Home | History | Annotate | Line # | Download | only in dist
      1 
      2  OpenSSL CHANGES
      3  _______________
      4 
      5  This is a high-level summary of the most important changes.
      6  For a full list of changes, see the git commit log; for example,
      7  https://github.com/openssl/openssl/commits/ and pick the appropriate
      8  release branch.
      9 
     10  Changes between 1.1.0g and 1.1.0h [27 Mar 2018]
     11 
     12   *) Constructed ASN.1 types with a recursive definition could exceed the stack
     13 
     14      Constructed ASN.1 types with a recursive definition (such as can be found
     15      in PKCS7) could eventually exceed the stack given malicious input with
     16      excessive recursion. This could result in a Denial Of Service attack. There
     17      are no such structures used within SSL/TLS that come from untrusted sources
     18      so this is considered safe.
     19 
     20      This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
     21      project.
     22      (CVE-2018-0739)
     23      [Matt Caswell]
     24 
     25   *) Incorrect CRYPTO_memcmp on HP-UX PA-RISC
     26 
     27      Because of an implementation bug the PA-RISC CRYPTO_memcmp function is
     28      effectively reduced to only comparing the least significant bit of each
     29      byte. This allows an attacker to forge messages that would be considered as
     30      authenticated in an amount of tries lower than that guaranteed by the
     31      security claims of the scheme. The module can only be compiled by the
     32      HP-UX assembler, so that only HP-UX PA-RISC targets are affected.
     33 
     34      This issue was reported to OpenSSL on 2nd March 2018 by Peter Waltenberg
     35      (IBM).
     36      (CVE-2018-0733)
     37      [Andy Polyakov]
     38 
     39   *) Add a build target 'build_all_generated', to build all generated files
     40      and only that.  This can be used to prepare everything that requires
     41      things like perl for a system that lacks perl and then move everything
     42      to that system and do the rest of the build there.
     43      [Richard Levitte]
     44 
     45   *) Backport SSL_OP_NO_RENGOTIATION
     46 
     47      OpenSSL 1.0.2 and below had the ability to disable renegotiation using the
     48      (undocumented) SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag. Due to the opacity
     49      changes this is no longer possible in 1.1.0. Therefore the new
     50      SSL_OP_NO_RENEGOTIATION option from 1.1.1-dev has been backported to
     51      1.1.0 to provide equivalent functionality.
     52 
     53      Note that if an application built against 1.1.0h headers (or above) is run
     54      using an older version of 1.1.0 (prior to 1.1.0h) then the option will be
     55      accepted but nothing will happen, i.e. renegotiation will not be prevented.
     56      [Matt Caswell]
     57 
     58   *) Removed the OS390-Unix config target.  It relied on a script that doesn't
     59      exist.
     60      [Rich Salz]
     61 
     62   *) rsaz_1024_mul_avx2 overflow bug on x86_64
     63 
     64      There is an overflow bug in the AVX2 Montgomery multiplication procedure
     65      used in exponentiation with 1024-bit moduli. No EC algorithms are affected.
     66      Analysis suggests that attacks against RSA and DSA as a result of this
     67      defect would be very difficult to perform and are not believed likely.
     68      Attacks against DH1024 are considered just feasible, because most of the
     69      work necessary to deduce information about a private key may be performed
     70      offline. The amount of resources required for such an attack would be
     71      significant. However, for an attack on TLS to be meaningful, the server
     72      would have to share the DH1024 private key among multiple clients, which is
     73      no longer an option since CVE-2016-0701.
     74 
     75      This only affects processors that support the AVX2 but not ADX extensions
     76      like Intel Haswell (4th generation).
     77 
     78      This issue was reported to OpenSSL by David Benjamin (Google). The issue
     79      was originally found via the OSS-Fuzz project.
     80      (CVE-2017-3738)
     81      [Andy Polyakov]
     82 
     83  Changes between 1.1.0f and 1.1.0g [2 Nov 2017]
     84 
     85   *) bn_sqrx8x_internal carry bug on x86_64
     86 
     87      There is a carry propagating bug in the x86_64 Montgomery squaring
     88      procedure. No EC algorithms are affected. Analysis suggests that attacks
     89      against RSA and DSA as a result of this defect would be very difficult to
     90      perform and are not believed likely. Attacks against DH are considered just
     91      feasible (although very difficult) because most of the work necessary to
     92      deduce information about a private key may be performed offline. The amount
     93      of resources required for such an attack would be very significant and
     94      likely only accessible to a limited number of attackers. An attacker would
     95      additionally need online access to an unpatched system using the target
     96      private key in a scenario with persistent DH parameters and a private
     97      key that is shared between multiple clients.
     98 
     99      This only affects processors that support the BMI1, BMI2 and ADX extensions
    100      like Intel Broadwell (5th generation) and later or AMD Ryzen.
    101 
    102      This issue was reported to OpenSSL by the OSS-Fuzz project.
    103      (CVE-2017-3736)
    104      [Andy Polyakov]
    105 
    106   *) Malformed X.509 IPAddressFamily could cause OOB read
    107 
    108      If an X.509 certificate has a malformed IPAddressFamily extension,
    109      OpenSSL could do a one-byte buffer overread. The most likely result
    110      would be an erroneous display of the certificate in text format.
    111 
    112      This issue was reported to OpenSSL by the OSS-Fuzz project.
    113      (CVE-2017-3735)
    114      [Rich Salz]
    115 
    116   *) Ignore the '-named_curve auto' value for compatibility of applications
    117      with OpenSSL 1.0.2.
    118      [Tomas Mraz <tmraz (a] fedoraproject.org>]
    119 
    120   *) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd.
    121      [Emilia Ksper]
    122 
    123  Changes between 1.1.0e and 1.1.0f [25 May 2017]
    124 
    125   *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
    126      platform rather than 'mingw'.
    127      [Richard Levitte]
    128 
    129   *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
    130      VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
    131      which is the minimum version we support.
    132      [Richard Levitte]
    133 
    134  Changes between 1.1.0d and 1.1.0e [16 Feb 2017]
    135 
    136   *) Encrypt-Then-Mac renegotiation crash
    137 
    138      During a renegotiation handshake if the Encrypt-Then-Mac extension is
    139      negotiated where it was not in the original handshake (or vice-versa) then
    140      this can cause OpenSSL to crash (dependant on ciphersuite). Both clients
    141      and servers are affected.
    142 
    143      This issue was reported to OpenSSL by Joe Orton (Red Hat).
    144      (CVE-2017-3733)
    145      [Matt Caswell]
    146 
    147  Changes between 1.1.0c and 1.1.0d [26 Jan 2017]
    148 
    149   *) Truncated packet could crash via OOB read
    150 
    151      If one side of an SSL/TLS path is running on a 32-bit host and a specific
    152      cipher is being used, then a truncated packet can cause that host to
    153      perform an out-of-bounds read, usually resulting in a crash.
    154 
    155      This issue was reported to OpenSSL by Robert wicki of Google.
    156      (CVE-2017-3731)
    157      [Andy Polyakov]
    158 
    159   *) Bad (EC)DHE parameters cause a client crash
    160 
    161      If a malicious server supplies bad parameters for a DHE or ECDHE key
    162      exchange then this can result in the client attempting to dereference a
    163      NULL pointer leading to a client crash. This could be exploited in a Denial
    164      of Service attack.
    165 
    166      This issue was reported to OpenSSL by Guido Vranken.
    167      (CVE-2017-3730)
    168      [Matt Caswell]
    169 
    170   *) BN_mod_exp may produce incorrect results on x86_64
    171 
    172      There is a carry propagating bug in the x86_64 Montgomery squaring
    173      procedure. No EC algorithms are affected. Analysis suggests that attacks
    174      against RSA and DSA as a result of this defect would be very difficult to
    175      perform and are not believed likely. Attacks against DH are considered just
    176      feasible (although very difficult) because most of the work necessary to
    177      deduce information about a private key may be performed offline. The amount
    178      of resources required for such an attack would be very significant and
    179      likely only accessible to a limited number of attackers. An attacker would
    180      additionally need online access to an unpatched system using the target
    181      private key in a scenario with persistent DH parameters and a private
    182      key that is shared between multiple clients. For example this can occur by
    183      default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
    184      similar to CVE-2015-3193 but must be treated as a separate problem.
    185 
    186      This issue was reported to OpenSSL by the OSS-Fuzz project.
    187      (CVE-2017-3732)
    188      [Andy Polyakov]
    189 
    190  Changes between 1.1.0b and 1.1.0c [10 Nov 2016]
    191 
    192   *) ChaCha20/Poly1305 heap-buffer-overflow
    193 
    194      TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to
    195      a DoS attack by corrupting larger payloads. This can result in an OpenSSL
    196      crash. This issue is not considered to be exploitable beyond a DoS.
    197 
    198      This issue was reported to OpenSSL by Robert wicki (Google Security Team)
    199      (CVE-2016-7054)
    200      [Richard Levitte]
    201 
    202   *) CMS Null dereference
    203 
    204      Applications parsing invalid CMS structures can crash with a NULL pointer
    205      dereference. This is caused by a bug in the handling of the ASN.1 CHOICE
    206      type in OpenSSL 1.1.0 which can result in a NULL value being passed to the
    207      structure callback if an attempt is made to free certain invalid encodings.
    208      Only CHOICE structures using a callback which do not handle NULL value are
    209      affected.
    210 
    211      This issue was reported to OpenSSL by Tyler Nighswander of ForAllSecure.
    212      (CVE-2016-7053)
    213      [Stephen Henson]
    214 
    215   *) Montgomery multiplication may produce incorrect results
    216 
    217      There is a carry propagating bug in the Broadwell-specific Montgomery
    218      multiplication procedure that handles input lengths divisible by, but
    219      longer than 256 bits. Analysis suggests that attacks against RSA, DSA
    220      and DH private keys are impossible. This is because the subroutine in
    221      question is not used in operations with the private key itself and an input
    222      of the attacker's direct choice. Otherwise the bug can manifest itself as
    223      transient authentication and key negotiation failures or reproducible
    224      erroneous outcome of public-key operations with specially crafted input.
    225      Among EC algorithms only Brainpool P-512 curves are affected and one
    226      presumably can attack ECDH key negotiation. Impact was not analyzed in
    227      detail, because pre-requisites for attack are considered unlikely. Namely
    228      multiple clients have to choose the curve in question and the server has to
    229      share the private key among them, neither of which is default behaviour.
    230      Even then only clients that chose the curve will be affected.
    231 
    232      This issue was publicly reported as transient failures and was not
    233      initially recognized as a security issue. Thanks to Richard Morgan for
    234      providing reproducible case.
    235      (CVE-2016-7055)
    236      [Andy Polyakov]
    237 
    238   *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
    239      or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
    240      prevent issues where no progress is being made and the peer continually
    241      sends unrecognised record types, using up resources processing them.
    242      [Matt Caswell]
    243 
    244   *) Removed automatic addition of RPATH in shared libraries and executables,
    245      as this was a remainder from OpenSSL 1.0.x and isn't needed any more.
    246      [Richard Levitte]
    247 
    248  Changes between 1.1.0a and 1.1.0b [26 Sep 2016]
    249 
    250   *) Fix Use After Free for large message sizes
    251 
    252      The patch applied to address CVE-2016-6307 resulted in an issue where if a
    253      message larger than approx 16k is received then the underlying buffer to
    254      store the incoming message is reallocated and moved. Unfortunately a
    255      dangling pointer to the old location is left which results in an attempt to
    256      write to the previously freed location. This is likely to result in a
    257      crash, however it could potentially lead to execution of arbitrary code.
    258 
    259      This issue only affects OpenSSL 1.1.0a.
    260 
    261      This issue was reported to OpenSSL by Robert wicki.
    262      (CVE-2016-6309)
    263      [Matt Caswell]
    264 
    265  Changes between 1.1.0 and 1.1.0a [22 Sep 2016]
    266 
    267   *) OCSP Status Request extension unbounded memory growth
    268 
    269      A malicious client can send an excessively large OCSP Status Request
    270      extension. If that client continually requests renegotiation, sending a
    271      large OCSP Status Request extension each time, then there will be unbounded
    272      memory growth on the server. This will eventually lead to a Denial Of
    273      Service attack through memory exhaustion. Servers with a default
    274      configuration are vulnerable even if they do not support OCSP. Builds using
    275      the "no-ocsp" build time option are not affected.
    276 
    277      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    278      (CVE-2016-6304)
    279      [Matt Caswell]
    280 
    281   *) SSL_peek() hang on empty record
    282 
    283      OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer
    284      sends an empty record. This could be exploited by a malicious peer in a
    285      Denial Of Service attack.
    286 
    287      This issue was reported to OpenSSL by Alex Gaynor.
    288      (CVE-2016-6305)
    289      [Matt Caswell]
    290 
    291   *) Excessive allocation of memory in tls_get_message_header() and
    292      dtls1_preprocess_fragment()
    293 
    294      A (D)TLS message includes 3 bytes for its length in the header for the
    295      message. This would allow for messages up to 16Mb in length. Messages of
    296      this length are excessive and OpenSSL includes a check to ensure that a
    297      peer is sending reasonably sized messages in order to avoid too much memory
    298      being consumed to service a connection. A flaw in the logic of version
    299      1.1.0 means that memory for the message is allocated too early, prior to
    300      the excessive message length check. Due to way memory is allocated in
    301      OpenSSL this could mean an attacker could force up to 21Mb to be allocated
    302      to service a connection. This could lead to a Denial of Service through
    303      memory exhaustion. However, the excessive message length check still takes
    304      place, and this would cause the connection to immediately fail. Assuming
    305      that the application calls SSL_free() on the failed connection in a timely
    306      manner then the 21Mb of allocated memory will then be immediately freed
    307      again. Therefore the excessive memory allocation will be transitory in
    308      nature. This then means that there is only a security impact if:
    309 
    310      1) The application does not call SSL_free() in a timely manner in the event
    311      that the connection fails
    312      or
    313      2) The application is working in a constrained environment where there is
    314      very little free memory
    315      or
    316      3) The attacker initiates multiple connection attempts such that there are
    317      multiple connections in a state where memory has been allocated for the
    318      connection; SSL_free() has not yet been called; and there is insufficient
    319      memory to service the multiple requests.
    320 
    321      Except in the instance of (1) above any Denial Of Service is likely to be
    322      transitory because as soon as the connection fails the memory is
    323      subsequently freed again in the SSL_free() call. However there is an
    324      increased risk during this period of application crashes due to the lack of
    325      memory - which would then mean a more serious Denial of Service.
    326 
    327      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    328      (CVE-2016-6307 and CVE-2016-6308)
    329      [Matt Caswell]
    330 
    331   *) solaris-x86-cc, i.e. 32-bit configuration with vendor compiler,
    332      had to be removed. Primary reason is that vendor assembler can't
    333      assemble our modules with -KPIC flag. As result it, assembly
    334      support, was not even available as option. But its lack means
    335      lack of side-channel resistant code, which is incompatible with
    336      security by todays standards. Fortunately gcc is readily available
    337      prepackaged option, which we firmly point at...
    338      [Andy Polyakov]
    339 
    340  Changes between 1.0.2h and 1.1.0  [25 Aug 2016]
    341 
    342   *) Windows command-line tool supports UTF-8 opt-in option for arguments
    343      and console input. Setting OPENSSL_WIN32_UTF8 environment variable
    344      (to any value) allows Windows user to access PKCS#12 file generated
    345      with Windows CryptoAPI and protected with non-ASCII password, as well
    346      as files generated under UTF-8 locale on Linux also protected with
    347      non-ASCII password.
    348      [Andy Polyakov]
    349 
    350   *) To mitigate the SWEET32 attack (CVE-2016-2183), 3DES cipher suites
    351      have been disabled by default and removed from DEFAULT, just like RC4.
    352      See the RC4 item below to re-enable both.
    353      [Rich Salz]
    354 
    355   *) The method for finding the storage location for the Windows RAND seed file
    356      has changed. First we check %RANDFILE%. If that is not set then we check
    357      the directories %HOME%, %USERPROFILE% and %SYSTEMROOT% in that order. If
    358      all else fails we fall back to C:\.
    359      [Matt Caswell]
    360 
    361   *) The EVP_EncryptUpdate() function has had its return type changed from void
    362      to int. A return of 0 indicates and error while a return of 1 indicates
    363      success.
    364      [Matt Caswell]
    365 
    366   *) The flags RSA_FLAG_NO_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME and
    367      DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch
    368      off the constant time implementation for RSA, DSA and DH have been made
    369      no-ops and deprecated.
    370      [Matt Caswell]
    371 
    372   *) Windows RAND implementation was simplified to only get entropy by
    373      calling CryptGenRandom(). Various other RAND-related tickets
    374      were also closed.
    375      [Joseph Wylie Yandle, Rich Salz]
    376 
    377   *) The stack and lhash API's were renamed to start with OPENSSL_SK_
    378      and OPENSSL_LH_, respectively.  The old names are available
    379      with API compatibility.  They new names are now completely documented.
    380      [Rich Salz]
    381 
    382   *) Unify TYPE_up_ref(obj) methods signature.
    383      SSL_CTX_up_ref(), SSL_up_ref(), X509_up_ref(), EVP_PKEY_up_ref(),
    384      X509_CRL_up_ref(), X509_OBJECT_up_ref_count() methods are now returning an
    385      int (instead of void) like all others TYPE_up_ref() methods.
