-0224)
   1465      [KIKUCHI Masashi, Steve Henson]
   1466 
   1467   *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
   1468      OpenSSL DTLS client the code can be made to recurse eventually crashing
   1469      in a DoS attack.
   1470 
   1471      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
   1472      (CVE-2014-0221)
   1473      [Imre Rad, Steve Henson]
   1474 
   1475   *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
   1476      be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
   1477      client or server. This is potentially exploitable to run arbitrary
   1478      code on a vulnerable client or server.
   1479 
   1480      Thanks to Jri Aedla for reporting this issue. (CVE-2014-0195)
   1481      [Jri Aedla, Steve Henson]
   1482 
   1483   *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
   1484      are subject to a denial of service attack.
   1485 
   1486      Thanks to Felix Grbert and Ivan Fratric at Google for discovering
   1487      this issue. (CVE-2014-3470)
   1488      [Felix Grbert, Ivan Fratric, Steve Henson]
   1489 
   1490   *) Harmonize version and its documentation. -f flag is used to display
   1491      compilation flags.
   1492      [mancha <mancha1 (a] zoho.com>]
   1493 
   1494   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
   1495      in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
   1496      [mancha <mancha1 (a] zoho.com>]
   1497 
   1498   *) Fix some double frees. These are not thought to be exploitable.
   1499      [mancha <mancha1 (a] zoho.com>]
   1500 
   1501  Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
   1502 
   1503   *) A missing bounds check in the handling of the TLS heartbeat extension
   1504      can be used to reveal up to 64k of memory to a connected client or
   1505      server.
   1506 
   1507      Thanks for Neel Mehta of Google Security for discovering this bug and to
   1508      Adam Langley <agl (a] chromium.org> and Bodo Moeller <bmoeller (a] acm.org> for
   1509      preparing the fix (CVE-2014-0160)
   1510      [Adam Langley, Bodo Moeller]
   1511 
   1512   *) Fix for the attack described in the paper "Recovering OpenSSL
   1513      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
   1514      by Yuval Yarom and Naomi Benger. Details can be obtained from:
   1515      http://eprint.iacr.org/2014/140
   1516 
   1517      Thanks to Yuval Yarom and Naomi Benger for discovering this
   1518      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
   1519      [Yuval Yarom and Naomi Benger]
   1520 
   1521   *) TLS pad extension: draft-agl-tls-padding-03
   1522 
   1523      Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
   1524      TLS client Hello record length value would otherwise be > 255 and
   1525      less that 512 pad with a dummy extension containing zeroes so it
   1526      is at least 512 bytes long.
   1527 
   1528      [Adam Langley, Steve Henson]
   1529 
   1530  Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
   1531 
   1532   *) Fix for TLS record tampering bug. A carefully crafted invalid 
   1533      handshake could crash OpenSSL with a NULL pointer exception.
   1534      Thanks to Anton Johansson for reporting this issues.
   1535      (CVE-2013-4353)
   1536 
   1537   *) Keep original DTLS digest and encryption contexts in retransmission
   1538      structures so we can use the previous session parameters if they need
   1539      to be resent. (CVE-2013-6450)
   1540      [Steve Henson]
   1541 
   1542   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
   1543      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
   1544      Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
   1545      several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
   1546      is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
   1547      10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
   1548      [Rob Stradling, Adam Langley]
   1549 
   1550  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
   1551 
   1552   *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
   1553      supporting platforms or when small records were transferred.
   1554      [Andy Polyakov, Steve Henson]
   1555 
   1556  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
   1557 
   1558   *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
   1559 
   1560      This addresses the flaw in CBC record processing discovered by 
   1561      Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
   1562      at: http://www.isg.rhul.ac.uk/tls/     
   1563 
   1564      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   1565      Security Group at Royal Holloway, University of London
   1566      (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
   1567      Emilia Ksper for the initial patch.
   1568      (CVE-2013-0169)
   1569      [Emilia Ksper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
   1570 
   1571   *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
   1572      ciphersuites which can be exploited in a denial of service attack.
   1573      Thanks go to and to Adam Langley <agl (a] chromium.org> for discovering
   1574      and detecting this bug and to Wolfgang Ettlinger
   1575      <wolfgang.ettlinger (a] gmail.com> for independently discovering this issue.
   1576      (CVE-2012-2686)
   1577      [Adam Langley]
   1578 
   1579   *) Return an error when checking OCSP signatures when key is NULL.
   1580      This fixes a DoS attack. (CVE-2013-0166)
   1581      [Steve Henson]
   1582 
   1583   *) Make openssl verify return errors.
   1584      [Chris Palmer <palmer (a] google.com> and Ben Laurie]
   1585 
   1586   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
   1587      the right response is stapled. Also change SSL_get_certificate()
   1588      so it returns the certificate actually sent.
   1589      See http://rt.openssl.org/Ticket/Display.html?id=2836.
   1590      [Rob Stradling <rob.stradling (a] comodo.com>]
   1591 
   1592   *) Fix possible deadlock when decoding public keys.
   1593      [Steve Henson]
   1594 
   1595   *) Don't use TLS 1.0 record version number in initial client hello
   1596      if renegotiating.
   1597      [Steve Henson]
   1598 
   1599  Changes between 1.0.1b and 1.0.1c [10 May 2012]
   1600 
   1601   *) Sanity check record length before skipping explicit IV in TLS
   1602      1.2, 1.1 and DTLS to fix DoS attack.
   1603 
   1604      Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
   1605      fuzzing as a service testing platform.
   1606      (CVE-2012-2333)
   1607      [Steve Henson]
   1608 
   1609   *) Initialise tkeylen properly when encrypting CMS messages.
   1610      Thanks to Solar Designer of Openwall for reporting this issue.
   1611      [Steve Henson]
   1612 
   1613   *) In FIPS mode don't try to use composite ciphers as they are not
   1614      approved.
   1615      [Steve Henson]
   1616 
   1617  Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
   1618 
   1619   *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
   1620      1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
   1621      mean any application compiled against OpenSSL 1.0.0 headers setting
   1622      SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
   1623      TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
   1624      0x10000000L Any application which was previously compiled against
   1625      OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
   1626      will need to be recompiled as a result. Letting be results in
   1627      inability to disable specifically TLS 1.1 and in client context,
   1628      in unlike event, limit maximum offered version to TLS 1.0 [see below].
   1629      [Steve Henson]
   1630 
   1631   *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
   1632      disable just protocol X, but all protocols above X *if* there are
   1633      protocols *below* X still enabled. In more practical terms it means
   1634      that if application wants to disable TLS1.0 in favor of TLS1.1 and
   1635      above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
   1636      SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
   1637      client side.
   1638      [Andy Polyakov]
   1639 
   1640  Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
   1641 
   1642   *) Check for potentially exploitable overflows in asn1_d2i_read_bio
   1643      BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
   1644      in CRYPTO_realloc_clean.
   1645 
   1646      Thanks to Tavis Ormandy, Google Security Team, for discovering this
   1647      issue and to Adam Langley <agl (a] chromium.org> for fixing it.
   1648      (CVE-2012-2110)
   1649      [Adam Langley (Google), Tavis Ormandy, Google Security Team]
   1650 
   1651   *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
   1652      [Adam Langley]
   1653 
   1654   *) Workarounds for some broken servers that "hang" if a client hello
   1655      record length exceeds 255 bytes.
   1656 
   1657      1. Do not use record version number > TLS 1.0 in initial client
   1658         hello: some (but not all) hanging servers will now work.
   1659      2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
   1660 	the number of ciphers sent in the client hello. This should be
   1661         set to an even number, such as 50, for example by passing:
   1662         -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
   1663         Most broken servers should now work.
   1664      3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
   1665 	TLS 1.2 client support entirely.
   1666      [Steve Henson]
   1667 
   1668   *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
   1669      [Andy Polyakov]
   1670 
   1671  Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
   1672 
   1673   *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
   1674      STRING form instead of a DigestInfo.
   1675      [Steve Henson]
   1676 
   1677   *) The format used for MDC2 RSA signatures is inconsistent between EVP
   1678      and the RSA_sign/RSA_verify functions. This was made more apparent when
   1679      OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
   1680      those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
   1681      the correct format in RSA_verify so both forms transparently work.
   1682      [Steve Henson]
   1683 
   1684   *) Some servers which support TLS 1.0 can choke if we initially indicate
   1685      support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
   1686      encrypted premaster secret. As a workaround use the maximum pemitted
   1687      client version in client hello, this should keep such servers happy
   1688      and still work with previous versions of OpenSSL.
   1689      [Steve Henson]
   1690 
   1691   *) Add support for TLS/DTLS heartbeats.
   1692      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   1693 
   1694   *) Add support for SCTP.
   1695      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   1696 
   1697   *) Improved PRNG seeding for VOS.
   1698      [Paul Green <Paul.Green (a] stratus.com>]
   1699 
   1700   *) Extensive assembler packs updates, most notably:
   1701 
   1702 	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
   1703 	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
   1704 	- x86_64:       bit-sliced AES implementation;
   1705 	- ARM:          NEON support, contemporary platforms optimizations;
   1706 	- s390x:        z196 support;
   1707 	- *:            GHASH and GF(2^m) multiplication implementations;
   1708 
   1709      [Andy Polyakov]
   1710 
   1711   *) Make TLS-SRP code conformant with RFC 5054 API cleanup
   1712      (removal of unnecessary code)
   1713      [Peter Sylvester <peter.sylvester (a] edelweb.fr>]
   1714 
   1715   *) Add TLS key material exporter from RFC 5705.
   1716      [Eric Rescorla]
   1717 
   1718   *) Add DTLS-SRTP negotiation from RFC 5764.
   1719      [Eric Rescorla]
   1720 
   1721   *) Add Next Protocol Negotiation,
   1722      http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
   1723      disabled with a no-npn flag to config or Configure. Code donated
   1724      by Google.
   1725      [Adam Langley <agl (a] google.com> and Ben Laurie]
   1726 
   1727   *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
   1728      NIST-P256, NIST-P521, with constant-time single point multiplication on
   1729      typical inputs. Compiler support for the nonstandard type __uint128_t is
   1730      required to use this (present in gcc 4.4 and later, for 64-bit builds).
   1731      Code made available under Apache License version 2.0.
   1732 
   1733      Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
   1734      line to include this in your build of OpenSSL, and run "make depend" (or
   1735      "make update"). This enables the following EC_METHODs:
   1736 
   1737          EC_GFp_nistp224_method()
   1738          EC_GFp_nistp256_method()
   1739          EC_GFp_nistp521_method()
   1740 
   1741      EC_GROUP_new_by_curve_name() will automatically use these (while
   1742      EC_GROUP_new_curve_GFp() currently prefers the more flexible
   1743      implementations).
   1744      [Emilia Ksper, Adam Langley, Bodo Moeller (Google)]
   1745 
   1746   *) Use type ossl_ssize_t instad of ssize_t which isn't available on
   1747      all platforms. Move ssize_t definition from e_os.h to the public
   1748      header file e_os2.h as it now appears in public header file cms.h
   1749      [Steve Henson]
   1750 
   1751   *) New -sigopt option to the ca, req and x509 utilities. Additional
   1752      signature parameters can be passed using this option and in
   1753      particular PSS. 
   1754      [Steve Henson]
   1755 
   1756   *) Add RSA PSS signing function. This will generate and set the
   1757      appropriate AlgorithmIdentifiers for PSS based on those in the
   1758      corresponding EVP_MD_CTX structure. No application support yet.
   1759      [Steve Henson]
   1760 
   1761   *) Support for companion algorithm specific ASN1 signing routines.
   1762      New function ASN1_item_sign_ctx() signs a pre-initialised
   1763      EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
   1764      the appropriate parameters.
   1765      [Steve Henson]
   1766 
   1767   *) Add new algorithm specific ASN1 verification initialisation function
   1768      to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
   1769      handling will be the same no matter what EVP_PKEY_METHOD is used.
   1770      Add a PSS handler to support verification of PSS signatures: checked
   1771      against a number of sample certificates.
   1772      [Steve Henson]
   1773 
   1774   *) Add signature printing for PSS. Add PSS OIDs.
   1775      [Steve Henson, Martin Kaiser <lists (a] kaiser.cx>]
   1776 
   1777   *) Add algorithm specific signature printing. An individual ASN1 method
   1778      can now print out signatures instead of the standard hex dump. 
   1779 
   1780      More complex signatures (e.g. PSS) can print out more meaningful
   1781      information. Include DSA version that prints out the signature
   1782      parameters r, s.
   1783      [Steve Henson]
   1784 
   1785   *) Password based recipient info support for CMS library: implementing
   1786      RFC3211.
   1787      [Steve Henson]
   1788 
   1789   *) Split password based encryption into PBES2 and PBKDF2 functions. This
   1790      neatly separates the code into cipher and PBE sections and is required
   1791      for some algorithms that split PBES2 into separate pieces (such as
   1792      password based CMS).
   1793      [Steve Henson]
   1794 
   1795   *) Session-handling fixes:
   1796      - Fix handling of connections that are resuming with a session ID,
   1797        but also support Session Tickets.
   1798      - Fix a bug that suppressed issuing of a new ticket if the client
   1799        presented a ticket with an expired session.
   1800      - Try to set the ticket lifetime hint to something reasonable.
   1801      - Make tickets shorter by excluding irrelevant information.
   1802      - On the client side, don't ignore renewed tickets.
   1803      [Adam Langley, Bodo Moeller (Google)]
   1804 
   1805   *) Fix PSK session representation.
   1806      [Bodo Moeller]
   1807 
   1808   *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
   1809 
   1810      This work was sponsored by Intel.
   1811      [Andy Polyakov]
   1812 
   1813   *) Add GCM support to TLS library. Some custom code is needed to split
   1814      the IV between the fixed (from PRF) and explicit (from TLS record)
   1815      portions. This adds all GCM ciphersuites supported by RFC5288 and 
   1816      RFC5289. Generalise some AES* cipherstrings to inlclude GCM and
   1817      add a special AESGCM string for GCM only.
   1818      [Steve Henson]
   1819 
   1820   *) Expand range of ctrls for AES GCM. Permit setting invocation
   1821      field on decrypt and retrieval of invocation field only on encrypt.
   1822      [Steve Henson]
   1823 
   1824   *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
   1825      As required by RFC5289 these ciphersuites cannot be used if for
   1826      versions of TLS earlier than 1.2.
   1827      [Steve Henson]
   1828 
   1829   *) For FIPS capable OpenSSL interpret a NULL default public key method
   1830      as unset and return the appopriate default but do *not* set the default.
   1831      This means we can return the appopriate method in applications that
   1832      swicth between FIPS and non-FIPS modes.
   1833      [Steve Henson]
   1834 
   1835   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
   1836      ENGINE is used then we cannot handle that in the FIPS module so we
   1837      keep original code iff non-FIPS operations are allowed.
   1838      [Steve Henson]
   1839 
   1840   *) Add -attime option to openssl utilities.
   1841      [Peter Eckersley <pde (a] eff.org>, Ben Laurie and Steve Henson]
   1842 
   1843   *) Redirect DSA and DH operations to FIPS module in FIPS mode.
   1844      [Steve Henson]
   1845 
   1846   *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
   1847      FIPS EC methods unconditionally for now.
   1848      [Steve Henson]
   1849 
   1850   *) New build option no-ec2m to disable characteristic 2 code.
   1851      [Steve Henson]
   1852 
   1853   *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
   1854      all cases can be covered as some introduce binary incompatibilities.
   1855      [Steve Henson]
   1856 
   1857   *) Redirect RSA operations to FIPS module including keygen,
   1858      encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
   1859      [Steve Henson]
   1860 
   1861   *) Add similar low level API blocking to ciphers.
   1862      [Steve Henson]
   1863 
   1864   *) Low level digest APIs are not approved in FIPS mode: any attempt
   1865      to use these will cause a fatal error. Applications that *really* want
   1866      to use them can use the private_* version instead.
   1867      [Steve Henson]
   1868 
   1869   *) Redirect cipher operations to FIPS module for FIPS builds. 
   1870      [Steve Henson]
   1871 
   1872   *) Redirect digest operations to FIPS module for FIPS builds. 
   1873      [Steve Henson]
   1874 
   1875   *) Update build system to add "fips" flag which will link in fipscanister.o
   1876      for static and shared library builds embedding a signature if needed.
   1877      [Steve Henson]
   1878 
   1879   *) Output TLS supported curves in preference order instead of numerical
   1880      order. This is currently hardcoded for the highest order curves first.
   1881      This should be configurable so applications can judge speed vs strength.
   1882      [Steve Henson]
   1883 
   1884   *) Add TLS v1.2 server support for client authentication. 
   1885      [Steve Henson]
   1886 
   1887   *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
   1888      and enable MD5.
   1889      [Steve Henson]
   1890 
   1891   *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
   1892      FIPS modules versions.
   1893      [Steve Henson]
   1894 
   1895   *) Add TLS v1.2 client side support for client authentication. Keep cache
   1896      of handshake records longer as we don't know the hash algorithm to use
   1897      until after the certificate request message is received.
   1898      [Steve Henson]
   1899 
   1900   *) Initial TLS v1.2 client support. Add a default signature algorithms
   1901      extension including all the algorithms we support. Parse new signature
   1902      format in client key exchange. Relax some ECC signing restrictions for
   1903      TLS v1.2 as indicated in RFC5246.
   1904      [Steve Henson]
   1905 
   1906   *) Add server support for TLS v1.2 signature algorithms extension. Switch
   1907      to new signature format when needed using client digest preference.
   1908      All server ciphersuites should now work correctly in TLS v1.2. No client
   1909      support yet and no support for client certificates.
   1910      [Steve Henson]
   1911 
   1912   *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
   1913      to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
   1914      ciphersuites. At present only RSA key exchange ciphersuites work with
   1915      TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
   1916      SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
   1917      and version checking.
   1918      [Steve Henson]
   1919 
   1920   *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
   1921      with this defined it will not be affected by any changes to ssl internal
   1922      structures. Add several utility functions to allow openssl application
   1923      to work with OPENSSL_NO_SSL_INTERN defined.
   1924      [Steve Henson]
   1925 
   1926   *) Add SRP support.
   1927      [Tom Wu <tjw (a] cs.stanford.edu> and Ben Laurie]
   1928 
   1929   *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
   1930      [Steve Henson]
   1931 
   1932   *) Permit abbreviated handshakes when renegotiating using the function
   1933      SSL_renegotiate_abbreviated().
   1934      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   1935 
   1936   *) Add call to ENGINE_register_all_complete() to
   1937      ENGINE_load_builtin_engines(), so some implementations get used
   1938      automatically instead of needing explicit application support.
   1939      [Steve Henson]
   1940 
   1941   *) Add support for TLS key exporter as described in RFC5705.
   1942      [Robin Seggelmann <seggelmann (a] fh-muenster.de>, Steve Henson]
   1943 
   1944   *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
   1945      a few changes are required:
   1946 
   1947        Add SSL_OP_NO_TLSv1_1 flag.
   1948        Add TLSv1_1 methods.
   1949        Update version checking logic to handle version 1.1.
   1950        Add explicit IV handling (ported from DTLS code).
   1951        Add command line options to s_client/s_server.
   1952      [Steve Henson]
   1953 
   1954  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
   1955 
   1956   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
   1957      in CMS and PKCS7 code. When RSA decryption fails use a random key for
   1958      content decryption and always return the same error. Note: this attack
   1959      needs on average 2^20 messages so it only affects automated senders. The
   1960      old behaviour can be reenabled in the CMS code by setting the
   1961      CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
   1962      an MMA defence is not necessary.
   1963      Thanks to Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering
   1964      this issue. (CVE-2012-0884)
   1965      [Steve Henson]
   1966 
   1967   *) Fix CVE-2011-4619: make sure we really are receiving a 
   1968      client hello before rejecting multiple SGC restarts. Thanks to
   1969      Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering this bug.
   1970      [Steve Henson]
   1971 
   1972  Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
   1973 
   1974   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
   1975      Thanks to Antonio Martin, Enterprise Secure Access Research and
   1976      Development, Cisco Systems, Inc. for discovering this bug and
   1977      preparing a fix. (CVE-2012-0050)
   1978      [Antonio Martin]
   1979 
   1980  Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
   1981 
   1982   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
   1983      of the Vaudenay padding oracle attack on CBC mode encryption
   1984      which enables an efficient plaintext recovery attack against
   1985      the OpenSSL implementation of DTLS. Their attack exploits timing
   1986      differences arising during decryption processing. A research
   1987      paper describing this attack can be found at:
   1988                   http://www.isg.rhul.ac.uk/~kp/dtls.pdf
   1989      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   1990      Security Group at Royal Holloway, University of London
   1991      (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
   1992      <seggelmann (a] fh-muenster.de> and Michael Tuexen <tuexen (a] fh-muenster.de>
   1993      for preparing the fix. (CVE-2011-4108)
   1994      [Robin Seggelmann, Michael Tuexen]
   1995 
   1996   *) Clear bytes used for block padding of SSL 3.0 records.
   1997      (CVE-2011-4576)
   1998      [Adam Langley (Google)]
   1999 
   2000   *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
   2001      Kadianakis <desnacked (a] gmail.com> for discovering this issue and
   2002      Adam Langley for preparing the fix. (CVE-2011-4619)
   2003      [Adam Langley (Google)]
   2004 
   2005   *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
   2006      [Andrey Kulikov <amdeich (a] gmail.com>]
   2007 
   2008   *) Prevent malformed RFC3779 data triggering an assertion failure.
   2009      Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
   2010      and Rob Austein <sra (a] hactrn.net> for fixing it. (CVE-2011-4577)
   2011      [Rob Austein <sra (a] hactrn.net>]
   2012 
   2013   *) Improved PRNG seeding for VOS.
   2014      [Paul Green <Paul.Green (a] stratus.com>]
   2015 
   2016   *) Fix ssl_ciph.c set-up race.
   2017      [Adam Langley (Google)]
   2018 
   2019   *) Fix spurious failures in ecdsatest.c.
   2020      [Emilia Ksper (Google)]
   2021 
   2022   *) Fix the BIO_f_buffer() implementation (which was mixing different
   2023      interpretations of the '..._len' fields).
   2024      [Adam Langley (Google)]
   2025 
   2026   *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
   2027      BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
   2028      threads won't reuse the same blinding coefficients.
   2029 
   2030      This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
   2031      lock to call BN_BLINDING_invert_ex, and avoids one use of
   2032      BN_BLINDING_update for each BN_BLINDING structure (previously,
   2033      the last update always remained unused).
   2034      [Emilia Ksper (Google)]
   2035 
   2036   *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
   2037      [Bob Buckholz (Google)]
   2038 
   2039  Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
   2040 
   2041   *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
   2042      by initialising X509_STORE_CTX properly. (CVE-2011-3207)
   2043      [Kaspar Brand <ossl (a] velox.ch>]
   2044 
   2045   *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
   2046      for multi-threaded use of ECDH. (CVE-2011-3210)
   2047      [Adam Langley (Google)]
   2048 
   2049   *) Fix x509_name_ex_d2i memory leak on bad inputs.
   2050      [Bodo Moeller]
   2051 
   2052   *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
   2053      signature public key algorithm by using OID xref utilities instead.
   2054      Before this you could only use some ECC ciphersuites with SHA1 only.
   2055      [Steve Henson]
   2056 
   2057   *) Add protection against ECDSA timing attacks as mentioned in the paper
   2058      by Billy Bob Brumley and Nicola Tuveri, see:
   2059 
   2060 	http://eprint.iacr.org/2011/232.pdf
   2061 
   2062      [Billy Bob Brumley and Nicola Tuveri]
   2063 
   2064  Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
   2065 
   2066   *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
   2067      [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
   2068 
   2069   *) Fix bug in string printing code: if *any* escaping is enabled we must
   2070      escape the escape character (backslash) or the resulting string is
   2071      ambiguous.
   2072      [Steve Henson]
   2073 
   2074  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
   2075 
   2076   *) Disable code workaround for ancient and obsolete Netscape browsers
   2077      and servers: an attacker can use it in a ciphersuite downgrade attack.
   2078      Thanks to Martin Rex for discovering this bug. CVE-2010-4180
   2079      [Steve Henson]
   2080 
   2081   *) Fixed J-PAKE implementation error, originally discovered by
   2082      Sebastien Martini, further info and confirmation from Stefan
   2083      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
   2084      [Ben Laurie]
   2085 
   2086  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
   2087 
   2088   *) Fix extension code to avoid race conditions which can result in a buffer
   2089      overrun vulnerability: resumed sessions must not be modified as they can
   2090      be shared by multiple threads. CVE-2010-3864
   2091      [Steve Henson]
   2092 
   2093   *) Fix WIN32 build system to correctly link an ENGINE directory into
   2094      a DLL. 
   2095      [Steve Henson]
   2096 
   2097  Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
   2098 
   2099   *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
   2100      (CVE-2010-1633)
   2101      [Steve Henson, Peter-Michael Hager <hager (a] dortmund.net>]
   2102 
   2103  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
   2104 
   2105   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
   2106      context. The operation can be customised via the ctrl mechanism in
   2107      case ENGINEs want to include additional functionality.
   2108      [Steve Henson]
   2109 
   2110   *) Tolerate yet another broken PKCS#8 key format: private key value negative.
   2111      [Steve Henson]
   2112 
   2113   *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
   2114      output hashes compatible with older versions of OpenSSL.
   2115      [Willy Weisz <weisz (a] vcpc.univie.ac.at>]
   2116 
   2117   *) Fix compression algorithm handling: if resuming a session use the
   2118      compression algorithm of the resumed session instead of determining
   2119      it from client hello again. Don't allow server to change algorithm.
   2120      [Steve Henson]
   2121 
   2122   *) Add load_crls() function to apps tidying load_certs() too. Add option
   2123      to verify utility to allow additional CRLs to be included.
   2124      [Steve Henson]
   2125 
   2126   *) Update OCSP request code to permit adding custom headers to the request:
   2127      some responders need this.
   2128      [Steve Henson]
   2129 
   2130   *) The function EVP_PKEY_sign() returns <=0 on error: check return code
   2131      correctly.
   2132      [Julia Lawall <julia (a] diku.dk>]
   2133 
   2134   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
   2135      needlessly dereferenced structures, used obsolete functions and
   2136      didn't handle all updated verify codes correctly.
   2137      [Steve Henson]
   2138 
   2139   *) Disable MD2 in the default configuration.
   2140      [Steve Henson]
   2141 
   2142   *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
   2143      indicate the initial BIO being pushed or popped. This makes it possible
   2144      to determine whether the BIO is the one explicitly called or as a result
   2145      of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
   2146      it handles reference counts correctly and doesn't zero out the I/O bio
   2147      when it is not being explicitly popped. WARNING: applications which
   2148      included workarounds for the old buggy behaviour will need to be modified
   2149      or they could free up already freed BIOs.
   2150      [Steve Henson]
   2151 
   2152   *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
   2153      renaming to all platforms (within the 0.9.8 branch, this was
   2154      done conditionally on Netware platforms to avoid a name clash).
   2155      [Guenter <lists (a] gknw.net>]
   2156 
   2157   *) Add ECDHE and PSK support to DTLS.
   2158      [Michael Tuexen <tuexen (a] fh-muenster.de>]
   2159 
   2160   *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
   2161      be used on C++.
   2162      [Steve Henson]
   2163 
   2164   *) Add "missing" function EVP_MD_flags() (without this the only way to
   2165      retrieve a digest flags is by accessing the structure directly. Update
   2166      EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
   2167      or cipher is registered as in the "from" argument. Print out all
   2168      registered digests in the dgst usage message instead of manually 
   2169      attempting to work them out.
   2170      [Steve Henson]
   2171 
   2172   *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
   2173      this allows the use of compression and extensions. Change default cipher
   2174      string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
   2175      by default unless an application cipher string requests it.
   2176      [Steve Henson]
   2177 
   2178   *) Alter match criteria in PKCS12_parse(). It used to try to use local
   2179      key ids to find matching certificates and keys but some PKCS#12 files
   2180      don't follow the (somewhat unwritten) rules and this strategy fails.
   2181      Now just gather all certificates together and the first private key
   2182      then look for the first certificate that matches the key.
   2183      [Steve Henson]
   2184 
   2185   *) Support use of registered digest and cipher names for dgst and cipher
   2186      commands instead of having to add each one as a special case. So now
   2187      you can do:
   2188 
   2189         openssl sha256 foo
   2190 
   2191      as well as:
   2192 
   2193         openssl dgst -sha256 foo
   2194 
   2195      and this works for ENGINE based algorithms too.
   2196 
   2197      [Steve Henson]
   2198 
   2199   *) Update Gost ENGINE to support parameter files.
   2200      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   2201 
   2202   *) Support GeneralizedTime in ca utility. 
   2203      [Oliver Martin <oliver (a] volatilevoid.net>, Steve Henson]
   2204 
   2205   *) Enhance the hash format used for certificate directory links. The new
   2206      form uses the canonical encoding (meaning equivalent names will work
   2207      even if they aren't identical) and uses SHA1 instead of MD5. This form
   2208      is incompatible with the older format and as a result c_rehash should
   2209      be used to rebuild symbolic links.
   2210      [Steve Henson]
   2211 
   2212   *) Make PKCS#8 the default write format for private keys, replacing the
   2213      traditional format. This form is standardised, more secure and doesn't
   2214      include an implicit MD5 dependency.
   2215      [Steve Henson]
   2216 
   2217   *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
   2218      committed to OpenSSL should pass this lot as a minimum.
   2219      [Steve Henson]
   2220 
   2221   *) Add session ticket override functionality for use by EAP-FAST.
   2222      [Jouni Malinen <j (a] w1.fi>]
   2223 
   2224   *) Modify HMAC functions to return a value. Since these can be implemented
   2225      in an ENGINE errors can occur.
   2226      [Steve Henson]
   2227 
   2228   *) Type-checked OBJ_bsearch_ex.
   2229      [Ben Laurie]
   2230 
   2231   *) Type-checked OBJ_bsearch. Also some constification necessitated
   2232      by type-checking.  Still to come: TXT_DB, bsearch(?),
   2233      OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
   2234      CONF_VALUE.
   2235      [Ben Laurie]
   2236 
   2237   *) New function OPENSSL_gmtime_adj() to add a specific number of days and
   2238      seconds to a tm structure directly, instead of going through OS
   2239      specific date routines. This avoids any issues with OS routines such
   2240      as the year 2038 bug. New *_adj() functions for ASN1 time structures
   2241      and X509_time_adj_ex() to cover the extended range. The existing
   2242      X509_time_adj() is still usable and will no longer have any date issues.
   2243      [Steve Henson]
   2244 
   2245   *) Delta CRL support. New use deltas option which will attempt to locate
   2246      and search any appropriate delta CRLs available.
   2247 
   2248      This work was sponsored by Google.
   2249      [Steve Henson]
   2250 
   2251   *) Support for CRLs partitioned by reason code. Reorganise CRL processing
   2252      code and add additional score elements. Validate alternate CRL paths
   2253      as part of the CRL checking and indicate a new error "CRL path validation
   2254      error" in this case. Applications wanting additional details can use
   2255      the verify callback and check the new "parent" field. If this is not
   2256      NULL CRL path validation is taking place. Existing applications wont
   2257      see this because it requires extended CRL support which is off by
   2258      default.
   2259 
   2260      This work was sponsored by Google.
   2261      [Steve Henson]
   2262 
   2263   *) Support for freshest CRL extension.
   2264 
   2265      This work was sponsored by Google.
   2266      [Steve Henson]
   2267 
   2268   *) Initial indirect CRL support. Currently only supported in the CRLs
   2269      passed directly and not via lookup. Process certificate issuer
   2270      CRL entry extension and lookup CRL entries by bother issuer name
   2271      and serial number. Check and process CRL issuer entry in IDP extension.
   2272 
   2273      This work was sponsored by Google.
   2274      [Steve Henson]
   2275 
   2276   *) Add support for distinct certificate and CRL paths. The CRL issuer
   2277      certificate is validated separately in this case. Only enabled if
   2278      an extended CRL support flag is set: this flag will enable additional
   2279      CRL functionality in future.
   2280 
   2281      This work was sponsored by Google.
   2282      [Steve Henson]
   2283 
   2284   *) Add support for policy mappings extension.
   2285 
   2286      This work was sponsored by Google.
   2287      [Steve Henson]
   2288 
   2289   *) Fixes to pathlength constraint, self issued certificate handling,
   2290      policy processing to align with RFC3280 and PKITS tests.
   2291 
   2292      This work was sponsored by Google.
   2293      [Steve Henson]
   2294 
   2295   *) Support for name constraints certificate extension. DN, email, DNS
   2296      and URI types are currently supported.
   2297 
   2298      This work was sponsored by Google.
   2299      [Steve Henson]
   2300 
   2301   *) To cater for systems that provide a pointer-based thread ID rather
   2302      than numeric, deprecate the current numeric thread ID mechanism and
   2303      replace it with a structure and associated callback type. This
   2304      mechanism allows a numeric "hash" to be extracted from a thread ID in
   2305      either case, and on platforms where pointers are larger than 'long',
   2306      mixing is done to help ensure the numeric 'hash' is usable even if it
   2307      can't be guaranteed unique. The default mechanism is to use "&errno"
   2308      as a pointer-based thread ID to distinguish between threads.
   2309 
   2310      Applications that want to provide their own thread IDs should now use
   2311      CRYPTO_THREADID_set_callback() to register a callback that will call
   2312      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
   2313 
   2314      Note that ERR_remove_state() is now deprecated, because it is tied
   2315      to the assumption that thread IDs are numeric.  ERR_remove_state(0)
   2316      to free the current thread's error state should be replaced by
   2317      ERR_remove_thread_state(NULL).
   2318 
   2319      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
   2320      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
   2321      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
   2322      application was previously providing a numeric thread callback that
   2323      was inappropriate for distinguishing threads, then uniqueness might
   2324      have been obtained with &errno that happened immediately in the
   2325      intermediate development versions of OpenSSL; this is no longer the
   2326      case, the numeric thread callback will now override the automatic use
   2327      of &errno.)
   2328      [Geoff Thorpe, with help from Bodo Moeller]
   2329 
   2330   *) Initial support for different CRL issuing certificates. This covers a
   2331      simple case where the self issued certificates in the chain exist and
   2332      the real CRL issuer is higher in the existing chain.
   2333 
   2334      This work was sponsored by Google.
   2335      [Steve Henson]
   2336 
   2337   *) Removed effectively defunct crypto/store from the build.
   2338      [Ben Laurie]
   2339 
   2340   *) Revamp of STACK to provide stronger type-checking. Still to come:
   2341      TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
   2342      ASN1_STRING, CONF_VALUE.
   2343      [Ben Laurie]
   2344 
   2345   *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
   2346      RAM on SSL connections.  This option can save about 34k per idle SSL.
   2347      [Nick Mathewson]
   2348 
   2349   *) Revamp of LHASH to provide stronger type-checking. Still to come:
   2350      STACK, TXT_DB, bsearch, qsort.
   2351      [Ben Laurie]
   2352 
   2353   *) Initial support for Cryptographic Message Syntax (aka CMS) based
   2354      on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
   2355      support for data, signedData, compressedData, digestedData and
   2356      encryptedData, envelopedData types included. Scripts to check against
   2357      RFC4134 examples draft and interop and consistency checks of many
   2358      content types and variants.
   2359      [Steve Henson]
   2360 
   2361   *) Add options to enc utility to support use of zlib compression BIO.
   2362      [Steve Henson]
   2363 
   2364   *) Extend mk1mf to support importing of options and assembly language
   2365      files from Configure script, currently only included in VC-WIN32.
   2366      The assembly language rules can now optionally generate the source
   2367      files from the associated perl scripts.
   2368      [Steve Henson]
   2369 
   2370   *) Implement remaining functionality needed to support GOST ciphersuites.
   2371      Interop testing has been performed using CryptoPro implementations.
   2372      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   2373 
   2374   *) s390x assembler pack.
   2375      [Andy Polyakov]
   2376 
   2377   *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
   2378      "family."
   2379      [Andy Polyakov]
   2380 
   2381   *) Implement Opaque PRF Input TLS extension as specified in
   2382      draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
   2383      official specification yet and no extension type assignment by
   2384      IANA exists, this extension (for now) will have to be explicitly
   2385      enabled when building OpenSSL by providing the extension number
   2386      to use.  For example, specify an option
   2387 
   2388          -DTLSEXT_TYPE_opaque_prf_input=0x9527
   2389 
   2390      to the "config" or "Configure" script to enable the extension,
   2391      assuming extension number 0x9527 (which is a completely arbitrary
   2392      and unofficial assignment based on the MD5 hash of the Internet
   2393      Draft).  Note that by doing so, you potentially lose
   2394      interoperability with other TLS implementations since these might
   2395      be using the same extension number for other purposes.
   2396 
   2397      SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
   2398      opaque PRF input value to use in the handshake.  This will create
   2399      an interal copy of the length-'len' string at 'src', and will
   2400      return non-zero for success.
   2401 
   2402      To get more control and flexibility, provide a callback function
   2403      by using
   2404 
   2405           SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
   2406           SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
   2407 
   2408      where
   2409 
   2410           int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
   2411           void *arg;
   2412 
   2413      Callback function 'cb' will be called in handshakes, and is
   2414      expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
   2415      Argument 'arg' is for application purposes (the value as given to
   2416      SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
   2417      be provided to the callback function).  The callback function
   2418      has to return non-zero to report success: usually 1 to use opaque
   2419      PRF input just if possible, or 2 to enforce use of the opaque PRF
   2420      input.  In the latter case, the library will abort the handshake
   2421      if opaque PRF input is not successfully negotiated.
   2422 
   2423      Arguments 'peerinput' and 'len' given to the callback function
   2424      will always be NULL and 0 in the case of a client.  A server will
   2425      see the client's opaque PRF input through these variables if
   2426      available (NULL and 0 otherwise).  Note that if the server
   2427      provides an opaque PRF input, the length must be the same as the
   2428      length of the client's opaque PRF input.
   2429 
   2430      Note that the callback function will only be called when creating
   2431      a new session (session resumption can resume whatever was
   2432      previously negotiated), and will not be called in SSL 2.0
   2433      handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
   2434      SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
   2435      for applications that need to enforce opaque PRF input.
   2436 
   2437      [Bodo Moeller]
   2438 
   2439   *) Update ssl code to support digests other than SHA1+MD5 for handshake
   2440      MAC. 
   2441 
   2442      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   2443 
   2444   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   2445      RFC4507bis. The encrypted ticket format is an encrypted encoded
   2446      SSL_SESSION structure, that way new session features are automatically
   2447      supported.
   2448 
   2449      If a client application caches session in an SSL_SESSION structure
   2450      support is transparent because tickets are now stored in the encoded
   2451      SSL_SESSION.
   2452      
   2453      The SSL_CTX structure automatically generates keys for ticket
   2454      protection in servers so again support should be possible
   2455      with no application modification.