    386      So now these methods also check the return value of CRYPTO_atomic_add(),
    387      and the validity of object reference counter.
    388      [fdasilvayy (a] gmail.com]
    389 
    390   *) With Windows Visual Studio builds, the .pdb files are installed
    391      alongside the installed libraries and executables.  For a static
    392      library installation, ossl_static.pdb is the associate compiler
    393      generated .pdb file to be used when linking programs.
    394      [Richard Levitte]
    395 
    396   *) Remove openssl.spec.  Packaging files belong with the packagers.
    397      [Richard Levitte]
    398 
    399   *) Automatic Darwin/OSX configuration has had a refresh, it will now
    400      recognise x86_64 architectures automatically.  You can still decide
    401      to build for a different bitness with the environment variable
    402      KERNEL_BITS (can be 32 or 64), for example:
    403 
    404          KERNEL_BITS=32 ./config
    405 
    406      [Richard Levitte]
    407 
    408   *) Change default algorithms in pkcs8 utility to use PKCS#5 v2.0,
    409      256 bit AES and HMAC with SHA256.
    410      [Steve Henson]
    411 
    412   *) Remove support for MIPS o32 ABI on IRIX (and IRIX only).
    413      [Andy Polyakov]
    414 
    415   *) Triple-DES ciphers have been moved from HIGH to MEDIUM.
    416      [Rich Salz]
    417 
    418   *) To enable users to have their own config files and build file templates,
    419      Configure looks in the directory indicated by the environment variable
    420      OPENSSL_LOCAL_CONFIG_DIR as well as the in-source Configurations/
    421      directory.  On VMS, OPENSSL_LOCAL_CONFIG_DIR is expected to be a logical
    422      name and is used as is.
    423      [Richard Levitte]
    424 
    425   *) The following datatypes were made opaque: X509_OBJECT, X509_STORE_CTX,
    426      X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD.  The unused type
    427      X509_CERT_FILE_CTX was removed.
    428      [Rich Salz]
    429 
    430   *) "shared" builds are now the default. To create only static libraries use
    431      the "no-shared" Configure option.
    432      [Matt Caswell]
    433 
    434   *) Remove the no-aes, no-hmac, no-rsa, no-sha and no-md5 Configure options.
    435      All of these option have not worked for some while and are fundamental
    436      algorithms.
    437      [Matt Caswell]
    438 
    439   *) Make various cleanup routines no-ops and mark them as deprecated. Most
    440      global cleanup functions are no longer required because they are handled
    441      via auto-deinit (see OPENSSL_init_crypto and OPENSSL_init_ssl man pages).
    442      Explicitly de-initing can cause problems (e.g. where a library that uses
    443      OpenSSL de-inits, but an application is still using it). The affected
    444      functions are CONF_modules_free(), ENGINE_cleanup(), OBJ_cleanup(),
    445      EVP_cleanup(), BIO_sock_cleanup(), CRYPTO_cleanup_all_ex_data(),
    446      RAND_cleanup(), SSL_COMP_free_compression_methods(), ERR_free_strings() and
    447      COMP_zlib_cleanup().
    448      [Matt Caswell]
    449 
    450   *) --strict-warnings no longer enables runtime debugging options
    451      such as REF_DEBUG. Instead, debug options are automatically
    452      enabled with '--debug' builds.
    453      [Andy Polyakov, Emilia Ksper]
    454 
    455   *) Made DH and DH_METHOD opaque. The structures for managing DH objects
    456      have been moved out of the public header files. New functions for managing
    457      these have been added.
    458      [Matt Caswell]
    459 
    460   *) Made RSA and RSA_METHOD opaque. The structures for managing RSA
    461      objects have been moved out of the public header files. New
    462      functions for managing these have been added.
    463      [Richard Levitte]
    464 
    465   *) Made DSA and DSA_METHOD opaque. The structures for managing DSA objects
    466      have been moved out of the public header files. New functions for managing
    467      these have been added.
    468      [Matt Caswell]
    469 
    470   *) Made BIO and BIO_METHOD opaque. The structures for managing BIOs have been
    471      moved out of the public header files. New functions for managing these
    472      have been added.
    473      [Matt Caswell]
    474 
    475   *) Removed no-rijndael as a config option. Rijndael is an old name for AES.
    476      [Matt Caswell]
    477 
    478   *) Removed the mk1mf build scripts.
    479      [Richard Levitte]
    480 
    481   *) Headers are now wrapped, if necessary, with OPENSSL_NO_xxx, so
    482      it is always safe to #include a header now.
    483      [Rich Salz]
    484 
    485   *) Removed the aged BC-32 config and all its supporting scripts
    486      [Richard Levitte]
    487 
    488   *) Removed support for Ultrix, Netware, and OS/2.
    489      [Rich Salz]
    490 
    491   *) Add support for HKDF.
    492      [Alessandro Ghedini]
    493 
    494   *) Add support for blake2b and blake2s
    495      [Bill Cox]
    496 
    497   *) Added support for "pipelining". Ciphers that have the
    498      EVP_CIPH_FLAG_PIPELINE flag set have a capability to process multiple
    499      encryptions/decryptions simultaneously. There are currently no built-in
    500      ciphers with this property but the expectation is that engines will be able
    501      to offer it to significantly improve throughput. Support has been extended
    502      into libssl so that multiple records for a single connection can be
    503      processed in one go (for >=TLS 1.1).
    504      [Matt Caswell]
    505 
    506   *) Added the AFALG engine. This is an async capable engine which is able to
    507      offload work to the Linux kernel. In this initial version it only supports
    508      AES128-CBC. The kernel must be version 4.1.0 or greater.
    509      [Catriona Lucey]
    510 
    511   *) OpenSSL now uses a new threading API. It is no longer necessary to
    512      set locking callbacks to use OpenSSL in a multi-threaded environment. There
    513      are two supported threading models: pthreads and windows threads. It is
    514      also possible to configure OpenSSL at compile time for "no-threads". The
    515      old threading API should no longer be used. The functions have been
    516      replaced with "no-op" compatibility macros.
    517      [Alessandro Ghedini, Matt Caswell]
    518 
    519   *) Modify behavior of ALPN to invoke callback after SNI/servername
    520      callback, such that updates to the SSL_CTX affect ALPN.
    521      [Todd Short]
    522 
    523   *) Add SSL_CIPHER queries for authentication and key-exchange.
    524      [Todd Short]
    525 
    526   *) Changes to the DEFAULT cipherlist:
    527        - Prefer (EC)DHE handshakes over plain RSA.
    528        - Prefer AEAD ciphers over legacy ciphers.
    529        - Prefer ECDSA over RSA when both certificates are available.
    530        - Prefer TLSv1.2 ciphers/PRF.
    531        - Remove DSS, SEED, IDEA, CAMELLIA, and AES-CCM from the
    532          default cipherlist.
    533      [Emilia Ksper]
    534 
    535   *) Change the ECC default curve list to be this, in order: x25519,
    536      secp256r1, secp521r1, secp384r1.
    537      [Rich Salz]
    538 
    539   *) RC4 based libssl ciphersuites are now classed as "weak" ciphers and are
    540      disabled by default. They can be re-enabled using the
    541      enable-weak-ssl-ciphers option to Configure.
    542      [Matt Caswell]
    543 
    544   *) If the server has ALPN configured, but supports no protocols that the
    545      client advertises, send a fatal "no_application_protocol" alert.
    546      This behaviour is SHALL in RFC 7301, though it isn't universally
    547      implemented by other servers.
    548      [Emilia Ksper]
    549 
    550   *) Add X25519 support.
    551      Add ASN.1 and EVP_PKEY methods for X25519. This includes support
    552      for public and private key encoding using the format documented in
    553      draft-ietf-curdle-pkix-02. The corresponding EVP_PKEY method supports
    554      key generation and key derivation.
    555 
    556      TLS support complies with draft-ietf-tls-rfc4492bis-08 and uses
    557      X25519(29).
    558      [Steve Henson]
    559 
    560   *) Deprecate SRP_VBASE_get_by_user.
    561      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
    562      In order to fix an unavoidable memory leak (CVE-2016-0798),
    563      SRP_VBASE_get_by_user was changed to ignore the "fake user" SRP
    564      seed, even if the seed is configured.
    565 
    566      Users should use SRP_VBASE_get1_by_user instead. Note that in
    567      SRP_VBASE_get1_by_user, caller must free the returned value. Note
    568      also that even though configuring the SRP seed attempts to hide
    569      invalid usernames by continuing the handshake with fake
    570      credentials, this behaviour is not constant time and no strong
    571      guarantees are made that the handshake is indistinguishable from
    572      that of a valid user.
    573      [Emilia Ksper]
    574 
    575   *) Configuration change; it's now possible to build dynamic engines
    576      without having to build shared libraries and vice versa.  This
    577      only applies to the engines in engines/, those in crypto/engine/
    578      will always be built into libcrypto (i.e. "static").
    579 
    580      Building dynamic engines is enabled by default; to disable, use
    581      the configuration option "disable-dynamic-engine".
    582 
    583      The only requirements for building dynamic engines are the
    584      presence of the DSO module and building with position independent
    585      code, so they will also automatically be disabled if configuring
    586      with "disable-dso" or "disable-pic".
    587 
    588      The macros OPENSSL_NO_STATIC_ENGINE and OPENSSL_NO_DYNAMIC_ENGINE
    589      are also taken away from openssl/opensslconf.h, as they are
    590      irrelevant.
    591      [Richard Levitte]
    592 
    593   *) Configuration change; if there is a known flag to compile
    594      position independent code, it will always be applied on the
    595      libcrypto and libssl object files, and never on the application
    596      object files.  This means other libraries that use routines from
    597      libcrypto / libssl can be made into shared libraries regardless
    598      of how OpenSSL was configured.
    599 
    600      If this isn't desirable, the configuration options "disable-pic"
    601      or "no-pic" can be used to disable the use of PIC.  This will
    602      also disable building shared libraries and dynamic engines.
    603      [Richard Levitte]
    604 
    605   *) Removed JPAKE code.  It was experimental and has no wide use.
    606      [Rich Salz]
    607 
    608   *) The INSTALL_PREFIX Makefile variable has been renamed to
    609      DESTDIR.  That makes for less confusion on what this variable
    610      is for.  Also, the configuration option --install_prefix is
    611      removed.
    612      [Richard Levitte]
    613 
    614   *) Heartbeat for TLS has been removed and is disabled by default
    615      for DTLS; configure with enable-heartbeats.  Code that uses the
    616      old #define's might need to be updated.
    617      [Emilia Ksper, Rich Salz]
    618 
    619   *) Rename REF_CHECK to REF_DEBUG.
    620      [Rich Salz]
    621 
    622   *) New "unified" build system
    623 
    624      The "unified" build system is aimed to be a common system for all
    625      platforms we support.  With it comes new support for VMS.
    626 
    627      This system builds supports building in a different directory tree
    628      than the source tree.  It produces one Makefile (for unix family
    629      or lookalikes), or one descrip.mms (for VMS).
    630 
    631      The source of information to make the Makefile / descrip.mms is
    632      small files called 'build.info', holding the necessary
    633      information for each directory with source to compile, and a
    634      template in Configurations, like unix-Makefile.tmpl or
    635      descrip.mms.tmpl.
    636 
    637      With this change, the library names were also renamed on Windows
    638      and on VMS.  They now have names that are closer to the standard
    639      on Unix, and include the major version number, and in certain
    640      cases, the architecture they are built for.  See "Notes on shared
    641      libraries" in INSTALL.
    642 
    643      We rely heavily on the perl module Text::Template.
    644      [Richard Levitte]
    645 
    646   *) Added support for auto-initialisation and de-initialisation of the library.
    647      OpenSSL no longer requires explicit init or deinit routines to be called,
    648      except in certain circumstances. See the OPENSSL_init_crypto() and
    649      OPENSSL_init_ssl() man pages for further information.
    650      [Matt Caswell]
    651 
    652   *) The arguments to the DTLSv1_listen function have changed. Specifically the
    653      "peer" argument is now expected to be a BIO_ADDR object.
    654 
    655   *) Rewrite of BIO networking library. The BIO library lacked consistent
    656      support of IPv6, and adding it required some more extensive
    657      modifications.  This introduces the BIO_ADDR and BIO_ADDRINFO types,
    658      which hold all types of addresses and chains of address information.
    659      It also introduces a new API, with functions like BIO_socket,
    660      BIO_connect, BIO_listen, BIO_lookup and a rewrite of BIO_accept.
    661      The source/sink BIOs BIO_s_connect, BIO_s_accept and BIO_s_datagram
    662      have been adapted accordingly.
    663      [Richard Levitte]
    664 
    665   *) RSA_padding_check_PKCS1_type_1 now accepts inputs with and without
    666      the leading 0-byte.
    667      [Emilia Ksper]
    668 
    669   *) CRIME protection: disable compression by default, even if OpenSSL is
    670      compiled with zlib enabled. Applications can still enable compression
    671      by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by
    672      using the SSL_CONF library to configure compression.
    673      [Emilia Ksper]
    674 
    675   *) The signature of the session callback configured with
    676      SSL_CTX_sess_set_get_cb was changed. The read-only input buffer
    677      was explicitly marked as 'const unsigned char*' instead of
    678      'unsigned char*'.
    679      [Emilia Ksper]
    680 
    681   *) Always DPURIFY. Remove the use of uninitialized memory in the
    682      RNG, and other conditional uses of DPURIFY. This makes -DPURIFY a no-op.
    683      [Emilia Ksper]
    684 
    685   *) Removed many obsolete configuration items, including
    686         DES_PTR, DES_RISC1, DES_RISC2, DES_INT
    687         MD2_CHAR, MD2_INT, MD2_LONG
    688         BF_PTR, BF_PTR2
    689         IDEA_SHORT, IDEA_LONG
    690         RC2_SHORT, RC2_LONG, RC4_LONG, RC4_CHUNK, RC4_INDEX
    691      [Rich Salz, with advice from Andy Polyakov]
    692 
    693   *) Many BN internals have been moved to an internal header file.
    694      [Rich Salz with help from Andy Polyakov]
    695 
    696   *) Configuration and writing out the results from it has changed.
    697      Files such as Makefile include/openssl/opensslconf.h and are now
    698      produced through general templates, such as Makefile.in and
    699      crypto/opensslconf.h.in and some help from the perl module
    700      Text::Template.
    701 
    702      Also, the center of configuration information is no longer
    703      Makefile.  Instead, Configure produces a perl module in
    704      configdata.pm which holds most of the config data (in the hash
    705      table %config), the target data that comes from the target
    706      configuration in one of the Configurations/*.conf files (in
    707      %target).
    708      [Richard Levitte]
    709 
    710   *) To clarify their intended purposes, the Configure options
    711      --prefix and --openssldir change their semantics, and become more
    712      straightforward and less interdependent.
    713 
    714      --prefix shall be used exclusively to give the location INSTALLTOP
    715      where programs, scripts, libraries, include files and manuals are
    716      going to be installed.  The default is now /usr/local.
    717 
    718      --openssldir shall be used exclusively to give the default
    719      location OPENSSLDIR where certificates, private keys, CRLs are
    720      managed.  This is also where the default openssl.cnf gets
    721      installed.
    722      If the directory given with this option is a relative path, the
    723      values of both the --prefix value and the --openssldir value will
    724      be combined to become OPENSSLDIR.
    725      The default for --openssldir is INSTALLTOP/ssl.
    726 
    727      Anyone who uses --openssldir to specify where OpenSSL is to be
    728      installed MUST change to use --prefix instead.
    729      [Richard Levitte]
    730 
    731   *) The GOST engine was out of date and therefore it has been removed. An up
    732      to date GOST engine is now being maintained in an external repository.
    733      See: https://wiki.openssl.org/index.php/Binaries. Libssl still retains
    734      support for GOST ciphersuites (these are only activated if a GOST engine
    735      is present).
    736      [Matt Caswell]
    737 
    738   *) EGD is no longer supported by default; use enable-egd when
    739      configuring.
    740      [Ben Kaduk and Rich Salz]
    741 
    742   *) The distribution now has Makefile.in files, which are used to
    743      create Makefile's when Configure is run.  *Configure must be run
    744      before trying to build now.*
    745      [Rich Salz]
    746 
    747   *) The return value for SSL_CIPHER_description() for error conditions
    748      has changed.
    749      [Rich Salz]
    750 
    751   *) Support for RFC6698/RFC7671 DANE TLSA peer authentication.
    752 
    753      Obtaining and performing DNSSEC validation of TLSA records is
    754      the application's responsibility.  The application provides
    755      the TLSA records of its choice to OpenSSL, and these are then
    756      used to authenticate the peer.
    757 
    758      The TLSA records need not even come from DNS.  They can, for
    759      example, be used to implement local end-entity certificate or
    760      trust-anchor "pinning", where the "pin" data takes the form
    761      of TLSA records, which can augment or replace verification
    762      based on the usual WebPKI public certification authorities.
    763      [Viktor Dukhovni]
    764 
    765   *) Revert default OPENSSL_NO_DEPRECATED setting.  Instead OpenSSL
    766      continues to support deprecated interfaces in default builds.
    767      However, applications are strongly advised to compile their
    768      source files with -DOPENSSL_API_COMPAT=0x10100000L, which hides
    769      the declarations of all interfaces deprecated in 0.9.8, 1.0.0
    770      or the 1.1.0 releases.
    771 
    772      In environments in which all applications have been ported to
    773      not use any deprecated interfaces OpenSSL's Configure script
    774      should be used with the --api=1.1.0 option to entirely remove
    775      support for the deprecated features from the library and
    776      unconditionally disable them in the installed headers.
    777      Essentially the same effect can be achieved with the "no-deprecated"
    778      argument to Configure, except that this will always restrict
    779      the build to just the latest API, rather than a fixed API
    780      version.
    781 
    782      As applications are ported to future revisions of the API,
    783      they should update their compile-time OPENSSL_API_COMPAT define
    784      accordingly, but in most cases should be able to continue to
    785      compile with later releases.
    786 
    787      The OPENSSL_API_COMPAT versions for 1.0.0, and 0.9.8 are
    788      0x10000000L and 0x00908000L, respectively.  However those
    789      versions did not support the OPENSSL_API_COMPAT feature, and
    790      so applications are not typically tested for explicit support
    791      of just the undeprecated features of either release.
    792      [Viktor Dukhovni]
    793 
    794   *) Add support for setting the minimum and maximum supported protocol.
    795      It can bet set via the SSL_set_min_proto_version() and
    796      SSL_set_max_proto_version(), or via the SSL_CONF's MinProtocol and
    797      MaxProtcol.  It's recommended to use the new APIs to disable
    798      protocols instead of disabling individual protocols using
    799      SSL_set_options() or SSL_CONF's Protocol.  This change also
    800      removes support for disabling TLS 1.2 in the OpenSSL TLS
    801      client at compile time by defining OPENSSL_NO_TLS1_2_CLIENT.
    802      [Kurt Roeckx]
    803 
    804   *) Support for ChaCha20 and Poly1305 added to libcrypto and libssl.
    805      [Andy Polyakov]
    806 
    807   *) New EC_KEY_METHOD, this replaces the older ECDSA_METHOD and ECDH_METHOD
    808      and integrates ECDSA and ECDH functionality into EC. Implementations can
    809      now redirect key generation and no longer need to convert to or from
    810      ECDSA_SIG format.
    811 
    812      Note: the ecdsa.h and ecdh.h headers are now no longer needed and just
    813      include the ec.h header file instead.
    814      [Steve Henson]
    815 
    816   *) Remove support for all 40 and 56 bit ciphers.  This includes all the export
    817      ciphers who are no longer supported and drops support the ephemeral RSA key
    818      exchange. The LOW ciphers currently doesn't have any ciphers in it.
    819      [Kurt Roeckx]
    820 
    821   *) Made EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX, EVP_CIPHER and HMAC_CTX
    822      opaque.  For HMAC_CTX, the following constructors and destructors
    823      were added:
    824 
    825         HMAC_CTX *HMAC_CTX_new(void);
    826         void HMAC_CTX_free(HMAC_CTX *ctx);
    827 
    828      For EVP_MD and EVP_CIPHER, complete APIs to create, fill and
    829      destroy such methods has been added.  See EVP_MD_meth_new(3) and
    830      EVP_CIPHER_meth_new(3) for documentation.
    831 
    832      Additional changes:
    833      1) EVP_MD_CTX_cleanup(), EVP_CIPHER_CTX_cleanup() and
    834         HMAC_CTX_cleanup() were removed.  HMAC_CTX_reset() and
    835         EVP_MD_CTX_reset() should be called instead to reinitialise
    836         an already created structure.
    837      2) For consistency with the majority of our object creators and
    838         destructors, EVP_MD_CTX_(create|destroy) were renamed to
    839         EVP_MD_CTX_(new|free).  The old names are retained as macros
    840         for deprecated builds.
    841      [Richard Levitte]
    842 
    843   *) Added ASYNC support. Libcrypto now includes the async sub-library to enable
    844      cryptographic operations to be performed asynchronously as long as an
    845      asynchronous capable engine is used. See the ASYNC_start_job() man page for
    846      further details. Libssl has also had this capability integrated with the
    847      introduction of the new mode SSL_MODE_ASYNC and associated error
    848      SSL_ERROR_WANT_ASYNC. See the SSL_CTX_set_mode() and SSL_get_error() man
    849      pages. This work was developed in partnership with Intel Corp.
    850      [Matt Caswell]
    851 
    852   *) SSL_{CTX_}set_ecdh_auto() has been removed and ECDH is support is
    853      always enabled now.  If you want to disable the support you should
    854      exclude it using the list of supported ciphers. This also means that the
    855      "-no_ecdhe" option has been removed from s_server.
    856      [Kurt Roeckx]
    857 
    858   *) SSL_{CTX}_set_tmp_ecdh() which can set 1 EC curve now internally calls
    859      SSL_{CTX_}set1_curves() which can set a list.
    860      [Kurt Roeckx]
    861 
    862   *) Remove support for SSL_{CTX_}set_tmp_ecdh_callback().  You should set the
    863      curve you want to support using SSL_{CTX_}set1_curves().
    864      [Kurt Roeckx]
    865 
    866   *) State machine rewrite. The state machine code has been significantly
    867      refactored in order to remove much duplication of code and solve issues
    868      with the old code (see ssl/statem/README for further details). This change
    869      does have some associated API changes. Notably the SSL_state() function
    870      has been removed and replaced by SSL_get_state which now returns an
    871      "OSSL_HANDSHAKE_STATE" instead of an int. SSL_set_state() has been removed
    872      altogether. The previous handshake states defined in ssl.h and ssl3.h have
    873      also been removed.
    874      [Matt Caswell]
    875 
    876   *) All instances of the string "ssleay" in the public API were replaced
    877      with OpenSSL (case-matching; e.g., OPENSSL_VERSION for #define's)
    878      Some error codes related to internal RSA_eay API's were renamed.
    879      [Rich Salz]
    880 
    881   *) The demo files in crypto/threads were moved to demo/threads.
    882      [Rich Salz]
    883 
    884   *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron, gmp,
    885      sureware and ubsec.
    886      [Matt Caswell, Rich Salz]
    887 
    888   *) New ASN.1 embed macro.
    889 
    890      New ASN.1 macro ASN1_EMBED. This is the same as ASN1_SIMPLE except the
    891      structure is not allocated: it is part of the parent. That is instead of
    892 
    893      FOO *x;
    894 
    895      it must be:
    896 
    897      FOO x;
    898 
    899      This reduces memory fragmentation and make it impossible to accidentally
    900      set a mandatory field to NULL.
    901 
    902      This currently only works for some fields specifically a SEQUENCE, CHOICE,
    903      or ASN1_STRING type which is part of a parent SEQUENCE. Since it is
    904      equivalent to ASN1_SIMPLE it cannot be tagged, OPTIONAL, SET OF or
    905      SEQUENCE OF.
    906      [Steve Henson]
    907 
    908   *) Remove EVP_CHECK_DES_KEY, a compile-time option that never compiled.
    909      [Emilia Ksper]
    910 
    911   *) Removed DES and RC4 ciphersuites from DEFAULT. Also removed RC2 although
    912      in 1.0.2 EXPORT was already removed and the only RC2 ciphersuite is also
    913      an EXPORT one. COMPLEMENTOFDEFAULT has been updated accordingly to add
    914      DES and RC4 ciphersuites.
    915      [Matt Caswell]
    916 
    917   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
    918      This changes the decoding behaviour for some invalid messages,
    919      though the change is mostly in the more lenient direction, and
    920      legacy behaviour is preserved as much as possible.
    921      [Emilia Ksper]
    922 
    923   *) Fix no-stdio build.
    924     [ David Woodhouse <David.Woodhouse (a] intel.com> and also
    925       Ivan Nestlerode <ivan.nestlerode (a] sonos.com> ]
    926 
    927   *) New testing framework
    928      The testing framework has been largely rewritten and is now using
    929      perl and the perl modules Test::Harness and an extended variant of
    930      Test::More called OpenSSL::Test to do its work.  All test scripts in
    931      test/ have been rewritten into test recipes, and all direct calls to
    932      executables in test/Makefile have become individual recipes using the
    933      simplified testing OpenSSL::Test::Simple.
    934 
    935      For documentation on our testing modules, do:
    936 
    937         perldoc test/testlib/OpenSSL/Test/Simple.pm
    938         perldoc test/testlib/OpenSSL/Test.pm
    939 
    940      [Richard Levitte]
    941 
    942   *) Revamped memory debug; only -DCRYPTO_MDEBUG and -DCRYPTO_MDEBUG_ABORT
    943      are used; the latter aborts on memory leaks (usually checked on exit).
    944      Some undocumented "set malloc, etc., hooks" functions were removed
    945      and others were changed.  All are now documented.
    946      [Rich Salz]
    947 
    948   *) In DSA_generate_parameters_ex, if the provided seed is too short,
    949      return an error
    950      [Rich Salz and Ismo Puustinen <ismo.puustinen (a] intel.com>]
    951 
    952   *) Rewrite PSK to support ECDHE_PSK, DHE_PSK and RSA_PSK. Add ciphersuites
    953      from RFC4279, RFC4785, RFC5487, RFC5489.
    954 
    955      Thanks to Christian J. Dietrich and Giuseppe D'Angelo for the
    956      original RSA_PSK patch.
    957      [Steve Henson]
    958 
    959   *) Dropped support for the SSL3_FLAGS_DELAY_CLIENT_FINISHED flag. This SSLeay
    960      era flag was never set throughout the codebase (only read). Also removed
    961      SSL3_FLAGS_POP_BUFFER which was only used if
    962      SSL3_FLAGS_DELAY_CLIENT_FINISHED was also set.
    963      [Matt Caswell]
    964 
    965   *) Changed the default name options in the "ca", "crl", "req" and "x509"
    966      to be "oneline" instead of "compat".
    967      [Richard Levitte]
    968 
    969   *) Remove SSL_OP_TLS_BLOCK_PADDING_BUG. This is SSLeay legacy, we're
    970      not aware of clients that still exhibit this bug, and the workaround
    971      hasn't been working properly for a while.
    972      [Emilia Ksper]
    973 
    974   *) The return type of BIO_number_read() and BIO_number_written() as well as
    975      the corresponding num_read and num_write members in the BIO structure has
    976      changed from unsigned long to uint64_t. On platforms where an unsigned
    977      long is 32 bits (e.g. Windows) these counters could overflow if >4Gb is
    978      transferred.
    979      [Matt Caswell]
    980 
    981   *) Given the pervasive nature of TLS extensions it is inadvisable to run
    982      OpenSSL without support for them. It also means that maintaining
    983      the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably
    984      not well tested). Therefore the OPENSSL_NO_TLSEXT option has been removed.
    985      [Matt Caswell]
    986 
    987   *) Removed support for the two export grade static DH ciphersuites
    988      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
    989      were newly added (along with a number of other static DH ciphersuites) to
    990      1.0.2. However the two export ones have *never* worked since they were
    991      introduced. It seems strange in any case to be adding new export
    992      ciphersuites, and given "logjam" it also does not seem correct to fix them.
    993      [Matt Caswell]
    994 
    995   *) Version negotiation has been rewritten. In particular SSLv23_method(),
    996      SSLv23_client_method() and SSLv23_server_method() have been deprecated,
    997      and turned into macros which simply call the new preferred function names
    998      TLS_method(), TLS_client_method() and TLS_server_method(). All new code
    999      should use the new names instead. Also as part of this change the ssl23.h
   1000      header file has been removed.
   1001      [Matt Caswell]
   1002 
   1003   *) Support for Kerberos ciphersuites in TLS (RFC2712) has been removed. This
   1004      code and the associated standard is no longer considered fit-for-purpose.
   1005      [Matt Caswell]
   1006 
   1007   *) RT2547 was closed.  When generating a private key, try to make the
   1008      output file readable only by the owner.  This behavior change might
   1009      be noticeable when interacting with other software.
   1010 
   1011   *) Documented all exdata functions.  Added CRYPTO_free_ex_index.
   1012      Added a test.
   1013      [Rich Salz]
   1014 
   1015   *) Added HTTP GET support to the ocsp command.
   1016      [Rich Salz]
   1017 
   1018   *) Changed default digest for the dgst and enc commands from MD5 to
   1019      sha256
   1020      [Rich Salz]
   1021 
   1022   *) RAND_pseudo_bytes has been deprecated. Users should use RAND_bytes instead.
   1023      [Matt Caswell]
   1024 
   1025   *) Added support for TLS extended master secret from
   1026      draft-ietf-tls-session-hash-03.txt. Thanks for Alfredo Pironti for an
   1027      initial patch which was a great help during development.
   1028      [Steve Henson]
   1029 
   1030   *) All libssl internal structures have been removed from the public header
   1031      files, and the OPENSSL_NO_SSL_INTERN option has been removed (since it is
   1032      now redundant). Users should not attempt to access internal structures
   1033      directly. Instead they should use the provided API functions.
   1034      [Matt Caswell]
   1035 
   1036   *) config has been changed so that by default OPENSSL_NO_DEPRECATED is used.
   1037      Access to deprecated functions can be re-enabled by running config with
   1038      "enable-deprecated". In addition applications wishing to use deprecated
   1039      functions must define OPENSSL_USE_DEPRECATED. Note that this new behaviour
   1040      will, by default, disable some transitive includes that previously existed
   1041      in the header files (e.g. ec.h will no longer, by default, include bn.h)
   1042      [Matt Caswell]
   1043 
   1044   *) Added support for OCB mode. OpenSSL has been granted a patent license
   1045      compatible with the OpenSSL license for use of OCB. Details are available
   1046      at https://www.openssl.org/source/OCB-patent-grant-OpenSSL.pdf. Support
   1047      for OCB can be removed by calling config with no-ocb.
   1048      [Matt Caswell]
   1049 
   1050   *) SSLv2 support has been removed.  It still supports receiving a SSLv2
   1051      compatible client hello.
   1052      [Kurt Roeckx]
   1053 
   1054   *) Increased the minimal RSA keysize from 256 to 512 bits [Rich Salz],
   1055      done while fixing the error code for the key-too-small case.
   1056      [Annie Yousar <a.yousar (a] informatik.hu-berlin.de>]
   1057 
   1058   *) CA.sh has been removed; use CA.pl instead.
   1059      [Rich Salz]
   1060 
   1061   *) Removed old DES API.
   1062      [Rich Salz]
   1063 
   1064   *) Remove various unsupported platforms:
   1065         Sony NEWS4
   1066         BEOS and BEOS_R5
   1067         NeXT
   1068         SUNOS
   1069         MPE/iX
   1070         Sinix/ReliantUNIX RM400
   1071         DGUX
   1072         NCR
   1073         Tandem
   1074         Cray
   1075         16-bit platforms such as WIN16
   1076      [Rich Salz]
   1077 
   1078   *) Clean up OPENSSL_NO_xxx #define's
   1079         Use setbuf() and remove OPENSSL_NO_SETVBUF_IONBF
   1080         Rename OPENSSL_SYSNAME_xxx to OPENSSL_SYS_xxx
   1081         OPENSSL_NO_EC{DH,DSA} merged into OPENSSL_NO_EC
   1082         OPENSSL_NO_RIPEMD160, OPENSSL_NO_RIPEMD merged into OPENSSL_NO_RMD160
   1083         OPENSSL_NO_FP_API merged into OPENSSL_NO_STDIO
   1084         Remove OPENSSL_NO_BIO OPENSSL_NO_BUFFER OPENSSL_NO_CHAIN_VERIFY
   1085         OPENSSL_NO_EVP OPENSSL_NO_FIPS_ERR OPENSSL_NO_HASH_COMP
   1086         OPENSSL_NO_LHASH OPENSSL_NO_OBJECT OPENSSL_NO_SPEED OPENSSL_NO_STACK
   1087         OPENSSL_NO_X509 OPENSSL_NO_X509_VERIFY
   1088         Remove MS_STATIC; it's a relic from platforms <32 bits.
   1089      [Rich Salz]
   1090 
   1091   *) Cleaned up dead code
   1092         Remove all but one '#ifdef undef' which is to be looked at.
   1093      [Rich Salz]
   1094 
   1095   *) Clean up calling of xxx_free routines.
   1096         Just like free(), fix most of the xxx_free routines to accept
   1097         NULL.  Remove the non-null checks from callers.  Save much code.
   1098      [Rich Salz]
   1099 
   1100   *) Add secure heap for storage of private keys (when possible).
   1101      Add BIO_s_secmem(), CBIGNUM, etc.
   1102      Contributed by Akamai Technologies under our Corporate CLA.
   1103      [Rich Salz]
   1104 
   1105   *) Experimental support for a new, fast, unbiased prime candidate generator,
   1106      bn_probable_prime_dh_coprime(). Not currently used by any prime generator.
   1107      [Felix Laurie von Massenbach <felix (a] erbridge.co.uk>]
   1108 
   1109   *) New output format NSS in the sess_id command line tool. This allows
   1110      exporting the session id and the master key in NSS keylog format.
   1111      [Martin Kaiser <martin (a] kaiser.cx>]
   1112 
   1113   *) Harmonize version and its documentation. -f flag is used to display
   1114      compilation flags.
   1115      [mancha <mancha1 (a] zoho.com>]
   1116 
   1117   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
   1118      in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
   1119      [mancha <mancha1 (a] zoho.com>]
   1120 
   1121   *) Fix some double frees. These are not thought to be exploitable.
   1122      [mancha <mancha1 (a] zoho.com>]
   1123 
   1124   *) A missing bounds check in the handling of the TLS heartbeat extension
   1125      can be used to reveal up to 64k of memory to a connected client or
   1126      server.