   2456 
   2457      If a client or server wishes to disable RFC4507 support then the option
   2458      SSL_OP_NO_TICKET can be set.
   2459 
   2460      Add a TLS extension debugging callback to allow the contents of any client
   2461      or server extensions to be examined.
   2462 
   2463      This work was sponsored by Google.
   2464      [Steve Henson]
   2465 
   2466   *) Final changes to avoid use of pointer pointer casts in OpenSSL.
   2467      OpenSSL should now compile cleanly on gcc 4.2
   2468      [Peter Hartley <pdh (a] utter.chaos.org.uk>, Steve Henson]
   2469 
   2470   *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
   2471      support including streaming MAC support: this is required for GOST
   2472      ciphersuite support.
   2473      [Victor B. Wagner <vitus (a] cryptocom.ru>, Steve Henson]
   2474 
   2475   *) Add option -stream to use PKCS#7 streaming in smime utility. New
   2476      function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
   2477      to output in BER and PEM format.
   2478      [Steve Henson]
   2479 
   2480   *) Experimental support for use of HMAC via EVP_PKEY interface. This
   2481      allows HMAC to be handled via the EVP_DigestSign*() interface. The
   2482      EVP_PKEY "key" in this case is the HMAC key, potentially allowing
   2483      ENGINE support for HMAC keys which are unextractable. New -mac and
   2484      -macopt options to dgst utility.
   2485      [Steve Henson]
   2486 
   2487   *) New option -sigopt to dgst utility. Update dgst to use
   2488      EVP_Digest{Sign,Verify}*. These two changes make it possible to use
   2489      alternative signing paramaters such as X9.31 or PSS in the dgst 
   2490      utility.
   2491      [Steve Henson]
   2492 
   2493   *) Change ssl_cipher_apply_rule(), the internal function that does
   2494      the work each time a ciphersuite string requests enabling
   2495      ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
   2496      removing ("!foo+bar") a class of ciphersuites: Now it maintains
   2497      the order of disabled ciphersuites such that those ciphersuites
   2498      that most recently went from enabled to disabled not only stay
   2499      in order with respect to each other, but also have higher priority
   2500      than other disabled ciphersuites the next time ciphersuites are
   2501      enabled again.
   2502 
   2503      This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
   2504      the same ciphersuites as with "HIGH" alone, but in a specific
   2505      order where the PSK ciphersuites come first (since they are the
   2506      most recently disabled ciphersuites when "HIGH" is parsed).
   2507 
   2508      Also, change ssl_create_cipher_list() (using this new
   2509      funcionality) such that between otherwise identical
   2510      cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
   2511      the default order.
   2512      [Bodo Moeller]
   2513 
   2514   *) Change ssl_create_cipher_list() so that it automatically
   2515      arranges the ciphersuites in reasonable order before starting
   2516      to process the rule string.  Thus, the definition for "DEFAULT"
   2517      (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
   2518      remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
   2519      This makes it much easier to arrive at a reasonable default order
   2520      in applications for which anonymous ciphers are OK (meaning
   2521      that you can't actually use DEFAULT).
   2522      [Bodo Moeller; suggested by Victor Duchovni]
   2523 
   2524   *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
   2525      processing) into multiple integers instead of setting
   2526      "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
   2527      "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
   2528      (These masks as well as the individual bit definitions are hidden
   2529      away into the non-exported interface ssl/ssl_locl.h, so this
   2530      change to the definition of the SSL_CIPHER structure shouldn't
   2531      affect applications.)  This give us more bits for each of these
   2532      categories, so there is no longer a need to coagulate AES128 and
   2533      AES256 into a single algorithm bit, and to coagulate Camellia128
   2534      and Camellia256 into a single algorithm bit, which has led to all
   2535      kinds of kludges.
   2536 
   2537      Thus, among other things, the kludge introduced in 0.9.7m and
   2538      0.9.8e for masking out AES256 independently of AES128 or masking
   2539      out Camellia256 independently of AES256 is not needed here in 0.9.9.
   2540 
   2541      With the change, we also introduce new ciphersuite aliases that
   2542      so far were missing: "AES128", "AES256", "CAMELLIA128", and
   2543      "CAMELLIA256".
   2544      [Bodo Moeller]
   2545 
   2546   *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
   2547      Use the leftmost N bytes of the signature input if the input is
   2548      larger than the prime q (with N being the size in bytes of q).
   2549      [Nils Larsch]
   2550 
   2551   *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
   2552      it yet and it is largely untested.
   2553      [Steve Henson]
   2554 
   2555   *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
   2556      [Nils Larsch]
   2557 
   2558   *) Initial incomplete changes to avoid need for function casts in OpenSSL
   2559      some compilers (gcc 4.2 and later) reject their use. Safestack is
   2560      reimplemented.  Update ASN1 to avoid use of legacy functions. 
   2561      [Steve Henson]
   2562 
   2563   *) Win32/64 targets are linked with Winsock2.
   2564      [Andy Polyakov]
   2565 
   2566   *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
   2567      to external functions. This can be used to increase CRL handling 
   2568      efficiency especially when CRLs are very large by (for example) storing
   2569      the CRL revoked certificates in a database.
   2570      [Steve Henson]
   2571 
   2572   *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
   2573      new CRLs added to a directory can be used. New command line option
   2574      -verify_return_error to s_client and s_server. This causes real errors
   2575      to be returned by the verify callback instead of carrying on no matter
   2576      what. This reflects the way a "real world" verify callback would behave.
   2577      [Steve Henson]
   2578 
   2579   *) GOST engine, supporting several GOST algorithms and public key formats.
   2580      Kindly donated by Cryptocom.
   2581      [Cryptocom]
   2582 
   2583   *) Partial support for Issuing Distribution Point CRL extension. CRLs
   2584      partitioned by DP are handled but no indirect CRL or reason partitioning
   2585      (yet). Complete overhaul of CRL handling: now the most suitable CRL is
   2586      selected via a scoring technique which handles IDP and AKID in CRLs.
   2587      [Steve Henson]
   2588 
   2589   *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
   2590      will ultimately be used for all verify operations: this will remove the
   2591      X509_STORE dependency on certificate verification and allow alternative
   2592      lookup methods.  X509_STORE based implementations of these two callbacks.
   2593      [Steve Henson]
   2594 
   2595   *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
   2596      Modify get_crl() to find a valid (unexpired) CRL if possible.
   2597      [Steve Henson]
   2598 
   2599   *) New function X509_CRL_match() to check if two CRLs are identical. Normally
   2600      this would be called X509_CRL_cmp() but that name is already used by
   2601      a function that just compares CRL issuer names. Cache several CRL 
   2602      extensions in X509_CRL structure and cache CRLDP in X509.
   2603      [Steve Henson]
   2604 
   2605   *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
   2606      this maps equivalent X509_NAME structures into a consistent structure.
   2607      Name comparison can then be performed rapidly using memcmp().
   2608      [Steve Henson]
   2609 
   2610   *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
   2611      utility.
   2612      [Steve Henson]
   2613 
   2614   *) Allow digests to supply their own micalg string for S/MIME type using
   2615      the ctrl EVP_MD_CTRL_MICALG.
   2616      [Steve Henson]
   2617 
   2618   *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
   2619      EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
   2620      ctrl. It can then customise the structure before and/or after signing
   2621      if necessary.
   2622      [Steve Henson]
   2623 
   2624   *) New function OBJ_add_sigid() to allow application defined signature OIDs
   2625      to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
   2626      to free up any added signature OIDs.
   2627      [Steve Henson]
   2628 
   2629   *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
   2630      EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
   2631      digest and cipher tables. New options added to openssl utility:
   2632      list-message-digest-algorithms and list-cipher-algorithms.
   2633      [Steve Henson]
   2634 
   2635   *) Change the array representation of binary polynomials: the list
   2636      of degrees of non-zero coefficients is now terminated with -1.
   2637      Previously it was terminated with 0, which was also part of the
   2638      value; thus, the array representation was not applicable to
   2639      polynomials where t^0 has coefficient zero.  This change makes
   2640      the array representation useful in a more general context.
   2641      [Douglas Stebila]
   2642 
   2643   *) Various modifications and fixes to SSL/TLS cipher string
   2644      handling.  For ECC, the code now distinguishes between fixed ECDH
   2645      with RSA certificates on the one hand and with ECDSA certificates
   2646      on the other hand, since these are separate ciphersuites.  The
   2647      unused code for Fortezza ciphersuites has been removed.
   2648 
   2649      For consistency with EDH, ephemeral ECDH is now called "EECDH"
   2650      (not "ECDHE").  For consistency with the code for DH
   2651      certificates, use of ECDH certificates is now considered ECDH
   2652      authentication, not RSA or ECDSA authentication (the latter is
   2653      merely the CA's signing algorithm and not actively used in the
   2654      protocol).
   2655 
   2656      The temporary ciphersuite alias "ECCdraft" is no longer
   2657      available, and ECC ciphersuites are no longer excluded from "ALL"
   2658      and "DEFAULT".  The following aliases now exist for RFC 4492
   2659      ciphersuites, most of these by analogy with the DH case:
   2660 
   2661          kECDHr   - ECDH cert, signed with RSA
   2662          kECDHe   - ECDH cert, signed with ECDSA
   2663          kECDH    - ECDH cert (signed with either RSA or ECDSA)
   2664          kEECDH   - ephemeral ECDH
   2665          ECDH     - ECDH cert or ephemeral ECDH
   2666 
   2667          aECDH    - ECDH cert
   2668          aECDSA   - ECDSA cert
   2669          ECDSA    - ECDSA cert
   2670 
   2671          AECDH    - anonymous ECDH
   2672          EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
   2673 
   2674      [Bodo Moeller]
   2675 
   2676   *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
   2677      Use correct micalg parameters depending on digest(s) in signed message.
   2678      [Steve Henson]
   2679 
   2680   *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
   2681      an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
   2682      [Steve Henson]
   2683 
   2684   *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
   2685      an engine to register a method. Add ENGINE lookups for methods and
   2686      functional reference processing.
   2687      [Steve Henson]
   2688 
   2689   *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
   2690      EVP_{Sign,Verify}* which allow an application to customise the signature
   2691      process.
   2692      [Steve Henson]
   2693 
   2694   *) New -resign option to smime utility. This adds one or more signers
   2695      to an existing PKCS#7 signedData structure. Also -md option to use an
   2696      alternative message digest algorithm for signing.
   2697      [Steve Henson]
   2698 
   2699   *) Tidy up PKCS#7 routines and add new functions to make it easier to
   2700      create PKCS7 structures containing multiple signers. Update smime
   2701      application to support multiple signers.
   2702      [Steve Henson]
   2703 
   2704   *) New -macalg option to pkcs12 utility to allow setting of an alternative
   2705      digest MAC.
   2706      [Steve Henson]
   2707 
   2708   *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
   2709      Reorganize PBE internals to lookup from a static table using NIDs,
   2710      add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
   2711      EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
   2712      PRF which will be automatically used with PBES2.
   2713      [Steve Henson]
   2714 
   2715   *) Replace the algorithm specific calls to generate keys in "req" with the
   2716      new API.
   2717      [Steve Henson]
   2718 
   2719   *) Update PKCS#7 enveloped data routines to use new API. This is now
   2720      supported by any public key method supporting the encrypt operation. A
   2721      ctrl is added to allow the public key algorithm to examine or modify
   2722      the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
   2723      a no op.
   2724      [Steve Henson]
   2725 
   2726   *) Add a ctrl to asn1 method to allow a public key algorithm to express
   2727      a default digest type to use. In most cases this will be SHA1 but some
   2728      algorithms (such as GOST) need to specify an alternative digest. The
   2729      return value indicates how strong the prefernce is 1 means optional and
   2730      2 is mandatory (that is it is the only supported type). Modify
   2731      ASN1_item_sign() to accept a NULL digest argument to indicate it should
   2732      use the default md. Update openssl utilities to use the default digest
   2733      type for signing if it is not explicitly indicated.
   2734      [Steve Henson]
   2735 
   2736   *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
   2737      EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
   2738      signing method from the key type. This effectively removes the link
   2739      between digests and public key types.
   2740      [Steve Henson]
   2741 
   2742   *) Add an OID cross reference table and utility functions. Its purpose is to
   2743      translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
   2744      rsaEncryption. This will allow some of the algorithm specific hackery
   2745      needed to use the correct OID to be removed. 
   2746      [Steve Henson]
   2747 
   2748   *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
   2749      structures for PKCS7_sign(). They are now set up by the relevant public
   2750      key ASN1 method.
   2751      [Steve Henson]
   2752 
   2753   *) Add provisional EC pkey method with support for ECDSA and ECDH.
   2754      [Steve Henson]
   2755 
   2756   *) Add support for key derivation (agreement) in the API, DH method and
   2757      pkeyutl.
   2758      [Steve Henson]
   2759 
   2760   *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
   2761      public and private key formats. As a side effect these add additional 
   2762      command line functionality not previously available: DSA signatures can be
   2763      generated and verified using pkeyutl and DH key support and generation in
   2764      pkey, genpkey.
   2765      [Steve Henson]
   2766 
   2767   *) BeOS support.
   2768      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   2769 
   2770   *) New make target "install_html_docs" installs HTML renditions of the
   2771      manual pages.
   2772      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   2773 
   2774   *) New utility "genpkey" this is analagous to "genrsa" etc except it can
   2775      generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
   2776      support key and parameter generation and add initial key generation
   2777      functionality for RSA.
   2778      [Steve Henson]
   2779 
   2780   *) Add functions for main EVP_PKEY_method operations. The undocumented
   2781      functions EVP_PKEY_{encrypt,decrypt} have been renamed to
   2782      EVP_PKEY_{encrypt,decrypt}_old. 
   2783      [Steve Henson]
   2784 
   2785   *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
   2786      key API, doesn't do much yet.
   2787      [Steve Henson]
   2788 
   2789   *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
   2790      public key algorithms. New option to openssl utility:
   2791      "list-public-key-algorithms" to print out info.
   2792      [Steve Henson]
   2793 
   2794   *) Implement the Supported Elliptic Curves Extension for
   2795      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   2796      [Douglas Stebila]
   2797 
   2798   *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
   2799      EVP_CIPHER structures to avoid later problems in EVP_cleanup().
   2800      [Steve Henson]
   2801 
   2802   *) New utilities pkey and pkeyparam. These are similar to algorithm specific
   2803      utilities such as rsa, dsa, dsaparam etc except they process any key
   2804      type.
   2805      [Steve Henson]
   2806 
   2807   *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
   2808      functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
   2809      EVP_PKEY_print_param() to print public key data from an EVP_PKEY
   2810      structure.
   2811      [Steve Henson]
   2812 
   2813   *) Initial support for pluggable public key ASN1.
   2814      De-spaghettify the public key ASN1 handling. Move public and private
   2815      key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
   2816      algorithm specific handling to a single module within the relevant
   2817      algorithm directory. Add functions to allow (near) opaque processing
   2818      of public and private key structures.
   2819      [Steve Henson]
   2820 
   2821   *) Implement the Supported Point Formats Extension for
   2822      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   2823      [Douglas Stebila]
   2824 
   2825   *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
   2826      for the psk identity [hint] and the psk callback functions to the
   2827      SSL_SESSION, SSL and SSL_CTX structure.
   2828      
   2829      New ciphersuites:
   2830          PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
   2831          PSK-AES256-CBC-SHA
   2832  
   2833      New functions:
   2834          SSL_CTX_use_psk_identity_hint
   2835          SSL_get_psk_identity_hint
   2836          SSL_get_psk_identity
   2837          SSL_use_psk_identity_hint
   2838 
   2839      [Mika Kousa and Pasi Eronen of Nokia Corporation]
   2840 
   2841   *) Add RFC 3161 compliant time stamp request creation, response generation
   2842      and response verification functionality.
   2843      [Zoltn Glzik <zglozik (a] opentsa.org>, The OpenTSA Project]
   2844 
   2845   *) Add initial support for TLS extensions, specifically for the server_name
   2846      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   2847      have new members for a host name.  The SSL data structure has an
   2848      additional member SSL_CTX *initial_ctx so that new sessions can be
   2849      stored in that context to allow for session resumption, even after the
   2850      SSL has been switched to a new SSL_CTX in reaction to a client's
   2851      server_name extension.
   2852 
   2853      New functions (subject to change):
   2854 
   2855          SSL_get_servername()
   2856          SSL_get_servername_type()
   2857          SSL_set_SSL_CTX()
   2858 
   2859      New CTRL codes and macros (subject to change):
   2860 
   2861          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
   2862                                  - SSL_CTX_set_tlsext_servername_callback()
   2863          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
   2864                                       - SSL_CTX_set_tlsext_servername_arg()
   2865          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   2866 
   2867      openssl s_client has a new '-servername ...' option.
   2868 
   2869      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   2870      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   2871      testing the HostName extension for a specific single host name ('-cert'
   2872      and '-key' remain fallbacks for handshakes without HostName
   2873      negotiation).  If the unrecogninzed_name alert has to be sent, this by
   2874      default is a warning; it becomes fatal with the '-servername_fatal'
   2875      option.
   2876 
   2877      [Peter Sylvester,  Remy Allais, Christophe Renou]
   2878 
   2879   *) Whirlpool hash implementation is added.
   2880      [Andy Polyakov]
   2881 
   2882   *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
   2883      bn(64,32). Because of instruction set limitations it doesn't have
   2884      any negative impact on performance. This was done mostly in order
   2885      to make it possible to share assembler modules, such as bn_mul_mont
   2886      implementations, between 32- and 64-bit builds without hassle.
   2887      [Andy Polyakov]
   2888 
   2889   *) Move code previously exiled into file crypto/ec/ec2_smpt.c
   2890      to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
   2891      macro.
   2892      [Bodo Moeller]
   2893 
   2894   *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
   2895      dedicated Montgomery multiplication procedure, is introduced.
   2896      BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
   2897      "64-bit" performance on certain 32-bit targets.
   2898      [Andy Polyakov]
   2899 
   2900   *) New option SSL_OP_NO_COMP to disable use of compression selectively
   2901      in SSL structures. New SSL ctrl to set maximum send fragment size. 
   2902      Save memory by seeting the I/O buffer sizes dynamically instead of
   2903      using the maximum available value.
   2904      [Steve Henson]
   2905 
   2906   *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
   2907      in addition to the text details.
   2908      [Bodo Moeller]
   2909 
   2910   *) Very, very preliminary EXPERIMENTAL support for printing of general
   2911      ASN1 structures. This currently produces rather ugly output and doesn't
   2912      handle several customised structures at all.
   2913      [Steve Henson]
   2914 
   2915   *) Integrated support for PVK file format and some related formats such
   2916      as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
   2917      these in the 'rsa' and 'dsa' utilities.
   2918      [Steve Henson]
   2919 
   2920   *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
   2921      [Steve Henson]
   2922 
   2923   *) Remove the ancient ASN1_METHOD code. This was only ever used in one
   2924      place for the (very old) "NETSCAPE" format certificates which are now
   2925      handled using new ASN1 code equivalents.
   2926      [Steve Henson]
   2927 
   2928   *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
   2929      pointer and make the SSL_METHOD parameter in SSL_CTX_new,
   2930      SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
   2931      [Nils Larsch]
   2932 
   2933   *) Modify CRL distribution points extension code to print out previously
   2934      unsupported fields. Enhance extension setting code to allow setting of
   2935      all fields.
   2936      [Steve Henson]
   2937 
   2938   *) Add print and set support for Issuing Distribution Point CRL extension.
   2939      [Steve Henson]
   2940 
   2941   *) Change 'Configure' script to enable Camellia by default.
   2942      [NTT]
   2943 
   2944  Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
   2945 
   2946   *) When rejecting SSL/TLS records due to an incorrect version number, never
   2947      update s->server with a new major version number.  As of
   2948      - OpenSSL 0.9.8m if 'short' is a 16-bit type,
   2949      - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
   2950      the previous behavior could result in a read attempt at NULL when
   2951      receiving specific incorrect SSL/TLS records once record payload
   2952      protection is active.  (CVE-2010-0740)
   2953      [Bodo Moeller, Adam Langley <agl (a] chromium.org>]
   2954 
   2955   *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
   2956      could be crashed if the relevant tables were not present (e.g. chrooted).
   2957      [Tomas Hoger <thoger (a] redhat.com>]
   2958 
   2959  Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
   2960 
   2961   *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
   2962      [Martin Olsson, Neel Mehta]
   2963 
   2964   *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
   2965      accommodate for stack sorting, always a write lock!).
   2966      [Bodo Moeller]
   2967 
   2968   *) On some versions of WIN32 Heap32Next is very slow. This can cause
   2969      excessive delays in the RAND_poll(): over a minute. As a workaround
   2970      include a time check in the inner Heap32Next loop too.
   2971      [Steve Henson]
   2972 
   2973   *) The code that handled flushing of data in SSL/TLS originally used the
   2974      BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
   2975      the problem outlined in PR#1949. The fix suggested there however can
   2976      trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
   2977      of Apache). So instead simplify the code to flush unconditionally.
   2978      This should be fine since flushing with no data to flush is a no op.
   2979      [Steve Henson]
   2980 
   2981   *) Handle TLS versions 2.0 and later properly and correctly use the
   2982      highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
   2983      off ancient servers have a habit of sticking around for a while...
   2984      [Steve Henson]
   2985 
   2986   *) Modify compression code so it frees up structures without using the
   2987      ex_data callbacks. This works around a problem where some applications
   2988      call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
   2989      restarting) then use compression (e.g. SSL with compression) later.
   2990      This results in significant per-connection memory leaks and
   2991      has caused some security issues including CVE-2008-1678 and
   2992      CVE-2009-4355.
   2993      [Steve Henson]
   2994 
   2995   *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
   2996      change when encrypting or decrypting.
   2997      [Bodo Moeller]
   2998 
   2999   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
   3000      connect and renegotiate with servers which do not support RI.
   3001      Until RI is more widely deployed this option is enabled by default.
   3002      [Steve Henson]
   3003 
   3004   *) Add "missing" ssl ctrls to clear options and mode.
   3005      [Steve Henson]
   3006 
   3007   *) If client attempts to renegotiate and doesn't support RI respond with
   3008      a no_renegotiation alert as required by RFC5746.  Some renegotiating
   3009      TLS clients will continue a connection gracefully when they receive
   3010      the alert. Unfortunately OpenSSL mishandled this alert and would hang
   3011      waiting for a server hello which it will never receive. Now we treat a
   3012      received no_renegotiation alert as a fatal error. This is because
   3013      applications requesting a renegotiation might well expect it to succeed
   3014      and would have no code in place to handle the server denying it so the
   3015      only safe thing to do is to terminate the connection.
   3016      [Steve Henson]
   3017 
   3018   *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
   3019      peer supports secure renegotiation and 0 otherwise. Print out peer
   3020      renegotiation support in s_client/s_server.
   3021      [Steve Henson]
   3022 
   3023   *) Replace the highly broken and deprecated SPKAC certification method with
   3024      the updated NID creation version. This should correctly handle UTF8.
   3025      [Steve Henson]
   3026 
   3027   *) Implement RFC5746. Re-enable renegotiation but require the extension
   3028      as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
   3029      turns out to be a bad idea. It has been replaced by
   3030      SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
   3031      SSL_CTX_set_options(). This is really not recommended unless you
   3032      know what you are doing.
   3033      [Eric Rescorla <ekr (a] networkresonance.com>, Ben Laurie, Steve Henson]
   3034 
   3035   *) Fixes to stateless session resumption handling. Use initial_ctx when
   3036      issuing and attempting to decrypt tickets in case it has changed during
   3037      servername handling. Use a non-zero length session ID when attempting
   3038      stateless session resumption: this makes it possible to determine if
   3039      a resumption has occurred immediately after receiving server hello
   3040      (several places in OpenSSL subtly assume this) instead of later in
   3041      the handshake.
   3042      [Steve Henson]
   3043 
   3044   *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
   3045      CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
   3046      fixes for a few places where the return code is not checked
   3047      correctly.
   3048      [Julia Lawall <julia (a] diku.dk>]
   3049 
   3050   *) Add --strict-warnings option to Configure script to include devteam
   3051      warnings in other configurations.
   3052      [Steve Henson]
   3053 
   3054   *) Add support for --libdir option and LIBDIR variable in makefiles. This
   3055      makes it possible to install openssl libraries in locations which
   3056      have names other than "lib", for example "/usr/lib64" which some
   3057      systems need.
   3058      [Steve Henson, based on patch from Jeremy Utley]
   3059 
   3060   *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
   3061      X690 8.9.12 and can produce some misleading textual output of OIDs.
   3062      [Steve Henson, reported by Dan Kaminsky]
   3063 
   3064   *) Delete MD2 from algorithm tables. This follows the recommendation in
   3065      several standards that it is not used in new applications due to
   3066      several cryptographic weaknesses. For binary compatibility reasons
   3067      the MD2 API is still compiled in by default.
   3068      [Steve Henson]
   3069 
   3070   *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
   3071      and restored.
   3072      [Steve Henson]
   3073 
   3074   *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
   3075      OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
   3076      clash.
   3077      [Guenter <lists (a] gknw.net>]
   3078 
   3079   *) Fix the server certificate chain building code to use X509_verify_cert(),
   3080      it used to have an ad-hoc builder which was unable to cope with anything
   3081      other than a simple chain.
   3082      [David Woodhouse <dwmw2 (a] infradead.org>, Steve Henson]
   3083 
   3084   *) Don't check self signed certificate signatures in X509_verify_cert()
   3085      by default (a flag can override this): it just wastes time without
   3086      adding any security. As a useful side effect self signed root CAs
   3087      with non-FIPS digests are now usable in FIPS mode.
   3088      [Steve Henson]
   3089 
   3090   *) In dtls1_process_out_of_seq_message() the check if the current message
   3091      is already buffered was missing. For every new message was memory
   3092      allocated, allowing an attacker to perform an denial of service attack
   3093      with sending out of seq handshake messages until there is no memory
   3094      left. Additionally every future messege was buffered, even if the
   3095      sequence number made no sense and would be part of another handshake.
   3096      So only messages with sequence numbers less than 10 in advance will be
   3097      buffered.  (CVE-2009-1378)
   3098      [Robin Seggelmann, discovered by Daniel Mentz] 	
   3099 
   3100   *) Records are buffered if they arrive with a future epoch to be
   3101      processed after finishing the corresponding handshake. There is
   3102      currently no limitation to this buffer allowing an attacker to perform
   3103      a DOS attack with sending records with future epochs until there is no
   3104      memory left. This patch adds the pqueue_size() function to detemine
   3105      the size of a buffer and limits the record buffer to 100 entries.
   3106      (CVE-2009-1377)
   3107      [Robin Seggelmann, discovered by Daniel Mentz] 	
   3108 
   3109   *) Keep a copy of frag->msg_header.frag_len so it can be used after the
   3110      parent structure is freed.  (CVE-2009-1379)
   3111      [Daniel Mentz] 	
   3112 
   3113   *) Handle non-blocking I/O properly in SSL_shutdown() call.
   3114      [Darryl Miles <darryl-mailinglists (a] netbauds.net>]
   3115 
   3116   *) Add 2.5.4.* OIDs
   3117      [Ilya O. <vrghost (a] gmail.com>]
   3118 
   3119  Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
   3120 
   3121   *) Disable renegotiation completely - this fixes a severe security
   3122      problem (CVE-2009-3555) at the cost of breaking all
   3123      renegotiation. Renegotiation can be re-enabled by setting
   3124      SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION in s3->flags at
   3125      run-time. This is really not recommended unless you know what
   3126      you're doing.
   3127      [Ben Laurie]
   3128 
   3129  Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
   3130 
   3131   *) Don't set val to NULL when freeing up structures, it is freed up by
   3132      underlying code. If sizeof(void *) > sizeof(long) this can result in
   3133      zeroing past the valid field. (CVE-2009-0789)
   3134      [Paolo Ganci <Paolo.Ganci (a] AdNovum.CH>]
   3135 
   3136   *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
   3137      checked correctly. This would allow some invalid signed attributes to
   3138      appear to verify correctly. (CVE-2009-0591)
   3139      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   3140 
   3141   *) Reject UniversalString and BMPString types with invalid lengths. This
   3142      prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
   3143      a legal length. (CVE-2009-0590)
   3144      [Steve Henson]
   3145 
   3146   *) Set S/MIME signing as the default purpose rather than setting it 
   3147      unconditionally. This allows applications to override it at the store
   3148      level.
   3149      [Steve Henson]
   3150 
   3151   *) Permit restricted recursion of ASN1 strings. This is needed in practice
   3152      to handle some structures.
   3153      [Steve Henson]
   3154 
   3155   *) Improve efficiency of mem_gets: don't search whole buffer each time
   3156      for a '\n'
   3157      [Jeremy Shapiro <jnshapir (a] us.ibm.com>]
   3158 
   3159   *) New -hex option for openssl rand.
   3160      [Matthieu Herrb]
   3161 
   3162   *) Print out UTF8String and NumericString when parsing ASN1.
   3163      [Steve Henson]
   3164 
   3165   *) Support NumericString type for name components.
   3166      [Steve Henson]
   3167 
   3168   *) Allow CC in the environment to override the automatically chosen
   3169      compiler. Note that nothing is done to ensure flags work with the
   3170      chosen compiler.
   3171      [Ben Laurie]
   3172 
   3173  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
   3174 
   3175   *) Properly check EVP_VerifyFinal() and similar return values
   3176      (CVE-2008-5077).
   3177      [Ben Laurie, Bodo Moeller, Google Security Team]
   3178 
   3179   *) Enable TLS extensions by default.
   3180      [Ben Laurie]
   3181 
   3182   *) Allow the CHIL engine to be loaded, whether the application is
   3183      multithreaded or not. (This does not release the developer from the
   3184      obligation to set up the dynamic locking callbacks.)
   3185      [Sander Temme <sander (a] temme.net>]
   3186 
   3187   *) Use correct exit code if there is an error in dgst command.
   3188      [Steve Henson; problem pointed out by Roland Dirlewanger]
   3189 
   3190   *) Tweak Configure so that you need to say "experimental-jpake" to enable
   3191      JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
   3192      [Bodo Moeller]
   3193 
   3194   *) Add experimental JPAKE support, including demo authentication in
   3195      s_client and s_server.
   3196      [Ben Laurie]
   3197 
   3198   *) Set the comparison function in v3_addr_canonize().
   3199      [Rob Austein <sra (a] hactrn.net>]
   3200 
   3201   *) Add support for XMPP STARTTLS in s_client.
   3202      [Philip Paeps <philip (a] freebsd.org>]
   3203 
   3204   *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
   3205      to ensure that even with this option, only ciphersuites in the
   3206      server's preference list will be accepted.  (Note that the option
   3207      applies only when resuming a session, so the earlier behavior was
   3208      just about the algorithm choice for symmetric cryptography.)
   3209      [Bodo Moeller]
   3210 
   3211  Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
   3212 
   3213   *) Fix NULL pointer dereference if a DTLS server received
   3214      ChangeCipherSpec as first record (CVE-2009-1386).
   3215      [PR #1679]
   3216 
   3217   *) Fix a state transitition in s3_srvr.c and d1_srvr.c
   3218      (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
   3219      [Nagendra Modadugu]
   3220 
   3221   *) The fix in 0.9.8c that supposedly got rid of unsafe
   3222      double-checked locking was incomplete for RSA blinding,
   3223      addressing just one layer of what turns out to have been
   3224      doubly unsafe triple-checked locking.
   3225 
   3226      So now fix this for real by retiring the MONT_HELPER macro
   3227      in crypto/rsa/rsa_eay.c.
   3228 
   3229      [Bodo Moeller; problem pointed out by Marius Schilder]
   3230 
   3231   *) Various precautionary measures:
   3232 
   3233      - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
   3234 
   3235      - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
   3236        (NB: This would require knowledge of the secret session ticket key
   3237        to exploit, in which case you'd be SOL either way.)
   3238 
   3239      - Change bn_nist.c so that it will properly handle input BIGNUMs
   3240        outside the expected range.
   3241 
   3242      - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
   3243        builds.
   3244 
   3245      [Neel Mehta, Bodo Moeller]
   3246 
   3247   *) Allow engines to be "soft loaded" - i.e. optionally don't die if
   3248      the load fails. Useful for distros.
   3249      [Ben Laurie and the FreeBSD team]
   3250 
   3251   *) Add support for Local Machine Keyset attribute in PKCS#12 files.
   3252      [Steve Henson]
   3253 
   3254   *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
   3255      [Huang Ying]
   3256 
   3257   *) Expand ENGINE to support engine supplied SSL client certificate functions.
   3258 
   3259      This work was sponsored by Logica.
   3260      [Steve Henson]
   3261 
   3262   *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
   3263      keystores. Support for SSL/TLS client authentication too.
   3264      Not compiled unless enable-capieng specified to Configure.
   3265 
   3266      This work was sponsored by Logica.
   3267      [Steve Henson]
   3268 
   3269   *) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
   3270      ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
   3271      attribute creation routines such as certifcate requests and PKCS#12
   3272      files.
   3273      [Steve Henson]
   3274 
   3275  Changes between 0.9.8g and 0.9.8h  [28 May 2008]
   3276 
   3277   *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
   3278      handshake which could lead to a cilent crash as found using the
   3279      Codenomicon TLS test suite (CVE-2008-1672) 
   3280      [Steve Henson, Mark Cox]
   3281 
   3282   *) Fix double free in TLS server name extensions which could lead to
   3283      a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
   3284      [Joe Orton]
   3285 
   3286   *) Clear error queue in SSL_CTX_use_certificate_chain_file()
   3287 
   3288      Clear the error queue to ensure that error entries left from
   3289      older function calls do not interfere with the correct operation.
   3290      [Lutz Jaenicke, Erik de Castro Lopo]
   3291 
   3292   *) Remove root CA certificates of commercial CAs:
   3293 
   3294      The OpenSSL project does not recommend any specific CA and does not
   3295      have any policy with respect to including or excluding any CA.
   3296      Therefore it does not make any sense to ship an arbitrary selection
   3297      of root CA certificates with the OpenSSL software.
   3298      [Lutz Jaenicke]
   3299 
   3300   *) RSA OAEP patches to fix two separate invalid memory reads.
   3301      The first one involves inputs when 'lzero' is greater than
   3302      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
   3303      before the beginning of from). The second one involves inputs where
   3304      the 'db' section contains nothing but zeroes (there is a one-byte
   3305      invalid read after the end of 'db').
   3306      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   3307 
   3308   *) Partial backport from 0.9.9-dev:
   3309 
   3310      Introduce bn_mul_mont (dedicated Montgomery multiplication
   3311      procedure) as a candidate for BIGNUM assembler implementation.
   3312      While 0.9.9-dev uses assembler for various architectures, only
   3313      x86_64 is available by default here in the 0.9.8 branch, and
   3314      32-bit x86 is available through a compile-time setting.
   3315 
   3316      To try the 32-bit x86 assembler implementation, use Configure
   3317      option "enable-montasm" (which exists only for this backport).
   3318 
   3319      As "enable-montasm" for 32-bit x86 disclaims code stability
   3320      anyway, in this constellation we activate additional code
   3321      backported from 0.9.9-dev for further performance improvements,
   3322      namely BN_from_montgomery_word.  (To enable this otherwise,
   3323      e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
   3324 
   3325      [Andy Polyakov (backport partially by Bodo Moeller)]
   3326 
   3327   *) Add TLS session ticket callback. This allows an application to set
   3328      TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
   3329      values. This is useful for key rollover for example where several key
   3330      sets may exist with different names.
   3331      [Steve Henson]
   3332 
   3333   *) Reverse ENGINE-internal logic for caching default ENGINE handles.
   3334      This was broken until now in 0.9.8 releases, such that the only way
   3335      a registered ENGINE could be used (assuming it initialises
   3336      successfully on the host) was to explicitly set it as the default
   3337      for the relevant algorithms. This is in contradiction with 0.9.7
   3338      behaviour and the documentation. With this fix, when an ENGINE is
   3339      registered into a given algorithm's table of implementations, the
   3340      'uptodate' flag is reset so that auto-discovery will be used next
   3341      time a new context for that algorithm attempts to select an
   3342      implementation.
   3343      [Ian Lister (tweaked by Geoff Thorpe)]
   3344 
   3345   *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
   3346      implemention in the following ways:
   3347 
   3348      Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
   3349      hard coded.
   3350 
   3351      Lack of BER streaming support means one pass streaming processing is
   3352      only supported if data is detached: setting the streaming flag is
   3353      ignored for embedded content.
   3354 
   3355      CMS support is disabled by default and must be explicitly enabled
   3356      with the enable-cms configuration option.
   3357      [Steve Henson]
   3358 
   3359   *) Update the GMP engine glue to do direct copies between BIGNUM and
   3360      mpz_t when openssl and GMP use the same limb size. Otherwise the
   3361      existing "conversion via a text string export" trick is still used.
   3362      [Paul Sheer <paulsheer (a] gmail.com>]
   3363 
   3364   *) Zlib compression BIO. This is a filter BIO which compressed and
   3365      uncompresses any data passed through it.
   3366      [Steve Henson]
   3367 
   3368   *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
   3369      RFC3394 compatible AES key wrapping.
   3370      [Steve Henson]
   3371 
   3372   *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
   3373      sets string data without copying. X509_ALGOR_set0() and
   3374      X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
   3375      data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
   3376      from an X509_ATTRIBUTE structure optionally checking it occurs only
   3377      once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
   3378      data.
   3379      [Steve Henson]
   3380 
   3381   *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
   3382      to get the expected BN_FLG_CONSTTIME behavior.
   3383      [Bodo Moeller (Google)]
   3384   
   3385   *) Netware support:
   3386 
   3387      - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
   3388      - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
   3389      - added some more tests to do_tests.pl
   3390      - fixed RunningProcess usage so that it works with newer LIBC NDKs too
   3391      - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
   3392      - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
   3393        netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
   3394      - various changes to netware.pl to enable gcc-cross builds on Win32
   3395        platform
   3396      - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
   3397      - various changes to fix missing prototype warnings
   3398      - fixed x86nasm.pl to create correct asm files for NASM COFF output
   3399      - added AES, WHIRLPOOL and CPUID assembler code to build files
   3400      - added missing AES assembler make rules to mk1mf.pl
   3401      - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
   3402      [Guenter Knauf <eflash (a] gmx.net>]
   3403 
   3404   *) Implement certificate status request TLS extension defined in RFC3546.
   3405      A client can set the appropriate parameters and receive the encoded
   3406      OCSP response via a callback. A server can query the supplied parameters
   3407      and set the encoded OCSP response in the callback. Add simplified examples
   3408      to s_client and s_server.