   1127 
   1128      Thanks for Neel Mehta of Google Security for discovering this bug and to
   1129      Adam Langley <agl (a] chromium.org> and Bodo Moeller <bmoeller (a] acm.org> for
   1130      preparing the fix (CVE-2014-0160)
   1131      [Adam Langley, Bodo Moeller]
   1132 
   1133   *) Fix for the attack described in the paper "Recovering OpenSSL
   1134      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
   1135      by Yuval Yarom and Naomi Benger. Details can be obtained from:
   1136      http://eprint.iacr.org/2014/140
   1137 
   1138      Thanks to Yuval Yarom and Naomi Benger for discovering this
   1139      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
   1140      [Yuval Yarom and Naomi Benger]
   1141 
   1142   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
   1143      this fixes a limitation in previous versions of OpenSSL.
   1144      [Steve Henson]
   1145 
   1146   *) Experimental encrypt-then-mac support.
   1147     
   1148      Experimental support for encrypt then mac from
   1149      draft-gutmann-tls-encrypt-then-mac-02.txt
   1150 
   1151      To enable it set the appropriate extension number (0x42 for the test
   1152      server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x42
   1153  
   1154      For non-compliant peers (i.e. just about everything) this should have no
   1155      effect.
   1156 
   1157      WARNING: EXPERIMENTAL, SUBJECT TO CHANGE.
   1158 
   1159      [Steve Henson]
   1160 
   1161   *) Add EVP support for key wrapping algorithms, to avoid problems with
   1162      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
   1163      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
   1164      algorithms and include tests cases.
   1165      [Steve Henson]
   1166 
   1167   *) Extend CMS code to support RSA-PSS signatures and RSA-OAEP for
   1168      enveloped data.
   1169      [Steve Henson]
   1170 
   1171   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
   1172      MGF1 digest and OAEP label.
   1173      [Steve Henson]
   1174 
   1175   *) Make openssl verify return errors.
   1176      [Chris Palmer <palmer (a] google.com> and Ben Laurie]
   1177 
   1178   *) New function ASN1_TIME_diff to calculate the difference between two
   1179      ASN1_TIME structures or one structure and the current time.
   1180      [Steve Henson]
   1181 
   1182   *) Update fips_test_suite to support multiple command line options. New
   1183      test to induce all self test errors in sequence and check expected
   1184      failures.
   1185      [Steve Henson]
   1186 
   1187   *) Add FIPS_{rsa,dsa,ecdsa}_{sign,verify} functions which digest and
   1188      sign or verify all in one operation.
   1189      [Steve Henson]
   1190 
   1191   *) Add fips_algvs: a multicall fips utility incorporating all the algorithm
   1192      test programs and fips_test_suite. Includes functionality to parse
   1193      the minimal script output of fipsalgest.pl directly.
   1194      [Steve Henson]
   1195 
   1196   *) Add authorisation parameter to FIPS_module_mode_set().
   1197      [Steve Henson]
   1198 
   1199   *) Add FIPS selftest for ECDH algorithm using P-224 and B-233 curves.
   1200      [Steve Henson]
   1201 
   1202   *) Use separate DRBG fields for internal and external flags. New function
   1203      FIPS_drbg_health_check() to perform on demand health checking. Add
   1204      generation tests to fips_test_suite with reduced health check interval to 
   1205      demonstrate periodic health checking. Add "nodh" option to
   1206      fips_test_suite to skip very slow DH test.
   1207      [Steve Henson]
   1208 
   1209   *) New function FIPS_get_cipherbynid() to lookup FIPS supported ciphers
   1210      based on NID.
   1211      [Steve Henson]
   1212 
   1213   *) More extensive health check for DRBG checking many more failure modes.
   1214      New function FIPS_selftest_drbg_all() to handle every possible DRBG
   1215      combination: call this in fips_test_suite.
   1216      [Steve Henson]
   1217 
   1218   *) Add support for canonical generation of DSA parameter 'g'. See 
   1219      FIPS 186-3 A.2.3.
   1220 
   1221   *) Add support for HMAC DRBG from SP800-90. Update DRBG algorithm test and
   1222      POST to handle HMAC cases.
   1223      [Steve Henson]
   1224 
   1225   *) Add functions FIPS_module_version() and FIPS_module_version_text()
   1226      to return numerical and string versions of the FIPS module number.
   1227      [Steve Henson]
   1228 
   1229   *) Rename FIPS_mode_set and FIPS_mode to FIPS_module_mode_set and
   1230      FIPS_module_mode. FIPS_mode and FIPS_mode_set will be implemented
   1231      outside the validated module in the FIPS capable OpenSSL.
   1232      [Steve Henson]
   1233 
   1234   *) Minor change to DRBG entropy callback semantics. In some cases
   1235      there is no multiple of the block length between min_len and
   1236      max_len. Allow the callback to return more than max_len bytes
   1237      of entropy but discard any extra: it is the callback's responsibility
   1238      to ensure that the extra data discarded does not impact the
   1239      requested amount of entropy.
   1240      [Steve Henson]
   1241 
   1242   *) Add PRNG security strength checks to RSA, DSA and ECDSA using 
   1243      information in FIPS186-3, SP800-57 and SP800-131A.
   1244      [Steve Henson]
   1245 
   1246   *) CCM support via EVP. Interface is very similar to GCM case except we
   1247      must supply all data in one chunk (i.e. no update, final) and the
   1248      message length must be supplied if AAD is used. Add algorithm test
   1249      support.
   1250      [Steve Henson]
   1251 
   1252   *) Initial version of POST overhaul. Add POST callback to allow the status
   1253      of POST to be monitored and/or failures induced. Modify fips_test_suite
   1254      to use callback. Always run all selftests even if one fails.
   1255      [Steve Henson]
   1256 
   1257   *) XTS support including algorithm test driver in the fips_gcmtest program.
   1258      Note: this does increase the maximum key length from 32 to 64 bytes but
   1259      there should be no binary compatibility issues as existing applications
   1260      will never use XTS mode.
   1261      [Steve Henson]
   1262 
   1263   *) Extensive reorganisation of FIPS PRNG behaviour. Remove all dependencies
   1264      to OpenSSL RAND code and replace with a tiny FIPS RAND API which also
   1265      performs algorithm blocking for unapproved PRNG types. Also do not
   1266      set PRNG type in FIPS_mode_set(): leave this to the application.
   1267      Add default OpenSSL DRBG handling: sets up FIPS PRNG and seeds with
   1268      the standard OpenSSL PRNG: set additional data to a date time vector.
   1269      [Steve Henson]
   1270 
   1271   *) Rename old X9.31 PRNG functions of the form FIPS_rand* to FIPS_x931*.
   1272      This shouldn't present any incompatibility problems because applications
   1273      shouldn't be using these directly and any that are will need to rethink
   1274      anyway as the X9.31 PRNG is now deprecated by FIPS 140-2
   1275      [Steve Henson]
   1276 
   1277   *) Extensive self tests and health checking required by SP800-90 DRBG.
   1278      Remove strength parameter from FIPS_drbg_instantiate and always
   1279      instantiate at maximum supported strength.
   1280      [Steve Henson]
   1281 
   1282   *) Add ECDH code to fips module and fips_ecdhvs for primitives only testing.
   1283      [Steve Henson]
   1284 
   1285   *) New algorithm test program fips_dhvs to handle DH primitives only testing.
   1286      [Steve Henson]
   1287 
   1288   *) New function DH_compute_key_padded() to compute a DH key and pad with
   1289      leading zeroes if needed: this complies with SP800-56A et al.
   1290      [Steve Henson]
   1291 
   1292   *) Initial implementation of SP800-90 DRBGs for Hash and CTR. Not used by
   1293      anything, incomplete, subject to change and largely untested at present.
   1294      [Steve Henson]
   1295 
   1296   *) Modify fipscanisteronly build option to only build the necessary object
   1297      files by filtering FIPS_EX_OBJ through a perl script in crypto/Makefile.
   1298      [Steve Henson]
   1299 
   1300   *) Add experimental option FIPSSYMS to give all symbols in
   1301      fipscanister.o and FIPS or fips prefix. This will avoid
   1302      conflicts with future versions of OpenSSL. Add perl script
   1303      util/fipsas.pl to preprocess assembly language source files
   1304      and rename any affected symbols.
   1305      [Steve Henson]
   1306 
   1307   *) Add selftest checks and algorithm block of non-fips algorithms in
   1308      FIPS mode. Remove DES2 from selftests.
   1309      [Steve Henson]
   1310 
   1311   *) Add ECDSA code to fips module. Add tiny fips_ecdsa_check to just
   1312      return internal method without any ENGINE dependencies. Add new
   1313      tiny fips sign and verify functions.
   1314      [Steve Henson]
   1315 
   1316   *) New build option no-ec2m to disable characteristic 2 code.
   1317      [Steve Henson]
   1318 
   1319   *) New build option "fipscanisteronly". This only builds fipscanister.o
   1320      and (currently) associated fips utilities. Uses the file Makefile.fips
   1321      instead of Makefile.org as the prototype.
   1322      [Steve Henson]
   1323 
   1324   *) Add some FIPS mode restrictions to GCM. Add internal IV generator.
   1325      Update fips_gcmtest to use IV generator.
   1326      [Steve Henson]
   1327 
   1328   *) Initial, experimental EVP support for AES-GCM. AAD can be input by
   1329      setting output buffer to NULL. The *Final function must be
   1330      called although it will not retrieve any additional data. The tag
   1331      can be set or retrieved with a ctrl. The IV length is by default 12
   1332      bytes (96 bits) but can be set to an alternative value. If the IV
   1333      length exceeds the maximum IV length (currently 16 bytes) it cannot be
   1334      set before the key. 
   1335      [Steve Henson]
   1336 
   1337   *) New flag in ciphers: EVP_CIPH_FLAG_CUSTOM_CIPHER. This means the
   1338      underlying do_cipher function handles all cipher semantics itself
   1339      including padding and finalisation. This is useful if (for example)
   1340      an ENGINE cipher handles block padding itself. The behaviour of
   1341      do_cipher is subtly changed if this flag is set: the return value
   1342      is the number of characters written to the output buffer (zero is
   1343      no longer an error code) or a negative error code. Also if the
   1344      input buffer is NULL and length 0 finalisation should be performed.
   1345      [Steve Henson]
   1346 
   1347   *) If a candidate issuer certificate is already part of the constructed
   1348      path ignore it: new debug notification X509_V_ERR_PATH_LOOP for this case.
   1349      [Steve Henson]
   1350 
   1351   *) Improve forward-security support: add functions
   1352 
   1353        void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb)(SSL *ssl, int is_forward_secure))
   1354        void SSL_set_not_resumable_session_callback(SSL *ssl, int (*cb)(SSL *ssl, int is_forward_secure))
   1355 
   1356      for use by SSL/TLS servers; the callback function will be called whenever a
   1357      new session is created, and gets to decide whether the session may be
   1358      cached to make it resumable (return 0) or not (return 1).  (As by the
   1359      SSL/TLS protocol specifications, the session_id sent by the server will be
   1360      empty to indicate that the session is not resumable; also, the server will
   1361      not generate RFC 4507 (RFC 5077) session tickets.)
   1362 
   1363      A simple reasonable callback implementation is to return is_forward_secure.
   1364      This parameter will be set to 1 or 0 depending on the ciphersuite selected
   1365      by the SSL/TLS server library, indicating whether it can provide forward
   1366      security.
   1367      [Emilia Ksper <emilia.kasper (a] esat.kuleuven.be> (Google)]
   1368 
   1369   *) New -verify_name option in command line utilities to set verification
   1370      parameters by name.
   1371      [Steve Henson]
   1372 
   1373   *) Initial CMAC implementation. WARNING: EXPERIMENTAL, API MAY CHANGE.
   1374      Add CMAC pkey methods.
   1375      [Steve Henson]
   1376 
   1377   *) Experimental renegotiation in s_server -www mode. If the client 
   1378      browses /reneg connection is renegotiated. If /renegcert it is
   1379      renegotiated requesting a certificate.
   1380      [Steve Henson]
   1381 
   1382   *) Add an "external" session cache for debugging purposes to s_server. This
   1383      should help trace issues which normally are only apparent in deployed
   1384      multi-process servers.
   1385      [Steve Henson]
   1386 
   1387   *) Extensive audit of libcrypto with DEBUG_UNUSED. Fix many cases where
   1388      return value is ignored. NB. The functions RAND_add(), RAND_seed(),
   1389      BIO_set_cipher() and some obscure PEM functions were changed so they
   1390      can now return an error. The RAND changes required a change to the
   1391      RAND_METHOD structure.
   1392      [Steve Henson]
   1393 
   1394   *) New macro __owur for "OpenSSL Warn Unused Result". This makes use of
   1395      a gcc attribute to warn if the result of a function is ignored. This
   1396      is enable if DEBUG_UNUSED is set. Add to several functions in evp.h
   1397      whose return value is often ignored. 
   1398      [Steve Henson]
   1399 
   1400   *) New -noct, -requestct, -requirect and -ctlogfile options for s_client.
   1401      These allow SCTs (signed certificate timestamps) to be requested and
   1402      validated when establishing a connection.
   1403      [Rob Percival <robpercival (a] google.com>]
   1404 
   1405  Changes between 1.0.2g and 1.0.2h [3 May 2016]
   1406 
   1407   *) Prevent padding oracle in AES-NI CBC MAC check
   1408 
   1409      A MITM attacker can use a padding oracle attack to decrypt traffic
   1410      when the connection uses an AES CBC cipher and the server support
   1411      AES-NI.
   1412 
   1413      This issue was introduced as part of the fix for Lucky 13 padding
   1414      attack (CVE-2013-0169). The padding check was rewritten to be in
   1415      constant time by making sure that always the same bytes are read and
   1416      compared against either the MAC or padding bytes. But it no longer
   1417      checked that there was enough data to have both the MAC and padding
   1418      bytes.
   1419 
   1420      This issue was reported by Juraj Somorovsky using TLS-Attacker.
   1421      (CVE-2016-2107)
   1422      [Kurt Roeckx]
   1423 
   1424   *) Fix EVP_EncodeUpdate overflow
   1425 
   1426      An overflow can occur in the EVP_EncodeUpdate() function which is used for
   1427      Base64 encoding of binary data. If an attacker is able to supply very large
   1428      amounts of input data then a length check can overflow resulting in a heap
   1429      corruption.
   1430 
   1431      Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by
   1432      the PEM_write_bio* family of functions. These are mainly used within the
   1433      OpenSSL command line applications, so any application which processes data
   1434      from an untrusted source and outputs it as a PEM file should be considered
   1435      vulnerable to this issue. User applications that call these APIs directly
   1436      with large amounts of untrusted data may also be vulnerable.
   1437 
   1438      This issue was reported by Guido Vranken.
   1439      (CVE-2016-2105)
   1440      [Matt Caswell]
   1441 
   1442   *) Fix EVP_EncryptUpdate overflow
   1443 
   1444      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
   1445      is able to supply very large amounts of input data after a previous call to
   1446      EVP_EncryptUpdate() with a partial block then a length check can overflow
   1447      resulting in a heap corruption. Following an analysis of all OpenSSL
   1448      internal usage of the EVP_EncryptUpdate() function all usage is one of two
   1449      forms. The first form is where the EVP_EncryptUpdate() call is known to be
   1450      the first called function after an EVP_EncryptInit(), and therefore that
   1451      specific call must be safe. The second form is where the length passed to
   1452      EVP_EncryptUpdate() can be seen from the code to be some small value and
   1453      therefore there is no possibility of an overflow. Since all instances are
   1454      one of these two forms, it is believed that there can be no overflows in
   1455      internal code due to this problem. It should be noted that
   1456      EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
   1457      Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
   1458      of these calls have also been analysed too and it is believed there are no
   1459      instances in internal usage where an overflow could occur.
   1460 
   1461      This issue was reported by Guido Vranken.
   1462      (CVE-2016-2106)
   1463      [Matt Caswell]
   1464 
   1465   *) Prevent ASN.1 BIO excessive memory allocation
   1466 
   1467      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
   1468      a short invalid encoding can cause allocation of large amounts of memory
   1469      potentially consuming excessive resources or exhausting memory.
   1470 
   1471      Any application parsing untrusted data through d2i BIO functions is
   1472      affected. The memory based functions such as d2i_X509() are *not* affected.
   1473      Since the memory based functions are used by the TLS library, TLS
   1474      applications are not affected.
   1475 
   1476      This issue was reported by Brian Carpenter.
   1477      (CVE-2016-2109)
   1478      [Stephen Henson]
   1479 
   1480   *) EBCDIC overread
   1481 
   1482      ASN1 Strings that are over 1024 bytes can cause an overread in applications
   1483      using the X509_NAME_oneline() function on EBCDIC systems. This could result
   1484      in arbitrary stack data being returned in the buffer.
   1485 
   1486      This issue was reported by Guido Vranken.
   1487      (CVE-2016-2176)
   1488      [Matt Caswell]
   1489 
   1490   *) Modify behavior of ALPN to invoke callback after SNI/servername
   1491      callback, such that updates to the SSL_CTX affect ALPN.
   1492      [Todd Short]
   1493 
   1494   *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
   1495      default.
   1496      [Kurt Roeckx]
   1497 
   1498   *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
   1499      methods are enabled and ssl2 is disabled the methods return NULL.