   3409      [Steve Henson]
   3410 
   3411  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
   3412 
   3413   *) Fix various bugs:
   3414      + Binary incompatibility of ssl_ctx_st structure
   3415      + DTLS interoperation with non-compliant servers
   3416      + Don't call get_session_cb() without proposed session
   3417      + Fix ia64 assembler code
   3418      [Andy Polyakov, Steve Henson]
   3419 
   3420  Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
   3421 
   3422   *) DTLS Handshake overhaul. There were longstanding issues with
   3423      OpenSSL DTLS implementation, which were making it impossible for
   3424      RFC 4347 compliant client to communicate with OpenSSL server.
   3425      Unfortunately just fixing these incompatibilities would "cut off"
   3426      pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
   3427      server keeps tolerating non RFC compliant syntax. The opposite is
   3428      not true, 0.9.8f client can not communicate with earlier server.
   3429      This update even addresses CVE-2007-4995.
   3430      [Andy Polyakov]
   3431 
   3432   *) Changes to avoid need for function casts in OpenSSL: some compilers
   3433      (gcc 4.2 and later) reject their use.
   3434      [Kurt Roeckx <kurt (a] roeckx.be>, Peter Hartley <pdh (a] utter.chaos.org.uk>,
   3435       Steve Henson]
   3436   
   3437   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   3438      RFC4507bis. The encrypted ticket format is an encrypted encoded
   3439      SSL_SESSION structure, that way new session features are automatically
   3440      supported.
   3441 
   3442      If a client application caches session in an SSL_SESSION structure
   3443      support is transparent because tickets are now stored in the encoded
   3444      SSL_SESSION.
   3445      
   3446      The SSL_CTX structure automatically generates keys for ticket
   3447      protection in servers so again support should be possible
   3448      with no application modification.
   3449 
   3450      If a client or server wishes to disable RFC4507 support then the option
   3451      SSL_OP_NO_TICKET can be set.
   3452 
   3453      Add a TLS extension debugging callback to allow the contents of any client
   3454      or server extensions to be examined.
   3455 
   3456      This work was sponsored by Google.
   3457      [Steve Henson]
   3458 
   3459   *) Add initial support for TLS extensions, specifically for the server_name
   3460      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   3461      have new members for a host name.  The SSL data structure has an
   3462      additional member SSL_CTX *initial_ctx so that new sessions can be
   3463      stored in that context to allow for session resumption, even after the
   3464      SSL has been switched to a new SSL_CTX in reaction to a client's
   3465      server_name extension.
   3466 
   3467      New functions (subject to change):
   3468 
   3469          SSL_get_servername()
   3470          SSL_get_servername_type()
   3471          SSL_set_SSL_CTX()
   3472 
   3473      New CTRL codes and macros (subject to change):
   3474 
   3475          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
   3476                                  - SSL_CTX_set_tlsext_servername_callback()
   3477          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
   3478                                       - SSL_CTX_set_tlsext_servername_arg()
   3479          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   3480 
   3481      openssl s_client has a new '-servername ...' option.
   3482 
   3483      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   3484      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   3485      testing the HostName extension for a specific single host name ('-cert'
   3486      and '-key' remain fallbacks for handshakes without HostName
   3487      negotiation).  If the unrecogninzed_name alert has to be sent, this by
   3488      default is a warning; it becomes fatal with the '-servername_fatal'
   3489      option.
   3490 
   3491      [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
   3492 
   3493   *) Add AES and SSE2 assembly language support to VC++ build.
   3494      [Steve Henson]
   3495 
   3496   *) Mitigate attack on final subtraction in Montgomery reduction.
   3497      [Andy Polyakov]
   3498 
   3499   *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
   3500      (which previously caused an internal error).
   3501      [Bodo Moeller]
   3502 
   3503   *) Squeeze another 10% out of IGE mode when in != out.
   3504      [Ben Laurie]
   3505 
   3506   *) AES IGE mode speedup.
   3507      [Dean Gaudet (Google)]
   3508 
   3509   *) Add the Korean symmetric 128-bit cipher SEED (see
   3510      http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
   3511      add SEED ciphersuites from RFC 4162:
   3512 
   3513         TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
   3514         TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"
   3515         TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"
   3516         TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
   3517 
   3518      To minimize changes between patchlevels in the OpenSSL 0.9.8
   3519      series, SEED remains excluded from compilation unless OpenSSL
   3520      is configured with 'enable-seed'.
   3521      [KISA, Bodo Moeller]
   3522 
   3523   *) Mitigate branch prediction attacks, which can be practical if a
   3524      single processor is shared, allowing a spy process to extract
   3525      information.  For detailed background information, see
   3526      http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
   3527      J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
   3528      and Necessary Software Countermeasures").  The core of the change
   3529      are new versions BN_div_no_branch() and
   3530      BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
   3531      respectively, which are slower, but avoid the security-relevant
   3532      conditional branches.  These are automatically called by BN_div()
   3533      and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
   3534      of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
   3535      remove a conditional branch.
   3536 
   3537      BN_FLG_CONSTTIME is the new name for the previous
   3538      BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
   3539      modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
   3540      in the exponent causes BN_mod_exp_mont() to use the alternative
   3541      implementation in BN_mod_exp_mont_consttime().)  The old name
   3542      remains as a deprecated alias.
   3543 
   3544      Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
   3545      RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
   3546      constant-time implementations for more than just exponentiation.
   3547      Here too the old name is kept as a deprecated alias.
   3548 
   3549      BN_BLINDING_new() will now use BN_dup() for the modulus so that
   3550      the BN_BLINDING structure gets an independent copy of the
   3551      modulus.  This means that the previous "BIGNUM *m" argument to
   3552      BN_BLINDING_new() and to BN_BLINDING_create_param() now
   3553      essentially becomes "const BIGNUM *m", although we can't actually
   3554      change this in the header file before 0.9.9.  It allows
   3555      RSA_setup_blinding() to use BN_with_flags() on the modulus to
   3556      enable BN_FLG_CONSTTIME.
   3557 
   3558      [Matthew D Wood (Intel Corp)]
   3559 
   3560   *) In the SSL/TLS server implementation, be strict about session ID
   3561      context matching (which matters if an application uses a single
   3562      external cache for different purposes).  Previously,
   3563      out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
   3564      set.  This did ensure strict client verification, but meant that,
   3565      with applications using a single external cache for quite
   3566      different requirements, clients could circumvent ciphersuite
   3567      restrictions for a given session ID context by starting a session
   3568      in a different context.
   3569      [Bodo Moeller]
   3570 
   3571   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   3572      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   3573      authentication-only ciphersuites.
   3574      [Bodo Moeller]
   3575 
   3576   *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
   3577      not complete and could lead to a possible single byte overflow
   3578      (CVE-2007-5135) [Ben Laurie]
   3579 
   3580  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
   3581 
   3582   *) Since AES128 and AES256 (and similarly Camellia128 and
   3583      Camellia256) share a single mask bit in the logic of
   3584      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   3585      kludge to work properly if AES128 is available and AES256 isn't
   3586      (or if Camellia128 is available and Camellia256 isn't).
   3587      [Victor Duchovni]
   3588 
   3589   *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
   3590      (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
   3591      When a point or a seed is encoded in a BIT STRING, we need to
   3592      prevent the removal of trailing zero bits to get the proper DER
   3593      encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
   3594      of a NamedBitList, for which trailing 0 bits need to be removed.)
   3595      [Bodo Moeller]
   3596 
   3597   *) Have SSL/TLS server implementation tolerate "mismatched" record
   3598      protocol version while receiving ClientHello even if the
   3599      ClientHello is fragmented.  (The server can't insist on the
   3600      particular protocol version it has chosen before the ServerHello
   3601      message has informed the client about his choice.)
   3602      [Bodo Moeller]
   3603 
   3604   *) Add RFC 3779 support.
   3605      [Rob Austein for ARIN, Ben Laurie]
   3606 
   3607   *) Load error codes if they are not already present instead of using a
   3608      static variable. This allows them to be cleanly unloaded and reloaded.
   3609      Improve header file function name parsing.
   3610      [Steve Henson]
   3611 
   3612   *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
   3613      or CAPABILITY handshake as required by RFCs.
   3614      [Goetz Babin-Ebell]
   3615 
   3616  Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
   3617 
   3618   *) Introduce limits to prevent malicious keys being able to
   3619      cause a denial of service.  (CVE-2006-2940)
   3620      [Steve Henson, Bodo Moeller]
   3621 
   3622   *) Fix ASN.1 parsing of certain invalid structures that can result
   3623      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   3624 
   3625   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   3626      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   3627 
   3628   *) Fix SSL client code which could crash if connecting to a
   3629      malicious SSLv2 server.  (CVE-2006-4343)
   3630      [Tavis Ormandy and Will Drewry, Google Security Team]
   3631 
   3632   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
   3633      match only those.  Before that, "AES256-SHA" would be interpreted
   3634      as a pattern and match "AES128-SHA" too (since AES128-SHA got
   3635      the same strength classification in 0.9.7h) as we currently only
   3636      have a single AES bit in the ciphersuite description bitmap.
   3637      That change, however, also applied to ciphersuite strings such as
   3638      "RC4-MD5" that intentionally matched multiple ciphersuites --
   3639      namely, SSL 2.0 ciphersuites in addition to the more common ones
   3640      from SSL 3.0/TLS 1.0.
   3641 
   3642      So we change the selection algorithm again: Naming an explicit
   3643      ciphersuite selects this one ciphersuite, and any other similar
   3644      ciphersuite (same bitmap) from *other* protocol versions.
   3645      Thus, "RC4-MD5" again will properly select both the SSL 2.0
   3646      ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
   3647 
   3648      Since SSL 2.0 does not have any ciphersuites for which the
   3649      128/256 bit distinction would be relevant, this works for now.
   3650      The proper fix will be to use different bits for AES128 and
   3651      AES256, which would have avoided the problems from the beginning;
   3652      however, bits are scarce, so we can only do this in a new release
   3653      (not just a patchlevel) when we can change the SSL_CIPHER
   3654      definition to split the single 'unsigned long mask' bitmap into
   3655      multiple values to extend the available space.
   3656 
   3657      [Bodo Moeller]
   3658 
   3659  Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
   3660 
   3661   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   3662      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   3663 
   3664   *) Add AES IGE and biIGE modes.
   3665      [Ben Laurie]
   3666 
   3667   *) Change the Unix randomness entropy gathering to use poll() when
   3668      possible instead of select(), since the latter has some
   3669      undesirable limitations.
   3670      [Darryl Miles via Richard Levitte and Bodo Moeller]
   3671 
   3672   *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
   3673      treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
   3674      cannot be implicitly activated as part of, e.g., the "AES" alias.
   3675      However, please upgrade to OpenSSL 0.9.9[-dev] for
   3676      non-experimental use of the ECC ciphersuites to get TLS extension
   3677      support, which is required for curve and point format negotiation
   3678      to avoid potential handshake problems.
   3679      [Bodo Moeller]
   3680 
   3681   *) Disable rogue ciphersuites:
   3682 
   3683       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   3684       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   3685       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   3686 
   3687      The latter two were purportedly from
   3688      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   3689      appear there.
   3690 
   3691      Also deactivate the remaining ciphersuites from
   3692      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   3693      unofficial, and the ID has long expired.
   3694      [Bodo Moeller]
   3695 
   3696   *) Fix RSA blinding Heisenbug (problems sometimes occured on
   3697      dual-core machines) and other potential thread-safety issues.
   3698      [Bodo Moeller]
   3699 
   3700   *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
   3701      versions), which is now available for royalty-free use
   3702      (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
   3703      Also, add Camellia TLS ciphersuites from RFC 4132.
   3704 
   3705      To minimize changes between patchlevels in the OpenSSL 0.9.8
   3706      series, Camellia remains excluded from compilation unless OpenSSL
   3707      is configured with 'enable-camellia'.
   3708      [NTT]
   3709 
   3710   *) Disable the padding bug check when compression is in use. The padding
   3711      bug check assumes the first packet is of even length, this is not
   3712      necessarily true if compresssion is enabled and can result in false
   3713      positives causing handshake failure. The actual bug test is ancient
   3714      code so it is hoped that implementations will either have fixed it by
   3715      now or any which still have the bug do not support compression.
   3716      [Steve Henson]
   3717 
   3718  Changes between 0.9.8a and 0.9.8b  [04 May 2006]
   3719 
   3720   *) When applying a cipher rule check to see if string match is an explicit
   3721      cipher suite and only match that one cipher suite if it is.
   3722      [Steve Henson]
   3723 
   3724   *) Link in manifests for VC++ if needed.
   3725      [Austin Ziegler <halostatue (a] gmail.com>]
   3726 
   3727   *) Update support for ECC-based TLS ciphersuites according to
   3728      draft-ietf-tls-ecc-12.txt with proposed changes (but without
   3729      TLS extensions, which are supported starting with the 0.9.9
   3730      branch, not in the OpenSSL 0.9.8 branch).
   3731      [Douglas Stebila]
   3732 
   3733   *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
   3734      opaque EVP_CIPHER_CTX handling.
   3735      [Steve Henson]
   3736 
   3737   *) Fixes and enhancements to zlib compression code. We now only use
   3738      "zlib1.dll" and use the default __cdecl calling convention on Win32
   3739      to conform with the standards mentioned here:
   3740            http://www.zlib.net/DLL_FAQ.txt
   3741      Static zlib linking now works on Windows and the new --with-zlib-include
   3742      --with-zlib-lib options to Configure can be used to supply the location
   3743      of the headers and library. Gracefully handle case where zlib library
   3744      can't be loaded.
   3745      [Steve Henson]
   3746 
   3747   *) Several fixes and enhancements to the OID generation code. The old code
   3748      sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
   3749      handle numbers larger than ULONG_MAX, truncated printing and had a
   3750      non standard OBJ_obj2txt() behaviour.
   3751      [Steve Henson]
   3752 
   3753   *) Add support for building of engines under engine/ as shared libraries
   3754      under VC++ build system.
   3755      [Steve Henson]
   3756 
   3757   *) Corrected the numerous bugs in the Win32 path splitter in DSO.
   3758      Hopefully, we will not see any false combination of paths any more.
   3759      [Richard Levitte]
   3760 
   3761  Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
   3762 
   3763   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   3764      (part of SSL_OP_ALL).  This option used to disable the
   3765      countermeasure against man-in-the-middle protocol-version
   3766      rollback in the SSL 2.0 server implementation, which is a bad
   3767      idea.  (CVE-2005-2969)
   3768 
   3769      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   3770      for Information Security, National Institute of Advanced Industrial
   3771      Science and Technology [AIST], Japan)]
   3772 
   3773   *) Add two function to clear and return the verify parameter flags.
   3774      [Steve Henson]
   3775 
   3776   *) Keep cipherlists sorted in the source instead of sorting them at
   3777      runtime, thus removing the need for a lock.
   3778      [Nils Larsch]
   3779 
   3780   *) Avoid some small subgroup attacks in Diffie-Hellman.
   3781      [Nick Mathewson and Ben Laurie]
   3782 
   3783   *) Add functions for well-known primes.
   3784      [Nick Mathewson]
   3785 
   3786   *) Extended Windows CE support.
   3787      [Satoshi Nakamura and Andy Polyakov]
   3788 
   3789   *) Initialize SSL_METHOD structures at compile time instead of during
   3790      runtime, thus removing the need for a lock.
   3791      [Steve Henson]
   3792 
   3793   *) Make PKCS7_decrypt() work even if no certificate is supplied by
   3794      attempting to decrypt each encrypted key in turn. Add support to
   3795      smime utility.
   3796      [Steve Henson]
   3797 
   3798  Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
   3799 
   3800   [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
   3801   OpenSSL 0.9.8.]
   3802 
   3803   *) Add libcrypto.pc and libssl.pc for those who feel they need them.
   3804      [Richard Levitte]
   3805 
   3806   *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
   3807      key into the same file any more.
   3808      [Richard Levitte]
   3809 
   3810   *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
   3811      [Andy Polyakov]
   3812 
   3813   *) Add -utf8 command line and config file option to 'ca'.
   3814      [Stefan <stf (a] udoma.org]
   3815 
   3816   *) Removed the macro des_crypt(), as it seems to conflict with some
   3817      libraries.  Use DES_crypt().
   3818      [Richard Levitte]
   3819 
   3820   *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
   3821      involves renaming the source and generated shared-libs for
   3822      both. The engines will accept the corrected or legacy ids
   3823      ('ncipher' and '4758_cca' respectively) when binding. NB,
   3824      this only applies when building 'shared'.
   3825      [Corinna Vinschen <vinschen (a] redhat.com> and Geoff Thorpe]
   3826 
   3827   *) Add attribute functions to EVP_PKEY structure. Modify
   3828      PKCS12_create() to recognize a CSP name attribute and
   3829      use it. Make -CSP option work again in pkcs12 utility.
   3830      [Steve Henson]
   3831 
   3832   *) Add new functionality to the bn blinding code:
   3833      - automatic re-creation of the BN_BLINDING parameters after
   3834        a fixed number of uses (currently 32)
   3835      - add new function for parameter creation
   3836      - introduce flags to control the update behaviour of the
   3837        BN_BLINDING parameters
   3838      - hide BN_BLINDING structure
   3839      Add a second BN_BLINDING slot to the RSA structure to improve
   3840      performance when a single RSA object is shared among several
   3841      threads.
   3842      [Nils Larsch]
   3843 
   3844   *) Add support for DTLS.
   3845      [Nagendra Modadugu <nagendra (a] cs.stanford.edu> and Ben Laurie]
   3846 
   3847   *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
   3848      to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
   3849      [Walter Goulet]
   3850 
   3851   *) Remove buggy and incompletet DH cert support from
   3852      ssl/ssl_rsa.c and ssl/s3_both.c
   3853      [Nils Larsch]
   3854 
   3855   *) Use SHA-1 instead of MD5 as the default digest algorithm for
   3856      the apps/openssl applications.
   3857      [Nils Larsch]
   3858 
   3859   *) Compile clean with "-Wall -Wmissing-prototypes
   3860      -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
   3861      DEBUG_SAFESTACK must also be set.
   3862      [Ben Laurie]
   3863 
   3864   *) Change ./Configure so that certain algorithms can be disabled by default.
   3865      The new counterpiece to "no-xxx" is "enable-xxx".
   3866 
   3867      The patented RC5 and MDC2 algorithms will now be disabled unless
   3868      "enable-rc5" and "enable-mdc2", respectively, are specified.
   3869 
   3870      (IDEA remains enabled despite being patented.  This is because IDEA
   3871      is frequently required for interoperability, and there is no license
   3872      fee for non-commercial use.  As before, "no-idea" can be used to
   3873      avoid this algorithm.)
   3874 
   3875      [Bodo Moeller]
   3876 
   3877   *) Add processing of proxy certificates (see RFC 3820).  This work was
   3878      sponsored by KTH (The Royal Institute of Technology in Stockholm) and
   3879      EGEE (Enabling Grids for E-science in Europe).
   3880      [Richard Levitte]
   3881 
   3882   *) RC4 performance overhaul on modern architectures/implementations, such
   3883      as Intel P4, IA-64 and AMD64.
   3884      [Andy Polyakov]
   3885 
   3886   *) New utility extract-section.pl. This can be used specify an alternative
   3887      section number in a pod file instead of having to treat each file as
   3888      a separate case in Makefile. This can be done by adding two lines to the
   3889      pod file:
   3890 
   3891      =for comment openssl_section:XXX
   3892 
   3893      The blank line is mandatory.
   3894 
   3895      [Steve Henson]
   3896 
   3897   *) New arguments -certform, -keyform and -pass for s_client and s_server
   3898      to allow alternative format key and certificate files and passphrase
   3899      sources.
   3900      [Steve Henson]
   3901 
   3902   *) New structure X509_VERIFY_PARAM which combines current verify parameters,
   3903      update associated structures and add various utility functions.
   3904 
   3905      Add new policy related verify parameters, include policy checking in 
   3906      standard verify code. Enhance 'smime' application with extra parameters
   3907      to support policy checking and print out.
   3908      [Steve Henson]
   3909 
   3910   *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
   3911      Nehemiah processors. These extensions support AES encryption in hardware
   3912      as well as RNG (though RNG support is currently disabled).
   3913      [Michal Ludvig <michal (a] logix.cz>, with help from Andy Polyakov]
   3914 
   3915   *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
   3916      [Geoff Thorpe]
   3917 
   3918   *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
   3919      [Andy Polyakov and a number of other people]
   3920 
   3921   *) Improved PowerPC platform support. Most notably BIGNUM assembler
   3922      implementation contributed by IBM.
   3923      [Suresh Chari, Peter Waltenberg, Andy Polyakov]
   3924 
   3925   *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
   3926      exponent rather than 'unsigned long'. There is a corresponding change to
   3927      the new 'rsa_keygen' element of the RSA_METHOD structure.
   3928      [Jelte Jansen, Geoff Thorpe]
   3929 
   3930   *) Functionality for creating the initial serial number file is now
   3931      moved from CA.pl to the 'ca' utility with a new option -create_serial.
   3932 
   3933      (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
   3934      number file to 1, which is bound to cause problems.  To avoid
   3935      the problems while respecting compatibility between different 0.9.7
   3936      patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
   3937      CA.pl for serial number initialization.  With the new release 0.9.8,
   3938      we can fix the problem directly in the 'ca' utility.)
   3939      [Steve Henson]
   3940 
   3941   *) Reduced header interdepencies by declaring more opaque objects in
   3942      ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
   3943      give fewer recursive includes, which could break lazy source code - so
   3944      this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
   3945      developers should define this symbol when building and using openssl to
   3946      ensure they track the recommended behaviour, interfaces, [etc], but
   3947      backwards-compatible behaviour prevails when this isn't defined.
   3948      [Geoff Thorpe]
   3949 
   3950   *) New function X509_POLICY_NODE_print() which prints out policy nodes.
   3951      [Steve Henson]
   3952 
   3953   *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
   3954      This will generate a random key of the appropriate length based on the 
   3955      cipher context. The EVP_CIPHER can provide its own random key generation
   3956      routine to support keys of a specific form. This is used in the des and 
   3957      3des routines to generate a key of the correct parity. Update S/MIME
   3958      code to use new functions and hence generate correct parity DES keys.
   3959      Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
   3960      valid (weak or incorrect parity).
   3961      [Steve Henson]
   3962 
   3963   *) Add a local set of CRLs that can be used by X509_verify_cert() as well
   3964      as looking them up. This is useful when the verified structure may contain
   3965      CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
   3966      present unless the new PKCS7_NO_CRL flag is asserted.
   3967      [Steve Henson]
   3968 
   3969   *) Extend ASN1 oid configuration module. It now additionally accepts the
   3970      syntax:
   3971 
   3972      shortName = some long name, 1.2.3.4
   3973      [Steve Henson]
   3974 
   3975   *) Reimplemented the BN_CTX implementation. There is now no more static
   3976      limitation on the number of variables it can handle nor the depth of the
   3977      "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
   3978      information can now expand as required, and rather than having a single
   3979      static array of bignums, BN_CTX now uses a linked-list of such arrays
   3980      allowing it to expand on demand whilst maintaining the usefulness of
   3981      BN_CTX's "bundling".
   3982      [Geoff Thorpe]
   3983 
   3984   *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
   3985      to allow all RSA operations to function using a single BN_CTX.
   3986      [Geoff Thorpe]
   3987 
   3988   *) Preliminary support for certificate policy evaluation and checking. This
   3989      is initially intended to pass the tests outlined in "Conformance Testing
   3990      of Relying Party Client Certificate Path Processing Logic" v1.07.
   3991      [Steve Henson]
   3992 
   3993   *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
   3994      remained unused and not that useful. A variety of other little bignum
   3995      tweaks and fixes have also been made continuing on from the audit (see
   3996      below).
   3997      [Geoff Thorpe]
   3998 
   3999   *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
   4000      associated ASN1, EVP and SSL functions and old ASN1 macros.
   4001      [Richard Levitte]
   4002 
   4003   *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
   4004      and this should never fail. So the return value from the use of
   4005      BN_set_word() (which can fail due to needless expansion) is now deprecated;
   4006      if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
   4007      [Geoff Thorpe]
   4008 
   4009   *) BN_CTX_get() should return zero-valued bignums, providing the same
   4010      initialised value as BN_new().
   4011      [Geoff Thorpe, suggested by Ulf Mller]
   4012 
   4013   *) Support for inhibitAnyPolicy certificate extension.
   4014      [Steve Henson]
   4015 
   4016   *) An audit of the BIGNUM code is underway, for which debugging code is
   4017      enabled when BN_DEBUG is defined. This makes stricter enforcements on what
   4018      is considered valid when processing BIGNUMs, and causes execution to
   4019      assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
   4020      further steps are taken to deliberately pollute unused data in BIGNUM
   4021      structures to try and expose faulty code further on. For now, openssl will
   4022      (in its default mode of operation) continue to tolerate the inconsistent
   4023      forms that it has tolerated in the past, but authors and packagers should
   4024      consider trying openssl and their own applications when compiled with
   4025      these debugging symbols defined. It will help highlight potential bugs in
   4026      their own code, and will improve the test coverage for OpenSSL itself. At
   4027      some point, these tighter rules will become openssl's default to improve
   4028      maintainability, though the assert()s and other overheads will remain only
   4029      in debugging configurations. See bn.h for more details.
   4030      [Geoff Thorpe, Nils Larsch, Ulf Mller]
   4031 
   4032   *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
   4033      that can only be obtained through BN_CTX_new() (which implicitly
   4034      initialises it). The presence of this function only made it possible
   4035      to overwrite an existing structure (and cause memory leaks).
   4036      [Geoff Thorpe]
   4037 
   4038   *) Because of the callback-based approach for implementing LHASH as a
   4039      template type, lh_insert() adds opaque objects to hash-tables and
   4040      lh_doall() or lh_doall_arg() are typically used with a destructor callback
   4041      to clean up those corresponding objects before destroying the hash table
   4042      (and losing the object pointers). So some over-zealous constifications in
   4043      LHASH have been relaxed so that lh_insert() does not take (nor store) the
   4044      objects as "const" and the lh_doall[_arg] callback wrappers are not
   4045      prototyped to have "const" restrictions on the object pointers they are
   4046      given (and so aren't required to cast them away any more).
   4047      [Geoff Thorpe]
   4048 
   4049   *) The tmdiff.h API was so ugly and minimal that our own timing utility
   4050      (speed) prefers to use its own implementation. The two implementations
   4051      haven't been consolidated as yet (volunteers?) but the tmdiff API has had
   4052      its object type properly exposed (MS_TM) instead of casting to/from "char
   4053      *". This may still change yet if someone realises MS_TM and "ms_time_***"
   4054      aren't necessarily the greatest nomenclatures - but this is what was used
   4055      internally to the implementation so I've used that for now.
   4056      [Geoff Thorpe]
   4057 
   4058   *) Ensure that deprecated functions do not get compiled when
   4059      OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
   4060      the self-tests were still using deprecated key-generation functions so
   4061      these have been updated also.
   4062      [Geoff Thorpe]
   4063 
   4064   *) Reorganise PKCS#7 code to separate the digest location functionality
   4065      into PKCS7_find_digest(), digest addtion into PKCS7_bio_add_digest().
   4066      New function PKCS7_set_digest() to set the digest type for PKCS#7
   4067      digestedData type. Add additional code to correctly generate the
   4068      digestedData type and add support for this type in PKCS7 initialization
   4069      functions.
   4070      [Steve Henson]
   4071 
   4072   *) New function PKCS7_set0_type_other() this initializes a PKCS7 
   4073      structure of type "other".
   4074      [Steve Henson]
   4075 
   4076   *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
   4077      sure the loop does correctly stop and breaking ("division by zero")
   4078      modulus operations are not performed. The (pre-generated) prime
   4079      table crypto/bn/bn_prime.h was already correct, but it could not be
   4080      re-generated on some platforms because of the "division by zero"
   4081      situation in the script.
   4082      [Ralf S. Engelschall]
   4083 
   4084   *) Update support for ECC-based TLS ciphersuites according to
   4085      draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
   4086      SHA-1 now is only used for "small" curves (where the
   4087      representation of a field element takes up to 24 bytes); for
   4088      larger curves, the field element resulting from ECDH is directly
   4089      used as premaster secret.
   4090      [Douglas Stebila (Sun Microsystems Laboratories)]
   4091 
   4092   *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
   4093      curve secp160r1 to the tests.
   4094      [Douglas Stebila (Sun Microsystems Laboratories)]
   4095 
   4096   *) Add the possibility to load symbols globally with DSO.
   4097      [Gtz Babin-Ebell <babin-ebell (a] trustcenter.de> via Richard Levitte]
   4098 
   4099   *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
   4100      control of the error stack.
   4101      [Richard Levitte]
   4102 
   4103   *) Add support for STORE in ENGINE.
   4104      [Richard Levitte]
   4105 
   4106   *) Add the STORE type.  The intention is to provide a common interface
   4107      to certificate and key stores, be they simple file-based stores, or
   4108      HSM-type store, or LDAP stores, or...
   4109      NOTE: The code is currently UNTESTED and isn't really used anywhere.
   4110      [Richard Levitte]
   4111 
   4112   *) Add a generic structure called OPENSSL_ITEM.  This can be used to
   4113      pass a list of arguments to any function as well as provide a way
   4114      for a function to pass data back to the caller.
   4115      [Richard Levitte]
   4116 
   4117   *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
   4118      works like BUF_strdup() but can be used to duplicate a portion of
   4119      a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
   4120      a memory area.
   4121      [Richard Levitte]
   4122 
   4123   *) Add the function sk_find_ex() which works like sk_find(), but will
   4124      return an index to an element even if an exact match couldn't be
   4125      found.  The index is guaranteed to point at the element where the
   4126      searched-for key would be inserted to preserve sorting order.
   4127      [Richard Levitte]
   4128 
   4129   *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
   4130      takes an extra flags argument for optional functionality.  Currently,
   4131      the following flags are defined:
   4132 
   4133 	OBJ_BSEARCH_VALUE_ON_NOMATCH
   4134 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   4135 	element where the comparing function returns a negative or zero
   4136 	number.
   4137 
   4138 	OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
   4139 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   4140 	element where the comparing function returns zero.  This is useful
   4141 	if there are more than one element where the comparing function
   4142 	returns zero.
   4143      [Richard Levitte]
   4144 
   4145   *) Make it possible to create self-signed certificates with 'openssl ca'
   4146      in such a way that the self-signed certificate becomes part of the
   4147      CA database and uses the same mechanisms for serial number generation
   4148      as all other certificate signing.  The new flag '-selfsign' enables
   4149      this functionality.  Adapt CA.sh and CA.pl.in.
   4150      [Richard Levitte]
   4151 
   4152   *) Add functionality to check the public key of a certificate request
   4153      against a given private.  This is useful to check that a certificate
   4154      request can be signed by that key (self-signing).
   4155      [Richard Levitte]
   4156 
   4157   *) Make it possible to have multiple active certificates with the same
   4158      subject in the CA index file.  This is done only if the keyword
   4159      'unique_subject' is set to 'no' in the main CA section (default
   4160      if 'CA_default') of the configuration file.  The value is saved
   4161      with the database itself in a separate index attribute file,
   4162      named like the index file with '.attr' appended to the name.
   4163      [Richard Levitte]
   4164 
   4165   *) Generate muti valued AVAs using '+' notation in config files for
   4166      req and dirName.
   4167      [Steve Henson]
   4168 
   4169   *) Support for nameConstraints certificate extension.
   4170      [Steve Henson]
   4171 
   4172   *) Support for policyConstraints certificate extension.
   4173      [Steve Henson]
   4174 
   4175   *) Support for policyMappings certificate extension.
   4176      [Steve Henson]
   4177 
   4178   *) Make sure the default DSA_METHOD implementation only uses its
   4179      dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
   4180      and change its own handlers to be NULL so as to remove unnecessary
   4181      indirection. This lets alternative implementations fallback to the
   4182      default implementation more easily.
   4183      [Geoff Thorpe]
   4184 
   4185   *) Support for directoryName in GeneralName related extensions
   4186      in config files.
   4187      [Steve Henson]
   4188 
   4189   *) Make it possible to link applications using Makefile.shared.
   4190      Make that possible even when linking against static libraries!
   4191      [Richard Levitte]
   4192 
   4193   *) Support for single pass processing for S/MIME signing. This now
   4194      means that S/MIME signing can be done from a pipe, in addition
   4195      cleartext signing (multipart/signed type) is effectively streaming
   4196      and the signed data does not need to be all held in memory.
   4197 
   4198      This is done with a new flag PKCS7_STREAM. When this flag is set
   4199      PKCS7_sign() only initializes the PKCS7 structure and the actual signing
   4200      is done after the data is output (and digests calculated) in
   4201      SMIME_write_PKCS7().
   4202      [Steve Henson]
   4203 
   4204   *) Add full support for -rpath/-R, both in shared libraries and
   4205      applications, at least on the platforms where it's known how
   4206      to do it.
   4207      [Richard Levitte]
   4208 
   4209   *) In crypto/ec/ec_mult.c, implement fast point multiplication with
   4210      precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
   4211      will now compute a table of multiples of the generator that
   4212      makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
   4213      faster (notably in the case of a single point multiplication,
   4214      scalar * generator).
   4215      [Nils Larsch, Bodo Moeller]
   4216 
   4217   *) IPv6 support for certificate extensions. The various extensions
   4218      which use the IP:a.b.c.d can now take IPv6 addresses using the
   4219      formats of RFC1884 2.2 . IPv6 addresses are now also displayed
   4220      correctly.
   4221      [Steve Henson]
   4222 
   4223   *) Added an ENGINE that implements RSA by performing private key
   4224      exponentiations with the GMP library. The conversions to and from
   4225      GMP's mpz_t format aren't optimised nor are any montgomery forms
   4226      cached, and on x86 it appears OpenSSL's own performance has caught up.
   4227      However there are likely to be other architectures where GMP could
   4228      provide a boost. This ENGINE is not built in by default, but it can be
   4229      specified at Configure time and should be accompanied by the necessary
   4230      linker additions, eg;
   4231          ./config -DOPENSSL_USE_GMP -lgmp
   4232      [Geoff Thorpe]
   4233 
   4234   *) "openssl engine" will not display ENGINE/DSO load failure errors when
   4235      testing availability of engines with "-t" - the old behaviour is
   4236      produced by increasing the feature's verbosity with "-tt".
   4237      [Geoff Thorpe]
   4238 
   4239   *) ECDSA routines: under certain error conditions uninitialized BN objects
   4240      could be freed. Solution: make sure initialization is performed early
   4241      enough. (Reported and fix supplied by Nils Larsch <nla (a] trustcenter.de>
   4242      via PR#459)
   4243      [Lutz Jaenicke]
   4244 
   4245   *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
   4246      and DH_METHOD (eg. by ENGINE implementations) to override the normal
   4247      software implementations. For DSA and DH, parameter generation can
   4248      also be overriden by providing the appropriate method callbacks.
   4249      [Geoff Thorpe]
   4250 
   4251   *) Change the "progress" mechanism used in key-generation and
   4252      primality testing to functions that take a new BN_GENCB pointer in
   4253      place of callback/argument pairs. The new API functions have "_ex"
   4254      postfixes and the older functions are reimplemented as wrappers for
   4255      the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
   4256      declarations of the old functions to help (graceful) attempts to
   4257      migrate to the new functions. Also, the new key-generation API
   4258      functions operate on a caller-supplied key-structure and return
   4259      success/failure rather than returning a key or NULL - this is to
   4260      help make "keygen" another member function of RSA_METHOD etc.
   4261 
   4262      Example for using the new callback interface:
   4263 
   4264           int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
   4265           void *my_arg = ...;
   4266           BN_GENCB my_cb;
   4267 
   4268           BN_GENCB_set(&my_cb, my_callback, my_arg);
   4269 
   4270           return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
   4271           /* For the meaning of a, b in calls to my_callback(), see the
   4272            * documentation of the function that calls the callback.
   4273            * cb will point to my_cb; my_arg can be retrieved as cb->arg.
   4274            * my_callback should return 1 if it wants BN_is_prime_ex()
   4275            * to continue, or 0 to stop.
   4276            */
   4277 
   4278      [Geoff Thorpe]
   4279 
   4280   *) Change the ZLIB compression method to be stateful, and make it
   4281      available to TLS with the number defined in 
   4282      draft-ietf-tls-compression-04.txt.
   4283      [Richard Levitte]
   4284 
   4285   *) Add the ASN.1 structures and functions for CertificatePair, which
   4286      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
   4287 
   4288      CertificatePair ::= SEQUENCE {
   4289         forward		[0]	Certificate OPTIONAL,
   4290         reverse		[1]	Certificate OPTIONAL,
   4291         -- at least one of the pair shall be present -- }
   4292 
   4293      Also implement the PEM functions to read and write certificate
   4294      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
   4295 
   4296      This needed to be defined, mostly for the sake of the LDAP
   4297      attribute crossCertificatePair, but may prove useful elsewhere as
   4298      well.
   4299      [Richard Levitte]
   4300 
   4301   *) Make it possible to inhibit symlinking of shared libraries in
   4302      Makefile.shared, for Cygwin's sake.
   4303      [Richard Levitte]
   4304 
   4305   *) Extend the BIGNUM API by creating a function 
   4306           void BN_set_negative(BIGNUM *a, int neg);
   4307      and a macro that behave like
   4308           int  BN_is_negative(const BIGNUM *a);
   4309 
   4310      to avoid the need to access 'a->neg' directly in applications.
   4311      [Nils Larsch]
   4312 
   4313   *) Implement fast modular reduction for pseudo-Mersenne primes
   4314      used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
   4315      EC_GROUP_new_curve_GFp() will now automatically use this
   4316      if applicable.
   4317      [Nils Larsch <nla (a] trustcenter.de>]
   4318 
   4319   *) Add new lock type (CRYPTO_LOCK_BN).
   4320      [Bodo Moeller]
   4321 
   4322   *) Change the ENGINE framework to automatically load engines
   4323      dynamically from specific directories unless they could be
   4324      found to already be built in or loaded.  Move all the
   4325      current engines except for the cryptodev one to a new
   4326      directory engines/.
   4327      The engines in engines/ are built as shared libraries if
   4328      the "shared" options was given to ./Configure or ./config.
   4329      Otherwise, they are inserted in libcrypto.a.
   4330      /usr/local/ssl/engines is the default directory for dynamic
   4331      engines, but that can be overriden at configure time through
   4332      the usual use of --prefix and/or --openssldir, and at run
   4333      time with the environment variable OPENSSL_ENGINES.
   4334      [Geoff Thorpe and Richard Levitte]
   4335 
   4336   *) Add Makefile.shared, a helper makefile to build shared
   4337      libraries.  Addapt Makefile.org.
   4338      [Richard Levitte]
   4339 
   4340   *) Add version info to Win32 DLLs.
   4341      [Peter 'Luna' Runestig" <peter (a] runestig.com>]
   4342 
   4343   *) Add new 'medium level' PKCS#12 API. Certificates and keys
   4344      can be added using this API to created arbitrary PKCS#12
   4345      files while avoiding the low level API.
   4346 
   4347      New options to PKCS12_create(), key or cert can be NULL and
   4348      will then be omitted from the output file. The encryption
   4349      algorithm NIDs can be set to -1 for no encryption, the mac
   4350      iteration count can be set to 0 to omit the mac.
   4351 
   4352      Enhance pkcs12 utility by making the -nokeys and -nocerts
   4353      options work when creating a PKCS#12 file. New option -nomac
   4354      to omit the mac, NONE can be set for an encryption algorithm.
   4355      New code is modified to use the enhanced PKCS12_create()
   4356      instead of the low level API.
   4357      [Steve Henson]
   4358 
   4359   *) Extend ASN1 encoder to support indefinite length constructed
   4360      encoding. This can output sequences tags and octet strings in
   4361      this form. Modify pk7_asn1.c to support indefinite length
   4362      encoding. This is experimental and needs additional code to
   4363      be useful, such as an ASN1 bio and some enhanced streaming
   4364      PKCS#7 code.
   4365 
   4366      Extend template encode functionality so that tagging is passed
   4367      down to the template encoder.
   4368      [Steve Henson]
   4369 
   4370   *) Let 'openssl req' fail if an argument to '-newkey' is not
   4371      recognized instead of using RSA as a default.
   4372      [Bodo Moeller]
   4373 
   4374   *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
   4375      As these are not official, they are not included in "ALL";
   4376      the "ECCdraft" ciphersuite group alias can be used to select them.
   4377      [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
   4378 
   4379   *) Add ECDH engine support.
   4380      [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
   4381 
   4382   *) Add ECDH in new directory crypto/ecdh/.
   4383      [Douglas Stebila (Sun Microsystems Laboratories)]
   4384 
   4385   *) Let BN_rand_range() abort with an error after 100 iterations
   4386      without success (which indicates a broken PRNG).
   4387      [Bodo Moeller]
   4388 
   4389   *) Change BN_mod_sqrt() so that it verifies that the input value
   4390      is really the square of the return value.  (Previously,
   4391      BN_mod_sqrt would show GIGO behaviour.)
   4392      [Bodo Moeller]
   4393 
   4394   *) Add named elliptic curves over binary fields from X9.62, SECG,
   4395      and WAP/WTLS; add OIDs that were still missing.
   4396 
   4397      [Sheueling Chang Shantz and Douglas Stebila
   4398      (Sun Microsystems Laboratories)]
   4399 
   4400   *) Extend the EC library for elliptic curves over binary fields
   4401      (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
   4402      New EC_METHOD:
   4403 
   4404           EC_GF2m_simple_method
   4405 
   4406      New API functions:
   4407 
   4408           EC_GROUP_new_curve_GF2m
   4409           EC_GROUP_set_curve_GF2m
   4410           EC_GROUP_get_curve_GF2m
   4411           EC_POINT_set_affine_coordinates_GF2m
   4412           EC_POINT_get_affine_coordinates_GF2m
   4413           EC_POINT_set_compressed_coordinates_GF2m
   4414 
   4415      Point compression for binary fields is disabled by default for
   4416      patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
   4417      enable it).
   4418 
   4419      As binary polynomials are represented as BIGNUMs, various members
   4420      of the EC_GROUP and EC_POINT data structures can be shared
   4421      between the implementations for prime fields and binary fields;
   4422      the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
   4423      are essentially identical to their ..._GFp counterparts.
   4424      (For simplicity, the '..._GFp' prefix has been dropped from
   4425      various internal method names.)
   4426 
   4427      An internal 'field_div' method (similar to 'field_mul' and
   4428      'field_sqr') has been added; this is used only for binary fields.
   4429 
   4430      [Sheueling Chang Shantz and Douglas Stebila
   4431      (Sun Microsystems Laboratories)]
   4432 
   4433   *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
   4434      through methods ('mul', 'precompute_mult').
   4435 
   4436      The generic implementations (now internally called 'ec_wNAF_mul'
   4437      and 'ec_wNAF_precomputed_mult') remain the default if these
   4438      methods are undefined.
   4439 
   4440      [Sheueling Chang Shantz and Douglas Stebila
   4441      (Sun Microsystems Laboratories)]
   4442 
   4443   *) New function EC_GROUP_get_degree, which is defined through
   4444      EC_METHOD.  For curves over prime fields, this returns the bit
   4445      length of the modulus.
   4446 
   4447      [Sheueling Chang Shantz and Douglas Stebila
   4448      (Sun Microsystems Laboratories)]
   4449 
   4450   *) New functions EC_GROUP_dup, EC_POINT_dup.
   4451      (These simply call ..._new  and ..._copy).
   4452 
   4453      [Sheueling Chang Shantz and Douglas Stebila
   4454      (Sun Microsystems Laboratories)]
   4455 
   4456   *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
   4457      Polynomials are represented as BIGNUMs (where the sign bit is not
   4458      used) in the following functions [macros]:  
   4459 
   4460           BN_GF2m_add
   4461           BN_GF2m_sub             [= BN_GF2m_add]
   4462           BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
   4463           BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
   4464           BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
   4465           BN_GF2m_mod_inv
   4466           BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
   4467           BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
   4468           BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
   4469           BN_GF2m_cmp             [= BN_ucmp]
   4470 
   4471      (Note that only the 'mod' functions are actually for fields GF(2^m).
   4472      BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
   4473 
   4474      For some functions, an the irreducible polynomial defining a
   4475      field can be given as an 'unsigned int[]' with strictly
   4476      decreasing elements giving the indices of those bits that are set;
   4477      i.e., p[] represents the polynomial
   4478           f(t) = t^p[0] + t^p[1] + ... + t^p[k]
   4479      where
   4480           p[0] > p[1] > ... > p[k] = 0.
   4481      This applies to the following functions:
   4482 
   4483           BN_GF2m_mod_arr
   4484           BN_GF2m_mod_mul_arr
   4485           BN_GF2m_mod_sqr_arr
   4486           BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
   4487           BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
   4488           BN_GF2m_mod_exp_arr
   4489           BN_GF2m_mod_sqrt_arr
   4490           BN_GF2m_mod_solve_quad_arr
   4491           BN_GF2m_poly2arr
   4492           BN_GF2m_arr2poly
   4493 
   4494      Conversion can be performed by the following functions:
   4495 
   4496           BN_GF2m_poly2arr
   4497           BN_GF2m_arr2poly
   4498 
   4499      bntest.c has additional tests for binary polynomial arithmetic.
   4500 
   4501      Two implementations for BN_GF2m_mod_div() are available.
   4502      The default algorithm simply uses BN_GF2m_mod_inv() and
   4503      BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
   4504      if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
   4505      copyright notice in crypto/bn/bn_gf2m.c before enabling it).
   4506 
   4507      [Sheueling Chang Shantz and Douglas Stebila
   4508      (Sun Microsystems Laboratories)]
   4509 
   4510   *) Add new error code 'ERR_R_DISABLED' that can be used when some
   4511      functionality is disabled at compile-time.
   4512      [Douglas Stebila <douglas.stebila (a] sun.com>]
   4513 
   4514   *) Change default behaviour of 'openssl asn1parse' so that more
   4515      information is visible when viewing, e.g., a certificate:
   4516 
   4517      Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
   4518      mode the content of non-printable OCTET STRINGs is output in a
   4519      style similar to INTEGERs, but with '[HEX DUMP]' prepended to
   4520      avoid the appearance of a printable string.
   4521      [Nils Larsch <nla (a] trustcenter.de>]
   4522 
   4523   *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
   4524      functions
   4525           EC_GROUP_set_asn1_flag()
   4526           EC_GROUP_get_asn1_flag()
   4527           EC_GROUP_set_point_conversion_form()
   4528           EC_GROUP_get_point_conversion_form()
   4529      These control ASN1 encoding details:
   4530      - Curves (i.e., groups) are encoded explicitly unless asn1_flag
   4531        has been set to OPENSSL_EC_NAMED_CURVE.
   4532      - Points are encoded in uncompressed form by default; options for
   4533        asn1_for are as for point2oct, namely
   4534           POINT_CONVERSION_COMPRESSED
   4535           POINT_CONVERSION_UNCOMPRESSED
   4536           POINT_CONVERSION_HYBRID
   4537 
   4538      Also add 'seed' and 'seed_len' members to EC_GROUP with access
   4539      functions
   4540           EC_GROUP_set_seed()
   4541           EC_GROUP_get0_seed()
   4542           EC_GROUP_get_seed_len()
   4543      This is used only for ASN1 purposes (so far).
   4544      [Nils Larsch <nla (a] trustcenter.de>]
   4545 
   4546   *) Add 'field_type' member to EC_METHOD, which holds the NID
   4547      of the appropriate field type OID.  The new function
   4548      EC_METHOD_get_field_type() returns this value.
   4549      [Nils Larsch <nla (a] trustcenter.de>]
   4550 
   4551   *) Add functions 
   4552           EC_POINT_point2bn()
   4553           EC_POINT_bn2point()
   4554           EC_POINT_point2hex()
   4555           EC_POINT_hex2point()
   4556      providing useful interfaces to EC_POINT_point2oct() and
   4557      EC_POINT_oct2point().
   4558      [Nils Larsch <nla (a] trustcenter.de>]
   4559 
   4560   *) Change internals of the EC library so that the functions
   4561           EC_GROUP_set_generator()
   4562           EC_GROUP_get_generator()
   4563           EC_GROUP_get_order()
   4564           EC_GROUP_get_cofactor()
   4565      are implemented directly in crypto/ec/ec_lib.c and not dispatched
   4566      to methods, which would lead to unnecessary code duplication when
   4567      adding different types of curves.
   4568      [Nils Larsch <nla (a] trustcenter.de> with input by Bodo Moeller]
   4569 
   4570   *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
   4571      arithmetic, and such that modified wNAFs are generated
   4572      (which avoid length expansion in many cases).
   4573      [Bodo Moeller]
   4574 
   4575   *) Add a function EC_GROUP_check_discriminant() (defined via
   4576      EC_METHOD) that verifies that the curve discriminant is non-zero.
   4577 
   4578      Add a function EC_GROUP_check() that makes some sanity tests
   4579      on a EC_GROUP, its generator and order.  This includes
   4580      EC_GROUP_check_discriminant().
   4581      [Nils Larsch <nla (a] trustcenter.de>]
   4582 
   4583   *) Add ECDSA in new directory crypto/ecdsa/.
   4584 
   4585      Add applications 'openssl ecparam' and 'openssl ecdsa'
   4586      (these are based on 'openssl dsaparam' and 'openssl dsa').
   4587 
   4588      ECDSA support is also included in various other files across the
   4589      library.  Most notably,
   4590      - 'openssl req' now has a '-newkey ecdsa:file' option;
   4591      - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
   4592      - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
   4593        d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
   4594        them suitable for ECDSA where domain parameters must be
   4595        extracted before the specific public key;
   4596      - ECDSA engine support has been added.
   4597      [Nils Larsch <nla (a] trustcenter.de>]
   4598 
   4599   *) Include some named elliptic curves, and add OIDs from X9.62,
   4600      SECG, and WAP/WTLS.  Each curve can be obtained from the new
   4601      function
   4602           EC_GROUP_new_by_curve_name(),
   4603      and the list of available named curves can be obtained with
   4604           EC_get_builtin_curves().
   4605      Also add a 'curve_name' member to EC_GROUP objects, which can be
   4606      accessed via
   4607          EC_GROUP_set_curve_name()
   4608          EC_GROUP_get_curve_name()
   4609      [Nils Larsch <larsch (a] trustcenter.de, Bodo Moeller]
   4610  
   4611   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   4612      was actually never needed) and in BN_mul().  The removal in BN_mul()
   4613      required a small change in bn_mul_part_recursive() and the addition
   4614      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   4615      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   4616      bn_sub_words() and bn_add_words() except they take arrays with
   4617      differing sizes.
   4618      [Richard Levitte]
   4619 
   4620  Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
   4621 
   4622   *) Cleanse PEM buffers before freeing them since they may contain 
   4623      sensitive data.
   4624      [Benjamin Bennett <ben (a] psc.edu>]
   4625 
   4626   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   4627      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   4628      authentication-only ciphersuites.
   4629      [Bodo Moeller]
   4630 
   4631   *) Since AES128 and AES256 share a single mask bit in the logic of
   4632      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   4633      kludge to work properly if AES128 is available and AES256 isn't.
   4634      [Victor Duchovni]
   4635 
   4636   *) Expand security boundary to match 1.1.1 module.
   4637      [Steve Henson]
   4638 
   4639   *) Remove redundant features: hash file source, editing of test vectors
   4640      modify fipsld to use external fips_premain.c signature.
   4641      [Steve Henson]
   4642 
   4643   *) New perl script mkfipsscr.pl to create shell scripts or batch files to
   4644      run algorithm test programs.
   4645      [Steve Henson]
   4646 
   4647   *) Make algorithm test programs more tolerant of whitespace.
   4648      [Steve Henson]
   4649 
   4650   *) Have SSL/TLS server implementation tolerate "mismatched" record
   4651      protocol version while receiving ClientHello even if the
   4652      ClientHello is fragmented.  (The server can't insist on the
   4653      particular protocol version it has chosen before the ServerHello
   4654      message has informed the client about his choice.)
   4655      [Bodo Moeller]
   4656 
   4657   *) Load error codes if they are not already present instead of using a
   4658      static variable. This allows them to be cleanly unloaded and reloaded.
   4659      [Steve Henson]
   4660 
   4661  Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
   4662 
   4663   *) Introduce limits to prevent malicious keys being able to
   4664      cause a denial of service.  (CVE-2006-2940)
   4665      [Steve Henson, Bodo Moeller]
   4666 
   4667   *) Fix ASN.1 parsing of certain invalid structures that can result
   4668      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   4669 
   4670   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   4671      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   4672 
   4673   *) Fix SSL client code which could crash if connecting to a
   4674      malicious SSLv2 server.  (CVE-2006-4343)
   4675      [Tavis Ormandy and Will Drewry, Google Security Team]
   4676 
   4677   *) Change ciphersuite string processing so that an explicit
   4678      ciphersuite selects this one ciphersuite (so that "AES256-SHA"
   4679      will no longer include "AES128-SHA"), and any other similar
   4680      ciphersuite (same bitmap) from *other* protocol versions (so that
   4681      "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
   4682      SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
   4683      changes from 0.9.8b and 0.9.8d.
   4684      [Bodo Moeller]
   4685 
   4686  Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
   4687 
   4688   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   4689      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   4690 
   4691   *) Change the Unix randomness entropy gathering to use poll() when
   4692      possible instead of select(), since the latter has some
   4693      undesirable limitations.
   4694      [Darryl Miles via Richard Levitte and Bodo Moeller]
   4695 
   4696   *) Disable rogue ciphersuites:
   4697 
   4698       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   4699       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   4700       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   4701 
   4702      The latter two were purportedly from
   4703      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   4704      appear there.
   4705 
   4706      Also deactive the remaining ciphersuites from
   4707      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   4708      unofficial, and the ID has long expired.
   4709      [Bodo Moeller]
   4710 
   4711   *) Fix RSA blinding Heisenbug (problems sometimes occured on
   4712      dual-core machines) and other potential thread-safety issues.
   4713      [Bodo Moeller]
   4714 
   4715  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
   4716 
   4717   *) Adapt fipsld and the build system to link against the validated FIPS
   4718      module in FIPS mode.
   4719      [Steve Henson]
   4720 
   4721   *) Fixes for VC++ 2005 build under Windows.
   4722      [Steve Henson]
   4723 
   4724   *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
   4725      from a Windows bash shell such as MSYS. It is autodetected from the
   4726      "config" script when run from a VC++ environment. Modify standard VC++
   4727      build to use fipscanister.o from the GNU make build. 
   4728      [Steve Henson]
   4729 
   4730  Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
   4731 
   4732   *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
   4733      The value now differs depending on if you build for FIPS or not.
   4734      BEWARE!  A program linked with a shared FIPSed libcrypto can't be
   4735      safely run with a non-FIPSed libcrypto, as it may crash because of
   4736      the difference induced by this change.
   4737      [Andy Polyakov]
   4738 
   4739  Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
   4740 
   4741   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   4742      (part of SSL_OP_ALL).  This option used to disable the
   4743      countermeasure against man-in-the-middle protocol-version
   4744      rollback in the SSL 2.0 server implementation, which is a bad
   4745      idea.  (CVE-2005-2969)
   4746 
   4747      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   4748      for Information Security, National Institute of Advanced Industrial
   4749      Science and Technology [AIST], Japan)]
   4750 
   4751   *) Minimal support for X9.31 signatures and PSS padding modes. This is
   4752      mainly for FIPS compliance and not fully integrated at this stage.
   4753      [Steve Henson]
   4754 
   4755   *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
   4756      the exponentiation using a fixed-length exponent.  (Otherwise,
   4757      the information leaked through timing could expose the secret key
   4758      after many signatures; cf. Bleichenbacher's attack on DSA with
   4759      biased k.)
   4760      [Bodo Moeller]
   4761 
   4762   *) Make a new fixed-window mod_exp implementation the default for
   4763      RSA, DSA, and DH private-key operations so that the sequence of
   4764      squares and multiplies and the memory access pattern are
   4765      independent of the particular secret key.  This will mitigate
   4766      cache-timing and potential related attacks.
   4767 
   4768      BN_mod_exp_mont_consttime() is the new exponentiation implementation,
   4769      and this is automatically used by BN_mod_exp_mont() if the new flag
   4770      BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
   4771      will use this BN flag for private exponents unless the flag
   4772      RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
   4773      DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
   4774 
   4775      [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
   4776 
   4777   *) Change the client implementation for SSLv23_method() and
   4778      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
   4779      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
   4780      (Previously, the SSL 2.0 backwards compatible Client Hello
   4781      message format would be used even with SSL_OP_NO_SSLv2.)
   4782      [Bodo Moeller]
   4783 
   4784   *) Add support for smime-type MIME parameter in S/MIME messages which some
   4785      clients need.
   4786      [Steve Henson]
   4787 
   4788   *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
   4789      a threadsafe manner. Modify rsa code to use new function and add calls
   4790      to dsa and dh code (which had race conditions before).
   4791      [Steve Henson]
   4792 
   4793   *) Include the fixed error library code in the C error file definitions
   4794      instead of fixing them up at runtime. This keeps the error code
   4795      structures constant.
   4796      [Steve Henson]
   4797 
   4798  Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
   4799 
   4800   [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
   4801   OpenSSL 0.9.8.]
   4802 
   4803   *) Fixes for newer kerberos headers. NB: the casts are needed because
   4804      the 'length' field is signed on one version and unsigned on another
   4805      with no (?) obvious way to tell the difference, without these VC++
   4806      complains. Also the "definition" of FAR (blank) is no longer included
   4807      nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
   4808      some needed definitions.
   4809      [Steve Henson]
   4810 
   4811   *) Undo Cygwin change.
   4812      [Ulf Mller]
   4813 
   4814   *) Added support for proxy certificates according to RFC 3820.
   4815      Because they may be a security thread to unaware applications,
   4816      they must be explicitely allowed in run-time.  See
   4817      docs/HOWTO/proxy_certificates.txt for further information.
   4818      [Richard Levitte]
   4819 
   4820  Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
   4821 
   4822   *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
   4823      server and client random values. Previously
   4824      (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
   4825      less random data when sizeof(time_t) > 4 (some 64 bit platforms).
   4826 
   4827      This change has negligible security impact because:
   4828 
   4829      1. Server and client random values still have 24 bytes of pseudo random
   4830         data.
   4831 
   4832      2. Server and client random values are sent in the clear in the initial
   4833         handshake.
   4834 
   4835      3. The master secret is derived using the premaster secret (48 bytes in
   4836         size for static RSA ciphersuites) as well as client server and random
   4837         values.
   4838 
   4839      The OpenSSL team would like to thank the UK NISCC for bringing this issue
   4840      to our attention. 
   4841 
   4842      [Stephen Henson, reported by UK NISCC]
   4843 
   4844   *) Use Windows randomness collection on Cygwin.
   4845      [Ulf Mller]
   4846 
   4847   *) Fix hang in EGD/PRNGD query when communication socket is closed
   4848      prematurely by EGD/PRNGD.
   4849      [Darren Tucker <dtucker (a] zip.com.au> via Lutz Jnicke, resolves #1014]
   4850 
   4851   *) Prompt for pass phrases when appropriate for PKCS12 input format.
   4852      [Steve Henson]
   4853 
   4854   *) Back-port of selected performance improvements from development
   4855      branch, as well as improved support for PowerPC platforms.
   4856      [Andy Polyakov]
   4857 
   4858   *) Add lots of checks for memory allocation failure, error codes to indicate
   4859      failure and freeing up memory if a failure occurs.
   4860      [Nauticus Networks SSL Team <openssl (a] nauticusnet.com>, Steve Henson]
   4861 
   4862   *) Add new -passin argument to dgst.
   4863      [Steve Henson]
   4864 
   4865   *) Perform some character comparisons of different types in X509_NAME_cmp:
   4866      this is needed for some certificates that reencode DNs into UTF8Strings
   4867      (in violation of RFC3280) and can't or wont issue name rollover
   4868      certificates.
   4869      [Steve Henson]
   4870 
   4871   *) Make an explicit check during certificate validation to see that
   4872      the CA setting in each certificate on the chain is correct.  As a
   4873      side effect always do the following basic checks on extensions,
   4874      not just when there's an associated purpose to the check:
   4875 
   4876       - if there is an unhandled critical extension (unless the user
   4877         has chosen to ignore this fault)
   4878       - if the path length has been exceeded (if one is set at all)
   4879       - that certain extensions fit the associated purpose (if one has
   4880         been given)
   4881      [Richard Levitte]
   4882 
   4883  Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
   4884 
   4885   *) Avoid a race condition when CRLs are checked in a multi threaded 
   4886      environment. This would happen due to the reordering of the revoked
   4887      entries during signature checking and serial number lookup. Now the
   4888      encoding is cached and the serial number sort performed under a lock.
   4889      Add new STACK function sk_is_sorted().
   4890      [Steve Henson]
   4891 
   4892   *) Add Delta CRL to the extension code.
   4893      [Steve Henson]
   4894 
   4895   *) Various fixes to s3_pkt.c so alerts are sent properly.
   4896      [David Holmes <d.holmes (a] f5.com>]
   4897 
   4898   *) Reduce the chances of duplicate issuer name and serial numbers (in
   4899      violation of RFC3280) using the OpenSSL certificate creation utilities.
   4900      This is done by creating a random 64 bit value for the initial serial
   4901      number when a serial number file is created or when a self signed
   4902      certificate is created using 'openssl req -x509'. The initial serial
   4903      number file is created using 'openssl x509 -next_serial' in CA.pl
   4904      rather than being initialized to 1.
   4905      [Steve Henson]
   4906 
   4907  Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
   4908 
   4909   *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
   4910      by using the Codenomicon TLS Test Tool (CVE-2004-0079)                    
   4911      [Joe Orton, Steve Henson]   
   4912 
   4913   *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
   4914      (CVE-2004-0112)
   4915      [Joe Orton, Steve Henson]   
   4916 
   4917   *) Make it possible to have multiple active certificates with the same
   4918      subject in the CA index file.  This is done only if the keyword
   4919      'unique_subject' is set to 'no' in the main CA section (default
   4920      if 'CA_default') of the configuration file.  The value is saved
   4921      with the database itself in a separate index attribute file,
   4922      named like the index file with '.attr' appended to the name.
   4923      [Richard Levitte]
   4924 
   4925   *) X509 verify fixes. Disable broken certificate workarounds when 
   4926      X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
   4927      keyUsage extension present. Don't accept CRLs with unhandled critical
   4928      extensions: since verify currently doesn't process CRL extensions this
   4929      rejects a CRL with *any* critical extensions. Add new verify error codes
   4930      for these cases.
   4931      [Steve Henson]
   4932 
   4933   *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
   4934      A clarification of RFC2560 will require the use of OCTET STRINGs and 
   4935      some implementations cannot handle the current raw format. Since OpenSSL
   4936      copies and compares OCSP nonces as opaque blobs without any attempt at
   4937      parsing them this should not create any compatibility issues.
   4938      [Steve Henson]
   4939 
   4940   *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
   4941      calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
   4942      this HMAC (and other) operations are several times slower than OpenSSL
   4943      < 0.9.7.
   4944      [Steve Henson]
   4945 
   4946   *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
   4947      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   4948 
   4949   *) Use the correct content when signing type "other".
   4950      [Steve Henson]
   4951 
   4952  Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
   4953 
   4954   *) Fix various bugs revealed by running the NISCC test suite:
   4955 
   4956      Stop out of bounds reads in the ASN1 code when presented with
   4957      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   4958      
   4959      Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
   4960 
   4961      If verify callback ignores invalid public key errors don't try to check
   4962      certificate signature with the NULL public key.
   4963 
   4964      [Steve Henson]
   4965 
   4966   *) New -ignore_err option in ocsp application to stop the server
   4967      exiting on the first error in a request.
   4968      [Steve Henson]
   4969 
   4970   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   4971      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   4972      specifications.
   4973      [Steve Henson]
   4974 
   4975   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   4976      extra data after the compression methods not only for TLS 1.0
   4977      but also for SSL 3.0 (as required by the specification).
   4978      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   4979 
   4980   *) Change X509_certificate_type() to mark the key as exported/exportable
   4981      when it's 512 *bits* long, not 512 bytes.
   4982      [Richard Levitte]
   4983 
   4984   *) Change AES_cbc_encrypt() so it outputs exact multiple of
   4985      blocks during encryption.
   4986      [Richard Levitte]
   4987 
   4988   *) Various fixes to base64 BIO and non blocking I/O. On write 
   4989      flushes were not handled properly if the BIO retried. On read
   4990      data was not being buffered properly and had various logic bugs.
   4991      This also affects blocking I/O when the data being decoded is a
   4992      certain size.
   4993      [Steve Henson]
   4994 
   4995   *) Various S/MIME bugfixes and compatibility changes:
   4996      output correct application/pkcs7 MIME type if
   4997      PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
   4998      Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
   4999      of files as .eml work). Correctly handle very long lines in MIME
   5000      parser.
   5001      [Steve Henson]
   5002 
   5003  Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
   5004 
   5005   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   5006      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   5007      a protocol version number mismatch like a decryption error
   5008      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   5009      [Bodo Moeller]
   5010 
   5011   *) Turn on RSA blinding by default in the default implementation
   5012      to avoid a timing attack. Applications that don't want it can call
   5013      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   5014      They would be ill-advised to do so in most cases.
   5015      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   5016 
   5017   *) Change RSA blinding code so that it works when the PRNG is not
   5018      seeded (in this case, the secret RSA exponent is abused as
   5019      an unpredictable seed -- if it is not unpredictable, there
   5020      is no point in blinding anyway).  Make RSA blinding thread-safe
   5021      by remembering the creator's thread ID in rsa->blinding and
   5022      having all other threads use local one-time blinding factors
   5023      (this requires more computation than sharing rsa->blinding, but
   5024      avoids excessive locking; and if an RSA object is not shared
   5025      between threads, blinding will still be very fast).
   5026      [Bodo Moeller]
   5027 
   5028   *) Fixed a typo bug that would cause ENGINE_set_default() to set an
   5029      ENGINE as defaults for all supported algorithms irrespective of
   5030      the 'flags' parameter. 'flags' is now honoured, so applications
   5031      should make sure they are passing it correctly.
   5032      [Geoff Thorpe]
   5033 
   5034   *) Target "mingw" now allows native Windows code to be generated in
   5035      the Cygwin environment as well as with the MinGW compiler.
   5036      [Ulf Moeller] 
   5037 
   5038  Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
   5039 
   5040   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   5041      via timing by performing a MAC computation even if incorrrect
   5042      block cipher padding has been found.  This is a countermeasure
   5043      against active attacks where the attacker has to distinguish
   5044      between bad padding and a MAC verification error. (CVE-2003-0078)
   5045 
   5046      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   5047      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   5048      Martin Vuagnoux (EPFL, Ilion)]
   5049 
   5050   *) Make the no-err option work as intended.  The intention with no-err
   5051      is not to have the whole error stack handling routines removed from
   5052      libcrypto, it's only intended to remove all the function name and
   5053      reason texts, thereby removing some of the footprint that may not
   5054      be interesting if those errors aren't displayed anyway.
   5055 
   5056      NOTE: it's still possible for any application or module to have it's
   5057      own set of error texts inserted.  The routines are there, just not
   5058      used by default when no-err is given.
   5059      [Richard Levitte]
   5060 
   5061   *) Add support for FreeBSD on IA64.
   5062      [dirk.meyer (a] dinoex.sub.org via Richard Levitte, resolves #454]
   5063 
   5064   *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
   5065      Kerberos function mit_des_cbc_cksum().  Before this change,
   5066      the value returned by DES_cbc_cksum() was like the one from
   5067      mit_des_cbc_cksum(), except the bytes were swapped.
   5068      [Kevin Greaney <Kevin.Greaney (a] hp.com> and Richard Levitte]
   5069 
   5070   *) Allow an application to disable the automatic SSL chain building.
   5071      Before this a rather primitive chain build was always performed in
   5072      ssl3_output_cert_chain(): an application had no way to send the 
   5073      correct chain if the automatic operation produced an incorrect result.
   5074 
   5075      Now the chain builder is disabled if either:
   5076 
   5077      1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
   5078 
   5079      2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
   5080 
   5081      The reasoning behind this is that an application would not want the
   5082      auto chain building to take place if extra chain certificates are
   5083      present and it might also want a means of sending no additional
   5084      certificates (for example the chain has two certificates and the
   5085      root is omitted).
   5086      [Steve Henson]
   5087 
   5088   *) Add the possibility to build without the ENGINE framework.
   5089      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   5090 
   5091   *) Under Win32 gmtime() can return NULL: check return value in
   5092      OPENSSL_gmtime(). Add error code for case where gmtime() fails.
   5093      [Steve Henson]
   5094 
   5095   *) DSA routines: under certain error conditions uninitialized BN objects
   5096      could be freed. Solution: make sure initialization is performed early
   5097      enough. (Reported and fix supplied by Ivan D Nestlerode <nestler (a] MIT.EDU>,
   5098      Nils Larsch <nla (a] trustcenter.de> via PR#459)
   5099      [Lutz Jaenicke]
   5100 
   5101   *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
   5102      checked on reconnect on the client side, therefore session resumption
   5103      could still fail with a "ssl session id is different" error. This
   5104      behaviour is masked when SSL_OP_ALL is used due to
   5105      SSL_OP_MICROSOFT_SESS_ID_BUG being set.
   5106      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   5107      followup to PR #377.
   5108      [Lutz Jaenicke]
   5109 
   5110   *) IA-32 assembler support enhancements: unified ELF targets, support
   5111      for SCO/Caldera platforms, fix for Cygwin shared build.
   5112      [Andy Polyakov]
   5113 
   5114   *) Add support for FreeBSD on sparc64.  As a consequence, support for
   5115      FreeBSD on non-x86 processors is separate from x86 processors on
   5116      the config script, much like the NetBSD support.
   5117      [Richard Levitte & Kris Kennaway <kris (a] obsecurity.org>]
   5118 
   5119  Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
   5120 
   5121   [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
   5122   OpenSSL 0.9.7.]
   5123 
   5124   *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
   5125      code (06) was taken as the first octet of the session ID and the last
   5126      octet was ignored consequently. As a result SSLv2 client side session
   5127      caching could not have worked due to the session ID mismatch between
   5128      client and server.
   5129      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   5130      PR #377.
   5131      [Lutz Jaenicke]
   5132 
   5133   *) Change the declaration of needed Kerberos libraries to use EX_LIBS
   5134      instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
   5135      removed entirely.
   5136      [Richard Levitte]
   5137 
   5138   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
   5139      seems that in spite of existing for more than a year, many application
   5140      author have done nothing to provide the necessary callbacks, which
   5141      means that this particular engine will not work properly anywhere.
   5142      This is a very unfortunate situation which forces us, in the name
   5143      of usability, to give the hw_ncipher.c a static lock, which is part
   5144      of libcrypto.
   5145      NOTE: This is for the 0.9.7 series ONLY.  This hack will never
   5146      appear in 0.9.8 or later.  We EXPECT application authors to have
   5147      dealt properly with this when 0.9.8 is released (unless we actually
   5148      make such changes in the libcrypto locking code that changes will
   5149      have to be made anyway).
   5150      [Richard Levitte]
   5151 
   5152   *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
   5153      octets have been read, EOF or an error occurs. Without this change
   5154      some truncated ASN1 structures will not produce an error.
   5155      [Steve Henson]
   5156 
   5157   *) Disable Heimdal support, since it hasn't been fully implemented.
   5158      Still give the possibility to force the use of Heimdal, but with
   5159      warnings and a request that patches get sent to openssl-dev.
   5160      [Richard Levitte]
   5161 
   5162   *) Add the VC-CE target, introduce the WINCE sysname, and add
   5163      INSTALL.WCE and appropriate conditionals to make it build.
   5164      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   5165 
   5166   *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
   5167      cygssl-x.y.z.dll, where x, y and z are the major, minor and
   5168      edit numbers of the version.
   5169      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   5170 
   5171   *) Introduce safe string copy and catenation functions
   5172      (BUF_strlcpy() and BUF_strlcat()).
   5173      [Ben Laurie (CHATS) and Richard Levitte]
   5174 
   5175   *) Avoid using fixed-size buffers for one-line DNs.
   5176      [Ben Laurie (CHATS)]
   5177 
   5178   *) Add BUF_MEM_grow_clean() to avoid information leakage when
   5179      resizing buffers containing secrets, and use where appropriate.
   5180      [Ben Laurie (CHATS)]
   5181 
   5182   *) Avoid using fixed size buffers for configuration file location.
   5183      [Ben Laurie (CHATS)]
   5184 
   5185   *) Avoid filename truncation for various CA files.
   5186      [Ben Laurie (CHATS)]
   5187 
   5188   *) Use sizeof in preference to magic numbers.
   5189      [Ben Laurie (CHATS)]
   5190 
   5191   *) Avoid filename truncation in cert requests.
   5192      [Ben Laurie (CHATS)]
   5193 
   5194   *) Add assertions to check for (supposedly impossible) buffer
   5195      overflows.
   5196      [Ben Laurie (CHATS)]
   5197 
   5198   *) Don't cache truncated DNS entries in the local cache (this could
   5199      potentially lead to a spoofing attack).
   5200      [Ben Laurie (CHATS)]
   5201 
   5202   *) Fix various buffers to be large enough for hex/decimal
   5203      representations in a platform independent manner.
   5204      [Ben Laurie (CHATS)]
   5205 
   5206   *) Add CRYPTO_realloc_clean() to avoid information leakage when
   5207      resizing buffers containing secrets, and use where appropriate.
   5208      [Ben Laurie (CHATS)]
   5209 
   5210   *) Add BIO_indent() to avoid much slightly worrying code to do
   5211      indents.
   5212      [Ben Laurie (CHATS)]
   5213 
   5214   *) Convert sprintf()/BIO_puts() to BIO_printf().
   5215      [Ben Laurie (CHATS)]
   5216 
   5217   *) buffer_gets() could terminate with the buffer only half
   5218      full. Fixed.
   5219      [Ben Laurie (CHATS)]
   5220 
   5221   *) Add assertions to prevent user-supplied crypto functions from
   5222      overflowing internal buffers by having large block sizes, etc.
   5223      [Ben Laurie (CHATS)]
   5224 
   5225   *) New OPENSSL_assert() macro (similar to assert(), but enabled
   5226      unconditionally).
   5227      [Ben Laurie (CHATS)]
   5228 
   5229   *) Eliminate unused copy of key in RC4.
   5230      [Ben Laurie (CHATS)]
   5231 
   5232   *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
   5233      [Ben Laurie (CHATS)]
   5234 
   5235   *) Fix off-by-one error in EGD path.
   5236      [Ben Laurie (CHATS)]
   5237 
   5238   *) If RANDFILE path is too long, ignore instead of truncating.
   5239      [Ben Laurie (CHATS)]
   5240 
   5241   *) Eliminate unused and incorrectly sized X.509 structure
   5242      CBCParameter.
   5243      [Ben Laurie (CHATS)]
   5244 
   5245   *) Eliminate unused and dangerous function knumber().
   5246      [Ben Laurie (CHATS)]
   5247 
   5248   *) Eliminate unused and dangerous structure, KSSL_ERR.
   5249      [Ben Laurie (CHATS)]
   5250 
   5251   *) Protect against overlong session ID context length in an encoded
   5252      session object. Since these are local, this does not appear to be
   5253      exploitable.
   5254      [Ben Laurie (CHATS)]
   5255 
   5256   *) Change from security patch (see 0.9.6e below) that did not affect
   5257      the 0.9.6 release series:
   5258 
   5259      Remote buffer overflow in SSL3 protocol - an attacker could
   5260      supply an oversized master key in Kerberos-enabled versions.
   5261      (CVE-2002-0657)
   5262      [Ben Laurie (CHATS)]
   5263 
   5264   *) Change the SSL kerb5 codes to match RFC 2712.
   5265      [Richard Levitte]
   5266 
   5267   *) Make -nameopt work fully for req and add -reqopt switch.
   5268      [Michael Bell <michael.bell (a] rz.hu-berlin.de>, Steve Henson]
   5269 
   5270   *) The "block size" for block ciphers in CFB and OFB mode should be 1.
   5271      [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve (a] opera.com>]
   5272 
   5273   *) Make sure tests can be performed even if the corresponding algorithms
   5274      have been removed entirely.  This was also the last step to make
   5275      OpenSSL compilable with DJGPP under all reasonable conditions.
   5276      [Richard Levitte, Doug Kaufman <dkaufman (a] rahul.net>]
   5277 
   5278   *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
   5279      to allow version independent disabling of normally unselected ciphers,
   5280      which may be activated as a side-effect of selecting a single cipher.
   5281 
   5282      (E.g., cipher list string "RSA" enables ciphersuites that are left
   5283      out of "ALL" because they do not provide symmetric encryption.
   5284      "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
   5285      [Lutz Jaenicke, Bodo Moeller]
   5286 
   5287   *) Add appropriate support for separate platform-dependent build
   5288      directories.  The recommended way to make a platform-dependent
   5289      build directory is the following (tested on Linux), maybe with
   5290      some local tweaks:
   5291 
   5292 	# Place yourself outside of the OpenSSL source tree.  In
   5293 	# this example, the environment variable OPENSSL_SOURCE
   5294 	# is assumed to contain the absolute OpenSSL source directory.
   5295 	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
   5296 	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
   5297 	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
   5298 		mkdir -p `dirname $F`
   5299 		ln -s $OPENSSL_SOURCE/$F $F
   5300 	done
   5301 
   5302      To be absolutely sure not to disturb the source tree, a "make clean"
   5303      is a good thing.  If it isn't successfull, don't worry about it,
   5304      it probably means the source directory is very clean.