   1500      [Kurt Roeckx]
   1501 
   1502  Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
   1503 
   1504   * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
   1505     Builds that are not configured with "enable-weak-ssl-ciphers" will not
   1506     provide any "EXPORT" or "LOW" strength ciphers.
   1507     [Viktor Dukhovni]
   1508 
   1509   * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
   1510     is by default disabled at build-time.  Builds that are not configured with
   1511     "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
   1512     users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
   1513     will need to explicitly call either of:
   1514 
   1515         SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
   1516     or
   1517         SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
   1518 
   1519     as appropriate.  Even if either of those is used, or the application
   1520     explicitly uses the version-specific SSLv2_method() or its client and
   1521     server variants, SSLv2 ciphers vulnerable to exhaustive search key
   1522     recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
   1523     ciphers, and SSLv2 56-bit DES are no longer available.
   1524     (CVE-2016-0800)
   1525     [Viktor Dukhovni]
   1526 
   1527   *) Fix a double-free in DSA code
   1528 
   1529      A double free bug was discovered when OpenSSL parses malformed DSA private
   1530      keys and could lead to a DoS attack or memory corruption for applications
   1531      that receive DSA private keys from untrusted sources.  This scenario is
   1532      considered rare.
   1533 
   1534      This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
   1535      libFuzzer.
   1536      (CVE-2016-0705)
   1537      [Stephen Henson]
   1538 
   1539   *) Disable SRP fake user seed to address a server memory leak.
   1540 
   1541      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
   1542 
   1543      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
   1544      In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
   1545      was changed to ignore the "fake user" SRP seed, even if the seed
   1546      is configured.
   1547 
   1548      Users should use SRP_VBASE_get1_by_user instead. Note that in
   1549      SRP_VBASE_get1_by_user, caller must free the returned value. Note
   1550      also that even though configuring the SRP seed attempts to hide
   1551      invalid usernames by continuing the handshake with fake
   1552      credentials, this behaviour is not constant time and no strong
   1553      guarantees are made that the handshake is indistinguishable from
   1554      that of a valid user.
   1555      (CVE-2016-0798)
   1556      [Emilia Ksper]
   1557 
   1558   *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
   1559 
   1560      In the BN_hex2bn function the number of hex digits is calculated using an
   1561      int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
   1562      large values of |i| this can result in |bn_expand| not allocating any
   1563      memory because |i * 4| is negative. This can leave the internal BIGNUM data
   1564      field as NULL leading to a subsequent NULL ptr deref. For very large values
   1565      of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
   1566      In this case memory is allocated to the internal BIGNUM data field, but it
   1567      is insufficiently sized leading to heap corruption. A similar issue exists
   1568      in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
   1569      is ever called by user applications with very large untrusted hex/dec data.
   1570      This is anticipated to be a rare occurrence.
   1571 
   1572      All OpenSSL internal usage of these functions use data that is not expected
   1573      to be untrusted, e.g. config file data or application command line
   1574      arguments. If user developed applications generate config file data based
   1575      on untrusted data then it is possible that this could also lead to security
   1576      consequences. This is also anticipated to be rare.
   1577 
   1578      This issue was reported to OpenSSL by Guido Vranken.
   1579      (CVE-2016-0797)
   1580      [Matt Caswell]
   1581 
   1582   *) Fix memory issues in BIO_*printf functions
   1583 
   1584      The internal |fmtstr| function used in processing a "%s" format string in
   1585      the BIO_*printf functions could overflow while calculating the length of a
   1586      string and cause an OOB read when printing very long strings.
   1587 
   1588      Additionally the internal |doapr_outch| function can attempt to write to an
   1589      OOB memory location (at an offset from the NULL pointer) in the event of a
   1590      memory allocation failure. In 1.0.2 and below this could be caused where
   1591      the size of a buffer to be allocated is greater than INT_MAX. E.g. this
   1592      could be in processing a very long "%s" format string. Memory leaks can
   1593      also occur.
   1594 
   1595      The first issue may mask the second issue dependent on compiler behaviour.
   1596      These problems could enable attacks where large amounts of untrusted data
   1597      is passed to the BIO_*printf functions. If applications use these functions
   1598      in this way then they could be vulnerable. OpenSSL itself uses these
   1599      functions when printing out human-readable dumps of ASN.1 data. Therefore
   1600      applications that print this data could be vulnerable if the data is from
   1601      untrusted sources. OpenSSL command line applications could also be
   1602      vulnerable where they print out ASN.1 data, or if untrusted data is passed
   1603      as command line arguments.
   1604 
   1605      Libssl is not considered directly vulnerable. Additionally certificates etc
   1606      received via remote connections via libssl are also unlikely to be able to
   1607      trigger these issues because of message size limits enforced within libssl.
   1608 
   1609      This issue was reported to OpenSSL Guido Vranken.
   1610      (CVE-2016-0799)
   1611      [Matt Caswell]
   1612 
   1613   *) Side channel attack on modular exponentiation
   1614 
   1615      A side-channel attack was found which makes use of cache-bank conflicts on
   1616      the Intel Sandy-Bridge microarchitecture which could lead to the recovery
   1617      of RSA keys.  The ability to exploit this issue is limited as it relies on
   1618      an attacker who has control of code in a thread running on the same
   1619      hyper-threaded core as the victim thread which is performing decryptions.
   1620 
   1621      This issue was reported to OpenSSL by Yuval Yarom, The University of
   1622      Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
   1623      Nadia Heninger, University of Pennsylvania with more information at
   1624      http://cachebleed.info.
   1625      (CVE-2016-0702)
   1626      [Andy Polyakov]
   1627 
   1628   *) Change the req app to generate a 2048-bit RSA/DSA key by default,
   1629      if no keysize is specified with default_bits. This fixes an
   1630      omission in an earlier change that changed all RSA/DSA key generation
   1631      apps to use 2048 bits by default.
   1632      [Emilia Ksper]
   1633 
   1634  Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
   1635   *) DH small subgroups
   1636 
   1637      Historically OpenSSL only ever generated DH parameters based on "safe"
   1638      primes. More recently (in version 1.0.2) support was provided for
   1639      generating X9.42 style parameter files such as those required for RFC 5114
   1640      support. The primes used in such files may not be "safe". Where an
   1641      application is using DH configured with parameters based on primes that are
   1642      not "safe" then an attacker could use this fact to find a peer's private
   1643      DH exponent. This attack requires that the attacker complete multiple
   1644      handshakes in which the peer uses the same private DH exponent. For example
   1645      this could be used to discover a TLS server's private DH exponent if it's
   1646      reusing the private DH exponent or it's using a static DH ciphersuite.
   1647 
   1648      OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
   1649      TLS. It is not on by default. If the option is not set then the server
   1650      reuses the same private DH exponent for the life of the server process and
   1651      would be vulnerable to this attack. It is believed that many popular
   1652      applications do set this option and would therefore not be at risk.
   1653 
   1654      The fix for this issue adds an additional check where a "q" parameter is
   1655      available (as is the case in X9.42 based parameters). This detects the
   1656      only known attack, and is the only possible defense for static DH
   1657      ciphersuites. This could have some performance impact.
   1658 
   1659      Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
   1660      default and cannot be disabled. This could have some performance impact.
   1661 
   1662      This issue was reported to OpenSSL by Antonio Sanso (Adobe).
   1663      (CVE-2016-0701)
   1664      [Matt Caswell]
   1665 
   1666   *) SSLv2 doesn't block disabled ciphers
   1667 
   1668      A malicious client can negotiate SSLv2 ciphers that have been disabled on
   1669      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
   1670      been disabled, provided that the SSLv2 protocol was not also disabled via
   1671      SSL_OP_NO_SSLv2.
   1672 
   1673      This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
   1674      and Sebastian Schinzel.
   1675      (CVE-2015-3197)
   1676      [Viktor Dukhovni]
   1677 
   1678  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
   1679 
   1680   *) BN_mod_exp may produce incorrect results on x86_64
   1681 
   1682      There is a carry propagating bug in the x86_64 Montgomery squaring
   1683      procedure. No EC algorithms are affected. Analysis suggests that attacks
   1684      against RSA and DSA as a result of this defect would be very difficult to
   1685      perform and are not believed likely. Attacks against DH are considered just
   1686      feasible (although very difficult) because most of the work necessary to
   1687      deduce information about a private key may be performed offline. The amount
   1688      of resources required for such an attack would be very significant and
   1689      likely only accessible to a limited number of attackers. An attacker would
   1690      additionally need online access to an unpatched system using the target
   1691      private key in a scenario with persistent DH parameters and a private
   1692      key that is shared between multiple clients. For example this can occur by
   1693      default in OpenSSL DHE based SSL/TLS ciphersuites.
   1694 
   1695      This issue was reported to OpenSSL by Hanno Bck.
   1696      (CVE-2015-3193)
   1697      [Andy Polyakov]
   1698 
   1699   *) Certificate verify crash with missing PSS parameter
   1700 
   1701      The signature verification routines will crash with a NULL pointer
   1702      dereference if presented with an ASN.1 signature using the RSA PSS
   1703      algorithm and absent mask generation function parameter. Since these
   1704      routines are used to verify certificate signature algorithms this can be
   1705      used to crash any certificate verification operation and exploited in a
   1706      DoS attack. Any application which performs certificate verification is
   1707      vulnerable including OpenSSL clients and servers which enable client
   1708      authentication.
   1709 
   1710      This issue was reported to OpenSSL by Loc Jonas Etienne (Qnective AG).
   1711      (CVE-2015-3194)
   1712      [Stephen Henson]
   1713 
   1714   *) X509_ATTRIBUTE memory leak
   1715 
   1716      When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
   1717      memory. This structure is used by the PKCS#7 and CMS routines so any
   1718      application which reads PKCS#7 or CMS data from untrusted sources is
   1719      affected. SSL/TLS is not affected.
   1720 
   1721      This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
   1722      libFuzzer.
   1723      (CVE-2015-3195)
   1724      [Stephen Henson]
   1725 
   1726   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
   1727      This changes the decoding behaviour for some invalid messages,
   1728      though the change is mostly in the more lenient direction, and
   1729      legacy behaviour is preserved as much as possible.
   1730      [Emilia Ksper]
   1731 
   1732   *) In DSA_generate_parameters_ex, if the provided seed is too short,
   1733      return an error
   1734      [Rich Salz and Ismo Puustinen <ismo.puustinen (a] intel.com>]
   1735 
   1736  Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
   1737 
   1738   *) Alternate chains certificate forgery
   1739 
   1740      During certificate verification, OpenSSL will attempt to find an
   1741      alternative certificate chain if the first attempt to build such a chain
   1742      fails. An error in the implementation of this logic can mean that an
   1743      attacker could cause certain checks on untrusted certificates to be
   1744      bypassed, such as the CA flag, enabling them to use a valid leaf
   1745      certificate to act as a CA and "issue" an invalid certificate.
   1746 
   1747      This issue was reported to OpenSSL by Adam Langley/David Benjamin
   1748      (Google/BoringSSL).
   1749      [Matt Caswell]
   1750 
   1751  Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
   1752 
   1753   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
   1754      incompatibility in the handling of HMAC. The previous ABI has now been
   1755      restored.
   1756      [Matt Caswell]
   1757 
   1758  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
   1759 
   1760   *) Malformed ECParameters causes infinite loop
   1761 
   1762      When processing an ECParameters structure OpenSSL enters an infinite loop
   1763      if the curve specified is over a specially malformed binary polynomial
   1764      field.
   1765 
   1766      This can be used to perform denial of service against any
   1767      system which processes public keys, certificate requests or
   1768      certificates.  This includes TLS clients and TLS servers with
   1769      client authentication enabled.
   1770 
   1771      This issue was reported to OpenSSL by Joseph Barr-Pixton.
   1772      (CVE-2015-1788)
   1773      [Andy Polyakov]
   1774 
   1775   *) Exploitable out-of-bounds read in X509_cmp_time
   1776 
   1777      X509_cmp_time does not properly check the length of the ASN1_TIME
   1778      string and can read a few bytes out of bounds. In addition,
   1779      X509_cmp_time accepts an arbitrary number of fractional seconds in the
   1780      time string.
   1781 
   1782      An attacker can use this to craft malformed certificates and CRLs of
   1783      various sizes and potentially cause a segmentation fault, resulting in
   1784      a DoS on applications that verify certificates or CRLs. TLS clients
   1785      that verify CRLs are affected. TLS clients and servers with client
   1786      authentication enabled may be affected if they use custom verification
   1787      callbacks.
   1788 
   1789      This issue was reported to OpenSSL by Robert Swiecki (Google), and
   1790      independently by Hanno Bck.
   1791      (CVE-2015-1789)
   1792      [Emilia Ksper]
   1793 
   1794   *) PKCS7 crash with missing EnvelopedContent
   1795 
   1796      The PKCS#7 parsing code does not handle missing inner EncryptedContent
   1797      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
   1798      with missing content and trigger a NULL pointer dereference on parsing.
   1799 
   1800      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
   1801      structures from untrusted sources are affected. OpenSSL clients and
   1802      servers are not affected.
   1803 
   1804      This issue was reported to OpenSSL by Michal Zalewski (Google).
   1805      (CVE-2015-1790)
   1806      [Emilia Ksper]
   1807 
   1808   *) CMS verify infinite loop with unknown hash function
   1809 
   1810      When verifying a signedData message the CMS code can enter an infinite loop
   1811      if presented with an unknown hash function OID. This can be used to perform
   1812      denial of service against any system which verifies signedData messages using
   1813      the CMS code.
   1814      This issue was reported to OpenSSL by Johannes Bauer.
   1815      (CVE-2015-1792)
   1816      [Stephen Henson]
   1817 
   1818   *) Race condition handling NewSessionTicket
   1819 
   1820      If a NewSessionTicket is received by a multi-threaded client when attempting to
   1821      reuse a previous ticket then a race condition can occur potentially leading to
   1822      a double free of the ticket data.
   1823      (CVE-2015-1791)
   1824      [Matt Caswell]
   1825 
   1826   *) Only support 256-bit or stronger elliptic curves with the
   1827      'ecdh_auto' setting (server) or by default (client). Of supported
   1828      curves, prefer P-256 (both).
   1829      [Emilia Kasper]
   1830 
   1831  Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
   1832 
   1833   *) ClientHello sigalgs DoS fix
   1834 
   1835      If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
   1836      invalid signature algorithms extension a NULL pointer dereference will
   1837      occur. This can be exploited in a DoS attack against the server.
   1838 
   1839      This issue was was reported to OpenSSL by David Ramos of Stanford
   1840      University.
   1841      (CVE-2015-0291)
   1842      [Stephen Henson and Matt Caswell]
   1843 
   1844   *) Multiblock corrupted pointer fix
   1845 
   1846      OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
   1847      feature only applies on 64 bit x86 architecture platforms that support AES
   1848      NI instructions. A defect in the implementation of "multiblock" can cause
   1849      OpenSSL's internal write buffer to become incorrectly set to NULL when
   1850      using non-blocking IO. Typically, when the user application is using a
   1851      socket BIO for writing, this will only result in a failed connection.
   1852      However if some other BIO is used then it is likely that a segmentation
   1853      fault will be triggered, thus enabling a potential DoS attack.
   1854 
   1855      This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
   1856      (CVE-2015-0290)
   1857      [Matt Caswell]
   1858 
   1859   *) Segmentation fault in DTLSv1_listen fix
   1860 
   1861      The DTLSv1_listen function is intended to be stateless and processes the
   1862      initial ClientHello from many peers. It is common for user code to loop
   1863      over the call to DTLSv1_listen until a valid ClientHello is received with
   1864      an associated cookie. A defect in the implementation of DTLSv1_listen means
   1865      that state is preserved in the SSL object from one invocation to the next
   1866      that can lead to a segmentation fault. Errors processing the initial
   1867      ClientHello can trigger this scenario. An example of such an error could be
   1868      that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
   1869      server.
   1870 
   1871      This issue was reported to OpenSSL by Per Allansson.
   1872      (CVE-2015-0207)
   1873      [Matt Caswell]
   1874 
   1875   *) Segmentation fault in ASN1_TYPE_cmp fix
   1876 
   1877      The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
   1878      made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
   1879      certificate signature algorithm consistency this can be used to crash any
   1880      certificate verification operation and exploited in a DoS attack. Any
   1881      application which performs certificate verification is vulnerable including
   1882      OpenSSL clients and servers which enable client authentication.
   1883      (CVE-2015-0286)
   1884      [Stephen Henson]
   1885 
   1886   *) Segmentation fault for invalid PSS parameters fix
   1887 
   1888      The signature verification routines will crash with a NULL pointer
   1889      dereference if presented with an ASN.1 signature using the RSA PSS
   1890      algorithm and invalid parameters. Since these routines are used to verify
   1891      certificate signature algorithms this can be used to crash any
   1892      certificate verification operation and exploited in a DoS attack. Any
   1893      application which performs certificate verification is vulnerable including
   1894      OpenSSL clients and servers which enable client authentication.
   1895 
   1896      This issue was was reported to OpenSSL by Brian Carpenter.
   1897      (CVE-2015-0208)
   1898      [Stephen Henson]
   1899 
   1900   *) ASN.1 structure reuse memory corruption fix
   1901 
   1902      Reusing a structure in ASN.1 parsing may allow an attacker to cause
   1903      memory corruption via an invalid write. Such reuse is and has been
   1904      strongly discouraged and is believed to be rare.
   1905 
   1906      Applications that parse structures containing CHOICE or ANY DEFINED BY
   1907      components may be affected. Certificate parsing (d2i_X509 and related
   1908      functions) are however not affected. OpenSSL clients and servers are
   1909      not affected.
   1910      (CVE-2015-0287)
   1911      [Stephen Henson]
   1912 
   1913   *) PKCS7 NULL pointer dereferences fix
   1914 
   1915      The PKCS#7 parsing code does not handle missing outer ContentInfo
   1916      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
   1917      missing content and trigger a NULL pointer dereference on parsing.
   1918 
   1919      Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
   1920      otherwise parse PKCS#7 structures from untrusted sources are
   1921      affected. OpenSSL clients and servers are not affected.
   1922 
   1923      This issue was reported to OpenSSL by Michal Zalewski (Google).
   1924      (CVE-2015-0289)
   1925      [Emilia Ksper]
   1926 
   1927   *) DoS via reachable assert in SSLv2 servers fix
   1928 
   1929      A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
   1930      servers that both support SSLv2 and enable export cipher suites by sending
   1931      a specially crafted SSLv2 CLIENT-MASTER-KEY message.
   1932 
   1933      This issue was discovered by Sean Burford (Google) and Emilia Ksper
   1934      (OpenSSL development team).
   1935      (CVE-2015-0293)
   1936      [Emilia Ksper]
   1937 
   1938   *) Empty CKE with client auth and DHE fix
   1939 
   1940      If client auth is used then a server can seg fault in the event of a DHE
   1941      ciphersuite being selected and a zero length ClientKeyExchange message
   1942      being sent by the client. This could be exploited in a DoS attack.
   1943      (CVE-2015-1787)
   1944      [Matt Caswell]
   1945 
   1946   *) Handshake with unseeded PRNG fix
   1947 
   1948      Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
   1949      with an unseeded PRNG. The conditions are:
   1950      - The client is on a platform where the PRNG has not been seeded
   1951      automatically, and the user has not seeded manually
   1952      - A protocol specific client method version has been used (i.e. not
   1953      SSL_client_methodv23)
   1954      - A ciphersuite is used that does not require additional random data from
   1955      the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
   1956 
   1957      If the handshake succeeds then the client random that has been used will
   1958      have been generated from a PRNG with insufficient entropy and therefore the
   1959      output may be predictable.
   1960 
   1961      For example using the following command with an unseeded openssl will
   1962      succeed on an unpatched platform:
   1963 
   1964      openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
   1965      (CVE-2015-0285)
   1966      [Matt Caswell]
   1967 
   1968   *) Use After Free following d2i_ECPrivatekey error fix
   1969 
   1970      A malformed EC private key file consumed via the d2i_ECPrivateKey function
   1971      could cause a use after free condition. This, in turn, could cause a double
   1972      free in several private key parsing functions (such as d2i_PrivateKey
   1973      or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
   1974      for applications that receive EC private keys from untrusted
   1975      sources. This scenario is considered rare.
   1976 
   1977      This issue was discovered by the BoringSSL project and fixed in their
   1978      commit 517073cd4b.
   1979      (CVE-2015-0209)
   1980      [Matt Caswell]
   1981 
   1982   *) X509_to_X509_REQ NULL pointer deref fix
   1983 
   1984      The function X509_to_X509_REQ will crash with a NULL pointer dereference if
   1985      the certificate key is invalid. This function is rarely used in practice.
   1986 
   1987      This issue was discovered by Brian Carpenter.
   1988      (CVE-2015-0288)
   1989      [Stephen Henson]
   1990 
   1991   *) Removed the export ciphers from the DEFAULT ciphers
   1992      [Kurt Roeckx]
   1993 
   1994  Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
   1995 
   1996   *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
   1997      ARMv5 through ARMv8, as opposite to "locking" it to single one.
   1998      So far those who have to target multiple platforms would compromise
   1999      and argue that binary targeting say ARMv5 would still execute on
   2000      ARMv8. "Universal" build resolves this compromise by providing
   2001      near-optimal performance even on newer platforms.
   2002      [Andy Polyakov]
   2003 
   2004   *) Accelerated NIST P-256 elliptic curve implementation for x86_64
   2005      (other platforms pending).
   2006      [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
   2007 
   2008   *) Add support for the SignedCertificateTimestampList certificate and
   2009      OCSP response extensions from RFC6962.
   2010      [Rob Stradling]
   2011 
   2012   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
   2013      for corner cases. (Certain input points at infinity could lead to
   2014      bogus results, with non-infinity inputs mapped to infinity too.)
   2015      [Bodo Moeller]
   2016 
   2017   *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
   2018      This covers AES, SHA256/512 and GHASH. "Initial" means that most
   2019      common cases are optimized and there still is room for further
   2020      improvements. Vector Permutation AES for Altivec is also added.
   2021      [Andy Polyakov]
   2022 
   2023   *) Add support for little-endian ppc64 Linux target.
   2024      [Marcelo Cerri (IBM)]
   2025 
   2026   *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
   2027      SHA1, SHA256 and GHASH. "Initial" means that most common cases
   2028      are optimized and there still is room for further improvements.
   2029      Both 32- and 64-bit modes are supported.
   2030      [Andy Polyakov, Ard Biesheuvel (Linaro)]
   2031 
   2032   *) Improved ARMv7 NEON support.
   2033      [Andy Polyakov]
   2034 
   2035   *) Support for SPARC Architecture 2011 crypto extensions, first
   2036      implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
   2037      SHA256/512, MD5, GHASH and modular exponentiation.
   2038      [Andy Polyakov, David Miller]
   2039 
   2040   *) Accelerated modular exponentiation for Intel processors, a.k.a.
   2041      RSAZ.
   2042      [Shay Gueron & Vlad Krasnov (Intel Corp)]
   2043 
   2044   *) Support for new and upcoming Intel processors, including AVX2,
   2045      BMI and SHA ISA extensions. This includes additional "stitched"
   2046      implementations, AESNI-SHA256 and GCM, and multi-buffer support
   2047      for TLS encrypt.
   2048 
   2049      This work was sponsored by Intel Corp.
   2050      [Andy Polyakov]
   2051 
   2052   *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
   2053      supports both DTLS 1.2 and 1.0 and should use whatever version the peer
   2054      supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
   2055      [Steve Henson]
   2056 
   2057   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
   2058      this fixes a limitation in previous versions of OpenSSL.
   2059      [Steve Henson]
   2060 
   2061   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
   2062      MGF1 digest and OAEP label.
   2063      [Steve Henson]
   2064 
   2065   *) Add EVP support for key wrapping algorithms, to avoid problems with
   2066      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
   2067      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
   2068      algorithms and include tests cases.
   2069      [Steve Henson]
   2070 
   2071   *) Add functions to allocate and set the fields of an ECDSA_METHOD
   2072      structure.
   2073      [Douglas E. Engert, Steve Henson]
   2074 
   2075   *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
   2076      difference in days and seconds between two tm or ASN1_TIME structures.
   2077      [Steve Henson]
   2078 
   2079   *) Add -rev test option to s_server to just reverse order of characters
   2080      received by client and send back to server. Also prints an abbreviated
   2081      summary of the connection parameters.
   2082      [Steve Henson]
   2083 
   2084   *) New option -brief for s_client and s_server to print out a brief summary
   2085      of connection parameters.
   2086      [Steve Henson]
   2087 
   2088   *) Add callbacks for arbitrary TLS extensions.
   2089      [Trevor Perrin <trevp (a] trevp.net> and Ben Laurie]
   2090 
   2091   *) New option -crl_download in several openssl utilities to download CRLs
   2092      from CRLDP extension in certificates.
   2093      [Steve Henson]
   2094 
   2095   *) New options -CRL and -CRLform for s_client and s_server for CRLs.
   2096      [Steve Henson]
   2097 
   2098   *) New function X509_CRL_diff to generate a delta CRL from the difference
   2099      of two full CRLs. Add support to "crl" utility.
   2100      [Steve Henson]
   2101 
   2102   *) New functions to set lookup_crls function and to retrieve
   2103      X509_STORE from X509_STORE_CTX.
   2104      [Steve Henson]
   2105 
   2106   *) Print out deprecated issuer and subject unique ID fields in
   2107      certificates.
   2108      [Steve Henson]
   2109 
   2110   *) Extend OCSP I/O functions so they can be used for simple general purpose
   2111      HTTP as well as OCSP. New wrapper function which can be used to download
   2112      CRLs using the OCSP API.
   2113      [Steve Henson]
   2114 
   2115   *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
   2116      [Steve Henson]
   2117 
   2118   *) SSL_CONF* functions. These provide a common framework for application
   2119      configuration using configuration files or command lines.
   2120      [Steve Henson]
   2121 
   2122   *) SSL/TLS tracing code. This parses out SSL/TLS records using the
   2123      message callback and prints the results. Needs compile time option
   2124      "enable-ssl-trace". New options to s_client and s_server to enable
   2125      tracing.
   2126      [Steve Henson]
   2127 
   2128   *) New ctrl and macro to retrieve supported points extensions.
   2129      Print out extension in s_server and s_client.
   2130      [Steve Henson]
   2131 
   2132   *) New functions to retrieve certificate signature and signature
   2133      OID NID.
   2134      [Steve Henson]
   2135 
   2136   *) Add functions to retrieve and manipulate the raw cipherlist sent by a
   2137      client to OpenSSL.
   2138      [Steve Henson]
   2139 
   2140   *) New Suite B modes for TLS code. These use and enforce the requirements
   2141      of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
   2142      only use Suite B curves. The Suite B modes can be set by using the
   2143      strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
   2144      [Steve Henson]
   2145 
   2146   *) New chain verification flags for Suite B levels of security. Check
   2147      algorithms are acceptable when flags are set in X509_verify_cert.
   2148      [Steve Henson]
   2149 
   2150   *) Make tls1_check_chain return a set of flags indicating checks passed
   2151      by a certificate chain. Add additional tests to handle client
   2152      certificates: checks for matching certificate type and issuer name
   2153      comparison.
   2154      [Steve Henson]
   2155 
   2156   *) If an attempt is made to use a signature algorithm not in the peer
   2157      preference list abort the handshake. If client has no suitable
   2158      signature algorithms in response to a certificate request do not
   2159      use the certificate.
   2160      [Steve Henson]
   2161 
   2162   *) If server EC tmp key is not in client preference list abort handshake.
   2163      [Steve Henson]
   2164 
   2165   *) Add support for certificate stores in CERT structure. This makes it
   2166      possible to have different stores per SSL structure or one store in
   2167      the parent SSL_CTX. Include distinct stores for certificate chain
   2168      verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
   2169      to build and store a certificate chain in CERT structure: returning
   2170      an error if the chain cannot be built: this will allow applications
   2171      to test if a chain is correctly configured.
   2172 
   2173      Note: if the CERT based stores are not set then the parent SSL_CTX
   2174      store is used to retain compatibility with existing behaviour.
   2175 
   2176      [Steve Henson]
   2177 
   2178   *) New function ssl_set_client_disabled to set a ciphersuite disabled
   2179      mask based on the current session, check mask when sending client
   2180      hello and checking the requested ciphersuite.
   2181      [Steve Henson]
   2182 
   2183   *) New ctrls to retrieve and set certificate types in a certificate
   2184      request message. Print out received values in s_client. If certificate
   2185      types is not set with custom values set sensible values based on
   2186      supported signature algorithms.
   2187      [Steve Henson]
   2188 
   2189   *) Support for distinct client and server supported signature algorithms.
   2190      [Steve Henson]
   2191 
   2192   *) Add certificate callback. If set this is called whenever a certificate
   2193      is required by client or server. An application can decide which
   2194      certificate chain to present based on arbitrary criteria: for example
   2195      supported signature algorithms. Add very simple example to s_server.
   2196      This fixes many of the problems and restrictions of the existing client
   2197      certificate callback: for example you can now clear an existing
   2198      certificate and specify the whole chain.
   2199      [Steve Henson]
   2200 
   2201   *) Add new "valid_flags" field to CERT_PKEY structure which determines what
   2202      the certificate can be used for (if anything). Set valid_flags field 
   2203      in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
   2204      to have similar checks in it.
   2205 
   2206      Add new "cert_flags" field to CERT structure and include a "strict mode".
   2207      This enforces some TLS certificate requirements (such as only permitting
   2208      certificate signature algorithms contained in the supported algorithms
   2209      extension) which some implementations ignore: this option should be used
   2210      with caution as it could cause interoperability issues.
   2211      [Steve Henson]
   2212 
   2213   *) Update and tidy signature algorithm extension processing. Work out
   2214      shared signature algorithms based on preferences and peer algorithms
   2215      and print them out in s_client and s_server. Abort handshake if no
   2216      shared signature algorithms.
   2217      [Steve Henson]
   2218 
   2219   *) Add new functions to allow customised supported signature algorithms
   2220      for SSL and SSL_CTX structures. Add options to s_client and s_server
   2221      to support them.
   2222      [Steve Henson]
   2223 
   2224   *) New function SSL_certs_clear() to delete all references to certificates
   2225      from an SSL structure. Before this once a certificate had been added
   2226      it couldn't be removed.
   2227      [Steve Henson]
   2228 
   2229   *) Integrate hostname, email address and IP address checking with certificate
   2230      verification. New verify options supporting checking in openssl utility.
   2231      [Steve Henson]
   2232 
   2233   *) Fixes and wildcard matching support to hostname and email checking
   2234      functions. Add manual page.
   2235      [Florian Weimer (Red Hat Product Security Team)]
   2236 
   2237   *) New functions to check a hostname email or IP address against a
   2238      certificate. Add options x509 utility to print results of checks against
   2239      a certificate.
   2240      [Steve Henson]
   2241 
   2242   *) Fix OCSP checking.
   2243      [Rob Stradling <rob.stradling (a] comodo.com> and Ben Laurie]
   2244 
   2245   *) Initial experimental support for explicitly trusted non-root CAs. 
   2246      OpenSSL still tries to build a complete chain to a root but if an
   2247      intermediate CA has a trust setting included that is used. The first
   2248      setting is used: whether to trust (e.g., -addtrust option to the x509
   2249      utility) or reject.
   2250      [Steve Henson]
   2251 
   2252   *) Add -trusted_first option which attempts to find certificates in the
   2253      trusted store even if an untrusted chain is also supplied.
   2254      [Steve Henson]
   2255 
   2256   *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
   2257      platform support for Linux and Android.
   2258      [Andy Polyakov]
   2259 
   2260   *) Support for linux-x32, ILP32 environment in x86_64 framework.
   2261      [Andy Polyakov]
   2262 
   2263   *) Experimental multi-implementation support for FIPS capable OpenSSL.
   2264      When in FIPS mode the approved implementations are used as normal,
   2265      when not in FIPS mode the internal unapproved versions are used instead.
   2266      This means that the FIPS capable OpenSSL isn't forced to use the
   2267      (often lower performance) FIPS implementations outside FIPS mode.
   2268      [Steve Henson]
   2269 
   2270   *) Transparently support X9.42 DH parameters when calling
   2271      PEM_read_bio_DHparameters. This means existing applications can handle
   2272      the new parameter format automatically.
   2273      [Steve Henson]
   2274 
   2275   *) Initial experimental support for X9.42 DH parameter format: mainly
   2276      to support use of 'q' parameter for RFC5114 parameters.
   2277      [Steve Henson]
   2278 
   2279   *) Add DH parameters from RFC5114 including test data to dhtest.
   2280      [Steve Henson]
   2281 
   2282   *) Support for automatic EC temporary key parameter selection. If enabled
   2283      the most preferred EC parameters are automatically used instead of
   2284      hardcoded fixed parameters. Now a server just has to call:
   2285      SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
   2286      support ECDH and use the most appropriate parameters.
   2287      [Steve Henson]
   2288 
   2289   *) Enhance and tidy EC curve and point format TLS extension code. Use
   2290      static structures instead of allocation if default values are used.
   2291      New ctrls to set curves we wish to support and to retrieve shared curves.
   2292      Print out shared curves in s_server. New options to s_server and s_client
   2293      to set list of supported curves.
   2294      [Steve Henson]
   2295 
   2296   *) New ctrls to retrieve supported signature algorithms and 
   2297      supported curve values as an array of NIDs. Extend openssl utility
   2298      to print out received values.
   2299      [Steve Henson]
   2300 
   2301   *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
   2302      between NIDs and the more common NIST names such as "P-256". Enhance
   2303      ecparam utility and ECC method to recognise the NIST names for curves.
   2304      [Steve Henson]
   2305 
   2306   *) Enhance SSL/TLS certificate chain handling to support different
   2307      chains for each certificate instead of one chain in the parent SSL_CTX.
   2308      [Steve Henson]
   2309 
   2310   *) Support for fixed DH ciphersuite client authentication: where both
   2311      server and client use DH certificates with common parameters.
   2312      [Steve Henson]
   2313 
   2314   *) Support for fixed DH ciphersuites: those requiring DH server
   2315      certificates.
   2316      [Steve Henson]
   2317 
   2318   *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
   2319      the certificate.
   2320      Note: Related 1.0.2-beta specific macros X509_get_cert_info,
   2321      X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
   2322      X509_CINF_get_signature were reverted post internal team review.
   2323 
   2324  Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
   2325 
   2326   *) Build fixes for the Windows and OpenVMS platforms
   2327      [Matt Caswell and Richard Levitte]
   2328 
   2329  Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
   2330 
   2331   *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
   2332      message can cause a segmentation fault in OpenSSL due to a NULL pointer
   2333      dereference. This could lead to a Denial Of Service attack. Thanks to
   2334      Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
   2335      (CVE-2014-3571)
   2336      [Steve Henson]
   2337 
   2338   *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
   2339      dtls1_buffer_record function under certain conditions. In particular this
   2340      could occur if an attacker sent repeated DTLS records with the same
   2341      sequence number but for the next epoch. The memory leak could be exploited
   2342      by an attacker in a Denial of Service attack through memory exhaustion.