   5305      [Richard Levitte]
   5306 
   5307   *) Make sure any ENGINE control commands make local copies of string
   5308      pointers passed to them whenever necessary. Otherwise it is possible
   5309      the caller may have overwritten (or deallocated) the original string
   5310      data when a later ENGINE operation tries to use the stored values.
   5311      [Gtz Babin-Ebell <babinebell (a] trustcenter.de>]
   5312 
   5313   *) Improve diagnostics in file reading and command-line digests.
   5314      [Ben Laurie aided and abetted by Solar Designer <solar (a] openwall.com>]
   5315 
   5316   *) Add AES modes CFB and OFB to the object database.  Correct an
   5317      error in AES-CFB decryption.
   5318      [Richard Levitte]
   5319 
   5320   *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
   5321      allows existing EVP_CIPHER_CTX structures to be reused after
   5322      calling EVP_*Final(). This behaviour is used by encryption
   5323      BIOs and some applications. This has the side effect that
   5324      applications must explicitly clean up cipher contexts with
   5325      EVP_CIPHER_CTX_cleanup() or they will leak memory.
   5326      [Steve Henson]
   5327 
   5328   *) Check the values of dna and dnb in bn_mul_recursive before calling
   5329      bn_mul_comba (a non zero value means the a or b arrays do not contain
   5330      n2 elements) and fallback to bn_mul_normal if either is not zero.
   5331      [Steve Henson]
   5332 
   5333   *) Fix escaping of non-ASCII characters when using the -subj option
   5334      of the "openssl req" command line tool. (Robert Joop <joop (a] fokus.gmd.de>)
   5335      [Lutz Jaenicke]
   5336 
   5337   *) Make object definitions compliant to LDAP (RFC2256): SN is the short
   5338      form for "surname", serialNumber has no short form.
   5339      Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
   5340      therefore remove "mail" short name for "internet 7".
   5341      The OID for unique identifiers in X509 certificates is
   5342      x500UniqueIdentifier, not uniqueIdentifier.
   5343      Some more OID additions. (Michael Bell <michael.bell (a] rz.hu-berlin.de>)
   5344      [Lutz Jaenicke]
   5345 
   5346   *) Add an "init" command to the ENGINE config module and auto initialize
   5347      ENGINEs. Without any "init" command the ENGINE will be initialized 
   5348      after all ctrl commands have been executed on it. If init=1 the 
   5349      ENGINE is initailized at that point (ctrls before that point are run
   5350      on the uninitialized ENGINE and after on the initialized one). If
   5351      init=0 then the ENGINE will not be iniatialized at all.
   5352      [Steve Henson]
   5353 
   5354   *) Fix the 'app_verify_callback' interface so that the user-defined
   5355      argument is actually passed to the callback: In the
   5356      SSL_CTX_set_cert_verify_callback() prototype, the callback
   5357      declaration has been changed from
   5358           int (*cb)()
   5359      into
   5360           int (*cb)(X509_STORE_CTX *,void *);
   5361      in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
   5362           i=s->ctx->app_verify_callback(&ctx)
   5363      has been changed into
   5364           i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
   5365 
   5366      To update applications using SSL_CTX_set_cert_verify_callback(),
   5367      a dummy argument can be added to their callback functions.
   5368      [D. K. Smetters <smetters (a] parc.xerox.com>]
   5369 
   5370   *) Added the '4758cca' ENGINE to support IBM 4758 cards.
   5371      [Maurice Gittens <maurice (a] gittens.nl>, touchups by Geoff Thorpe]
   5372 
   5373   *) Add and OPENSSL_LOAD_CONF define which will cause
   5374      OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
   5375      This allows older applications to transparently support certain
   5376      OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
   5377      Two new functions OPENSSL_add_all_algorithms_noconf() which will never
   5378      load the config file and OPENSSL_add_all_algorithms_conf() which will
   5379      always load it have also been added.
   5380      [Steve Henson]
   5381 
   5382   *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
   5383      Adjust NIDs and EVP layer.
   5384      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   5385 
   5386   *) Config modules support in openssl utility.
   5387 
   5388      Most commands now load modules from the config file,
   5389      though in a few (such as version) this isn't done 
   5390      because it couldn't be used for anything.
   5391 
   5392      In the case of ca and req the config file used is
   5393      the same as the utility itself: that is the -config
   5394      command line option can be used to specify an
   5395      alternative file.
   5396      [Steve Henson]
   5397 
   5398   *) Move default behaviour from OPENSSL_config(). If appname is NULL
   5399      use "openssl_conf" if filename is NULL use default openssl config file.
   5400      [Steve Henson]
   5401 
   5402   *) Add an argument to OPENSSL_config() to allow the use of an alternative
   5403      config section name. Add a new flag to tolerate a missing config file
   5404      and move code to CONF_modules_load_file().
   5405      [Steve Henson]
   5406 
   5407   *) Support for crypto accelerator cards from Accelerated Encryption
   5408      Processing, www.aep.ie.  (Use engine 'aep')
   5409      The support was copied from 0.9.6c [engine] and adapted/corrected
   5410      to work with the new engine framework.
   5411      [AEP Inc. and Richard Levitte]
   5412 
   5413   *) Support for SureWare crypto accelerator cards from Baltimore
   5414      Technologies.  (Use engine 'sureware')
   5415      The support was copied from 0.9.6c [engine] and adapted
   5416      to work with the new engine framework.
   5417      [Richard Levitte]
   5418 
   5419   *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
   5420      make the newer ENGINE framework commands for the CHIL engine work.
   5421      [Toomas Kiisk <vix (a] cyber.ee> and Richard Levitte]
   5422 
   5423   *) Make it possible to produce shared libraries on ReliantUNIX.
   5424      [Robert Dahlem <Robert.Dahlem (a] ffm2.siemens.de> via Richard Levitte]
   5425 
   5426   *) Add the configuration target debug-linux-ppro.
   5427      Make 'openssl rsa' use the general key loading routines
   5428      implemented in apps.c, and make those routines able to
   5429      handle the key format FORMAT_NETSCAPE and the variant
   5430      FORMAT_IISSGC.
   5431      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   5432 
   5433  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   5434      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   5435 
   5436   *) Add -keyform to rsautl, and document -engine.
   5437      [Richard Levitte, inspired by Toomas Kiisk <vix (a] cyber.ee>]
   5438 
   5439   *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
   5440      BIO_R_NO_SUCH_FILE error code rather than the generic
   5441      ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
   5442      [Ben Laurie]
   5443 
   5444   *) Add new functions
   5445           ERR_peek_last_error
   5446           ERR_peek_last_error_line
   5447           ERR_peek_last_error_line_data.
   5448      These are similar to
   5449           ERR_peek_error
   5450           ERR_peek_error_line
   5451           ERR_peek_error_line_data,
   5452      but report on the latest error recorded rather than the first one
   5453      still in the error queue.
   5454      [Ben Laurie, Bodo Moeller]
   5455         
   5456   *) default_algorithms option in ENGINE config module. This allows things
   5457      like:
   5458      default_algorithms = ALL
   5459      default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
   5460      [Steve Henson]
   5461 
   5462   *) Prelminary ENGINE config module.
   5463      [Steve Henson]
   5464 
   5465   *) New experimental application configuration code.
   5466      [Steve Henson]
   5467 
   5468   *) Change the AES code to follow the same name structure as all other
   5469      symmetric ciphers, and behave the same way.  Move everything to
   5470      the directory crypto/aes, thereby obsoleting crypto/rijndael.
   5471      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   5472 
   5473   *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
   5474      [Ben Laurie and Theo de Raadt]
   5475 
   5476   *) Add option to output public keys in req command.
   5477      [Massimiliano Pala madwolf (a] openca.org]
   5478 
   5479   *) Use wNAFs in EC_POINTs_mul() for improved efficiency
   5480      (up to about 10% better than before for P-192 and P-224).
   5481      [Bodo Moeller]
   5482 
   5483   *) New functions/macros
   5484 
   5485           SSL_CTX_set_msg_callback(ctx, cb)
   5486           SSL_CTX_set_msg_callback_arg(ctx, arg)
   5487           SSL_set_msg_callback(ssl, cb)
   5488           SSL_set_msg_callback_arg(ssl, arg)
   5489 
   5490      to request calling a callback function
   5491 
   5492           void cb(int write_p, int version, int content_type,
   5493                   const void *buf, size_t len, SSL *ssl, void *arg)
   5494 
   5495      whenever a protocol message has been completely received
   5496      (write_p == 0) or sent (write_p == 1).  Here 'version' is the
   5497      protocol version  according to which the SSL library interprets
   5498      the current protocol message (SSL2_VERSION, SSL3_VERSION, or
   5499      TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
   5500      the content type as defined in the SSL 3.0/TLS 1.0 protocol
   5501      specification (change_cipher_spec(20), alert(21), handshake(22)).
   5502      'buf' and 'len' point to the actual message, 'ssl' to the
   5503      SSL object, and 'arg' is the application-defined value set by
   5504      SSL[_CTX]_set_msg_callback_arg().
   5505 
   5506      'openssl s_client' and 'openssl s_server' have new '-msg' options
   5507      to enable a callback that displays all protocol messages.
   5508      [Bodo Moeller]
   5509 
   5510   *) Change the shared library support so shared libraries are built as
   5511      soon as the corresponding static library is finished, and thereby get
   5512      openssl and the test programs linked against the shared library.
   5513      This still only happens when the keyword "shard" has been given to
   5514      the configuration scripts.
   5515 
   5516      NOTE: shared library support is still an experimental thing, and
   5517      backward binary compatibility is still not guaranteed.
   5518      ["Maciej W. Rozycki" <macro (a] ds2.pg.gda.pl> and Richard Levitte]
   5519 
   5520   *) Add support for Subject Information Access extension.
   5521      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   5522 
   5523   *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
   5524      additional bytes when new memory had to be allocated, not just
   5525      when reusing an existing buffer.
   5526      [Bodo Moeller]
   5527 
   5528   *) New command line and configuration option 'utf8' for the req command.
   5529      This allows field values to be specified as UTF8 strings.
   5530      [Steve Henson]
   5531 
   5532   *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
   5533      runs for the former and machine-readable output for the latter.
   5534      [Ben Laurie]
   5535 
   5536   *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
   5537      of the e-mail address in the DN (i.e., it will go into a certificate
   5538      extension only).  The new configuration file option 'email_in_dn = no'
   5539      has the same effect.
   5540      [Massimiliano Pala madwolf (a] openca.org]
   5541 
   5542   *) Change all functions with names starting with des_ to be starting
   5543      with DES_ instead.  Add wrappers that are compatible with libdes,
   5544      but are named _ossl_old_des_*.  Finally, add macros that map the
   5545      des_* symbols to the corresponding _ossl_old_des_* if libdes
   5546      compatibility is desired.  If OpenSSL 0.9.6c compatibility is
   5547      desired, the des_* symbols will be mapped to DES_*, with one
   5548      exception.
   5549 
   5550      Since we provide two compatibility mappings, the user needs to
   5551      define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
   5552      compatibility is desired.  The default (i.e., when that macro
   5553      isn't defined) is OpenSSL 0.9.6c compatibility.
   5554 
   5555      There are also macros that enable and disable the support of old
   5556      des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
   5557      and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
   5558      are defined, the default will apply: to support the old des routines.
   5559 
   5560      In either case, one must include openssl/des.h to get the correct
   5561      definitions.  Do not try to just include openssl/des_old.h, that
   5562      won't work.
   5563 
   5564      NOTE: This is a major break of an old API into a new one.  Software
   5565      authors are encouraged to switch to the DES_ style functions.  Some
   5566      time in the future, des_old.h and the libdes compatibility functions
   5567      will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
   5568      default), and then completely removed.
   5569      [Richard Levitte]
   5570 
   5571   *) Test for certificates which contain unsupported critical extensions.
   5572      If such a certificate is found during a verify operation it is 
   5573      rejected by default: this behaviour can be overridden by either
   5574      handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
   5575      by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
   5576      X509_supported_extension() has also been added which returns 1 if a
   5577      particular extension is supported.
   5578      [Steve Henson]
   5579 
   5580   *) Modify the behaviour of EVP cipher functions in similar way to digests
   5581      to retain compatibility with existing code.
   5582      [Steve Henson]
   5583 
   5584   *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
   5585      compatibility with existing code. In particular the 'ctx' parameter does
   5586      not have to be to be initialized before the call to EVP_DigestInit() and
   5587      it is tidied up after a call to EVP_DigestFinal(). New function
   5588      EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
   5589      EVP_MD_CTX_copy() changed to not require the destination to be
   5590      initialized valid and new function EVP_MD_CTX_copy_ex() added which
   5591      requires the destination to be valid.
   5592 
   5593      Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
   5594      EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
   5595      [Steve Henson]
   5596 
   5597   *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
   5598      so that complete 'Handshake' protocol structures are kept in memory
   5599      instead of overwriting 'msg_type' and 'length' with 'body' data.
   5600      [Bodo Moeller]
   5601 
   5602   *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
   5603      [Massimo Santin via Richard Levitte]
   5604 
   5605   *) Major restructuring to the underlying ENGINE code. This includes
   5606      reduction of linker bloat, separation of pure "ENGINE" manipulation
   5607      (initialisation, etc) from functionality dealing with implementations
   5608      of specific crypto iterfaces. This change also introduces integrated
   5609      support for symmetric ciphers and digest implementations - so ENGINEs
   5610      can now accelerate these by providing EVP_CIPHER and EVP_MD
   5611      implementations of their own. This is detailed in crypto/engine/README
   5612      as it couldn't be adequately described here. However, there are a few
   5613      API changes worth noting - some RSA, DSA, DH, and RAND functions that
   5614      were changed in the original introduction of ENGINE code have now
   5615      reverted back - the hooking from this code to ENGINE is now a good
   5616      deal more passive and at run-time, operations deal directly with
   5617      RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
   5618      dereferencing through an ENGINE pointer any more. Also, the ENGINE
   5619      functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
   5620      they were not being used by the framework as there is no concept of a
   5621      BIGNUM_METHOD and they could not be generalised to the new
   5622      'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
   5623      ENGINE_cpy() has been removed as it cannot be consistently defined in
   5624      the new code.
   5625      [Geoff Thorpe]
   5626 
   5627   *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
   5628      [Steve Henson]
   5629 
   5630   *) Change mkdef.pl to sort symbols that get the same entry number,
   5631      and make sure the automatically generated functions ERR_load_*
   5632      become part of libeay.num as well.
   5633      [Richard Levitte]
   5634 
   5635   *) New function SSL_renegotiate_pending().  This returns true once
   5636      renegotiation has been requested (either SSL_renegotiate() call
   5637      or HelloRequest/ClientHello receveived from the peer) and becomes
   5638      false once a handshake has been completed.
   5639      (For servers, SSL_renegotiate() followed by SSL_do_handshake()
   5640      sends a HelloRequest, but does not ensure that a handshake takes
   5641      place.  SSL_renegotiate_pending() is useful for checking if the
   5642      client has followed the request.)
   5643      [Bodo Moeller]
   5644 
   5645   *) New SSL option SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION.
   5646      By default, clients may request session resumption even during
   5647      renegotiation (if session ID contexts permit); with this option,
   5648      session resumption is possible only in the first handshake.
   5649 
   5650      SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
   5651      more bits available for options that should not be part of
   5652      SSL_OP_ALL (such as SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION).
   5653      [Bodo Moeller]
   5654 
   5655   *) Add some demos for certificate and certificate request creation.
   5656      [Steve Henson]
   5657 
   5658   *) Make maximum certificate chain size accepted from the peer application
   5659      settable (SSL*_get/set_max_cert_list()), as proposed by
   5660      "Douglas E. Engert" <deengert (a] anl.gov>.
   5661      [Lutz Jaenicke]
   5662 
   5663   *) Add support for shared libraries for Unixware-7
   5664      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   5665      [Lutz Jaenicke]
   5666 
   5667   *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
   5668      be done prior to destruction. Use this to unload error strings from
   5669      ENGINEs that load their own error strings. NB: This adds two new API
   5670      functions to "get" and "set" this destroy handler in an ENGINE.
   5671      [Geoff Thorpe]
   5672 
   5673   *) Alter all existing ENGINE implementations (except "openssl" and
   5674      "openbsd") to dynamically instantiate their own error strings. This
   5675      makes them more flexible to be built both as statically-linked ENGINEs
   5676      and self-contained shared-libraries loadable via the "dynamic" ENGINE.
   5677      Also, add stub code to each that makes building them as self-contained
   5678      shared-libraries easier (see README.ENGINE).
   5679      [Geoff Thorpe]
   5680 
   5681   *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
   5682      implementations into applications that are completely implemented in
   5683      self-contained shared-libraries. The "dynamic" ENGINE exposes control
   5684      commands that can be used to configure what shared-library to load and
   5685      to control aspects of the way it is handled. Also, made an update to
   5686      the README.ENGINE file that brings its information up-to-date and
   5687      provides some information and instructions on the "dynamic" ENGINE
   5688      (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
   5689      [Geoff Thorpe]
   5690 
   5691   *) Make it possible to unload ranges of ERR strings with a new
   5692      "ERR_unload_strings" function.
   5693      [Geoff Thorpe]
   5694 
   5695   *) Add a copy() function to EVP_MD.
   5696      [Ben Laurie]
   5697 
   5698   *) Make EVP_MD routines take a context pointer instead of just the
   5699      md_data void pointer.
   5700      [Ben Laurie]
   5701 
   5702   *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
   5703      that the digest can only process a single chunk of data
   5704      (typically because it is provided by a piece of
   5705      hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
   5706      is only going to provide a single chunk of data, and hence the
   5707      framework needn't accumulate the data for oneshot drivers.
   5708      [Ben Laurie]
   5709 
   5710   *) As with "ERR", make it possible to replace the underlying "ex_data"
   5711      functions. This change also alters the storage and management of global
   5712      ex_data state - it's now all inside ex_data.c and all "class" code (eg.
   5713      RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
   5714      index counters. The API functions that use this state have been changed
   5715      to take a "class_index" rather than pointers to the class's local STACK
   5716      and counter, and there is now an API function to dynamically create new
   5717      classes. This centralisation allows us to (a) plug a lot of the
   5718      thread-safety problems that existed, and (b) makes it possible to clean
   5719      up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
   5720      such data would previously have always leaked in application code and
   5721      workarounds were in place to make the memory debugging turn a blind eye
   5722      to it. Application code that doesn't use this new function will still
   5723      leak as before, but their memory debugging output will announce it now
   5724      rather than letting it slide.
   5725 
   5726      Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
   5727      induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
   5728      has a return value to indicate success or failure.
   5729      [Geoff Thorpe]
   5730 
   5731   *) Make it possible to replace the underlying "ERR" functions such that the
   5732      global state (2 LHASH tables and 2 locks) is only used by the "default"
   5733      implementation. This change also adds two functions to "get" and "set"
   5734      the implementation prior to it being automatically set the first time
   5735      any other ERR function takes place. Ie. an application can call "get",
   5736      pass the return value to a module it has just loaded, and that module
   5737      can call its own "set" function using that value. This means the
   5738      module's "ERR" operations will use (and modify) the error state in the
   5739      application and not in its own statically linked copy of OpenSSL code.
   5740      [Geoff Thorpe]
   5741 
   5742   *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
   5743      reference counts. This performs normal REF_PRINT/REF_CHECK macros on
   5744      the operation, and provides a more encapsulated way for external code
   5745      (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
   5746      to use these functions rather than manually incrementing the counts.
   5747 
   5748      Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
   5749      [Geoff Thorpe]
   5750 
   5751   *) Add EVP test program.
   5752      [Ben Laurie]
   5753 
   5754   *) Add symmetric cipher support to ENGINE. Expect the API to change!
   5755      [Ben Laurie]
   5756 
   5757   *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
   5758      X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
   5759      X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
   5760      These allow a CRL to be built without having to access X509_CRL fields
   5761      directly. Modify 'ca' application to use new functions.
   5762      [Steve Henson]
   5763 
   5764   *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
   5765      bug workarounds. Rollback attack detection is a security feature.
   5766      The problem will only arise on OpenSSL servers when TLSv1 is not
   5767      available (sslv3_server_method() or SSL_OP_NO_TLSv1).
   5768      Software authors not wanting to support TLSv1 will have special reasons
   5769      for their choice and can explicitly enable this option.
   5770      [Bodo Moeller, Lutz Jaenicke]
   5771 
   5772   *) Rationalise EVP so it can be extended: don't include a union of
   5773      cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
   5774      (similar to those existing for EVP_CIPHER_CTX).
   5775      Usage example:
   5776 
   5777          EVP_MD_CTX md;
   5778 
   5779          EVP_MD_CTX_init(&md);             /* new function call */
   5780          EVP_DigestInit(&md, EVP_sha1());
   5781          EVP_DigestUpdate(&md, in, len);
   5782          EVP_DigestFinal(&md, out, NULL);
   5783          EVP_MD_CTX_cleanup(&md);          /* new function call */
   5784 
   5785      [Ben Laurie]
   5786 
   5787   *) Make DES key schedule conform to the usual scheme, as well as
   5788      correcting its structure. This means that calls to DES functions
   5789      now have to pass a pointer to a des_key_schedule instead of a
   5790      plain des_key_schedule (which was actually always a pointer
   5791      anyway): E.g.,
   5792 
   5793          des_key_schedule ks;
   5794 
   5795 	 des_set_key_checked(..., &ks);
   5796 	 des_ncbc_encrypt(..., &ks, ...);
   5797 
   5798      (Note that a later change renames 'des_...' into 'DES_...'.)
   5799      [Ben Laurie]
   5800 
   5801   *) Initial reduction of linker bloat: the use of some functions, such as
   5802      PEM causes large amounts of unused functions to be linked in due to
   5803      poor organisation. For example pem_all.c contains every PEM function
   5804      which has a knock on effect of linking in large amounts of (unused)
   5805      ASN1 code. Grouping together similar functions and splitting unrelated
   5806      functions prevents this.
   5807      [Steve Henson]
   5808 
   5809   *) Cleanup of EVP macros.
   5810      [Ben Laurie]
   5811 
   5812   *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
   5813      correct _ecb suffix.
   5814      [Ben Laurie]
   5815 
   5816   *) Add initial OCSP responder support to ocsp application. The
   5817      revocation information is handled using the text based index
   5818      use by the ca application. The responder can either handle
   5819      requests generated internally, supplied in files (for example
   5820      via a CGI script) or using an internal minimal server.
   5821      [Steve Henson]
   5822 
   5823   *) Add configuration choices to get zlib compression for TLS.
   5824      [Richard Levitte]
   5825 
   5826   *) Changes to Kerberos SSL for RFC 2712 compliance:
   5827      1.  Implemented real KerberosWrapper, instead of just using
   5828          KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw (a] sxw.org.uk>]
   5829      2.  Implemented optional authenticator field of KerberosWrapper.
   5830 
   5831      Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
   5832      and authenticator structs; see crypto/krb5/.
   5833 
   5834      Generalized Kerberos calls to support multiple Kerberos libraries.
   5835      [Vern Staats <staatsvr (a] asc.hpc.mil>,
   5836       Jeffrey Altman <jaltman (a] columbia.edu>
   5837       via Richard Levitte]
   5838 
   5839   *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
   5840      already does with RSA. testdsa.h now has 'priv_key/pub_key'
   5841      values for each of the key sizes rather than having just
   5842      parameters (and 'speed' generating keys each time).
   5843      [Geoff Thorpe]
   5844 
   5845   *) Speed up EVP routines.
   5846      Before:
   5847 encrypt
   5848 type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
   5849 des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
   5850 des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
   5851 des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
   5852 decrypt
   5853 des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
   5854 des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
   5855 des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
   5856      After:
   5857 encrypt
   5858 des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
   5859 decrypt
   5860 des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   5861      [Ben Laurie]
   5862 
   5863   *) Added the OS2-EMX target.
   5864      ["Brian Havard" <brianh (a] kheldar.apana.org.au> and Richard Levitte]
   5865 
   5866   *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
   5867      to support NCONF routines in extension code. New function CONF_set_nconf()
   5868      to allow functions which take an NCONF to also handle the old LHASH
   5869      structure: this means that the old CONF compatible routines can be
   5870      retained (in particular wrt extensions) without having to duplicate the
   5871      code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
   5872      [Steve Henson]
   5873 
   5874   *) Enhance the general user interface with mechanisms for inner control
   5875      and with possibilities to have yes/no kind of prompts.
   5876      [Richard Levitte]
   5877 
   5878   *) Change all calls to low level digest routines in the library and
   5879      applications to use EVP. Add missing calls to HMAC_cleanup() and
   5880      don't assume HMAC_CTX can be copied using memcpy().
   5881      [Verdon Walker <VWalker (a] novell.com>, Steve Henson]
   5882 
   5883   *) Add the possibility to control engines through control names but with
   5884      arbitrary arguments instead of just a string.
   5885      Change the key loaders to take a UI_METHOD instead of a callback
   5886      function pointer.  NOTE: this breaks binary compatibility with earlier
   5887      versions of OpenSSL [engine].
   5888      Adapt the nCipher code for these new conditions and add a card insertion
   5889      callback.
   5890      [Richard Levitte]
   5891 
   5892   *) Enhance the general user interface with mechanisms to better support
   5893      dialog box interfaces, application-defined prompts, the possibility
   5894      to use defaults (for example default passwords from somewhere else)
   5895      and interrupts/cancellations.
   5896      [Richard Levitte]
   5897 
   5898   *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
   5899      attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
   5900      [Steve Henson]
   5901 
   5902   *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
   5903      tidy up some unnecessarily weird code in 'sk_new()').
   5904      [Geoff, reported by Diego Tartara <dtartara (a] novamens.com>]
   5905 
   5906   *) Change the key loading routines for ENGINEs to use the same kind
   5907      callback (pem_password_cb) as all other routines that need this
   5908      kind of callback.
   5909      [Richard Levitte]
   5910 
   5911   *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
   5912      256 bit (=32 byte) keys. Of course seeding with more entropy bytes
   5913      than this minimum value is recommended.
   5914      [Lutz Jaenicke]
   5915 
   5916   *) New random seeder for OpenVMS, using the system process statistics
   5917      that are easily reachable.
   5918      [Richard Levitte]
   5919 
   5920   *) Windows apparently can't transparently handle global
   5921      variables defined in DLLs. Initialisations such as:
   5922 
   5923         const ASN1_ITEM *it = &ASN1_INTEGER_it;
   5924 
   5925      wont compile. This is used by the any applications that need to
   5926      declare their own ASN1 modules. This was fixed by adding the option
   5927      EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
   5928      needed for static libraries under Win32.
   5929      [Steve Henson]
   5930 
   5931   *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
   5932      setting of purpose and trust fields. New X509_STORE trust and
   5933      purpose functions and tidy up setting in other SSL functions.
   5934      [Steve Henson]
   5935 
   5936   *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
   5937      structure. These are inherited by X509_STORE_CTX when it is 
   5938      initialised. This allows various defaults to be set in the
   5939      X509_STORE structure (such as flags for CRL checking and custom
   5940      purpose or trust settings) for functions which only use X509_STORE_CTX
   5941      internally such as S/MIME.
   5942 
   5943      Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
   5944      trust settings if they are not set in X509_STORE. This allows X509_STORE
   5945      purposes and trust (in S/MIME for example) to override any set by default.
   5946 
   5947      Add command line options for CRL checking to smime, s_client and s_server
   5948      applications.
   5949      [Steve Henson]
   5950 
   5951   *) Initial CRL based revocation checking. If the CRL checking flag(s)
   5952      are set then the CRL is looked up in the X509_STORE structure and
   5953      its validity and signature checked, then if the certificate is found
   5954      in the CRL the verify fails with a revoked error.
   5955 
   5956      Various new CRL related callbacks added to X509_STORE_CTX structure.
   5957 
   5958      Command line options added to 'verify' application to support this.
   5959 
   5960      This needs some additional work, such as being able to handle multiple
   5961      CRLs with different times, extension based lookup (rather than just
   5962      by subject name) and ultimately more complete V2 CRL extension
   5963      handling.
   5964      [Steve Henson]
   5965 
   5966   *) Add a general user interface API (crypto/ui/).  This is designed
   5967      to replace things like des_read_password and friends (backward
   5968      compatibility functions using this new API are provided).
   5969      The purpose is to remove prompting functions from the DES code
   5970      section as well as provide for prompting through dialog boxes in
   5971      a window system and the like.
   5972      [Richard Levitte]
   5973 
   5974   *) Add "ex_data" support to ENGINE so implementations can add state at a
   5975      per-structure level rather than having to store it globally.
   5976      [Geoff]
   5977 
   5978   *) Make it possible for ENGINE structures to be copied when retrieved by
   5979      ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
   5980      This causes the "original" ENGINE structure to act like a template,
   5981      analogous to the RSA vs. RSA_METHOD type of separation. Because of this
   5982      operational state can be localised to each ENGINE structure, despite the
   5983      fact they all share the same "methods". New ENGINE structures returned in
   5984      this case have no functional references and the return value is the single
   5985      structural reference. This matches the single structural reference returned
   5986      by ENGINE_by_id() normally, when it is incremented on the pre-existing
   5987      ENGINE structure.
   5988      [Geoff]
   5989 
   5990   *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
   5991      needs to match any other type at all we need to manually clear the
   5992      tag cache.
   5993      [Steve Henson]
   5994 
   5995   *) Changes to the "openssl engine" utility to include;
   5996      - verbosity levels ('-v', '-vv', and '-vvv') that provide information
   5997        about an ENGINE's available control commands.
   5998      - executing control commands from command line arguments using the
   5999        '-pre' and '-post' switches. '-post' is only used if '-t' is
   6000        specified and the ENGINE is successfully initialised. The syntax for
   6001        the individual commands are colon-separated, for example;
   6002 	 openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
   6003      [Geoff]
   6004 
   6005   *) New dynamic control command support for ENGINEs. ENGINEs can now
   6006      declare their own commands (numbers), names (strings), descriptions,
   6007      and input types for run-time discovery by calling applications. A
   6008      subset of these commands are implicitly classed as "executable"
   6009      depending on their input type, and only these can be invoked through
   6010      the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
   6011      can be based on user input, config files, etc). The distinction is
   6012      that "executable" commands cannot return anything other than a boolean
   6013      result and can only support numeric or string input, whereas some
   6014      discoverable commands may only be for direct use through
   6015      ENGINE_ctrl(), eg. supporting the exchange of binary data, function
   6016      pointers, or other custom uses. The "executable" commands are to
   6017      support parameterisations of ENGINE behaviour that can be
   6018      unambiguously defined by ENGINEs and used consistently across any
   6019      OpenSSL-based application. Commands have been added to all the
   6020      existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
   6021      control over shared-library paths without source code alterations.
   6022      [Geoff]
   6023 
   6024   *) Changed all ENGINE implementations to dynamically allocate their
   6025      ENGINEs rather than declaring them statically. Apart from this being
   6026      necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
   6027      this also allows the implementations to compile without using the
   6028      internal engine_int.h header.
   6029      [Geoff]
   6030 
   6031   *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
   6032      'const' value. Any code that should be able to modify a RAND_METHOD
   6033      should already have non-const pointers to it (ie. they should only
   6034      modify their own ones).
   6035      [Geoff]
   6036 
   6037   *) Made a variety of little tweaks to the ENGINE code.
   6038      - "atalla" and "ubsec" string definitions were moved from header files
   6039        to C code. "nuron" string definitions were placed in variables
   6040        rather than hard-coded - allowing parameterisation of these values
   6041        later on via ctrl() commands.
   6042      - Removed unused "#if 0"'d code.
   6043      - Fixed engine list iteration code so it uses ENGINE_free() to release
   6044        structural references.
   6045      - Constified the RAND_METHOD element of ENGINE structures.
   6046      - Constified various get/set functions as appropriate and added
   6047        missing functions (including a catch-all ENGINE_cpy that duplicates
   6048        all ENGINE values onto a new ENGINE except reference counts/state).
   6049      - Removed NULL parameter checks in get/set functions. Setting a method
   6050        or function to NULL is a way of cancelling out a previously set
   6051        value.  Passing a NULL ENGINE parameter is just plain stupid anyway
   6052        and doesn't justify the extra error symbols and code.
   6053      - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
   6054        flags from engine_int.h to engine.h.
   6055      - Changed prototypes for ENGINE handler functions (init(), finish(),
   6056        ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
   6057      [Geoff]
   6058 
   6059   *) Implement binary inversion algorithm for BN_mod_inverse in addition
   6060      to the algorithm using long division.  The binary algorithm can be
   6061      used only if the modulus is odd.  On 32-bit systems, it is faster
   6062      only for relatively small moduli (roughly 20-30% for 128-bit moduli,
   6063      roughly 5-15% for 256-bit moduli), so we use it only for moduli
   6064      up to 450 bits.  In 64-bit environments, the binary algorithm
   6065      appears to be advantageous for much longer moduli; here we use it
   6066      for moduli up to 2048 bits.
   6067      [Bodo Moeller]
   6068 
   6069   *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
   6070      could not support the combine flag in choice fields.
   6071      [Steve Henson]
   6072 
   6073   *) Add a 'copy_extensions' option to the 'ca' utility. This copies
   6074      extensions from a certificate request to the certificate.
   6075      [Steve Henson]
   6076 
   6077   *) Allow multiple 'certopt' and 'nameopt' options to be separated
   6078      by commas. Add 'namopt' and 'certopt' options to the 'ca' config
   6079      file: this allows the display of the certificate about to be
   6080      signed to be customised, to allow certain fields to be included
   6081      or excluded and extension details. The old system didn't display
   6082      multicharacter strings properly, omitted fields not in the policy
   6083      and couldn't display additional details such as extensions.
   6084      [Steve Henson]
   6085 
   6086   *) Function EC_POINTs_mul for multiple scalar multiplication
   6087      of an arbitrary number of elliptic curve points
   6088           \sum scalars[i]*points[i],
   6089      optionally including the generator defined for the EC_GROUP:
   6090           scalar*generator +  \sum scalars[i]*points[i].
   6091 
   6092      EC_POINT_mul is a simple wrapper function for the typical case
   6093      that the point list has just one item (besides the optional
   6094      generator).
   6095      [Bodo Moeller]
   6096 
   6097   *) First EC_METHODs for curves over GF(p):
   6098 
   6099      EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
   6100      operations and provides various method functions that can also
   6101      operate with faster implementations of modular arithmetic.     
   6102 
   6103      EC_GFp_mont_method() reuses most functions that are part of
   6104      EC_GFp_simple_method, but uses Montgomery arithmetic.
   6105 
   6106      [Bodo Moeller; point addition and point doubling
   6107      implementation directly derived from source code provided by
   6108      Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>]
   6109 
   6110   *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
   6111      crypto/ec/ec_lib.c):
   6112 
   6113      Curves are EC_GROUP objects (with an optional group generator)
   6114      based on EC_METHODs that are built into the library.
   6115 
   6116      Points are EC_POINT objects based on EC_GROUP objects.
   6117 
   6118      Most of the framework would be able to handle curves over arbitrary
   6119      finite fields, but as there are no obvious types for fields other
   6120      than GF(p), some functions are limited to that for now.
   6121      [Bodo Moeller]
   6122 
   6123   *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
   6124      that the file contains a complete HTTP response.
   6125      [Richard Levitte]
   6126 
   6127   *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
   6128      change the def and num file printf format specifier from "%-40sXXX"
   6129      to "%-39s XXX". The latter will always guarantee a space after the
   6130      field while the former will cause them to run together if the field
   6131      is 40 of more characters long.
   6132      [Steve Henson]
   6133 
   6134   *) Constify the cipher and digest 'method' functions and structures
   6135      and modify related functions to take constant EVP_MD and EVP_CIPHER
   6136      pointers.
   6137      [Steve Henson]
   6138 
   6139   *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
   6140      in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
   6141      [Bodo Moeller]
   6142 
   6143   *) Modify EVP_Digest*() routines so they now return values. Although the
   6144      internal software routines can never fail additional hardware versions
   6145      might.
   6146      [Steve Henson]
   6147 
   6148   *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
   6149 
   6150      Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
   6151      (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
   6152 
   6153      ASN1 error codes
   6154           ERR_R_NESTED_ASN1_ERROR
   6155           ...
   6156           ERR_R_MISSING_ASN1_EOS
   6157      were 4 .. 9, conflicting with
   6158           ERR_LIB_RSA (= ERR_R_RSA_LIB)
   6159           ...
   6160           ERR_LIB_PEM (= ERR_R_PEM_LIB).
   6161      They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
   6162 
   6163      Add new error code 'ERR_R_INTERNAL_ERROR'.
   6164      [Bodo Moeller]
   6165 
   6166   *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
   6167      suffices.
   6168      [Bodo Moeller]
   6169 
   6170   *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
   6171      sets the subject name for a new request or supersedes the
   6172      subject name in a given request. Formats that can be parsed are
   6173           'CN=Some Name, OU=myOU, C=IT'
   6174      and
   6175           'CN=Some Name/OU=myOU/C=IT'.
   6176 
   6177      Add options '-batch' and '-verbose' to 'openssl req'.
   6178      [Massimiliano Pala <madwolf (a] hackmasters.net>]
   6179 
   6180   *) Introduce the possibility to access global variables through
   6181      functions on platform were that's the best way to handle exporting
   6182      global variables in shared libraries.  To enable this functionality,
   6183      one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
   6184      "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
   6185      is normally done by Configure or something similar).
   6186 
   6187      To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
   6188      in the source file (foo.c) like this:
   6189 
   6190 	OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
   6191 	OPENSSL_IMPLEMENT_GLOBAL(double,bar);
   6192 
   6193      To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
   6194      and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
   6195 
   6196 	OPENSSL_DECLARE_GLOBAL(int,foo);
   6197 	#define foo OPENSSL_GLOBAL_REF(foo)
   6198 	OPENSSL_DECLARE_GLOBAL(double,bar);
   6199 	#define bar OPENSSL_GLOBAL_REF(bar)
   6200 
   6201      The #defines are very important, and therefore so is including the
   6202      header file everywhere where the defined globals are used.
   6203 
   6204      The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
   6205      of ASN.1 items, but that structure is a bit different.
   6206 
   6207      The largest change is in util/mkdef.pl which has been enhanced with
   6208      better and easier to understand logic to choose which symbols should
   6209      go into the Windows .def files as well as a number of fixes and code
   6210      cleanup (among others, algorithm keywords are now sorted
   6211      lexicographically to avoid constant rewrites).
   6212      [Richard Levitte]
   6213 
   6214   *) In BN_div() keep a copy of the sign of 'num' before writing the
   6215      result to 'rm' because if rm==num the value will be overwritten
   6216      and produce the wrong result if 'num' is negative: this caused
   6217      problems with BN_mod() and BN_nnmod().