   2343      Thanks to Chris Mueller for reporting this issue.
   2344      (CVE-2015-0206)
   2345      [Matt Caswell]
   2346 
   2347   *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
   2348      built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
   2349      method would be set to NULL which could later result in a NULL pointer
   2350      dereference. Thanks to Frank Schmirler for reporting this issue.
   2351      (CVE-2014-3569)
   2352      [Kurt Roeckx]
   2353 
   2354   *) Abort handshake if server key exchange message is omitted for ephemeral
   2355      ECDH ciphersuites.
   2356 
   2357      Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
   2358      reporting this issue.
   2359      (CVE-2014-3572)
   2360      [Steve Henson]
   2361 
   2362   *) Remove non-export ephemeral RSA code on client and server. This code
   2363      violated the TLS standard by allowing the use of temporary RSA keys in
   2364      non-export ciphersuites and could be used by a server to effectively
   2365      downgrade the RSA key length used to a value smaller than the server
   2366      certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
   2367      INRIA or reporting this issue.
   2368      (CVE-2015-0204)
   2369      [Steve Henson]
   2370 
   2371   *) Fixed issue where DH client certificates are accepted without verification.
   2372      An OpenSSL server will accept a DH certificate for client authentication
   2373      without the certificate verify message. This effectively allows a client to
   2374      authenticate without the use of a private key. This only affects servers
   2375      which trust a client certificate authority which issues certificates
   2376      containing DH keys: these are extremely rare and hardly ever encountered.
   2377      Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
   2378      this issue.
   2379      (CVE-2015-0205)
   2380      [Steve Henson]
   2381 
   2382   *) Ensure that the session ID context of an SSL is updated when its
   2383      SSL_CTX is updated via SSL_set_SSL_CTX.
   2384 
   2385      The session ID context is typically set from the parent SSL_CTX,
   2386      and can vary with the CTX.
   2387      [Adam Langley]
   2388 
   2389   *) Fix various certificate fingerprint issues.
   2390 
   2391      By using non-DER or invalid encodings outside the signed portion of a
   2392      certificate the fingerprint can be changed without breaking the signature.
   2393      Although no details of the signed portion of the certificate can be changed
   2394      this can cause problems with some applications: e.g. those using the
   2395      certificate fingerprint for blacklists.
   2396 
   2397      1. Reject signatures with non zero unused bits.
   2398 
   2399      If the BIT STRING containing the signature has non zero unused bits reject
   2400      the signature. All current signature algorithms require zero unused bits.
   2401 
   2402      2. Check certificate algorithm consistency.
   2403 
   2404      Check the AlgorithmIdentifier inside TBS matches the one in the
   2405      certificate signature. NB: this will result in signature failure
   2406      errors for some broken certificates.
   2407 
   2408      Thanks to Konrad Kraszewski from Google for reporting this issue.
   2409 
   2410      3. Check DSA/ECDSA signatures use DER.
   2411 
   2412      Re-encode DSA/ECDSA signatures and compare with the original received
   2413      signature. Return an error if there is a mismatch.
   2414 
   2415      This will reject various cases including garbage after signature
   2416      (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
   2417      program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
   2418      (negative or with leading zeroes).
   2419 
   2420      Further analysis was conducted and fixes were developed by Stephen Henson
   2421      of the OpenSSL core team.
   2422 
   2423      (CVE-2014-8275)
   2424      [Steve Henson]
   2425 
   2426    *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
   2427       results on some platforms, including x86_64. This bug occurs at random
   2428       with a very low probability, and is not known to be exploitable in any
   2429       way, though its exact impact is difficult to determine. Thanks to Pieter
   2430       Wuille (Blockstream) who reported this issue and also suggested an initial
   2431       fix. Further analysis was conducted by the OpenSSL development team and
   2432       Adam Langley of Google. The final fix was developed by Andy Polyakov of
   2433       the OpenSSL core team.
   2434       (CVE-2014-3570)
   2435       [Andy Polyakov]
   2436 
   2437    *) Do not resume sessions on the server if the negotiated protocol
   2438       version does not match the session's version. Resuming with a different
   2439       version, while not strictly forbidden by the RFC, is of questionable
   2440       sanity and breaks all known clients.
   2441       [David Benjamin, Emilia Ksper]
   2442 
   2443    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
   2444       early CCS messages during renegotiation. (Note that because
   2445       renegotiation is encrypted, this early CCS was not exploitable.)
   2446       [Emilia Ksper]
   2447 
   2448    *) Tighten client-side session ticket handling during renegotiation:
   2449       ensure that the client only accepts a session ticket if the server sends
   2450       the extension anew in the ServerHello. Previously, a TLS client would
   2451       reuse the old extension state and thus accept a session ticket if one was
   2452       announced in the initial ServerHello.
   2453 
   2454       Similarly, ensure that the client requires a session ticket if one
   2455       was advertised in the ServerHello. Previously, a TLS client would
   2456       ignore a missing NewSessionTicket message.
   2457       [Emilia Ksper]
   2458 
   2459  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
   2460 
   2461   *) SRTP Memory Leak.
   2462 
   2463      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
   2464      sends a carefully crafted handshake message, to cause OpenSSL to fail
   2465      to free up to 64k of memory causing a memory leak. This could be
   2466      exploited in a Denial Of Service attack. This issue affects OpenSSL
   2467      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
   2468      whether SRTP is used or configured. Implementations of OpenSSL that
   2469      have been compiled with OPENSSL_NO_SRTP defined are not affected.
   2470 
   2471      The fix was developed by the OpenSSL team.
   2472      (CVE-2014-3513)
   2473      [OpenSSL team]
   2474 
   2475   *) Session Ticket Memory Leak.
   2476 
   2477      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
   2478      integrity of that ticket is first verified. In the event of a session
   2479      ticket integrity check failing, OpenSSL will fail to free memory
   2480      causing a memory leak. By sending a large number of invalid session
   2481      tickets an attacker could exploit this issue in a Denial Of Service
   2482      attack.
   2483      (CVE-2014-3567)
   2484      [Steve Henson]
   2485 
   2486   *) Build option no-ssl3 is incomplete.
   2487 
   2488      When OpenSSL is configured with "no-ssl3" as a build option, servers
   2489      could accept and complete a SSL 3.0 handshake, and clients could be
   2490      configured to send them.
   2491      (CVE-2014-3568)
   2492      [Akamai and the OpenSSL team]
   2493 
   2494   *) Add support for TLS_FALLBACK_SCSV.
   2495      Client applications doing fallback retries should call
   2496      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
   2497      (CVE-2014-3566)
   2498      [Adam Langley, Bodo Moeller]
   2499 
   2500   *) Add additional DigestInfo checks.
   2501  
   2502      Re-encode DigestInto in DER and check against the original when
   2503      verifying RSA signature: this will reject any improperly encoded
   2504      DigestInfo structures.
   2505 
   2506      Note: this is a precautionary measure and no attacks are currently known.
   2507 
   2508      [Steve Henson]
   2509 
   2510  Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
   2511 
   2512   *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
   2513      SRP code can be overrun an internal buffer. Add sanity check that
   2514      g, A, B < N to SRP code.
   2515 
   2516      Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
   2517      Group for discovering this issue.
   2518      (CVE-2014-3512)
   2519      [Steve Henson]
   2520 
   2521   *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
   2522      TLS 1.0 instead of higher protocol versions when the ClientHello message
   2523      is badly fragmented. This allows a man-in-the-middle attacker to force a
   2524      downgrade to TLS 1.0 even if both the server and the client support a
   2525      higher protocol version, by modifying the client's TLS records.
   2526 
   2527      Thanks to David Benjamin and Adam Langley (Google) for discovering and
   2528      researching this issue.
   2529      (CVE-2014-3511)
   2530      [David Benjamin]
   2531 
   2532   *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
   2533      to a denial of service attack. A malicious server can crash the client
   2534      with a null pointer dereference (read) by specifying an anonymous (EC)DH
   2535      ciphersuite and sending carefully crafted handshake messages.
   2536 
   2537      Thanks to Felix Grbert (Google) for discovering and researching this
   2538      issue.
   2539      (CVE-2014-3510)
   2540      [Emilia Ksper]
   2541 
   2542   *) By sending carefully crafted DTLS packets an attacker could cause openssl
   2543      to leak memory. This can be exploited through a Denial of Service attack.
   2544      Thanks to Adam Langley for discovering and researching this issue.
   2545      (CVE-2014-3507)
   2546      [Adam Langley]
   2547 
   2548   *) An attacker can force openssl to consume large amounts of memory whilst
   2549      processing DTLS handshake messages. This can be exploited through a
   2550      Denial of Service attack.
   2551      Thanks to Adam Langley for discovering and researching this issue.
   2552      (CVE-2014-3506)
   2553      [Adam Langley]
   2554 
   2555   *) An attacker can force an error condition which causes openssl to crash
   2556      whilst processing DTLS packets due to memory being freed twice. This
   2557      can be exploited through a Denial of Service attack.
   2558      Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
   2559      this issue.
   2560      (CVE-2014-3505)
   2561      [Adam Langley]
   2562 
   2563   *) If a multithreaded client connects to a malicious server using a resumed
   2564      session and the server sends an ec point format extension it could write
   2565      up to 255 bytes to freed memory.
   2566 
   2567      Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
   2568      issue.
   2569      (CVE-2014-3509)
   2570      [Gabor Tyukasz]
   2571 
   2572   *) A malicious server can crash an OpenSSL client with a null pointer
   2573      dereference (read) by specifying an SRP ciphersuite even though it was not
   2574      properly negotiated with the client. This can be exploited through a
   2575      Denial of Service attack.
   2576 
   2577      Thanks to Joonas Kuorilehto and Riku Hietamki (Codenomicon) for
   2578      discovering and researching this issue.
   2579      (CVE-2014-5139)
   2580      [Steve Henson]
   2581 
   2582   *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
   2583      X509_name_oneline, X509_name_print_ex et al. to leak some information
   2584      from the stack. Applications may be affected if they echo pretty printing
   2585      output to the attacker.
   2586 
   2587      Thanks to Ivan Fratric (Google) for discovering this issue.
   2588      (CVE-2014-3508)
   2589      [Emilia Ksper, and Steve Henson]
   2590 
   2591   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
   2592      for corner cases. (Certain input points at infinity could lead to
   2593      bogus results, with non-infinity inputs mapped to infinity too.)
   2594      [Bodo Moeller]
   2595 
   2596  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
   2597 
   2598   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
   2599      handshake can force the use of weak keying material in OpenSSL
   2600      SSL/TLS clients and servers.
   2601 
   2602      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
   2603      researching this issue. (CVE-2014-0224)
   2604      [KIKUCHI Masashi, Steve Henson]
   2605 
   2606   *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
   2607      OpenSSL DTLS client the code can be made to recurse eventually crashing
   2608      in a DoS attack.
   2609 
   2610      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
   2611      (CVE-2014-0221)
   2612      [Imre Rad, Steve Henson]
   2613 
   2614   *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
   2615      be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
   2616      client or server. This is potentially exploitable to run arbitrary
   2617      code on a vulnerable client or server.
   2618 
   2619      Thanks to Jri Aedla for reporting this issue. (CVE-2014-0195)
   2620      [Jri Aedla, Steve Henson]
   2621 
   2622   *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
   2623      are subject to a denial of service attack.
   2624 
   2625      Thanks to Felix Grbert and Ivan Fratric at Google for discovering
   2626      this issue. (CVE-2014-3470)
   2627      [Felix Grbert, Ivan Fratric, Steve Henson]
   2628 
   2629   *) Harmonize version and its documentation. -f flag is used to display
   2630      compilation flags.
   2631      [mancha <mancha1 (a] zoho.com>]
   2632 
   2633   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
   2634      in i2d_ECPrivateKey.
   2635      [mancha <mancha1 (a] zoho.com>]
   2636 
   2637   *) Fix some double frees. These are not thought to be exploitable.
   2638      [mancha <mancha1 (a] zoho.com>]
   2639 
   2640  Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
   2641 
   2642   *) A missing bounds check in the handling of the TLS heartbeat extension
   2643      can be used to reveal up to 64k of memory to a connected client or
   2644      server.
   2645 
   2646      Thanks for Neel Mehta of Google Security for discovering this bug and to
   2647      Adam Langley <agl (a] chromium.org> and Bodo Moeller <bmoeller (a] acm.org> for
   2648      preparing the fix (CVE-2014-0160)
   2649      [Adam Langley, Bodo Moeller]
   2650 
   2651   *) Fix for the attack described in the paper "Recovering OpenSSL
   2652      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
   2653      by Yuval Yarom and Naomi Benger. Details can be obtained from:
   2654      http://eprint.iacr.org/2014/140
   2655 
   2656      Thanks to Yuval Yarom and Naomi Benger for discovering this
   2657      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
   2658      [Yuval Yarom and Naomi Benger]
   2659 
   2660   *) TLS pad extension: draft-agl-tls-padding-03
   2661 
   2662      Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
   2663      TLS client Hello record length value would otherwise be > 255 and
   2664      less that 512 pad with a dummy extension containing zeroes so it
   2665      is at least 512 bytes long.
   2666 
   2667      [Adam Langley, Steve Henson]
   2668 
   2669  Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
   2670 
   2671   *) Fix for TLS record tampering bug. A carefully crafted invalid 
   2672      handshake could crash OpenSSL with a NULL pointer exception.
   2673      Thanks to Anton Johansson for reporting this issues.
   2674      (CVE-2013-4353)
   2675 
   2676   *) Keep original DTLS digest and encryption contexts in retransmission
   2677      structures so we can use the previous session parameters if they need
   2678      to be resent. (CVE-2013-6450)
   2679      [Steve Henson]
   2680 
   2681   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
   2682      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
   2683      Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
   2684      several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
   2685      is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
   2686      10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
   2687      [Rob Stradling, Adam Langley]
   2688 
   2689  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
   2690 
   2691   *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
   2692      supporting platforms or when small records were transferred.
   2693      [Andy Polyakov, Steve Henson]
   2694 
   2695  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
   2696 
   2697   *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
   2698 
   2699      This addresses the flaw in CBC record processing discovered by 
   2700      Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
   2701      at: http://www.isg.rhul.ac.uk/tls/     
   2702 
   2703      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   2704      Security Group at Royal Holloway, University of London
   2705      (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
   2706      Emilia Ksper for the initial patch.
   2707      (CVE-2013-0169)
   2708      [Emilia Ksper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
   2709 
   2710   *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
   2711      ciphersuites which can be exploited in a denial of service attack.
   2712      Thanks go to and to Adam Langley <agl (a] chromium.org> for discovering
   2713      and detecting this bug and to Wolfgang Ettlinger
   2714      <wolfgang.ettlinger (a] gmail.com> for independently discovering this issue.
   2715      (CVE-2012-2686)
   2716      [Adam Langley]
   2717 
   2718   *) Return an error when checking OCSP signatures when key is NULL.
   2719      This fixes a DoS attack. (CVE-2013-0166)
   2720      [Steve Henson]
   2721 
   2722   *) Make openssl verify return errors.
   2723      [Chris Palmer <palmer (a] google.com> and Ben Laurie]
   2724 
   2725   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
   2726      the right response is stapled. Also change SSL_get_certificate()
   2727      so it returns the certificate actually sent.
   2728      See http://rt.openssl.org/Ticket/Display.html?id=2836.
   2729      [Rob Stradling <rob.stradling (a] comodo.com>]
   2730 
   2731   *) Fix possible deadlock when decoding public keys.
   2732      [Steve Henson]
   2733 
   2734   *) Don't use TLS 1.0 record version number in initial client hello
   2735      if renegotiating.
   2736      [Steve Henson]
   2737 
   2738  Changes between 1.0.1b and 1.0.1c [10 May 2012]
   2739 
   2740   *) Sanity check record length before skipping explicit IV in TLS
   2741      1.2, 1.1 and DTLS to fix DoS attack.
   2742 
   2743      Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
   2744      fuzzing as a service testing platform.
   2745      (CVE-2012-2333)
   2746      [Steve Henson]
   2747 
   2748   *) Initialise tkeylen properly when encrypting CMS messages.
   2749      Thanks to Solar Designer of Openwall for reporting this issue.
   2750      [Steve Henson]
   2751 
   2752   *) In FIPS mode don't try to use composite ciphers as they are not
   2753      approved.
   2754      [Steve Henson]
   2755 
   2756  Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
   2757 
   2758   *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
   2759      1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
   2760      mean any application compiled against OpenSSL 1.0.0 headers setting
   2761      SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
   2762      TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
   2763      0x10000000L Any application which was previously compiled against
   2764      OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
   2765      will need to be recompiled as a result. Letting be results in
   2766      inability to disable specifically TLS 1.1 and in client context,
   2767      in unlike event, limit maximum offered version to TLS 1.0 [see below].
   2768      [Steve Henson]
   2769 
   2770   *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
   2771      disable just protocol X, but all protocols above X *if* there are
   2772      protocols *below* X still enabled. In more practical terms it means
   2773      that if application wants to disable TLS1.0 in favor of TLS1.1 and
   2774      above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
   2775      SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
   2776      client side.