   6218      [Steve Henson]
   6219 
   6220   *) Function OCSP_request_verify(). This checks the signature on an
   6221      OCSP request and verifies the signer certificate. The signer
   6222      certificate is just checked for a generic purpose and OCSP request
   6223      trust settings.
   6224      [Steve Henson]
   6225 
   6226   *) Add OCSP_check_validity() function to check the validity of OCSP
   6227      responses. OCSP responses are prepared in real time and may only
   6228      be a few seconds old. Simply checking that the current time lies
   6229      between thisUpdate and nextUpdate max reject otherwise valid responses
   6230      caused by either OCSP responder or client clock inaccuracy. Instead
   6231      we allow thisUpdate and nextUpdate to fall within a certain period of
   6232      the current time. The age of the response can also optionally be
   6233      checked. Two new options -validity_period and -status_age added to
   6234      ocsp utility.
   6235      [Steve Henson]
   6236 
   6237   *) If signature or public key algorithm is unrecognized print out its
   6238      OID rather that just UNKNOWN.
   6239      [Steve Henson]
   6240 
   6241   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
   6242      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
   6243      ID to be generated from the issuer certificate alone which can then be
   6244      passed to OCSP_id_issuer_cmp().
   6245      [Steve Henson]
   6246 
   6247   *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
   6248      ASN1 modules to export functions returning ASN1_ITEM pointers
   6249      instead of the ASN1_ITEM structures themselves. This adds several
   6250      new macros which allow the underlying ASN1 function/structure to
   6251      be accessed transparently. As a result code should not use ASN1_ITEM
   6252      references directly (such as &X509_it) but instead use the relevant
   6253      macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
   6254      use of the new ASN1 code on platforms where exporting structures
   6255      is problematical (for example in shared libraries) but exporting
   6256      functions returning pointers to structures is not.
   6257      [Steve Henson]
   6258 
   6259   *) Add support for overriding the generation of SSL/TLS session IDs.
   6260      These callbacks can be registered either in an SSL_CTX or per SSL.
   6261      The purpose of this is to allow applications to control, if they wish,
   6262      the arbitrary values chosen for use as session IDs, particularly as it
   6263      can be useful for session caching in multiple-server environments. A
   6264      command-line switch for testing this (and any client code that wishes
   6265      to use such a feature) has been added to "s_server".
   6266      [Geoff Thorpe, Lutz Jaenicke]
   6267 
   6268   *) Modify mkdef.pl to recognise and parse preprocessor conditionals
   6269      of the form '#if defined(...) || defined(...) || ...' and
   6270      '#if !defined(...) && !defined(...) && ...'.  This also avoids
   6271      the growing number of special cases it was previously handling.
   6272      [Richard Levitte]
   6273 
   6274   *) Make all configuration macros available for application by making
   6275      sure they are available in opensslconf.h, by giving them names starting
   6276      with "OPENSSL_" to avoid conflicts with other packages and by making
   6277      sure e_os2.h will cover all platform-specific cases together with
   6278      opensslconf.h.
   6279      Additionally, it is now possible to define configuration/platform-
   6280      specific names (called "system identities").  In the C code, these
   6281      are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
   6282      macro with the name beginning with "OPENSSL_SYS_", which is determined
   6283      from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
   6284      what is available.
   6285      [Richard Levitte]
   6286 
   6287   *) New option -set_serial to 'req' and 'x509' this allows the serial
   6288      number to use to be specified on the command line. Previously self
   6289      signed certificates were hard coded with serial number 0 and the 
   6290      CA options of 'x509' had to use a serial number in a file which was
   6291      auto incremented.
   6292      [Steve Henson]
   6293 
   6294   *) New options to 'ca' utility to support V2 CRL entry extensions.
   6295      Currently CRL reason, invalidity date and hold instruction are
   6296      supported. Add new CRL extensions to V3 code and some new objects.
   6297      [Steve Henson]
   6298 
   6299   *) New function EVP_CIPHER_CTX_set_padding() this is used to
   6300      disable standard block padding (aka PKCS#5 padding) in the EVP
   6301      API, which was previously mandatory. This means that the data is
   6302      not padded in any way and so the total length much be a multiple
   6303      of the block size, otherwise an error occurs.
   6304      [Steve Henson]
   6305 
   6306   *) Initial (incomplete) OCSP SSL support.
   6307      [Steve Henson]
   6308 
   6309   *) New function OCSP_parse_url(). This splits up a URL into its host,
   6310      port and path components: primarily to parse OCSP URLs. New -url
   6311      option to ocsp utility.
   6312      [Steve Henson]
   6313 
   6314   *) New nonce behavior. The return value of OCSP_check_nonce() now 
   6315      reflects the various checks performed. Applications can decide
   6316      whether to tolerate certain situations such as an absent nonce
   6317      in a response when one was present in a request: the ocsp application
   6318      just prints out a warning. New function OCSP_add1_basic_nonce()
   6319      this is to allow responders to include a nonce in a response even if
   6320      the request is nonce-less.
   6321      [Steve Henson]
   6322 
   6323   *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
   6324      skipped when using openssl x509 multiple times on a single input file,
   6325      e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
   6326      [Bodo Moeller]
   6327 
   6328   *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
   6329      set string type: to handle setting ASN1_TIME structures. Fix ca
   6330      utility to correctly initialize revocation date of CRLs.
   6331      [Steve Henson]
   6332 
   6333   *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
   6334      the clients preferred ciphersuites and rather use its own preferences.
   6335      Should help to work around M$ SGC (Server Gated Cryptography) bug in
   6336      Internet Explorer by ensuring unchanged hash method during stepup.
   6337      (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
   6338      [Lutz Jaenicke]
   6339 
   6340   *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
   6341      to aes and add a new 'exist' option to print out symbols that don't
   6342      appear to exist.
   6343      [Steve Henson]
   6344 
   6345   *) Additional options to ocsp utility to allow flags to be set and
   6346      additional certificates supplied.
   6347      [Steve Henson]
   6348 
   6349   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
   6350      OCSP client a number of certificate to only verify the response
   6351      signature against.
   6352      [Richard Levitte]
   6353 
   6354   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
   6355      handle the new API. Currently only ECB, CBC modes supported. Add new
   6356      AES OIDs.
   6357 
   6358      Add TLS AES ciphersuites as described in RFC3268, "Advanced
   6359      Encryption Standard (AES) Ciphersuites for Transport Layer
   6360      Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
   6361      not enabled by default and were not part of the "ALL" ciphersuite
   6362      alias because they were not yet official; they could be
   6363      explicitly requested by specifying the "AESdraft" ciphersuite
   6364      group alias.  In the final release of OpenSSL 0.9.7, the group
   6365      alias is called "AES" and is part of "ALL".)
   6366      [Ben Laurie, Steve  Henson, Bodo Moeller]
   6367 
   6368   *) New function OCSP_copy_nonce() to copy nonce value (if present) from
   6369      request to response.
   6370      [Steve Henson]
   6371 
   6372   *) Functions for OCSP responders. OCSP_request_onereq_count(),
   6373      OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
   6374      extract information from a certificate request. OCSP_response_create()
   6375      creates a response and optionally adds a basic response structure.
   6376      OCSP_basic_add1_status() adds a complete single response to a basic
   6377      response and returns the OCSP_SINGLERESP structure just added (to allow
   6378      extensions to be included for example). OCSP_basic_add1_cert() adds a
   6379      certificate to a basic response and OCSP_basic_sign() signs a basic
   6380      response with various flags. New helper functions ASN1_TIME_check()
   6381      (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
   6382      (converts ASN1_TIME to GeneralizedTime).
   6383      [Steve Henson]
   6384 
   6385   *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
   6386      in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
   6387      structure from a certificate. X509_pubkey_digest() digests the public_key
   6388      contents: this is used in various key identifiers. 
   6389      [Steve Henson]
   6390 
   6391   *) Make sk_sort() tolerate a NULL argument.
   6392      [Steve Henson reported by Massimiliano Pala <madwolf (a] comune.modena.it>]
   6393 
   6394   *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
   6395      passed by the function are trusted implicitly. If any of them signed the
   6396      response then it is assumed to be valid and is not verified.
   6397      [Steve Henson]
   6398 
   6399   *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
   6400      to data. This was previously part of the PKCS7 ASN1 code. This
   6401      was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
   6402      [Steve Henson, reported by Kenneth R. Robinette
   6403 				<support (a] securenetterm.com>]
   6404 
   6405   *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
   6406      routines: without these tracing memory leaks is very painful.
   6407      Fix leaks in PKCS12 and PKCS7 routines.
   6408      [Steve Henson]
   6409 
   6410   *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
   6411      Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
   6412      effectively meant GeneralizedTime would never be used. Now it
   6413      is initialised to -1 but X509_time_adj() now has to check the value
   6414      and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
   6415      V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
   6416      [Steve Henson, reported by Kenneth R. Robinette
   6417 				<support (a] securenetterm.com>]
   6418 
   6419   *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
   6420      result in a zero length in the ASN1_INTEGER structure which was
   6421      not consistent with the structure when d2i_ASN1_INTEGER() was used
   6422      and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
   6423      to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
   6424      where it did not print out a minus for negative ASN1_INTEGER.
   6425      [Steve Henson]
   6426 
   6427   *) Add summary printout to ocsp utility. The various functions which
   6428      convert status values to strings have been renamed to:
   6429      OCSP_response_status_str(), OCSP_cert_status_str() and
   6430      OCSP_crl_reason_str() and are no longer static. New options
   6431      to verify nonce values and to disable verification. OCSP response
   6432      printout format cleaned up.
   6433      [Steve Henson]
   6434 
   6435   *) Add additional OCSP certificate checks. These are those specified
   6436      in RFC2560. This consists of two separate checks: the CA of the
   6437      certificate being checked must either be the OCSP signer certificate
   6438      or the issuer of the OCSP signer certificate. In the latter case the
   6439      OCSP signer certificate must contain the OCSP signing extended key
   6440      usage. This check is performed by attempting to match the OCSP
   6441      signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
   6442      in the OCSP_CERTID structures of the response.
   6443      [Steve Henson]
   6444 
   6445   *) Initial OCSP certificate verification added to OCSP_basic_verify()
   6446      and related routines. This uses the standard OpenSSL certificate
   6447      verify routines to perform initial checks (just CA validity) and
   6448      to obtain the certificate chain. Then additional checks will be
   6449      performed on the chain. Currently the root CA is checked to see
   6450      if it is explicitly trusted for OCSP signing. This is used to set
   6451      a root CA as a global signing root: that is any certificate that
   6452      chains to that CA is an acceptable OCSP signing certificate.
   6453      [Steve Henson]
   6454 
   6455   *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
   6456      extensions from a separate configuration file.
   6457      As when reading extensions from the main configuration file,
   6458      the '-extensions ...' option may be used for specifying the
   6459      section to use.
   6460      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   6461 
   6462   *) New OCSP utility. Allows OCSP requests to be generated or
   6463      read. The request can be sent to a responder and the output
   6464      parsed, outputed or printed in text form. Not complete yet:
   6465      still needs to check the OCSP response validity.
   6466      [Steve Henson]
   6467 
   6468   *) New subcommands for 'openssl ca':
   6469      'openssl ca -status <serial>' prints the status of the cert with
   6470      the given serial number (according to the index file).
   6471      'openssl ca -updatedb' updates the expiry status of certificates
   6472      in the index file.
   6473      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   6474 
   6475   *) New '-newreq-nodes' command option to CA.pl.  This is like
   6476      '-newreq', but calls 'openssl req' with the '-nodes' option
   6477      so that the resulting key is not encrypted.
   6478      [Damien Miller <djm (a] mindrot.org>]
   6479 
   6480   *) New configuration for the GNU Hurd.
   6481      [Jonathan Bartlett <johnnyb (a] wolfram.com> via Richard Levitte]
   6482 
   6483   *) Initial code to implement OCSP basic response verify. This
   6484      is currently incomplete. Currently just finds the signer's
   6485      certificate and verifies the signature on the response.
   6486      [Steve Henson]
   6487 
   6488   *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
   6489      value of OPENSSLDIR.  This is available via the new '-d' option
   6490      to 'openssl version', and is also included in 'openssl version -a'.
   6491      [Bodo Moeller]
   6492 
   6493   *) Allowing defining memory allocation callbacks that will be given
   6494      file name and line number information in additional arguments
   6495      (a const char* and an int).  The basic functionality remains, as
   6496      well as the original possibility to just replace malloc(),
   6497      realloc() and free() by functions that do not know about these
   6498      additional arguments.  To register and find out the current
   6499      settings for extended allocation functions, the following
   6500      functions are provided:
   6501 
   6502 	CRYPTO_set_mem_ex_functions
   6503 	CRYPTO_set_locked_mem_ex_functions
   6504 	CRYPTO_get_mem_ex_functions
   6505 	CRYPTO_get_locked_mem_ex_functions
   6506 
   6507      These work the same way as CRYPTO_set_mem_functions and friends.
   6508      CRYPTO_get_[locked_]mem_functions now writes 0 where such an
   6509      extended allocation function is enabled.
   6510      Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
   6511      a conventional allocation function is enabled.
   6512      [Richard Levitte, Bodo Moeller]
   6513 
   6514   *) Finish off removing the remaining LHASH function pointer casts.
   6515      There should no longer be any prototype-casting required when using
   6516      the LHASH abstraction, and any casts that remain are "bugs". See
   6517      the callback types and macros at the head of lhash.h for details
   6518      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
   6519      [Geoff Thorpe]
   6520 
   6521   *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
   6522      If /dev/[u]random devices are not available or do not return enough
   6523      entropy, EGD style sockets (served by EGD or PRNGD) will automatically
   6524      be queried.
   6525      The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
   6526      /etc/entropy will be queried once each in this sequence, quering stops
   6527      when enough entropy was collected without querying more sockets.
   6528      [Lutz Jaenicke]
   6529 
   6530   *) Change the Unix RAND_poll() variant to be able to poll several
   6531      random devices, as specified by DEVRANDOM, until a sufficient amount
   6532      of data has been collected.   We spend at most 10 ms on each file
   6533      (select timeout) and read in non-blocking mode.  DEVRANDOM now
   6534      defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
   6535      (previously it was just the string "/dev/urandom"), so on typical
   6536      platforms the 10 ms delay will never occur.
   6537      Also separate out the Unix variant to its own file, rand_unix.c.
   6538      For VMS, there's a currently-empty rand_vms.c.
   6539      [Richard Levitte]
   6540 
   6541   *) Move OCSP client related routines to ocsp_cl.c. These
   6542      provide utility functions which an application needing
   6543      to issue a request to an OCSP responder and analyse the
   6544      response will typically need: as opposed to those which an
   6545      OCSP responder itself would need which will be added later.
   6546 
   6547      OCSP_request_sign() signs an OCSP request with an API similar
   6548      to PKCS7_sign(). OCSP_response_status() returns status of OCSP
   6549      response. OCSP_response_get1_basic() extracts basic response
   6550      from response. OCSP_resp_find_status(): finds and extracts status
   6551      information from an OCSP_CERTID structure (which will be created
   6552      when the request structure is built). These are built from lower
   6553      level functions which work on OCSP_SINGLERESP structures but
   6554      wont normally be used unless the application wishes to examine
   6555      extensions in the OCSP response for example.
   6556 
   6557      Replace nonce routines with a pair of functions.
   6558      OCSP_request_add1_nonce() adds a nonce value and optionally
   6559      generates a random value. OCSP_check_nonce() checks the
   6560      validity of the nonce in an OCSP response.
   6561      [Steve Henson]
   6562 
   6563   *) Change function OCSP_request_add() to OCSP_request_add0_id().
   6564      This doesn't copy the supplied OCSP_CERTID and avoids the
   6565      need to free up the newly created id. Change return type
   6566      to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
   6567      This can then be used to add extensions to the request.
   6568      Deleted OCSP_request_new(), since most of its functionality
   6569      is now in OCSP_REQUEST_new() (and the case insensitive name
   6570      clash) apart from the ability to set the request name which
   6571      will be added elsewhere.
   6572      [Steve Henson]
   6573 
   6574   *) Update OCSP API. Remove obsolete extensions argument from
   6575      various functions. Extensions are now handled using the new
   6576      OCSP extension code. New simple OCSP HTTP function which 
   6577      can be used to send requests and parse the response.
   6578      [Steve Henson]
   6579 
   6580   *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
   6581      ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
   6582      uses the special reorder version of SET OF to sort the attributes
   6583      and reorder them to match the encoded order. This resolves a long
   6584      standing problem: a verify on a PKCS7 structure just after signing
   6585      it used to fail because the attribute order did not match the
   6586      encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
   6587      it uses the received order. This is necessary to tolerate some broken
   6588      software that does not order SET OF. This is handled by encoding
   6589      as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
   6590      to produce the required SET OF.
   6591      [Steve Henson]
   6592 
   6593   *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
   6594      OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
   6595      files to get correct declarations of the ASN.1 item variables.
   6596      [Richard Levitte]
   6597 
   6598   *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
   6599      PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
   6600      asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
   6601      NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
   6602      New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
   6603      ASN1_ITEM and no wrapper functions.
   6604      [Steve Henson]
   6605 
   6606   *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
   6607      replace the old function pointer based I/O routines. Change most of
   6608      the *_d2i_bio() and *_d2i_fp() functions to use these.
   6609      [Steve Henson]
   6610 
   6611   *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
   6612      lines, recognice more "algorithms" that can be deselected, and make
   6613      it complain about algorithm deselection that isn't recognised.
   6614      [Richard Levitte]
   6615 
   6616   *) New ASN1 functions to handle dup, sign, verify, digest, pack and
   6617      unpack operations in terms of ASN1_ITEM. Modify existing wrappers
   6618      to use new functions. Add NO_ASN1_OLD which can be set to remove
   6619      some old style ASN1 functions: this can be used to determine if old
   6620      code will still work when these eventually go away.
   6621      [Steve Henson]
   6622 
   6623   *) New extension functions for OCSP structures, these follow the
   6624      same conventions as certificates and CRLs.
   6625      [Steve Henson]
   6626 
   6627   *) New function X509V3_add1_i2d(). This automatically encodes and
   6628      adds an extension. Its behaviour can be customised with various
   6629      flags to append, replace or delete. Various wrappers added for
   6630      certifcates and CRLs.
   6631      [Steve Henson]
   6632 
   6633   *) Fix to avoid calling the underlying ASN1 print routine when
   6634      an extension cannot be parsed. Correct a typo in the
   6635      OCSP_SERVICELOC extension. Tidy up print OCSP format.
   6636      [Steve Henson]
   6637 
   6638   *) Make mkdef.pl parse some of the ASN1 macros and add apropriate
   6639      entries for variables.
   6640      [Steve Henson]
   6641 
   6642   *) Add functionality to apps/openssl.c for detecting locking
   6643      problems: As the program is single-threaded, all we have
   6644      to do is register a locking callback using an array for
   6645      storing which locks are currently held by the program.
   6646      [Bodo Moeller]
   6647 
   6648   *) Use a lock around the call to CRYPTO_get_ex_new_index() in
   6649      SSL_get_ex_data_X509_STORE_idx(), which is used in
   6650      ssl_verify_cert_chain() and thus can be called at any time
   6651      during TLS/SSL handshakes so that thread-safety is essential.
   6652      Unfortunately, the ex_data design is not at all suited
   6653      for multi-threaded use, so it probably should be abolished.
   6654      [Bodo Moeller]
   6655 
   6656   *) Added Broadcom "ubsec" ENGINE to OpenSSL.
   6657      [Broadcom, tweaked and integrated by Geoff Thorpe]
   6658 
   6659   *) Move common extension printing code to new function
   6660      X509V3_print_extensions(). Reorganise OCSP print routines and
   6661      implement some needed OCSP ASN1 functions. Add OCSP extensions.
   6662      [Steve Henson]
   6663 
   6664   *) New function X509_signature_print() to remove duplication in some
   6665      print routines.
   6666      [Steve Henson]
   6667 
   6668   *) Add a special meaning when SET OF and SEQUENCE OF flags are both
   6669      set (this was treated exactly the same as SET OF previously). This
   6670      is used to reorder the STACK representing the structure to match the
   6671      encoding. This will be used to get round a problem where a PKCS7
   6672      structure which was signed could not be verified because the STACK
   6673      order did not reflect the encoded order.
   6674      [Steve Henson]
   6675 
   6676   *) Reimplement the OCSP ASN1 module using the new code.
   6677      [Steve Henson]
   6678 
   6679   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
   6680      for its ASN1 operations. The old style function pointers still exist
   6681      for now but they will eventually go away.
   6682      [Steve Henson]
   6683 
   6684   *) Merge in replacement ASN1 code from the ASN1 branch. This almost
   6685      completely replaces the old ASN1 functionality with a table driven
   6686      encoder and decoder which interprets an ASN1_ITEM structure describing
   6687      the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
   6688      largely maintained. Almost all of the old asn1_mac.h macro based ASN1
   6689      has also been converted to the new form.
   6690      [Steve Henson]
   6691 
   6692   *) Change BN_mod_exp_recp so that negative moduli are tolerated
   6693      (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
   6694      so that BN_mod_exp_mont and BN_mod_exp_mont_word work
   6695      for negative moduli.
   6696      [Bodo Moeller]
   6697 
   6698   *) Fix BN_uadd and BN_usub: Always return non-negative results instead
   6699      of not touching the result's sign bit.
   6700      [Bodo Moeller]
   6701 
   6702   *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
   6703      set.
   6704      [Bodo Moeller]
   6705 
   6706   *) Changed the LHASH code to use prototypes for callbacks, and created
   6707      macros to declare and implement thin (optionally static) functions
   6708      that provide type-safety and avoid function pointer casting for the
   6709      type-specific callbacks.
   6710      [Geoff Thorpe]
   6711 
   6712   *) Added Kerberos Cipher Suites to be used with TLS, as written in
   6713      RFC 2712.
   6714      [Veers Staats <staatsvr (a] asc.hpc.mil>,
   6715       Jeffrey Altman <jaltman (a] columbia.edu>, via Richard Levitte]
   6716 
   6717   *) Reformat the FAQ so the different questions and answers can be divided
   6718      in sections depending on the subject.
   6719      [Richard Levitte]
   6720 
   6721   *) Have the zlib compression code load ZLIB.DLL dynamically under
   6722      Windows.
   6723      [Richard Levitte]
   6724 
   6725   *) New function BN_mod_sqrt for computing square roots modulo a prime
   6726      (using the probabilistic Tonelli-Shanks algorithm unless
   6727      p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
   6728      be handled deterministically).
   6729      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   6730 
   6731   *) Make BN_mod_inverse faster by explicitly handling small quotients
   6732      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
   6733      512 bits], about 30% for larger ones [1024 or 2048 bits].)
   6734      [Bodo Moeller]
   6735 
   6736   *) New function BN_kronecker.
   6737      [Bodo Moeller]
   6738 
   6739   *) Fix BN_gcd so that it works on negative inputs; the result is
   6740      positive unless both parameters are zero.
   6741      Previously something reasonably close to an infinite loop was
   6742      possible because numbers could be growing instead of shrinking
   6743      in the implementation of Euclid's algorithm.
   6744      [Bodo Moeller]
   6745 
   6746   *) Fix BN_is_word() and BN_is_one() macros to take into account the
   6747      sign of the number in question.
   6748 
   6749      Fix BN_is_word(a,w) to work correctly for w == 0.
   6750 
   6751      The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
   6752      because its test if the absolute value of 'a' equals 'w'.
   6753      Note that BN_abs_is_word does *not* handle w == 0 reliably;
   6754      it exists mostly for use in the implementations of BN_is_zero(),
   6755      BN_is_one(), and BN_is_word().
   6756      [Bodo Moeller]
   6757 
   6758   *) New function BN_swap.
   6759      [Bodo Moeller]
   6760 
   6761   *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
   6762      the exponentiation functions are more likely to produce reasonable
   6763      results on negative inputs.
   6764      [Bodo Moeller]
   6765 
   6766   *) Change BN_mod_mul so that the result is always non-negative.
   6767      Previously, it could be negative if one of the factors was negative;
   6768      I don't think anyone really wanted that behaviour.
   6769      [Bodo Moeller]
   6770 
   6771   *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
   6772      (except for exponentiation, which stays in crypto/bn/bn_exp.c,
   6773      and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
   6774      and add new functions:
   6775 
   6776           BN_nnmod
   6777           BN_mod_sqr
   6778           BN_mod_add
   6779           BN_mod_add_quick
   6780           BN_mod_sub
   6781           BN_mod_sub_quick
   6782           BN_mod_lshift1
   6783           BN_mod_lshift1_quick
   6784           BN_mod_lshift
   6785           BN_mod_lshift_quick
   6786 
   6787      These functions always generate non-negative results.
   6788 
   6789      BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
   6790      such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
   6791 
   6792      BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
   6793      BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
   6794      be reduced modulo  m.
   6795      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   6796 
   6797 #if 0
   6798      The following entry accidentily appeared in the CHANGES file
   6799      distributed with OpenSSL 0.9.7.  The modifications described in
   6800      it do *not* apply to OpenSSL 0.9.7.
   6801 
   6802   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   6803      was actually never needed) and in BN_mul().  The removal in BN_mul()
   6804      required a small change in bn_mul_part_recursive() and the addition
   6805      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   6806      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   6807      bn_sub_words() and bn_add_words() except they take arrays with
   6808      differing sizes.
   6809      [Richard Levitte]
   6810 #endif
   6811 
   6812   *) In 'openssl passwd', verify passwords read from the terminal
   6813      unless the '-salt' option is used (which usually means that
   6814      verification would just waste user's time since the resulting
   6815      hash is going to be compared with some given password hash)
   6816      or the new '-noverify' option is used.
   6817 
   6818      This is an incompatible change, but it does not affect
   6819      non-interactive use of 'openssl passwd' (passwords on the command
   6820      line, '-stdin' option, '-in ...' option) and thus should not
   6821      cause any problems.
   6822      [Bodo Moeller]
   6823 
   6824   *) Remove all references to RSAref, since there's no more need for it.
   6825      [Richard Levitte]
   6826 
   6827   *) Make DSO load along a path given through an environment variable
   6828      (SHLIB_PATH) with shl_load().
   6829      [Richard Levitte]
   6830 
   6831   *) Constify the ENGINE code as a result of BIGNUM constification.
   6832      Also constify the RSA code and most things related to it.  In a
   6833      few places, most notable in the depth of the ASN.1 code, ugly
   6834      casts back to non-const were required (to be solved at a later
   6835      time)
   6836      [Richard Levitte]
   6837 
   6838   *) Make it so the openssl application has all engines loaded by default.
   6839      [Richard Levitte]
   6840 
   6841   *) Constify the BIGNUM routines a little more.
   6842      [Richard Levitte]
   6843 
   6844   *) Add the following functions:
   6845 
   6846 	ENGINE_load_cswift()
   6847 	ENGINE_load_chil()
   6848 	ENGINE_load_atalla()
   6849 	ENGINE_load_nuron()
   6850 	ENGINE_load_builtin_engines()
   6851 
   6852      That way, an application can itself choose if external engines that
   6853      are built-in in OpenSSL shall ever be used or not.  The benefit is
   6854      that applications won't have to be linked with libdl or other dso
   6855      libraries unless it's really needed.
   6856 
   6857      Changed 'openssl engine' to load all engines on demand.
   6858      Changed the engine header files to avoid the duplication of some
   6859      declarations (they differed!).
   6860      [Richard Levitte]
   6861 
   6862   *) 'openssl engine' can now list capabilities.
   6863      [Richard Levitte]
   6864 
   6865   *) Better error reporting in 'openssl engine'.
   6866      [Richard Levitte]
   6867 
   6868   *) Never call load_dh_param(NULL) in s_server.
   6869      [Bodo Moeller]
   6870 
   6871   *) Add engine application.  It can currently list engines by name and
   6872      identity, and test if they are actually available.
   6873      [Richard Levitte]
   6874 
   6875   *) Improve RPM specification file by forcing symbolic linking and making
   6876      sure the installed documentation is also owned by root.root.
   6877      [Damien Miller <djm (a] mindrot.org>]
   6878 
   6879   *) Give the OpenSSL applications more possibilities to make use of
   6880      keys (public as well as private) handled by engines.
   6881      [Richard Levitte]
   6882 
   6883   *) Add OCSP code that comes from CertCo.
   6884      [Richard Levitte]
   6885 
   6886   *) Add VMS support for the Rijndael code.
   6887      [Richard Levitte]
   6888 
   6889   *) Added untested support for Nuron crypto accelerator.
   6890      [Ben Laurie]
   6891 
   6892   *) Add support for external cryptographic devices.  This code was
   6893      previously distributed separately as the "engine" branch.
   6894      [Geoff Thorpe, Richard Levitte]
   6895 
   6896   *) Rework the filename-translation in the DSO code. It is now possible to
   6897      have far greater control over how a "name" is turned into a filename
   6898      depending on the operating environment and any oddities about the
   6899      different shared library filenames on each system.
   6900      [Geoff Thorpe]
   6901 
   6902   *) Support threads on FreeBSD-elf in Configure.
   6903      [Richard Levitte]
   6904 
   6905   *) Fix for SHA1 assembly problem with MASM: it produces
   6906      warnings about corrupt line number information when assembling
   6907      with debugging information. This is caused by the overlapping
   6908      of two sections.
   6909      [Bernd Matthes <mainbug (a] celocom.de>, Steve Henson]
   6910 
   6911   *) NCONF changes.
   6912      NCONF_get_number() has no error checking at all.  As a replacement,
   6913      NCONF_get_number_e() is defined (_e for "error checking") and is
   6914      promoted strongly.  The old NCONF_get_number is kept around for
   6915      binary backward compatibility.
   6916      Make it possible for methods to load from something other than a BIO,
   6917      by providing a function pointer that is given a name instead of a BIO.
   6918      For example, this could be used to load configuration data from an
   6919      LDAP server.
   6920      [Richard Levitte]
   6921 
   6922   *) Fix for non blocking accept BIOs. Added new I/O special reason
   6923      BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
   6924      with non blocking I/O was not possible because no retry code was
   6925      implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
   6926      this case.
   6927      [Steve Henson]
   6928 
   6929   *) Added the beginnings of Rijndael support.
   6930      [Ben Laurie]
   6931 
   6932   *) Fix for bug in DirectoryString mask setting. Add support for
   6933      X509_NAME_print_ex() in 'req' and X509_print_ex() function
   6934      to allow certificate printing to more controllable, additional
   6935      'certopt' option to 'x509' to allow new printing options to be
   6936      set.
   6937      [Steve Henson]
   6938 
   6939   *) Clean old EAY MD5 hack from e_os.h.
   6940      [Richard Levitte]
   6941 
   6942  Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
   6943 
   6944   *) Fix null-pointer assignment in do_change_cipher_spec() revealed
   6945      by using the Codenomicon TLS Test Tool (CVE-2004-0079)
   6946      [Joe Orton, Steve Henson]
   6947 
   6948  Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
   6949 
   6950   *) Fix additional bug revealed by the NISCC test suite:
   6951 
   6952      Stop bug triggering large recursion when presented with
   6953      certain ASN.1 tags (CVE-2003-0851)
   6954      [Steve Henson]
   6955 
   6956  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
   6957 
   6958   *) Fix various bugs revealed by running the NISCC test suite:
   6959 
   6960      Stop out of bounds reads in the ASN1 code when presented with
   6961      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   6962      
   6963      If verify callback ignores invalid public key errors don't try to check
   6964      certificate signature with the NULL public key.
   6965 
   6966      [Steve Henson]
   6967 
   6968   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   6969      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   6970      specifications.
   6971      [Steve Henson]
   6972 
   6973   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   6974      extra data after the compression methods not only for TLS 1.0
   6975      but also for SSL 3.0 (as required by the specification).
   6976      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   6977 
   6978   *) Change X509_certificate_type() to mark the key as exported/exportable
   6979      when it's 512 *bits* long, not 512 bytes.
   6980      [Richard Levitte]
   6981 
   6982  Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
   6983 
   6984   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   6985      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   6986      a protocol version number mismatch like a decryption error
   6987      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   6988      [Bodo Moeller]
   6989 
   6990   *) Turn on RSA blinding by default in the default implementation
   6991      to avoid a timing attack. Applications that don't want it can call
   6992      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   6993      They would be ill-advised to do so in most cases.
   6994      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   6995 
   6996   *) Change RSA blinding code so that it works when the PRNG is not
   6997      seeded (in this case, the secret RSA exponent is abused as
   6998      an unpredictable seed -- if it is not unpredictable, there
   6999      is no point in blinding anyway).  Make RSA blinding thread-safe
   7000      by remembering the creator's thread ID in rsa->blinding and
   7001      having all other threads use local one-time blinding factors
   7002      (this requires more computation than sharing rsa->blinding, but
   7003      avoids excessive locking; and if an RSA object is not shared
   7004      between threads, blinding will still be very fast).
   7005      [Bodo Moeller]
   7006 
   7007  Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
   7008 
   7009   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   7010      via timing by performing a MAC computation even if incorrrect
   7011      block cipher padding has been found.  This is a countermeasure
   7012      against active attacks where the attacker has to distinguish
   7013      between bad padding and a MAC verification error. (CVE-2003-0078)
   7014 
   7015      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   7016      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   7017      Martin Vuagnoux (EPFL, Ilion)]
   7018 
   7019  Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
   7020 
   7021   *) New function OPENSSL_cleanse(), which is used to cleanse a section of
   7022      memory from it's contents.  This is done with a counter that will
   7023      place alternating values in each byte.  This can be used to solve
   7024      two issues: 1) the removal of calls to memset() by highly optimizing
   7025      compilers, and 2) cleansing with other values than 0, since those can
   7026      be read through on certain media, for example a swap space on disk.
   7027      [Geoff Thorpe]
   7028 
   7029   *) Bugfix: client side session caching did not work with external caching,
   7030      because the session->cipher setting was not restored when reloading
   7031      from the external cache. This problem was masked, when
   7032      SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
   7033      (Found by Steve Haslam <steve (a] araqnid.ddts.net>.)
   7034      [Lutz Jaenicke]
   7035 
   7036   *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
   7037      length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
   7038      [Zeev Lieber <zeev-l (a] yahoo.com>]
   7039 
   7040   *) Undo an undocumented change introduced in 0.9.6e which caused
   7041      repeated calls to OpenSSL_add_all_ciphers() and 
   7042      OpenSSL_add_all_digests() to be ignored, even after calling
   7043      EVP_cleanup().
   7044      [Richard Levitte]
   7045 
   7046   *) Change the default configuration reader to deal with last line not
   7047      being properly terminated.
   7048      [Richard Levitte]
   7049 
   7050   *) Change X509_NAME_cmp() so it applies the special rules on handling
   7051      DN values that are of type PrintableString, as well as RDNs of type
   7052      emailAddress where the value has the type ia5String.
   7053      [stefank (a] valicert.com via Richard Levitte]
   7054 
   7055   *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
   7056      the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
   7057      doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
   7058      the bitwise-OR of the two for use by the majority of applications
   7059      wanting this behaviour, and update the docs. The documented
   7060      behaviour and actual behaviour were inconsistent and had been
   7061      changing anyway, so this is more a bug-fix than a behavioural
   7062      change.
   7063      [Geoff Thorpe, diagnosed by Nadav Har'El]
   7064 
   7065   *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
   7066      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
   7067      [Bodo Moeller]
   7068 
   7069   *) Fix initialization code race conditions in
   7070         SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
   7071         SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
   7072         SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
   7073         TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
   7074         ssl2_get_cipher_by_char(),
   7075         ssl3_get_cipher_by_char().
   7076      [Patrick McCormick <patrick (a] tellme.com>, Bodo Moeller]
   7077 
   7078   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
   7079      the cached sessions are flushed, as the remove_cb() might use ex_data
   7080      contents. Bug found by Sam Varshavchik <mrsam (a] courier-mta.com>
   7081      (see [openssl.org #212]).
   7082      [Geoff Thorpe, Lutz Jaenicke]
   7083 
   7084   *) Fix typo in OBJ_txt2obj which incorrectly passed the content
   7085      length, instead of the encoding length to d2i_ASN1_OBJECT.
   7086      [Steve Henson]
   7087 
   7088  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
   7089 
   7090   *) [In 0.9.6g-engine release:]
   7091      Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
   7092      [Lynn Gazis <lgazis (a] rainbow.com>]
   7093 
   7094  Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
   7095 
   7096   *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
   7097      and get fix the header length calculation.
   7098      [Florian Weimer <Weimer (a] CERT.Uni-Stuttgart.DE>,
   7099 	Alon Kantor <alonk (a] checkpoint.com> (and others),
   7100 	Steve Henson]
   7101 
   7102   *) Use proper error handling instead of 'assertions' in buffer
   7103      overflow checks added in 0.9.6e.  This prevents DoS (the
   7104      assertions could call abort()).
   7105      [Arne Ansper <arne (a] ats.cyber.ee>, Bodo Moeller]
   7106 
   7107  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
   7108 
   7109   *) Add various sanity checks to asn1_get_length() to reject
   7110      the ASN1 length bytes if they exceed sizeof(long), will appear
   7111      negative or the content length exceeds the length of the
   7112      supplied buffer.
   7113      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   7114 
   7115   *) Fix cipher selection routines: ciphers without encryption had no flags
   7116      for the cipher strength set and where therefore not handled correctly
   7117      by the selection routines (PR #130).
   7118      [Lutz Jaenicke]
   7119 
   7120   *) Fix EVP_dsa_sha macro.
   7121      [Nils Larsch]
   7122 
   7123   *) New option
   7124           SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
   7125      for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
   7126      that was added in OpenSSL 0.9.6d.
   7127 
   7128      As the countermeasure turned out to be incompatible with some
   7129      broken SSL implementations, the new option is part of SSL_OP_ALL.
   7130      SSL_OP_ALL is usually employed when compatibility with weird SSL
   7131      implementations is desired (e.g. '-bugs' option to 's_client' and
   7132      's_server'), so the new option is automatically set in many
   7133      applications.
   7134      [Bodo Moeller]
   7135 
   7136   *) Changes in security patch:
   7137 
   7138      Changes marked "(CHATS)" were sponsored by the Defense Advanced
   7139      Research Projects Agency (DARPA) and Air Force Research Laboratory,
   7140      Air Force Materiel Command, USAF, under agreement number
   7141      F30602-01-2-0537.
   7142 
   7143   *) Add various sanity checks to asn1_get_length() to reject
   7144      the ASN1 length bytes if they exceed sizeof(long), will appear
   7145      negative or the content length exceeds the length of the
   7146      supplied buffer. (CVE-2002-0659)
   7147      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   7148 
   7149   *) Assertions for various potential buffer overflows, not known to
   7150      happen in practice.
   7151      [Ben Laurie (CHATS)]
   7152 
   7153   *) Various temporary buffers to hold ASCII versions of integers were
   7154      too small for 64 bit platforms. (CVE-2002-0655)
   7155      [Matthew Byng-Maddick <mbm (a] aldigital.co.uk> and Ben Laurie (CHATS)>
   7156 
   7157   *) Remote buffer overflow in SSL3 protocol - an attacker could
   7158      supply an oversized session ID to a client. (CVE-2002-0656)
   7159      [Ben Laurie (CHATS)]
   7160 
   7161   *) Remote buffer overflow in SSL2 protocol - an attacker could
   7162      supply an oversized client master key. (CVE-2002-0656)
   7163      [Ben Laurie (CHATS)]
   7164 
   7165  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
   7166 
   7167   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
   7168      encoded as NULL) with id-dsa-with-sha1.
   7169      [Nils Larsch <nla (a] trustcenter.de>; problem pointed out by Bodo Moeller]
   7170 
   7171   *) Check various X509_...() return values in apps/req.c.
   7172      [Nils Larsch <nla (a] trustcenter.de>]
   7173 
   7174   *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
   7175      an end-of-file condition would erronously be flagged, when the CRLF
   7176      was just at the end of a processed block. The bug was discovered when
   7177      processing data through a buffering memory BIO handing the data to a
   7178      BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
   7179      <ptsekov (a] syntrex.com> and Nedelcho Stanev.
   7180      [Lutz Jaenicke]
   7181 
   7182   *) Implement a countermeasure against a vulnerability recently found
   7183      in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
   7184      before application data chunks to avoid the use of known IVs
   7185      with data potentially chosen by the attacker.
   7186      [Bodo Moeller]
   7187 
   7188   *) Fix length checks in ssl3_get_client_hello().
   7189      [Bodo Moeller]
   7190 
   7191   *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
   7192      to prevent ssl3_read_internal() from incorrectly assuming that
   7193      ssl3_read_bytes() found application data while handshake
   7194      processing was enabled when in fact s->s3->in_read_app_data was
   7195      merely automatically cleared during the initial handshake.
   7196      [Bodo Moeller; problem pointed out by Arne Ansper <arne (a] ats.cyber.ee>]
   7197 
   7198   *) Fix object definitions for Private and Enterprise: they were not
   7199      recognized in their shortname (=lowercase) representation. Extend
   7200      obj_dat.pl to issue an error when using undefined keywords instead
   7201      of silently ignoring the problem (Svenning Sorensen
   7202      <sss (a] sss.dnsalias.net>).
   7203      [Lutz Jaenicke]
   7204 
   7205   *) Fix DH_generate_parameters() so that it works for 'non-standard'
   7206      generators, i.e. generators other than 2 and 5.  (Previously, the
   7207      code did not properly initialise the 'add' and 'rem' values to
   7208      BN_generate_prime().)
   7209 
   7210      In the new general case, we do not insist that 'generator' is
   7211      actually a primitive root: This requirement is rather pointless;
   7212      a generator of the order-q subgroup is just as good, if not
   7213      better.
   7214      [Bodo Moeller]
   7215  
   7216   *) Map new X509 verification errors to alerts. Discovered and submitted by
   7217      Tom Wu <tom (a] arcot.com>.
   7218      [Lutz Jaenicke]
   7219 
   7220   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
   7221      returning non-zero before the data has been completely received
   7222      when using non-blocking I/O.
   7223      [Bodo Moeller; problem pointed out by John Hughes]
   7224 
   7225   *) Some of the ciphers missed the strength entry (SSL_LOW etc).
   7226      [Ben Laurie, Lutz Jaenicke]
   7227 
   7228   *) Fix bug in SSL_clear(): bad sessions were not removed (found by
   7229      Yoram Zahavi <YoramZ (a] gilian.com>).
   7230      [Lutz Jaenicke]
   7231 
   7232   *) Add information about CygWin 1.3 and on, and preserve proper
   7233      configuration for the versions before that.
   7234      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   7235 
   7236   *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
   7237      check whether we deal with a copy of a session and do not delete from
   7238      the cache in this case. Problem reported by "Izhar Shoshani Levi"
   7239      <izhar (a] checkpoint.com>.
   7240      [Lutz Jaenicke]
   7241 
   7242   *) Do not store session data into the internal session cache, if it
   7243      is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
   7244      flag is set). Proposed by Aslam <aslam (a] funk.com>.
   7245      [Lutz Jaenicke]
   7246 
   7247   *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
   7248      value is 0.
   7249      [Richard Levitte]
   7250 
   7251   *) [In 0.9.6d-engine release:]
   7252      Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   7253      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   7254 
   7255   *) Add the configuration target linux-s390x.
   7256      [Neale Ferguson <Neale.Ferguson (a] SoftwareAG-USA.com> via Richard Levitte]
   7257 
   7258   *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
   7259      ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
   7260      variable as an indication that a ClientHello message has been
   7261      received.  As the flag value will be lost between multiple
   7262      invocations of ssl3_accept when using non-blocking I/O, the
   7263      function may not be aware that a handshake has actually taken
   7264      place, thus preventing a new session from being added to the
   7265      session cache.
   7266 
   7267      To avoid this problem, we now set s->new_session to 2 instead of
   7268      using a local variable.
   7269      [Lutz Jaenicke, Bodo Moeller]
   7270 
   7271   *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
   7272      if the SSL_R_LENGTH_MISMATCH error is detected.
   7273      [Geoff Thorpe, Bodo Moeller]
   7274 
   7275   *) New 'shared_ldflag' column in Configure platform table.
   7276      [Richard Levitte]
   7277 
   7278   *) Fix EVP_CIPHER_mode macro.
   7279      ["Dan S. Camper" <dan (a] bti.net>]
   7280 
   7281   *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
   7282      type, we must throw them away by setting rr->length to 0.
   7283      [D P Chang <dpc (a] qualys.com>]
   7284 
   7285  Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
   7286 
   7287   *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
   7288      <Dominikus.Scherkl (a] biodata.com>.  (The previous implementation
   7289      worked incorrectly for those cases where  range = 10..._2  and
   7290      3*range  is two bits longer than  range.)
   7291      [Bodo Moeller]
   7292 
   7293   *) Only add signing time to PKCS7 structures if it is not already
   7294      present.
   7295      [Steve Henson]
   7296 
   7297   *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
   7298      OBJ_ld_ce should be OBJ_id_ce.
   7299      Also some ip-pda OIDs in crypto/objects/objects.txt were
   7300      incorrect (cf. RFC 3039).
   7301      [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
   7302 
   7303   *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
   7304      returns early because it has nothing to do.
   7305      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   7306 
   7307   *) [In 0.9.6c-engine release:]
   7308      Fix mutex callback return values in crypto/engine/hw_ncipher.c.
   7309      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   7310 
   7311   *) [In 0.9.6c-engine release:]
   7312      Add support for Cryptographic Appliance's keyserver technology.
   7313      (Use engine 'keyclient')
   7314      [Cryptographic Appliances and Geoff Thorpe]
   7315 
   7316   *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
   7317      is called via tools/c89.sh because arguments have to be
   7318      rearranged (all '-L' options must appear before the first object
   7319      modules).
   7320      [Richard Shapiro <rshapiro (a] abinitio.com>]
   7321 
   7322   *) [In 0.9.6c-engine release:]
   7323      Add support for Broadcom crypto accelerator cards, backported
   7324      from 0.9.7.
   7325      [Broadcom, Nalin Dahyabhai <nalin (a] redhat.com>, Mark Cox]
   7326 
   7327   *) [In 0.9.6c-engine release:]
   7328      Add support for SureWare crypto accelerator cards from 
   7329      Baltimore Technologies.  (Use engine 'sureware')
   7330      [Baltimore Technologies and Mark Cox]
   7331 
   7332   *) [In 0.9.6c-engine release:]
   7333      Add support for crypto accelerator cards from Accelerated
   7334      Encryption Processing, www.aep.ie.  (Use engine 'aep')
   7335      [AEP Inc. and Mark Cox]
   7336 
   7337   *) Add a configuration entry for gcc on UnixWare.
   7338      [Gary Benson <gbenson (a] redhat.com>]
   7339 
   7340   *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
   7341      messages are stored in a single piece (fixed-length part and
   7342      variable-length part combined) and fix various bugs found on the way.
   7343      [Bodo Moeller]
   7344 
   7345   *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
   7346      instead.  BIO_gethostbyname() does not know what timeouts are
   7347      appropriate, so entries would stay in cache even when they have
   7348      become invalid.
   7349      [Bodo Moeller; problem pointed out by Rich Salz <rsalz (a] zolera.com>
   7350 
   7351   *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
   7352      faced with a pathologically small ClientHello fragment that does
   7353      not contain client_version: Instead of aborting with an error,
   7354      simply choose the highest available protocol version (i.e.,
   7355      TLS 1.0 unless it is disabled).  In practice, ClientHello
   7356      messages are never sent like this, but this change gives us
   7357      strictly correct behaviour at least for TLS.
   7358      [Bodo Moeller]
   7359 
   7360   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
   7361      never resets s->method to s->ctx->method when called from within
   7362      one of the SSL handshake functions.
   7363      [Bodo Moeller; problem pointed out by Niko Baric]
   7364 
   7365   *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
   7366      (sent using the client's version number) if client_version is
   7367      smaller than the protocol version in use.  Also change
   7368      ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
   7369      the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
   7370      the client will at least see that alert.
   7371      [Bodo Moeller]
   7372 
   7373   *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
   7374      correctly.
   7375      [Bodo Moeller]
   7376 
   7377   *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
   7378      client receives HelloRequest while in a handshake.
   7379      [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider (a] bjss.co.uk>]
   7380 
   7381   *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
   7382      should end in 'break', not 'goto end' which circuments various
   7383      cleanups done in state SSL_ST_OK.   But session related stuff
   7384      must be disabled for SSL_ST_OK in the case that we just sent a
   7385      HelloRequest.
   7386 
   7387      Also avoid some overhead by not calling ssl_init_wbio_buffer()
   7388      before just sending a HelloRequest.
   7389      [Bodo Moeller, Eric Rescorla <ekr (a] rtfm.com>]
   7390 
   7391   *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
   7392      reveal whether illegal block cipher padding was found or a MAC
   7393      verification error occured.  (Neither SSLerr() codes nor alerts
   7394      are directly visible to potential attackers, but the information
   7395      may leak via logfiles.)
   7396 
   7397      Similar changes are not required for the SSL 2.0 implementation
   7398      because the number of padding bytes is sent in clear for SSL 2.0,
   7399      and the extra bytes are just ignored.  However ssl/s2_pkt.c
   7400      failed to verify that the purported number of padding bytes is in
   7401      the legal range.
   7402      [Bodo Moeller]
   7403 
   7404   *) Add OpenUNIX-8 support including shared libraries
   7405      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   7406      [Lutz Jaenicke]
   7407 
   7408   *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
   7409      'wristwatch attack' using huge encoding parameters (cf.
   7410      James H. Manger's CRYPTO 2001 paper).  Note that the
   7411      RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
   7412      encoding parameters and hence was not vulnerable.
   7413      [Bodo Moeller]
   7414 
   7415   *) BN_sqr() bug fix.
   7416      [Ulf Mller, reported by Jim Ellis <jim.ellis (a] cavium.com>]
   7417 
   7418   *) Rabin-Miller test analyses assume uniformly distributed witnesses,
   7419      so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
   7420      followed by modular reduction.
   7421      [Bodo Moeller; pointed out by Adam Young <AYoung1 (a] NCSUS.JNJ.COM>]
   7422 
   7423   *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
   7424      equivalent based on BN_pseudo_rand() instead of BN_rand().
   7425      [Bodo Moeller]
   7426 
   7427   *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
   7428      This function was broken, as the check for a new client hello message
   7429      to handle SGC did not allow these large messages.
   7430      (Tracked down by "Douglas E. Engert" <deengert (a] anl.gov>.)
   7431      [Lutz Jaenicke]
   7432 
   7433   *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
   7434      [Lutz Jaenicke]
   7435 
   7436   *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
   7437      for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton (a] netopia.com>).
   7438      [Lutz Jaenicke]
   7439 
   7440   *) Rework the configuration and shared library support for Tru64 Unix.
   7441      The configuration part makes use of modern compiler features and
   7442      still retains old compiler behavior for those that run older versions
   7443      of the OS.  The shared library support part includes a variant that
   7444      uses the RPATH feature, and is available through the special
   7445      configuration target "alpha-cc-rpath", which will never be selected
   7446      automatically.
   7447      [Tim Mooney <mooney (a] dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
   7448 
   7449   *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
   7450      with the same message size as in ssl3_get_certificate_request().
   7451      Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
   7452      messages might inadvertently be reject as too long.
   7453      [Petr Lampa <lampa (a] fee.vutbr.cz>]
   7454 
   7455   *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
   7456      [Andy Polyakov]
   7457 
   7458   *) Modified SSL library such that the verify_callback that has been set
   7459      specificly for an SSL object with SSL_set_verify() is actually being
   7460      used. Before the change, a verify_callback set with this function was
   7461      ignored and the verify_callback() set in the SSL_CTX at the time of
   7462      the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
   7463      to allow the necessary settings.
   7464      [Lutz Jaenicke]
   7465 
   7466   *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
   7467      explicitly to NULL, as at least on Solaris 8 this seems not always to be
   7468      done automatically (in contradiction to the requirements of the C
   7469      standard). This made problems when used from OpenSSH.
   7470      [Lutz Jaenicke]
   7471 
   7472   *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
   7473      dh->length and always used
   7474 
   7475           BN_rand_range(priv_key, dh->p).
   7476 
   7477      BN_rand_range() is not necessary for Diffie-Hellman, and this
   7478      specific range makes Diffie-Hellman unnecessarily inefficient if
   7479      dh->length (recommended exponent length) is much smaller than the
   7480      length of dh->p.  We could use BN_rand_range() if the order of
   7481      the subgroup was stored in the DH structure, but we only have
   7482      dh->length.
   7483 
   7484      So switch back to
   7485 
   7486           BN_rand(priv_key, l, ...)
   7487 
   7488      where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
   7489      otherwise.
   7490      [Bodo Moeller]
   7491 
   7492   *) In
   7493 
   7494           RSA_eay_public_encrypt
   7495           RSA_eay_private_decrypt
   7496           RSA_eay_private_encrypt (signing)
   7497           RSA_eay_public_decrypt (signature verification)
   7498 
   7499      (default implementations for RSA_public_encrypt,
   7500      RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
   7501      always reject numbers >= n.
   7502      [Bodo Moeller]
   7503 
   7504   *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
   7505      to synchronize access to 'locking_thread'.  This is necessary on
   7506      systems where access to 'locking_thread' (an 'unsigned long'
   7507      variable) is not atomic.
   7508      [Bodo Moeller]
   7509 
   7510   *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
   7511      *before* setting the 'crypto_lock_rand' flag.  The previous code had
   7512      a race condition if 0 is a valid thread ID.
   7513      [Travis Vitek <vitek (a] roguewave.com>]
   7514 
   7515   *) Add support for shared libraries under Irix.
   7516      [Albert Chin-A-Young <china (a] thewrittenword.com>]
   7517 
   7518   *) Add configuration option to build on Linux on both big-endian and
   7519      little-endian MIPS.
   7520      [Ralf Baechle <ralf (a] uni-koblenz.de>]
   7521 
   7522   *) Add the possibility to create shared libraries on HP-UX.
   7523      [Richard Levitte]
   7524 
   7525  Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
   7526 
   7527   *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
   7528      to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
   7529      Markku-Juhani O. Saarinen <markku-juhani.saarinen (a] nokia.com>:
   7530      PRNG state recovery was possible based on the output of
   7531      one PRNG request appropriately sized to gain knowledge on
   7532      'md' followed by enough consecutive 1-byte PRNG requests
   7533      to traverse all of 'state'.
   7534 
   7535      1. When updating 'md_local' (the current thread's copy of 'md')
   7536         during PRNG output generation, hash all of the previous
   7537         'md_local' value, not just the half used for PRNG output.
   7538 
   7539      2. Make the number of bytes from 'state' included into the hash
   7540         independent from the number of PRNG bytes requested.
   7541 
   7542      The first measure alone would be sufficient to avoid
   7543      Markku-Juhani's attack.  (Actually it had never occurred
   7544      to me that the half of 'md_local' used for chaining was the
   7545      half from which PRNG output bytes were taken -- I had always
   7546      assumed that the secret half would be used.)  The second
   7547      measure makes sure that additional data from 'state' is never
   7548      mixed into 'md_local' in small portions; this heuristically
   7549      further strengthens the PRNG.
   7550      [Bodo Moeller]
   7551 
   7552   *) Fix crypto/bn/asm/mips3.s.
   7553      [Andy Polyakov]
   7554 
   7555   *) When only the key is given to "enc", the IV is undefined. Print out
   7556      an error message in this case.
   7557      [Lutz Jaenicke]
   7558 
   7559   *) Handle special case when X509_NAME is empty in X509 printing routines.
   7560      [Steve Henson]
   7561 
   7562   *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
   7563      positive and less than q.
   7564      [Bodo Moeller]
   7565 
   7566   *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
   7567      used: it isn't thread safe and the add_lock_callback should handle
   7568      that itself.
   7569      [Paul Rose <Paul.Rose (a] bridge.com>]
   7570 
   7571   *) Verify that incoming data obeys the block size in
   7572      ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
   7573      [Bodo Moeller]
   7574 
   7575   *) Fix OAEP check.
   7576      [Ulf Mller, Bodo Mller]
   7577 
   7578   *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
   7579      RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
   7580      when fixing the server behaviour for backwards-compatible 'client
   7581      hello' messages.  (Note that the attack is impractical against
   7582      SSL 3.0 and TLS 1.0 anyway because length and version checking
   7583      means that the probability of guessing a valid ciphertext is
   7584      around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
   7585      paper.)
   7586 
   7587      Before 0.9.5, the countermeasure (hide the error by generating a
   7588      random 'decryption result') did not work properly because
   7589      ERR_clear_error() was missing, meaning that SSL_get_error() would
   7590      detect the supposedly ignored error.
   7591 
   7592      Both problems are now fixed.
   7593      [Bodo Moeller]
   7594 
   7595   *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
   7596      (previously it was 1024).
   7597      [Bodo Moeller]
   7598 
   7599   *) Fix for compatibility mode trust settings: ignore trust settings
   7600      unless some valid trust or reject settings are present.
   7601      [Steve Henson]
   7602 
   7603   *) Fix for blowfish EVP: its a variable length cipher.
   7604      [Steve Henson]
   7605 
   7606   *) Fix various bugs related to DSA S/MIME verification. Handle missing
   7607      parameters in DSA public key structures and return an error in the
   7608      DSA routines if parameters are absent.
   7609      [Steve Henson]
   7610 
   7611   *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
   7612      in the current directory if neither $RANDFILE nor $HOME was set.
   7613      RAND_file_name() in 0.9.6a returned NULL in this case.  This has
   7614      caused some confusion to Windows users who haven't defined $HOME.
   7615      Thus RAND_file_name() is changed again: e_os.h can define a
   7616      DEFAULT_HOME, which will be used if $HOME is not set.
   7617      For Windows, we use "C:"; on other platforms, we still require
   7618      environment variables.
   7619 
   7620   *) Move 'if (!initialized) RAND_poll()' into regions protected by
   7621      CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
   7622      having multiple threads call RAND_poll() concurrently.
   7623      [Bodo Moeller]
   7624 
   7625   *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
   7626      combination of a flag and a thread ID variable.
   7627      Otherwise while one thread is in ssleay_rand_bytes (which sets the
   7628      flag), *other* threads can enter ssleay_add_bytes without obeying
   7629      the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
   7630      that they do not hold after the first thread unsets add_do_not_lock).
   7631      [Bodo Moeller]
   7632 
   7633   *) Change bctest again: '-x' expressions are not available in all
   7634      versions of 'test'.
   7635      [Bodo Moeller]
   7636 
   7637  Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
   7638 
   7639   *) Fix a couple of memory leaks in PKCS7_dataDecode()
   7640      [Steve Henson, reported by Heyun Zheng <hzheng (a] atdsprint.com>]
   7641 
   7642   *) Change Configure and Makefiles to provide EXE_EXT, which will contain
   7643      the default extension for executables, if any.  Also, make the perl
   7644      scripts that use symlink() to test if it really exists and use "cp"
   7645      if it doesn't.  All this made OpenSSL compilable and installable in
   7646      CygWin.
   7647      [Richard Levitte]
   7648 
   7649   *) Fix for asn1_GetSequence() for indefinite length constructed data.
   7650      If SEQUENCE is length is indefinite just set c->slen to the total
   7651      amount of data available.
   7652      [Steve Henson, reported by shige (a] FreeBSD.org]
   7653      [This change does not apply to 0.9.7.]
   7654 
   7655   *) Change bctest to avoid here-documents inside command substitution
   7656      (workaround for FreeBSD /bin/sh bug).
   7657      For compatibility with Ultrix, avoid shell functions (introduced
   7658      in the bctest version that searches along $PATH).
   7659      [Bodo Moeller]
   7660 
   7661   *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
   7662      with des_encrypt() defined on some operating systems, like Solaris
   7663      and UnixWare.
   7664      [Richard Levitte]
   7665 
   7666   *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
   7667      On the Importance of Eliminating Errors in Cryptographic
   7668      Computations, J. Cryptology 14 (2001) 2, 101-119,
   7669      http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
   7670      [Ulf Moeller]
   7671   
   7672   *) MIPS assembler BIGNUM division bug fix. 
   7673      [Andy Polyakov]
   7674 
   7675   *) Disabled incorrect Alpha assembler code.
   7676      [Richard Levitte]
   7677 
   7678   *) Fix PKCS#7 decode routines so they correctly update the length
   7679      after reading an EOC for the EXPLICIT tag.
   7680      [Steve Henson]
   7681      [This change does not apply to 0.9.7.]
   7682 
   7683   *) Fix bug in PKCS#12 key generation routines. This was triggered
   7684      if a 3DES key was generated with a 0 initial byte. Include
   7685      PKCS12_BROKEN_KEYGEN compilation option to retain the old
   7686      (but broken) behaviour.
   7687      [Steve Henson]
   7688 
   7689   *) Enhance bctest to search for a working bc along $PATH and print
   7690      it when found.
   7691      [Tim Rice <tim (a] multitalents.net> via Richard Levitte]
   7692 
   7693   *) Fix memory leaks in err.c: free err_data string if necessary;
   7694      don't write to the wrong index in ERR_set_error_data.
   7695      [Bodo Moeller]
   7696 
   7697   *) Implement ssl23_peek (analogous to ssl23_read), which previously
   7698      did not exist.
   7699      [Bodo Moeller]
   7700 
   7701   *) Replace rdtsc with _emit statements for VC++ version 5.
   7702      [Jeremy Cooper <jeremy (a] baymoo.org>]
   7703 
   7704   *) Make it possible to reuse SSLv2 sessions.
   7705      [Richard Levitte]
   7706 
   7707   *) In copy_email() check for >= 0 as a return value for
   7708      X509_NAME_get_index_by_NID() since 0 is a valid index.
   7709      [Steve Henson reported by Massimiliano Pala <madwolf (a] opensca.org>]
   7710 
   7711   *) Avoid coredump with unsupported or invalid public keys by checking if
   7712      X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
   7713      PKCS7_verify() fails with non detached data.
   7714      [Steve Henson]
   7715 
   7716   *) Don't use getenv in library functions when run as setuid/setgid.
   7717      New function OPENSSL_issetugid().
   7718      [Ulf Moeller]
   7719 
   7720   *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
   7721      due to incorrect handling of multi-threading:
   7722 
   7723      1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
   7724 
   7725      2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
   7726 
   7727      3. Count how many times MemCheck_off() has been called so that
   7728         nested use can be treated correctly.  This also avoids 
   7729         inband-signalling in the previous code (which relied on the
   7730         assumption that thread ID 0 is impossible).
   7731      [Bodo Moeller]
   7732 
   7733   *) Add "-rand" option also to s_client and s_server.
   7734      [Lutz Jaenicke]
   7735 
   7736   *) Fix CPU detection on Irix 6.x.
   7737      [Kurt Hockenbury <khockenb (a] stevens-tech.edu> and
   7738       "Bruce W. Forsberg" <bruce.forsberg (a] baesystems.com>]
   7739 
   7740   *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
   7741      was empty.
   7742      [Steve Henson]
   7743      [This change does not apply to 0.9.7.]
   7744 
   7745   *) Use the cached encoding of an X509_NAME structure rather than
   7746      copying it. This is apparently the reason for the libsafe "errors"
   7747      but the code is actually correct.
   7748      [Steve Henson]
   7749 
   7750   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
   7751      Bleichenbacher's DSA attack.
   7752      Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
   7753      to be set and top=0 forces the highest bit to be set; top=-1 is new
   7754      and leaves the highest bit random.
   7755      [Ulf Moeller, Bodo Moeller]
   7756 
   7757   *) In the NCONF_...-based implementations for CONF_... queries
   7758      (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
   7759      a temporary CONF structure with the data component set to NULL
   7760      (which gives segmentation faults in lh_retrieve).
   7761      Instead, use NULL for the CONF pointer in CONF_get_string and
   7762      CONF_get_number (which may use environment variables) and directly
   7763      return NULL from CONF_get_section.
   7764      [Bodo Moeller]
   7765 
   7766   *) Fix potential buffer overrun for EBCDIC.
   7767      [Ulf Moeller]
   7768 
   7769   *) Tolerate nonRepudiation as being valid for S/MIME signing and certSign
   7770      keyUsage if basicConstraints absent for a CA.
   7771      [Steve Henson]
   7772 
   7773   *) Make SMIME_write_PKCS7() write mail header values with a format that
   7774      is more generally accepted (no spaces before the semicolon), since
   7775      some programs can't parse those values properly otherwise.  Also make
   7776      sure BIO's that break lines after each write do not create invalid
   7777      headers.
   7778      [Richard Levitte]
   7779 
   7780   *) Make the CRL encoding routines work with empty SEQUENCE OF. The
   7781      macros previously used would not encode an empty SEQUENCE OF
   7782      and break the signature.
   7783      [Steve Henson]
   7784      [This change does not apply to 0.9.7.]
   7785 
   7786   *) Zero the premaster secret after deriving the master secret in
   7787      DH ciphersuites.
   7788      [Steve Henson]
   7789 
   7790   *) Add some EVP_add_digest_alias registrations (as found in
   7791      OpenSSL_add_all_digests()) to SSL_library_init()
   7792      aka OpenSSL_add_ssl_algorithms().  This provides improved
   7793      compatibility with peers using X.509 certificates
   7794      with unconventional AlgorithmIdentifier OIDs.
   7795      [Bodo Moeller]
   7796 
   7797   *) Fix for Irix with NO_ASM.
   7798      ["Bruce W. Forsberg" <bruce.forsberg (a] baesystems.com>]
   7799 
   7800   *) ./config script fixes.
   7801      [Ulf Moeller, Richard Levitte]
   7802 
   7803   *) Fix 'openssl passwd -1'.
   7804      [Bodo Moeller]
   7805 
   7806   *) Change PKCS12_key_gen_asc() so it can cope with non null
   7807      terminated strings whose length is passed in the passlen
   7808      parameter, for example from PEM callbacks. This was done
   7809      by adding an extra length parameter to asc2uni().
   7810      [Steve Henson, reported by <oddissey (a] samsung.co.kr>]
   7811 
   7812   *) Fix C code generated by 'openssl dsaparam -C': If a BN_bin2bn
   7813      call failed, free the DSA structure.
   7814      [Bodo Moeller]
   7815 
   7816   *) Fix to uni2asc() to cope with zero length Unicode strings.
   7817      These are present in some PKCS#12 files.
   7818      [Steve Henson]
   7819 
   7820   *) Increase s2->wbuf allocation by one byte in ssl2_new (ssl/s2_lib.c).
   7821      Otherwise do_ssl_write (ssl/s2_pkt.c) will write beyond buffer limits
   7822      when writing a 32767 byte record.
   7823      [Bodo Moeller; problem reported by Eric Day <eday (a] concentric.net>]
   7824 
   7825   *) In RSA_eay_public_{en,ed}crypt and RSA_eay_mod_exp (rsa_eay.c),
   7826      obtain lock CRYPTO_LOCK_RSA before setting rsa->_method_mod_{n,p,q}.
   7827 
   7828      (RSA objects have a reference count access to which is protected
   7829      by CRYPTO_LOCK_RSA [see rsa_lib.c, s3_srvr.c, ssl_cert.c, ssl_rsa.c],
   7830      so they are meant to be shared between threads.)
   7831      [Bodo Moeller, Geoff Thorpe; original patch submitted by
   7832      "Reddie, Steven" <Steven.Reddie (a] ca.com>]
   7833 
   7834   *) Fix a deadlock in CRYPTO_mem_leaks().
   7835      [Bodo Moeller]
   7836 
   7837   *) Use better test patterns in bntest.
   7838      [Ulf Mller]
   7839 
   7840   *) rand_win.c fix for Borland C.
   7841      [Ulf Mller]
   7842  
   7843   *) BN_rshift bugfix for n == 0.
   7844      [Bodo Moeller]
   7845 
   7846   *) Add a 'bctest' script that checks for some known 'bc' bugs
   7847      so that 'make test' does not abort just because 'bc' is broken.
   7848      [Bodo Moeller]
   7849 
   7850   *) Store verify_result within SSL_SESSION also for client side to
   7851      avoid potential security hole. (Re-used sessions on the client side
   7852      always resulted in verify_result==X509_V_OK, not using the original
   7853      result of the server certificate verification.)
   7854      [Lutz Jaenicke]
   7855 
   7856   *) Fix ssl3_pending: If the record in s->s3->rrec is not of type
   7857      SSL3_RT_APPLICATION_DATA, return 0.
   7858      Similarly, change ssl2_pending to return 0 if SSL_in_init(s) is true.
   7859      [Bodo Moeller]
   7860 
   7861   *) Fix SSL_peek:
   7862      Both ssl2_peek and ssl3_peek, which were totally broken in earlier
   7863      releases, have been re-implemented by renaming the previous
   7864      implementations of ssl2_read and ssl3_read to ssl2_read_internal
   7865      and ssl3_read_internal, respectively, and adding 'peek' parameters
   7866      to them.  The new ssl[23]_{read,peek} functions are calls to
   7867      ssl[23]_read_internal with the 'peek' flag set appropriately.
   7868      A 'peek' parameter has also been added to ssl3_read_bytes, which
   7869      does the actual work for ssl3_read_internal.
   7870      [Bodo Moeller]
   7871 
   7872   *) Initialise "ex_data" member of RSA/DSA/DH structures prior to calling
   7873      the method-specific "init()" handler. Also clean up ex_data after
   7874      calling the method-specific "finish()" handler. Previously, this was
   7875      happening the other way round.
   7876      [Geoff Thorpe]
   7877 
   7878   *) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
   7879      The previous value, 12, was not always sufficient for BN_mod_exp().
   7880      [Bodo Moeller]
   7881 
   7882   *) Make sure that shared libraries get the internal name engine with
   7883      the full version number and not just 0.  This should mark the
   7884      shared libraries as not backward compatible.  Of course, this should
   7885      be changed again when we can guarantee backward binary compatibility.
   7886      [Richard Levitte]
   7887 
   7888   *) Fix typo in get_cert_by_subject() in by_dir.c
   7889      [Jean-Marc Desperrier <jean-marc.desperrier (a] certplus.com>]
   7890 
   7891   *) Rework the system to generate shared libraries:
   7892 
   7893      - Make note of the expected extension for the shared libraries and
   7894        if there is a need for symbolic links from for example libcrypto.so.0
   7895        to libcrypto.so.0.9.7.  There is extended info in Configure for
   7896        that.
   7897 
   7898      - Make as few rebuilds of the shared libraries as possible.
   7899 
   7900      - Still avoid linking the OpenSSL programs with the shared libraries.
   7901 
   7902      - When installing, install the shared libraries separately from the
   7903        static ones.
   7904      [Richard Levitte]
   7905 
   7906   *) Fix SSL_CTX_set_read_ahead macro to actually use its argument.
   7907 
   7908      Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
   7909      and not in SSL_clear because the latter is also used by the
   7910      accept/connect functions; previously, the settings made by
   7911      SSL_set_read_ahead would be lost during the handshake.
   7912      [Bodo Moeller; problems reported by Anders Gertz <gertz (a] epact.se>]     
   7913 
   7914   *) Correct util/mkdef.pl to be selective about disabled algorithms.
   7915      Previously, it would create entries for disableed algorithms no
   7916      matter what.
   7917      [Richard Levitte]
   7918 
   7919   *) Added several new manual pages for SSL_* function.
   7920      [Lutz Jaenicke]
   7921 
   7922  Changes between 0.9.5a and 0.9.6  [24 Sep 2000]
   7923 
   7924   *) In ssl23_get_client_hello, generate an error message when faced
   7925      with an initial SSL 3.0/TLS record that is too small to contain the
   7926      first two bytes of the ClientHello message, i.e. client_version.
   7927      (Note that this is a pathologic case that probably has never happened
   7928      in real life.)  The previous approach was to use the version number
   7929      from the record header as a substitute; but our protocol choice
   7930      should not depend on that one because it is not authenticated
   7931      by the Finished messages.
   7932      [Bodo Moeller]
   7933 
   7934   *) More robust randomness gathering functions for Windows.
   7935      [Jeffrey Altman <jaltman (a] columbia.edu>]
   7936 
   7937   *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
   7938      not set then we don't setup the error code for issuer check errors
   7939      to avoid possibly overwriting other errors which the callback does
   7940      handle. If an application does set the flag then we assume it knows
   7941      what it is doing and can handle the new informational codes
   7942      appropriately.
   7943      [Steve Henson]
   7944 
   7945   *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
   7946      a general "ANY" type, as such it should be able to decode anything
   7947      including tagged types. However it didn't check the class so it would
   7948      wrongly interpret tagged types in the same way as their universal
   7949      counterpart and unknown types were just rejected. Changed so that the
   7950      tagged and unknown types are handled in the same way as a SEQUENCE:
   7951      that is the encoding is stored intact. There is also a new type
   7952      "V_ASN1_OTHER" which is used when the class is not universal, in this
   7953      case we have no idea what the actual type is so we just lump them all
   7954      together.
   7955      [Steve Henson]
   7956 
   7957   *) On VMS, stdout may very well lead to a file that is written to
   7958      in a record-oriented fashion.  That means that every write() will
   7959      write a separate record, which will be read separately by the
   7960      programs trying to read from it.  This can be very confusing.
   7961 
   7962      The solution is to put a BIO filter in the way that will buffer
   7963      text until a linefeed is reached, and then write everything a
   7964      line at a time, so every record written will be an actual line,
   7965      not chunks of lines and not (usually doesn't happen, but I've
   7966      seen it once) several lines in one record.  BIO_f_linebuffer() is
   7967      the answer.
   7968 
   7969      Currently, it's a VMS-only method, because that's where it has
   7970      been tested well enough.
   7971      [Richard Levitte]
   7972 
   7973   *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
   7974      it can return incorrect results.
   7975      (Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
   7976      but it was in 0.9.6-beta[12].)
   7977      [Bodo Moeller]
   7978 
   7979   *) Disable the check for content being present when verifying detached
   7980      signatures in pk7_smime.c. Some versions of Netscape (wrongly)
   7981      include zero length content when signing messages.
   7982      [Steve Henson]
   7983 
   7984   *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
   7985      BIO_ctrl (for BIO pairs).
   7986      [Bodo Mller]
   7987 
   7988   *) Add DSO method for VMS.
   7989      [Richard Levitte]
   7990 
   7991   *) Bug fix: Montgomery multiplication could produce results with the
   7992      wrong sign.
   7993      [Ulf Mller]
   7994 
   7995   *) Add RPM specification openssl.spec and modify it to build three
   7996      packages.  The default package contains applications, application
   7997      documentation and run-time libraries.  The devel package contains
   7998      include files, static libraries and function documentation.  The
   7999      doc package contains the contents of the doc directory.  The original
   8000      openssl.spec was provided by Damien Miller <djm (a] mindrot.org>.
   8001      [Richard Levitte]
   8002      
   8003   *) Add a large number of documentation files for many SSL routines.
   8004      [Lutz Jaenicke <Lutz.Jaenicke (a] aet.TU-Cottbus.DE>]
   8005 
   8006   *) Add a configuration entry for Sony News 4.
   8007      [NAKAJI Hiroyuki <nakaji (a] tutrp.tut.ac.jp>]
   8008 
   8009   *) Don't set the two most significant bits to one when generating a
   8010      random number < q in the DSA library.
   8011      [Ulf Mller]
   8012 
   8013   *) New SSL API mode 'SSL_MODE_AUTO_RETRY'.  This disables the default
   8014      behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if
   8015      the underlying transport is blocking) if a handshake took place.
   8016      (The default behaviour is needed by applications such as s_client
   8017      and s_server that use select() to determine when to use SSL_read;
   8018      but for applications that know in advance when to expect data, it
   8019      just makes things more complicated.)
   8020      [Bodo Moeller]
   8021 
   8022   *) Add RAND_egd_bytes(), which gives control over the number of bytes read
   8023      from EGD.
   8024      [Ben Laurie]
   8025 
   8026   *) Add a few more EBCDIC conditionals that make `req' and `x509'
   8027      work better on such systems.
   8028      [Martin Kraemer <Martin.Kraemer (a] MchP.Siemens.De>]
   8029 
   8030   *) Add two demo programs for PKCS12_parse() and PKCS12_create().
   8031      Update PKCS12_parse() so it copies the friendlyName and the
   8032      keyid to the certificates aux info.
   8033      [Steve Henson]
   8034 
   8035   *) Fix bug in PKCS7_verify() which caused an infinite loop
   8036      if there was more than one signature.
   8037      [Sven Uszpelkat <su (a] celocom.de>]
   8038 
   8039   *) Major change in util/mkdef.pl to include extra information
   8040      about each symbol, as well as presentig variables as well
   8041      as functions.  This change means that there's n more need
   8042      to rebuild the .num files when some algorithms are excluded.
   8043      [Richard Levitte]
   8044 
   8045   *) Allow the verify time to be set by an application,
   8046      rather than always using the current time.
   8047      [Steve Henson]
   8048   
   8049   *) Phase 2 verify code reorganisation. The certificate
   8050      verify code now looks up an issuer certificate by a
   8051      number of criteria: subject name, authority key id
   8052      and key usage. It also verifies self signed certificates
   8053      by the same criteria. The main comparison function is
   8054      X509_check_issued() which performs these checks.
   8055  
   8056      Lot of changes were necessary in order to support this
   8057      without completely rewriting the lookup code.
   8058  
   8059      Authority and subject key identifier are now cached.
   8060  
   8061      The LHASH 'certs' is X509_STORE has now been replaced
   8062      by a STACK_OF(X509_OBJECT). This is mainly because an
   8063      LHASH can't store or retrieve multiple objects with
   8064      the same hash value.
   8065 
   8066      As a result various functions (which were all internal
   8067      use only) have changed to handle the new X509_STORE
   8068      structure. This will break anything that messed round
   8069      with X509_STORE internally.
   8070  
   8071      The functions X509_STORE_add_cert() now checks for an
   8072      exact match, rather than just subject name.
   8073  
   8074      The X509_STORE API doesn't directly support the retrieval
   8075      of multiple certificates matching a given criteria, however
   8076      this can be worked round by performing a lookup first
   8077      (which will fill the cache with candidate certificates)
   8078      and then examining the cache for matches. This is probably
   8079      the best we can do without throwing out X509_LOOKUP
   8080      entirely (maybe later...).
   8081  
   8082      The X509_VERIFY_CTX structure has been enhanced considerably.
   8083  
   8084      All certificate lookup operations now go via a get_issuer()
   8085      callback. Although this currently uses an X509_STORE it
   8086      can be replaced by custom lookups. This is a simple way
   8087      to bypass the X509_STORE hackery necessary to make this
   8088      work and makes it possible to use more efficient techniques
   8089      in future. A very simple version which uses a simple
   8090      STACK for its trusted certificate store is also provided
   8091      using X509_STORE_CTX_trusted_stack().
   8092  
   8093      The verify_cb() and verify() callbacks now have equivalents
   8094      in the X509_STORE_CTX structure.
   8095  
   8096      X509_STORE_CTX also has a 'flags' field which can be used
   8097      to customise the verify behaviour.
   8098      [Steve Henson]
   8099  
   8100   *) Add new PKCS#7 signing option PKCS7_NOSMIMECAP which 
   8101      excludes S/MIME capabilities.
   8102      [Steve Henson]
   8103 
   8104   *) When a certificate request is read in keep a copy of the
   8105      original encoding of the signed data and use it when outputing
   8106      again. Signatures then use the original encoding rather than
   8107      a decoded, encoded version which may cause problems if the
   8108      request is improperly encoded.
   8109      [Steve Henson]
   8110 
   8111   *) For consistency with other BIO_puts implementations, call
   8112      buffer_write(b, ...) directly in buffer_puts instead of calling
   8113      BIO_write(b, ...).
   8114 
   8115      In BIO_puts, increment b->num_write as in BIO_write.
   8116      [Peter.Sylvester (a] EdelWeb.fr]
   8117 
   8118   *) Fix BN_mul_word for the case where the word is 0. (We have to use
   8119      BN_zero, we may not return a BIGNUM with an array consisting of
   8120      words set to zero.)
   8121      [Bodo Moeller]
   8122 
   8123   *) Avoid calling abort() from within the library when problems are
   8124      detected, except if preprocessor symbols have been defined
   8125      (such as REF_CHECK, BN_DEBUG etc.).
   8126      [Bodo Moeller]
   8127 
   8128   *) New openssl application 'rsautl'. This utility can be
   8129      used for low level RSA operations. DER public key
   8130      BIO/fp routines also added.
   8131      [Steve Henson]
   8132 
   8133   *) New Configure entry and patches for compiling on QNX 4.
   8134      [Andreas Schneider <andreas (a] ds3.etech.fh-hamburg.de>]
   8135 
   8136   *) A demo state-machine implementation was sponsored by
   8137      Nuron (http://www.nuron.com/) and is now available in
   8138      demos/state_machine.
   8139      [Ben Laurie]
   8140 
   8141   *) New options added to the 'dgst' utility for signature
   8142      generation and verification.
   8143      [Steve Henson]
   8144 
   8145   *) Unrecognized PKCS#7 content types are now handled via a
   8146      catch all ASN1_TYPE structure. This allows unsupported
   8147      types to be stored as a "blob" and an application can
   8148      encode and decode it manually.
   8149      [Steve Henson]
   8150 
   8151   *) Fix various signed/unsigned issues to make a_strex.c
   8152      compile under VC++.
   8153      [Oscar Jacobsson <oscar.jacobsson (a] celocom.com>]
   8154 
   8155   *) ASN1 fixes. i2d_ASN1_OBJECT was not returning the correct
   8156      length if passed a buffer. ASN1_INTEGER_to_BN failed
   8157      if passed a NULL BN and its argument was negative.
   8158      [Steve Henson, pointed out by Sven Heiberg <sven (a] tartu.cyber.ee>]
   8159 
   8160   *) Modification to PKCS#7 encoding routines to output definite
   8161      length encoding. Since currently the whole structures are in
   8162      memory there's not real point in using indefinite length 
   8163      constructed encoding. However if OpenSSL is compiled with
   8164      the flag PKCS7_INDEFINITE_ENCODING the old form is used.
   8165      [Steve Henson]
   8166 
   8167   *) Added BIO_vprintf() and BIO_vsnprintf().
   8168      [Richard Levitte]
   8169 
   8170   *) Added more prefixes to parse for in the the strings written
   8171      through a logging bio, to cover all the levels that are available
   8172      through syslog.  The prefixes are now:
   8173 
   8174 	PANIC, EMERG, EMR	=>	LOG_EMERG
   8175 	ALERT, ALR		=>	LOG_ALERT
   8176 	CRIT, CRI		=>	LOG_CRIT
   8177 	ERROR, ERR		=>	LOG_ERR
   8178 	WARNING, WARN, WAR	=>	LOG_WARNING
   8179 	NOTICE, NOTE, NOT	=>	LOG_NOTICE
   8180 	INFO, INF		=>	LOG_INFO
   8181 	DEBUG, DBG		=>	LOG_DEBUG
   8182 
   8183      and as before, if none of those prefixes are present at the
   8184      beginning of the string, LOG_ERR is chosen.
   8185 
   8186      On Win32, the LOG_* levels are mapped according to this:
   8187 
   8188 	LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR	=> EVENTLOG_ERROR_TYPE
   8189 	LOG_WARNING				=> EVENTLOG_WARNING_TYPE
   8190 	LOG_NOTICE, LOG_INFO, LOG_DEBUG		=> EVENTLOG_INFORMATION_TYPE
   8191 
   8192      [Richard Levitte]
   8193 
   8194   *) Made it possible to reconfigure with just the configuration
   8195      argument "reconf" or "reconfigure".  The command line arguments
   8196      are stored in Makefile.ssl in the variable CONFIGURE_ARGS,
   8197      and are retrieved from there when reconfiguring.
   8198      [Richard Levitte]
   8199 
   8200   *) MD4 implemented.
   8201      [Assar Westerlund <assar (a] sics.se>, Richard Levitte]
   8202 
   8203   *) Add the arguments -CAfile and -CApath to the pkcs12 utility.
   8204      [Richard Levitte]
   8205 
   8206   *) The obj_dat.pl script was messing up the sorting of object
   8207      names. The reason was that it compared the quoted version
   8208      of strings as a result "OCSP" > "OCSP Signing" because
   8209      " > SPACE. Changed script to store unquoted versions of
   8210      names and add quotes on output. It was also omitting some
   8211      names from the lookup table if they were given a default
   8212      value (that is if SN is missing it is given the same
   8213      value as LN and vice versa), these are now added on the
   8214      grounds that if an object has a name we should be able to
   8215      look it up. Finally added warning output when duplicate
   8216      short or long names are found.
   8217      [Steve Henson]
   8218 
   8219   *) Changes needed for Tandem NSK.
   8220      [Scott Uroff <scott (a] xypro.com>]
   8221 
   8222   *) Fix SSL 2.0 rollback checking: Due to an off-by-one error in
   8223      RSA_padding_check_SSLv23(), special padding was never detected
   8224      and thus the SSL 3.0/TLS 1.0 countermeasure against protocol
   8225      version rollback attacks was not effective.
   8226 
   8227      In s23_clnt.c, don't use special rollback-attack detection padding
   8228      (RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the
   8229      client; similarly, in s23_srvr.c, don't do the rollback check if
   8230      SSL 2.0 is the only protocol enabled in the server.
   8231      [Bodo Moeller]
   8232 
   8233   *) Make it possible to get hexdumps of unprintable data with 'openssl
   8234      asn1parse'.  By implication, the functions ASN1_parse_dump() and
   8235      BIO_dump_indent() are added.
   8236      [Richard Levitte]
   8237 
   8238   *) New functions ASN1_STRING_print_ex() and X509_NAME_print_ex()
   8239      these print out strings and name structures based on various
   8240      flags including RFC2253 support and proper handling of
   8241      multibyte characters. Added options to the 'x509' utility 
   8242      to allow the various flags to be set.
   8243      [Steve Henson]
   8244 
   8245   *) Various fixes to use ASN1_TIME instead of ASN1_UTCTIME.
   8246      Also change the functions X509_cmp_current_time() and
   8247      X509_gmtime_adj() work with an ASN1_TIME structure,
   8248      this will enable certificates using GeneralizedTime in validity
   8249      dates to be checked.
   8250      [Steve Henson]
   8251 
   8252   *) Make the NEG_PUBKEY_BUG code (which tolerates invalid
   8253      negative public key encodings) on by default,
   8254      NO_NEG_PUBKEY_BUG can be set to disable it.
   8255      [Steve Henson]
   8256 
   8257   *) New function c2i_ASN1_OBJECT() which acts on ASN1_OBJECT
   8258      content octets. An i2c_ASN1_OBJECT is unnecessary because
   8259      the encoding can be trivially obtained from the structure.
   8260      [Steve Henson]
   8261 
   8262   *) crypto/err.c locking bugfix: Use write locks (CRYPTO_w_[un]lock),
   8263      not read locks (CRYPTO_r_[un]lock).
   8264      [Bodo Moeller]
   8265 
   8266   *) A first attempt at creating official support for shared
   8267      libraries through configuration.  I've kept it so the
   8268      default is static libraries only, and the OpenSSL programs
   8269      are always statically linked for now, but there are
   8270      preparations for dynamic linking in place.
   8271      This has been tested on Linux and Tru64.
   8272      [Richard Levitte]
   8273 
   8274   *) Randomness polling function for Win9x, as described in:
   8275      Peter Gutmann, Software Generation of Practically Strong
   8276      Random Numbers.
   8277      [Ulf Mller]
   8278 
   8279   *) Fix so PRNG is seeded in req if using an already existing
   8280      DSA key.
   8281      [Steve Henson]
   8282 
   8283   *) New options to smime application. -inform and -outform
   8284      allow alternative formats for the S/MIME message including
   8285      PEM and DER. The -content option allows the content to be
   8286      specified separately. This should allow things like Netscape
   8287      form signing output easier to verify.
   8288      [Steve Henson]
   8289 
   8290   *) Fix the ASN1 encoding of tags using the 'long form'.
   8291      [Steve Henson]
   8292 
   8293   *) New ASN1 functions, i2c_* and c2i_* for INTEGER and BIT
   8294      STRING types. These convert content octets to and from the
   8295      underlying type. The actual tag and length octets are
   8296      already assumed to have been read in and checked. These
   8297      are needed because all other string types have virtually
   8298      identical handling apart from the tag. By having versions
   8299      of the ASN1 functions that just operate on content octets
   8300      IMPLICIT tagging can be handled properly. It also allows
   8301      the ASN1_ENUMERATED code to be cut down because ASN1_ENUMERATED
   8302      and ASN1_INTEGER are identical apart from the tag.
   8303      [Steve Henson]
   8304 
   8305   *) Change the handling of OID objects as follows:
   8306 
   8307      - New object identifiers are inserted in objects.txt, following
   8308        the syntax given in objects.README.
   8309      - objects.pl is used to process obj_mac.num and create a new
   8310        obj_mac.h.
   8311      - obj_dat.pl is used to create a new obj_dat.h, using the data in
   8312        obj_mac.h.
   8313 
   8314      This is currently kind of a hack, and the perl code in objects.pl
   8315      isn't very elegant, but it works as I intended.  The simplest way
   8316      to check that it worked correctly is to look in obj_dat.h and
   8317      check the array nid_objs and make sure the objects haven't moved
   8318      around (this is important!).  Additions are OK, as well as
   8319      consistent name changes. 
   8320      [Richard Levitte]
   8321 
   8322   *) Add BSD-style MD5-based passwords to 'openssl passwd' (option '-1').
   8323      [Bodo Moeller]
   8324 
   8325   *) Addition of the command line parameter '-rand file' to 'openssl req'.
   8326      The given file adds to whatever has already been seeded into the
   8327      random pool through the RANDFILE configuration file option or
   8328      environment variable, or the default random state file.
   8329      [Richard Levitte]
   8330 
   8331   *) mkstack.pl now sorts each macro group into lexical order.
   8332      Previously the output order depended on the order the files
   8333      appeared in the directory, resulting in needless rewriting
   8334      of safestack.h .
   8335      [Steve Henson]
   8336 
   8337   *) Patches to make OpenSSL compile under Win32 again. Mostly
   8338      work arounds for the VC++ problem that it treats func() as
   8339      func(void). Also stripped out the parts of mkdef.pl that
   8340      added extra typesafe functions: these no longer exist.
   8341      [Steve Henson]
   8342 
   8343   *) Reorganisation of the stack code. The macros are now all 
   8344      collected in safestack.h . Each macro is defined in terms of
   8345      a "stack macro" of the form SKM_<name>(type, a, b). The 
   8346      DEBUG_SAFESTACK is now handled in terms of function casts,
   8347      this has the advantage of retaining type safety without the
   8348      use of additional functions. If DEBUG_SAFESTACK is not defined
   8349      then the non typesafe macros are used instead. Also modified the
   8350      mkstack.pl script to handle the new form. Needs testing to see
   8351      if which (if any) compilers it chokes and maybe make DEBUG_SAFESTACK
   8352      the default if no major problems. Similar behaviour for ASN1_SET_OF
   8353      and PKCS12_STACK_OF.
   8354      [Steve Henson]
   8355 
   8356   *) When some versions of IIS use the 'NET' form of private key the
   8357      key derivation algorithm is different. Normally MD5(password) is
   8358      used as a 128 bit RC4 key. In the modified case
   8359      MD5(MD5(password) + "SGCKEYSALT")  is used insted. Added some
   8360      new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same
   8361      as the old Netscape_RSA functions except they have an additional
   8362      'sgckey' parameter which uses the modified algorithm. Also added
   8363      an -sgckey command line option to the rsa utility. Thanks to 
   8364      Adrian Peck <bertie (a] ncipher.com> for posting details of the modified
   8365      algorithm to openssl-dev.
   8366      [Steve Henson]
   8367 
   8368   *) The evp_local.h macros were using 'c.##kname' which resulted in
   8369      invalid expansion on some systems (SCO 5.0.5 for example).
   8370      Corrected to 'c.kname'.
   8371      [Phillip Porch <root (a] theporch.com>]
   8372 
   8373   *) New X509_get1_email() and X509_REQ_get1_email() functions that return
   8374      a STACK of email addresses from a certificate or request, these look
   8375      in the subject name and the subject alternative name extensions and 
   8376      omit any duplicate addresses.
   8377      [Steve Henson]
   8378 
   8379   *) Re-implement BN_mod_exp2_mont using independent (and larger) windows.
   8380      This makes DSA verification about 2 % faster.
   8381      [Bodo Moeller]
   8382 
   8383   *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5
   8384      (meaning that now 2^5 values will be precomputed, which is only 4 KB
   8385      plus overhead for 1024 bit moduli).
   8386      This makes exponentiations about 0.5 % faster for 1024 bit
   8387      exponents (as measured by "openssl speed rsa2048").
   8388      [Bodo Moeller]
   8389 
   8390   *) Rename memory handling macros to avoid conflicts with other
   8391      software:
   8392           Malloc         =>  OPENSSL_malloc
   8393           Malloc_locked  =>  OPENSSL_malloc_locked
   8394           Realloc        =>  OPENSSL_realloc
   8395           Free           =>  OPENSSL_free
   8396      [Richard Levitte]
   8397 
   8398   *) New function BN_mod_exp_mont_word for small bases (roughly 15%
   8399      faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange).
   8400      [Bodo Moeller]
   8401 
   8402   *) CygWin32 support.
   8403      [John Jarvie <jjarvie (a] newsguy.com>]
   8404 
   8405   *) The type-safe stack code has been rejigged. It is now only compiled
   8406      in when OpenSSL is configured with the DEBUG_SAFESTACK option and
   8407      by default all type-specific stack functions are "#define"d back to
   8408      standard stack functions. This results in more streamlined output
   8409      but retains the type-safety checking possibilities of the original
   8410      approach.
   8411      [Geoff Thorpe]
   8412 
   8413   *) The STACK code has been cleaned up, and certain type declarations
   8414      that didn't make a lot of sense have been brought in line. This has
   8415      also involved a cleanup of sorts in safestack.h to more correctly
   8416      map type-safe stack functions onto their plain stack counterparts.
   8417      This work has also resulted in a variety of "const"ifications of
   8418      lots of the code, especially "_cmp" operations which should normally
   8419      be prototyped with "const" parameters anyway.
   8420      [Geoff Thorpe]
   8421 
   8422   *) When generating bytes for the first time in md_rand.c, 'stir the pool'
   8423      by seeding with STATE_SIZE dummy bytes (with zero entropy count).
   8424      (The PRNG state consists of two parts, the large pool 'state' and 'md',
   8425      where all of 'md' is used each time the PRNG is used, but 'state'
   8426      is used only indexed by a cyclic counter. As entropy may not be
   8427      well distributed from the beginning, 'md' is important as a
   8428      chaining variable. However, the output function chains only half
   8429      of 'md', i.e. 80 bits.  ssleay_rand_add, on the other hand, chains
   8430      all of 'md', and seeding with STATE_SIZE dummy bytes will result
   8431      in all of 'state' being rewritten, with the new values depending
   8432      on virtually all of 'md'.  This overcomes the 80 bit limitation.)
   8433      [Bodo Moeller]
   8434 
   8435   *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when
   8436      the handshake is continued after ssl_verify_cert_chain();
   8437      otherwise, if SSL_VERIFY_NONE is set, remaining error codes
   8438      can lead to 'unexplainable' connection aborts later.
   8439      [Bodo Moeller; problem tracked down by Lutz Jaenicke]
   8440 
   8441   *) Major EVP API cipher revision.
   8442      Add hooks for extra EVP features. This allows various cipher
   8443      parameters to be set in the EVP interface. Support added for variable
   8444      key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and
   8445      setting of RC2 and RC5 parameters.
   8446 
   8447      Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length
   8448      ciphers.
   8449 
   8450      Remove lots of duplicated code from the EVP library. For example *every*
   8451      cipher init() function handles the 'iv' in the same way according to the
   8452      cipher mode. They also all do nothing if the 'key' parameter is NULL and
   8453      for CFB and OFB modes they zero ctx->num.
   8454 
   8455      New functionality allows removal of S/MIME code RC2 hack.
   8456 
   8457      Most of the routines have the same form and so can be declared in terms
   8458      of macros.
   8459 
   8460      By shifting this to the top level EVP_CipherInit() it can be removed from
   8461      all individual ciphers. If the cipher wants to handle IVs or keys
   8462      differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT
   8463      flags.
   8464 
   8465      Change lots of functions like EVP_EncryptUpdate() to now return a
   8466      value: although software versions of the algorithms cannot fail
   8467      any installed hardware versions can.
   8468      [Steve Henson]
   8469 
   8470   *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if
   8471      this option is set, tolerate broken clients that send the negotiated
   8472      protocol version number instead of the requested protocol version
   8473      number.
   8474      [Bodo Moeller]
   8475 
   8476   *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag;
   8477      i.e. non-zero for export ciphersuites, zero otherwise.
   8478      Previous versions had this flag inverted, inconsistent with
   8479      rsa_tmp_cb (..._TMP_RSA_CB).
   8480      [Bodo Moeller; problem reported by Amit Chopra]
   8481 
   8482   *) Add missing DSA library text string. Work around for some IIS
   8483      key files with invalid SEQUENCE encoding.
   8484      [Steve Henson]
   8485 
   8486   *) Add a document (doc/standards.txt) that list all kinds of standards
   8487      and so on that are implemented in OpenSSL.
   8488      [Richard Levitte]
   8489 
   8490   *) Enhance c_rehash script. Old version would mishandle certificates
   8491      with the same subject name hash and wouldn't handle CRLs at all.
   8492      Added -fingerprint option to crl utility, to support new c_rehash
   8493      features.
   8494      [Steve Henson]
   8495 
   8496   *) Eliminate non-ANSI declarations in crypto.h and stack.h.
   8497      [Ulf Mller]
   8498 
   8499   *) Fix for SSL server purpose checking. Server checking was
   8500      rejecting certificates which had extended key usage present
   8501      but no ssl client purpose.
   8502      [Steve Henson, reported by Rene Grosser <grosser (a] hisolutions.com>]
   8503 
   8504   *) Make PKCS#12 code work with no password. The PKCS#12 spec
   8505      is a little unclear about how a blank password is handled.
   8506      Since the password in encoded as a BMPString with terminating
   8507      double NULL a zero length password would end up as just the
   8508      double NULL. However no password at all is different and is
   8509      handled differently in the PKCS#12 key generation code. NS
   8510      treats a blank password as zero length. MSIE treats it as no
   8511      password on export: but it will try both on import. We now do
   8512      the same: PKCS12_parse() tries zero length and no password if
   8513      the password is set to "" or NULL (NULL is now a valid password:
   8514      it wasn't before) as does the pkcs12 application.
   8515      [Steve Henson]
   8516 
   8517   *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use
   8518      perror when PEM_read_bio_X509_REQ fails, the error message must
   8519      be obtained from the error queue.
   8520      [Bodo Moeller]
   8521 
   8522   *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing
   8523      it in ERR_remove_state if appropriate, and change ERR_get_state
   8524      accordingly to avoid race conditions (this is necessary because
   8525      thread_hash is no longer constant once set).
   8526      [Bodo Moeller]
   8527 
   8528   *) Bugfix for linux-elf makefile.one.
   8529      [Ulf Mller]
   8530 
   8531   *) RSA_get_default_method() will now cause a default
   8532      RSA_METHOD to be chosen if one doesn't exist already.
   8533      Previously this was only set during a call to RSA_new()
   8534      or RSA_new_method(NULL) meaning it was possible for
   8535      RSA_get_default_method() to return NULL.
   8536      [Geoff Thorpe]
   8537 
   8538   *) Added native name translation to the existing DSO code
   8539      that will convert (if the flag to do so is set) filenames
   8540      that are sufficiently small and have no path information
   8541      into a canonical native form. Eg. "blah" converted to
   8542      "libblah.so" or "blah.dll" etc.
   8543      [Geoff Thorpe]
   8544 
   8545   *) New function ERR_error_string_n(e, buf, len) which is like
   8546      ERR_error_string(e, buf), but writes at most 'len' bytes
   8547      including the 0 terminator.  For ERR_error_string_n, 'buf'
   8548      may not be NULL.
   8549      [Damien Miller <djm (a] mindrot.org>, Bodo Moeller]
   8550 
   8551   *) CONF library reworked to become more general.  A new CONF
   8552      configuration file reader "class" is implemented as well as a
   8553      new functions (NCONF_*, for "New CONF") to handle it.  The now
   8554      old CONF_* functions are still there, but are reimplemented to
   8555      work in terms of the new functions.  Also, a set of functions
   8556      to handle the internal storage of the configuration data is
   8557      provided to make it easier to write new configuration file
   8558      reader "classes" (I can definitely see something reading a
   8559      configuration file in XML format, for example), called _CONF_*,
   8560      or "the configuration storage API"...
   8561 
   8562      The new configuration file reading functions are:
   8563 
   8564         NCONF_new, NCONF_free, NCONF_load, NCONF_load_fp, NCONF_load_bio,
   8565         NCONF_get_section, NCONF_get_string, NCONF_get_numbre
   8566 
   8567         NCONF_default, NCONF_WIN32
   8568 
   8569         NCONF_dump_fp, NCONF_dump_bio
   8570 
   8571      NCONF_default and NCONF_WIN32 are method (or "class") choosers,
   8572      NCONF_new creates a new CONF object.  This works in the same way
   8573      as other interfaces in OpenSSL, like the BIO interface.
   8574      NCONF_dump_* dump the internal storage of the configuration file,
   8575      which is useful for debugging.  All other functions take the same
   8576      arguments as the old CONF_* functions wth the exception of the
   8577      first that must be a `CONF *' instead of a `LHASH *'.
   8578 
   8579      To make it easer to use the new classes with the old CONF_* functions,
   8580      the function CONF_set_default_method is provided.
   8581      [Richard Levitte]
   8582 
   8583   *) Add '-tls1' option to 'openssl ciphers', which was already
   8584      mentioned in the documentation but had not been implemented.
   8585      (This option is not yet really useful because even the additional
   8586      experimental TLS 1.0 ciphers are currently treated as SSL 3.0 ciphers.)
   8587      [Bodo Moeller]
   8588 
   8589   *) Initial DSO code added into libcrypto for letting OpenSSL (and
   8590      OpenSSL-based applications) load shared libraries and bind to
   8591      them in a portable way.
   8592      [Geoff Thorpe, with contributions from Richard Levitte]
   8593 
   8594  Changes between 0.9.5 and 0.9.5a  [1 Apr 2000]
   8595 
   8596   *) Make sure _lrotl and _lrotr are only used with MSVC.
   8597 
   8598   *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status
   8599      (the default implementation of RAND_status).
   8600 
   8601   *) Rename openssl x509 option '-crlext', which was added in 0.9.5,
   8602      to '-clrext' (= clear extensions), as intended and documented.
   8603      [Bodo Moeller; inconsistency pointed out by Michael Attili
   8604      <attili (a] amaxo.com>]
   8605 
   8606   *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length
   8607      was larger than the MD block size.      
   8608      [Steve Henson, pointed out by Yost William <YostW (a] tce.com>]
   8609 
   8610   *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument
   8611      fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set()
   8612      using the passed key: if the passed key was a private key the result
   8613      of X509_print(), for example, would be to print out all the private key
   8614      components.
   8615      [Steve Henson]
   8616 
   8617   *) des_quad_cksum() byte order bug fix.
   8618      [Ulf Mller, using the problem description in krb4-0.9.7, where
   8619       the solution is attributed to Derrick J Brashear <shadow (a] DEMENTIA.ORG>]
   8620 
   8621   *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly
   8622      discouraged.
   8623      [Steve Henson, pointed out by Brian Korver <briank (a] cs.stanford.edu>]
   8624 
   8625   *) For easily testing in shell scripts whether some command
   8626      'openssl XXX' exists, the new pseudo-command 'openssl no-XXX'
   8627      returns with exit code 0 iff no command of the given name is available.
   8628      'no-XXX' is printed in this case, 'XXX' otherwise.  In both cases,
   8629      the output goes to stdout and nothing is printed to stderr.
   8630      Additional arguments are always ignored.
   8631 
   8632      Since for each cipher there is a command of the same name,
   8633      the 'no-cipher' compilation switches can be tested this way.
   8634 
   8635      ('openssl no-XXX' is not able to detect pseudo-commands such
   8636      as 'quit', 'list-XXX-commands', or 'no-XXX' itself.)
   8637      [Bodo Moeller]
   8638 
   8639   *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration.
   8640      [Bodo Moeller]
   8641 
   8642   *) For SSL_[CTX_]set_tmp_dh, don't create a DH key if SSL_OP_SINGLE_DH_USE
   8643      is set; it will be thrown away anyway because each handshake creates
   8644      its own key.
   8645      ssl_cert_dup, which is used by SSL_new, now copies DH keys in addition
   8646      to parameters -- in previous versions (since OpenSSL 0.9.3) the
   8647      'default key' from SSL_CTX_set_tmp_dh would always be lost, meanining
   8648      you effectivly got SSL_OP_SINGLE_DH_USE when using this macro.
   8649      [Bodo Moeller]
   8650 
   8651   *) New s_client option -ign_eof: EOF at stdin is ignored, and
   8652      'Q' and 'R' lose their special meanings (quit/renegotiate).
   8653      This is part of what -quiet does; unlike -quiet, -ign_eof
   8654      does not suppress any output.
   8655      [Richard Levitte]
   8656 
   8657   *) Add compatibility options to the purpose and trust code. The
   8658      purpose X509_PURPOSE_ANY is "any purpose" which automatically
   8659      accepts a certificate or CA, this was the previous behaviour,
   8660      with all the associated security issues.
   8661 
   8662      X509_TRUST_COMPAT is the old trust behaviour: only and
   8663      automatically trust self signed roots in certificate store. A
   8664      new trust setting X509_TRUST_DEFAULT is used to specify that
   8665      a purpose has no associated trust setting and it should instead
   8666      use the value in the default purpose.
   8667      [Steve Henson]
   8668 
   8669   *) Fix the PKCS#8 DSA private key code so it decodes keys again
   8670      and fix a memory leak.
   8671      [Steve Henson]
   8672 
   8673   *) In util/mkerr.pl (which implements 'make errors'), preserve
   8674      reason strings from the previous version of the .c file, as
   8675      the default to have only downcase letters (and digits) in
   8676      automatically generated reasons codes is not always appropriate.
   8677      [Bodo Moeller]
   8678 
   8679   *) In ERR_load_ERR_strings(), build an ERR_LIB_SYS error reason table
   8680      using strerror.  Previously, ERR_reason_error_string() returned
   8681      library names as reason strings for SYSerr; but SYSerr is a special
   8682      case where small numbers are errno values, not library numbers.
   8683      [Bodo Moeller]
   8684 
   8685   *) Add '-dsaparam' option to 'openssl dhparam' application.  This
   8686      converts DSA parameters into DH parameters. (When creating parameters,
   8687      DSA_generate_parameters is used.)
   8688      [Bodo Moeller]
   8689 
   8690   *) Include 'length' (recommended exponent length) in C code generated
   8691      by 'openssl dhparam -C'.
   8692      [Bodo Moeller]
   8693 
   8694   *) The second argument to set_label in perlasm was already being used
   8695      so couldn't be used as a "file scope" flag. Moved to third argument
   8696      which was free.
   8697      [Steve Henson]
   8698 
   8699   *) In PEM_ASN1_write_bio and some other functions, use RAND_pseudo_bytes
   8700      instead of RAND_bytes for encryption IVs and salts.
   8701      [Bodo Moeller]
   8702 
   8703   *) Include RAND_status() into RAND_METHOD instead of implementing
   8704      it only for md_rand.c  Otherwise replacing the PRNG by calling
   8705      RAND_set_rand_method would be impossible.
   8706      [Bodo Moeller]
   8707 
   8708   *) Don't let DSA_generate_key() enter an infinite loop if the random
   8709      number generation fails.
   8710      [Bodo Moeller]
   8711 
   8712   *) New 'rand' application for creating pseudo-random output.
   8713      [Bodo Moeller]
   8714 
   8715   *) Added configuration support for Linux/IA64
   8716      [Rolf Haberrecker <rolf (a] suse.de>]
   8717 
   8718   *) Assembler module support for Mingw32.
   8719      [Ulf Mller]
   8720 
   8721   *) Shared library support for HPUX (in shlib/).
   8722      [Lutz Jaenicke <Lutz.Jaenicke (a] aet.TU-Cottbus.DE> and Anonymous]
   8723 
   8724   *) Shared library support for Solaris gcc.
   8725      [Lutz Behnke <behnke (a] trustcenter.de>]
   8726 
   8727  Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
   8728 
   8729   *) PKCS7_encrypt() was adding text MIME headers twice because they
   8730      were added manually and by SMIME_crlf_copy().
   8731      [Steve Henson]
   8732 
   8733   *) In bntest.c don't call BN_rand with zero bits argument.
   8734      [Steve Henson, pointed out by Andrew W. Gray <agray (a] iconsinc.com>]
   8735 
   8736   *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
   8737      case was implemented. This caused BN_div_recp() to fail occasionally.
   8738      [Ulf Mller]
   8739 
   8740   *) Add an optional second argument to the set_label() in the perl
   8741      assembly language builder. If this argument exists and is set
   8742      to 1 it signals that the assembler should use a symbol whose 
   8743      scope is the entire file, not just the current function. This
   8744      is needed with MASM which uses the format label:: for this scope.
   8745      [Steve Henson, pointed out by Peter Runestig <peter (a] runestig.com>]
   8746 
   8747   *) Change the ASN1 types so they are typedefs by default. Before
   8748      almost all types were #define'd to ASN1_STRING which was causing
   8749      STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
   8750      for example.
   8751      [Steve Henson]
   8752 
   8753   *) Change names of new functions to the new get1/get0 naming
   8754      convention: After 'get1', the caller owns a reference count
   8755      and has to call ..._free; 'get0' returns a pointer to some
   8756      data structure without incrementing reference counters.
   8757      (Some of the existing 'get' functions increment a reference
   8758      counter, some don't.)
   8759      Similarly, 'set1' and 'add1' functions increase reference
   8760      counters or duplicate objects.
   8761      [Steve Henson]
   8762 
   8763   *) Allow for the possibility of temp RSA key generation failure:
   8764      the code used to assume it always worked and crashed on failure.
   8765      [Steve Henson]
   8766 
   8767   *) Fix potential buffer overrun problem in BIO_printf().
   8768      [Ulf Mller, using public domain code by Patrick Powell; problem
   8769       pointed out by David Sacerdote <das33 (a] cornell.edu>]
   8770 
   8771   *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
   8772      RAND_egd() and RAND_status().  In the command line application,
   8773      the EGD socket can be specified like a seed file using RANDFILE
   8774      or -rand.
   8775      [Ulf Mller]
   8776 
   8777   *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
   8778      Some CAs (e.g. Verisign) distribute certificates in this form.
   8779      [Steve Henson]
   8780 
   8781   *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
   8782      list to exclude them. This means that no special compilation option
   8783      is needed to use anonymous DH: it just needs to be included in the
   8784      cipher list.
   8785      [Steve Henson]
   8786 
   8787   *) Change the EVP_MD_CTX_type macro so its meaning consistent with
   8788      EVP_MD_type. The old functionality is available in a new macro called
   8789      EVP_MD_md(). Change code that uses it and update docs.
   8790      [Steve Henson]
   8791 
   8792   *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
   8793      where the 'void *' argument is replaced by a function pointer argument.
   8794      Previously 'void *' was abused to point to functions, which works on
   8795      many platforms, but is not correct.  As these functions are usually
   8796      called by macros defined in OpenSSL header files, most source code
   8797      should work without changes.
   8798      [Richard Levitte]
   8799 
   8800   *) <openssl/opensslconf.h> (which is created by Configure) now contains
   8801      sections with information on -D... compiler switches used for
   8802      compiling the library so that applications can see them.  To enable
   8803      one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
   8804      must be defined.  E.g.,
   8805         #define OPENSSL_ALGORITHM_DEFINES
   8806         #include <openssl/opensslconf.h>
   8807      defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
   8808      [Richard Levitte, Ulf and Bodo Mller]
   8809 
   8810   *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
   8811      record layer.
   8812      [Bodo Moeller]
   8813 
   8814   *) Change the 'other' type in certificate aux info to a STACK_OF
   8815      X509_ALGOR. Although not an AlgorithmIdentifier as such it has
   8816      the required ASN1 format: arbitrary types determined by an OID.
   8817      [Steve Henson]
   8818 
   8819   *) Add some PEM_write_X509_REQ_NEW() functions and a command line
   8820      argument to 'req'. This is not because the function is newer or
   8821      better than others it just uses the work 'NEW' in the certificate
   8822      request header lines. Some software needs this.
   8823      [Steve Henson]
   8824 
   8825   *) Reorganise password command line arguments: now passwords can be
   8826      obtained from various sources. Delete the PEM_cb function and make
   8827      it the default behaviour: i.e. if the callback is NULL and the
   8828      usrdata argument is not NULL interpret it as a null terminated pass
   8829      phrase. If usrdata and the callback are NULL then the pass phrase
   8830      is prompted for as usual.
   8831      [Steve Henson]
   8832 
   8833   *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
   8834      the support is automatically enabled. The resulting binaries will
   8835      autodetect the card and use it if present.
   8836      [Ben Laurie and Compaq Inc.]
   8837 
   8838   *) Work around for Netscape hang bug. This sends certificate request
   8839      and server done in one record. Since this is perfectly legal in the
   8840      SSL/TLS protocol it isn't a "bug" option and is on by default. See
   8841      the bugs/SSLv3 entry for more info.
   8842      [Steve Henson]
   8843 
   8844   *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
   8845      [Andy Polyakov]
   8846 
   8847   *) Add -rand argument to smime and pkcs12 applications and read/write
   8848      of seed file.
   8849      [Steve Henson]
   8850 
   8851   *) New 'passwd' tool for crypt(3) and apr1 password hashes.
   8852      [Bodo Moeller]
   8853 
   8854   *) Add command line password options to the remaining applications.
   8855      [Steve Henson]
   8856 
   8857   *) Bug fix for BN_div_recp() for numerators with an even number of
   8858      bits.
   8859      [Ulf Mller]
   8860 
   8861   *) More tests in bntest.c, and changed test_bn output.
   8862      [Ulf Mller]
   8863 
   8864   *) ./config recognizes MacOS X now.
   8865      [Andy Polyakov]
   8866 
   8867   *) Bug fix for BN_div() when the first words of num and divsor are
   8868      equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
   8869      [Ulf Mller]
   8870 
   8871   *) Add support for various broken PKCS#8 formats, and command line
   8872      options to produce them.
   8873      [Steve Henson]
   8874 
   8875   *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
   8876      get temporary BIGNUMs from a BN_CTX.
   8877      [Ulf Mller]
   8878 
   8879   *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
   8880      for p == 0.
   8881      [Ulf Mller]
   8882 
   8883   *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
   8884      include a #define from the old name to the new. The original intent
   8885      was that statically linked binaries could for example just call
   8886      SSLeay_add_all_ciphers() to just add ciphers to the table and not
   8887      link with digests. This never worked becayse SSLeay_add_all_digests()
   8888      and SSLeay_add_all_ciphers() were in the same source file so calling
   8889      one would link with the other. They are now in separate source files.
   8890      [Steve Henson]
   8891 
   8892   *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
   8893      [Steve Henson]
   8894 
   8895   *) Use a less unusual form of the Miller-Rabin primality test (it used
   8896      a binary algorithm for exponentiation integrated into the Miller-Rabin
   8897      loop, our standard modexp algorithms are faster).
   8898      [Bodo Moeller]
   8899 
   8900   *) Support for the EBCDIC character set completed.
   8901      [Martin Kraemer <Martin.Kraemer (a] Mch.SNI.De>]
   8902 
   8903   *) Source code cleanups: use const where appropriate, eliminate casts,
   8904      use void * instead of char * in lhash.
   8905      [Ulf Mller] 
   8906 
   8907   *) Bugfix: ssl3_send_server_key_exchange was not restartable
   8908      (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
   8909      this the server could overwrite ephemeral keys that the client
   8910      has already seen).
   8911      [Bodo Moeller]
   8912