   2777      [Andy Polyakov]
   2778 
   2779  Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
   2780 
   2781   *) Check for potentially exploitable overflows in asn1_d2i_read_bio
   2782      BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
   2783      in CRYPTO_realloc_clean.
   2784 
   2785      Thanks to Tavis Ormandy, Google Security Team, for discovering this
   2786      issue and to Adam Langley <agl (a] chromium.org> for fixing it.
   2787      (CVE-2012-2110)
   2788      [Adam Langley (Google), Tavis Ormandy, Google Security Team]
   2789 
   2790   *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
   2791      [Adam Langley]
   2792 
   2793   *) Workarounds for some broken servers that "hang" if a client hello
   2794      record length exceeds 255 bytes.
   2795 
   2796      1. Do not use record version number > TLS 1.0 in initial client
   2797         hello: some (but not all) hanging servers will now work.
   2798      2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
   2799 	the number of ciphers sent in the client hello. This should be
   2800         set to an even number, such as 50, for example by passing:
   2801         -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
   2802         Most broken servers should now work.
   2803      3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
   2804 	TLS 1.2 client support entirely.
   2805      [Steve Henson]
   2806 
   2807   *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
   2808      [Andy Polyakov]
   2809 
   2810  Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
   2811 
   2812   *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
   2813      STRING form instead of a DigestInfo.
   2814      [Steve Henson]
   2815 
   2816   *) The format used for MDC2 RSA signatures is inconsistent between EVP
   2817      and the RSA_sign/RSA_verify functions. This was made more apparent when
   2818      OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
   2819      those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
   2820      the correct format in RSA_verify so both forms transparently work.
   2821      [Steve Henson]
   2822 
   2823   *) Some servers which support TLS 1.0 can choke if we initially indicate
   2824      support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
   2825      encrypted premaster secret. As a workaround use the maximum permitted
   2826      client version in client hello, this should keep such servers happy
   2827      and still work with previous versions of OpenSSL.
   2828      [Steve Henson]
   2829 
   2830   *) Add support for TLS/DTLS heartbeats.
   2831      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   2832 
   2833   *) Add support for SCTP.
   2834      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   2835 
   2836   *) Improved PRNG seeding for VOS.
   2837      [Paul Green <Paul.Green (a] stratus.com>]
   2838 
   2839   *) Extensive assembler packs updates, most notably:
   2840 
   2841 	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
   2842 	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
   2843 	- x86_64:       bit-sliced AES implementation;
   2844 	- ARM:          NEON support, contemporary platforms optimizations;
   2845 	- s390x:        z196 support;
   2846 	- *:            GHASH and GF(2^m) multiplication implementations;
   2847 
   2848      [Andy Polyakov]
   2849 
   2850   *) Make TLS-SRP code conformant with RFC 5054 API cleanup
   2851      (removal of unnecessary code)
   2852      [Peter Sylvester <peter.sylvester (a] edelweb.fr>]
   2853 
   2854   *) Add TLS key material exporter from RFC 5705.
   2855      [Eric Rescorla]
   2856 
   2857   *) Add DTLS-SRTP negotiation from RFC 5764.
   2858      [Eric Rescorla]
   2859 
   2860   *) Add Next Protocol Negotiation,
   2861      http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
   2862      disabled with a no-npn flag to config or Configure. Code donated
   2863      by Google.
   2864      [Adam Langley <agl (a] google.com> and Ben Laurie]
   2865 
   2866   *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
   2867      NIST-P256, NIST-P521, with constant-time single point multiplication on
   2868      typical inputs. Compiler support for the nonstandard type __uint128_t is
   2869      required to use this (present in gcc 4.4 and later, for 64-bit builds).
   2870      Code made available under Apache License version 2.0.
   2871 
   2872      Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
   2873      line to include this in your build of OpenSSL, and run "make depend" (or
   2874      "make update"). This enables the following EC_METHODs:
   2875 
   2876          EC_GFp_nistp224_method()
   2877          EC_GFp_nistp256_method()
   2878          EC_GFp_nistp521_method()
   2879 
   2880      EC_GROUP_new_by_curve_name() will automatically use these (while
   2881      EC_GROUP_new_curve_GFp() currently prefers the more flexible
   2882      implementations).
   2883      [Emilia Ksper, Adam Langley, Bodo Moeller (Google)]
   2884 
   2885   *) Use type ossl_ssize_t instad of ssize_t which isn't available on
   2886      all platforms. Move ssize_t definition from e_os.h to the public
   2887      header file e_os2.h as it now appears in public header file cms.h
   2888      [Steve Henson]
   2889 
   2890   *) New -sigopt option to the ca, req and x509 utilities. Additional
   2891      signature parameters can be passed using this option and in
   2892      particular PSS. 
   2893      [Steve Henson]
   2894 
   2895   *) Add RSA PSS signing function. This will generate and set the
   2896      appropriate AlgorithmIdentifiers for PSS based on those in the
   2897      corresponding EVP_MD_CTX structure. No application support yet.
   2898      [Steve Henson]
   2899 
   2900   *) Support for companion algorithm specific ASN1 signing routines.
   2901      New function ASN1_item_sign_ctx() signs a pre-initialised
   2902      EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
   2903      the appropriate parameters.
   2904      [Steve Henson]
   2905 
   2906   *) Add new algorithm specific ASN1 verification initialisation function
   2907      to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
   2908      handling will be the same no matter what EVP_PKEY_METHOD is used.
   2909      Add a PSS handler to support verification of PSS signatures: checked
   2910      against a number of sample certificates.
   2911      [Steve Henson]
   2912 
   2913   *) Add signature printing for PSS. Add PSS OIDs.
   2914      [Steve Henson, Martin Kaiser <lists (a] kaiser.cx>]
   2915 
   2916   *) Add algorithm specific signature printing. An individual ASN1 method
   2917      can now print out signatures instead of the standard hex dump. 
   2918 
   2919      More complex signatures (e.g. PSS) can print out more meaningful
   2920      information. Include DSA version that prints out the signature
   2921      parameters r, s.
   2922      [Steve Henson]
   2923 
   2924   *) Password based recipient info support for CMS library: implementing
   2925      RFC3211.
   2926      [Steve Henson]
   2927 
   2928   *) Split password based encryption into PBES2 and PBKDF2 functions. This
   2929      neatly separates the code into cipher and PBE sections and is required
   2930      for some algorithms that split PBES2 into separate pieces (such as
   2931      password based CMS).
   2932      [Steve Henson]
   2933 
   2934   *) Session-handling fixes:
   2935      - Fix handling of connections that are resuming with a session ID,
   2936        but also support Session Tickets.
   2937      - Fix a bug that suppressed issuing of a new ticket if the client
   2938        presented a ticket with an expired session.
   2939      - Try to set the ticket lifetime hint to something reasonable.
   2940      - Make tickets shorter by excluding irrelevant information.
   2941      - On the client side, don't ignore renewed tickets.
   2942      [Adam Langley, Bodo Moeller (Google)]
   2943 
   2944   *) Fix PSK session representation.
   2945      [Bodo Moeller]
   2946 
   2947   *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
   2948 
   2949      This work was sponsored by Intel.
   2950      [Andy Polyakov]
   2951 
   2952   *) Add GCM support to TLS library. Some custom code is needed to split
   2953      the IV between the fixed (from PRF) and explicit (from TLS record)
   2954      portions. This adds all GCM ciphersuites supported by RFC5288 and 
   2955      RFC5289. Generalise some AES* cipherstrings to include GCM and
   2956      add a special AESGCM string for GCM only.
   2957      [Steve Henson]
   2958 
   2959   *) Expand range of ctrls for AES GCM. Permit setting invocation
   2960      field on decrypt and retrieval of invocation field only on encrypt.
   2961      [Steve Henson]
   2962 
   2963   *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
   2964      As required by RFC5289 these ciphersuites cannot be used if for
   2965      versions of TLS earlier than 1.2.
   2966      [Steve Henson]
   2967 
   2968   *) For FIPS capable OpenSSL interpret a NULL default public key method
   2969      as unset and return the appropriate default but do *not* set the default.
   2970      This means we can return the appropriate method in applications that
   2971      switch between FIPS and non-FIPS modes.
   2972      [Steve Henson]
   2973 
   2974   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
   2975      ENGINE is used then we cannot handle that in the FIPS module so we
   2976      keep original code iff non-FIPS operations are allowed.
   2977      [Steve Henson]
   2978 
   2979   *) Add -attime option to openssl utilities.
   2980      [Peter Eckersley <pde (a] eff.org>, Ben Laurie and Steve Henson]
   2981 
   2982   *) Redirect DSA and DH operations to FIPS module in FIPS mode.
   2983      [Steve Henson]
   2984 
   2985   *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
   2986      FIPS EC methods unconditionally for now.
   2987      [Steve Henson]
   2988 
   2989   *) New build option no-ec2m to disable characteristic 2 code.
   2990      [Steve Henson]
   2991 
   2992   *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
   2993      all cases can be covered as some introduce binary incompatibilities.
   2994      [Steve Henson]
   2995 
   2996   *) Redirect RSA operations to FIPS module including keygen,
   2997      encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
   2998      [Steve Henson]
   2999 
   3000   *) Add similar low level API blocking to ciphers.
   3001      [Steve Henson]
   3002 
   3003   *) Low level digest APIs are not approved in FIPS mode: any attempt
   3004      to use these will cause a fatal error. Applications that *really* want
   3005      to use them can use the private_* version instead.
   3006      [Steve Henson]
   3007 
   3008   *) Redirect cipher operations to FIPS module for FIPS builds. 
   3009      [Steve Henson]
   3010 
   3011   *) Redirect digest operations to FIPS module for FIPS builds. 
   3012      [Steve Henson]
   3013 
   3014   *) Update build system to add "fips" flag which will link in fipscanister.o
   3015      for static and shared library builds embedding a signature if needed.
   3016      [Steve Henson]
   3017 
   3018   *) Output TLS supported curves in preference order instead of numerical
   3019      order. This is currently hardcoded for the highest order curves first.
   3020      This should be configurable so applications can judge speed vs strength.
   3021      [Steve Henson]
   3022 
   3023   *) Add TLS v1.2 server support for client authentication. 
   3024      [Steve Henson]
   3025 
   3026   *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
   3027      and enable MD5.
   3028      [Steve Henson]
   3029 
   3030   *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
   3031      FIPS modules versions.
   3032      [Steve Henson]
   3033 
   3034   *) Add TLS v1.2 client side support for client authentication. Keep cache
   3035      of handshake records longer as we don't know the hash algorithm to use
   3036      until after the certificate request message is received.
   3037      [Steve Henson]
   3038 
   3039   *) Initial TLS v1.2 client support. Add a default signature algorithms
   3040      extension including all the algorithms we support. Parse new signature
   3041      format in client key exchange. Relax some ECC signing restrictions for
   3042      TLS v1.2 as indicated in RFC5246.
   3043      [Steve Henson]
   3044 
   3045   *) Add server support for TLS v1.2 signature algorithms extension. Switch
   3046      to new signature format when needed using client digest preference.
   3047      All server ciphersuites should now work correctly in TLS v1.2. No client
   3048      support yet and no support for client certificates.
   3049      [Steve Henson]
   3050 
   3051   *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
   3052      to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
   3053      ciphersuites. At present only RSA key exchange ciphersuites work with
   3054      TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
   3055      SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
   3056      and version checking.
   3057      [Steve Henson]
   3058 
   3059   *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
   3060      with this defined it will not be affected by any changes to ssl internal
   3061      structures. Add several utility functions to allow openssl application
   3062      to work with OPENSSL_NO_SSL_INTERN defined.
   3063      [Steve Henson]
   3064 
   3065   *) A long standing patch to add support for SRP from EdelWeb (Peter
   3066      Sylvester and Christophe Renou) was integrated.
   3067      [Christophe Renou <christophe.renou (a] edelweb.fr>, Peter Sylvester
   3068      <peter.sylvester (a] edelweb.fr>, Tom Wu <tjw (a] cs.stanford.edu>, and
   3069      Ben Laurie]
   3070 
   3071   *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
   3072      [Steve Henson]
   3073 
   3074   *) Permit abbreviated handshakes when renegotiating using the function
   3075      SSL_renegotiate_abbreviated().
   3076      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   3077 
   3078   *) Add call to ENGINE_register_all_complete() to
   3079      ENGINE_load_builtin_engines(), so some implementations get used
   3080      automatically instead of needing explicit application support.
   3081      [Steve Henson]
   3082 
   3083   *) Add support for TLS key exporter as described in RFC5705.
   3084      [Robin Seggelmann <seggelmann (a] fh-muenster.de>, Steve Henson]
   3085 
   3086   *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
   3087      a few changes are required:
   3088 
   3089        Add SSL_OP_NO_TLSv1_1 flag.
   3090        Add TLSv1_1 methods.
   3091        Update version checking logic to handle version 1.1.
   3092        Add explicit IV handling (ported from DTLS code).
   3093        Add command line options to s_client/s_server.
   3094      [Steve Henson]
   3095 
   3096  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
   3097 
   3098   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
   3099      in CMS and PKCS7 code. When RSA decryption fails use a random key for
   3100      content decryption and always return the same error. Note: this attack
   3101      needs on average 2^20 messages so it only affects automated senders. The
   3102      old behaviour can be re-enabled in the CMS code by setting the
   3103      CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
   3104      an MMA defence is not necessary.
   3105      Thanks to Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering
   3106      this issue. (CVE-2012-0884)
   3107      [Steve Henson]
   3108 
   3109   *) Fix CVE-2011-4619: make sure we really are receiving a 
   3110      client hello before rejecting multiple SGC restarts. Thanks to
   3111      Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering this bug.
   3112      [Steve Henson]
   3113 
   3114  Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
   3115 
   3116   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
   3117      Thanks to Antonio Martin, Enterprise Secure Access Research and
   3118      Development, Cisco Systems, Inc. for discovering this bug and
   3119      preparing a fix. (CVE-2012-0050)
   3120      [Antonio Martin]
   3121 
   3122  Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
   3123 
   3124   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
   3125      of the Vaudenay padding oracle attack on CBC mode encryption
   3126      which enables an efficient plaintext recovery attack against
   3127      the OpenSSL implementation of DTLS. Their attack exploits timing
   3128      differences arising during decryption processing. A research
   3129      paper describing this attack can be found at:
   3130                   http://www.isg.rhul.ac.uk/~kp/dtls.pdf
   3131      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   3132      Security Group at Royal Holloway, University of London
   3133      (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
   3134      <seggelmann (a] fh-muenster.de> and Michael Tuexen <tuexen (a] fh-muenster.de>
   3135      for preparing the fix. (CVE-2011-4108)
   3136      [Robin Seggelmann, Michael Tuexen]
   3137 
   3138   *) Clear bytes used for block padding of SSL 3.0 records.
   3139      (CVE-2011-4576)
   3140      [Adam Langley (Google)]
   3141 
   3142   *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
   3143      Kadianakis <desnacked (a] gmail.com> for discovering this issue and
   3144      Adam Langley for preparing the fix. (CVE-2011-4619)
   3145      [Adam Langley (Google)]
   3146 
   3147   *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
   3148      [Andrey Kulikov <amdeich (a] gmail.com>]
   3149 
   3150   *) Prevent malformed RFC3779 data triggering an assertion failure.
   3151      Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
   3152      and Rob Austein <sra (a] hactrn.net> for fixing it. (CVE-2011-4577)
   3153      [Rob Austein <sra (a] hactrn.net>]
   3154 
   3155   *) Improved PRNG seeding for VOS.
   3156      [Paul Green <Paul.Green (a] stratus.com>]
   3157 
   3158   *) Fix ssl_ciph.c set-up race.
   3159      [Adam Langley (Google)]
   3160 
   3161   *) Fix spurious failures in ecdsatest.c.
   3162      [Emilia Ksper (Google)]
   3163 
   3164   *) Fix the BIO_f_buffer() implementation (which was mixing different
   3165      interpretations of the '..._len' fields).
   3166      [Adam Langley (Google)]
   3167 
   3168   *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
   3169      BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
   3170      threads won't reuse the same blinding coefficients.
   3171 
   3172      This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
   3173      lock to call BN_BLINDING_invert_ex, and avoids one use of
   3174      BN_BLINDING_update for each BN_BLINDING structure (previously,
   3175      the last update always remained unused).
   3176      [Emilia Ksper (Google)]
   3177 
   3178   *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
   3179      [Bob Buckholz (Google)]
   3180 
   3181  Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
   3182 
   3183   *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
   3184      by initialising X509_STORE_CTX properly. (CVE-2011-3207)
   3185      [Kaspar Brand <ossl (a] velox.ch>]
   3186 
   3187   *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
   3188      for multi-threaded use of ECDH. (CVE-2011-3210)
   3189      [Adam Langley (Google)]
   3190 
   3191   *) Fix x509_name_ex_d2i memory leak on bad inputs.
   3192      [Bodo Moeller]
   3193 
   3194   *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
   3195      signature public key algorithm by using OID xref utilities instead.
   3196      Before this you could only use some ECC ciphersuites with SHA1 only.
   3197      [Steve Henson]
   3198 
   3199   *) Add protection against ECDSA timing attacks as mentioned in the paper
   3200      by Billy Bob Brumley and Nicola Tuveri, see:
   3201 
   3202 	http://eprint.iacr.org/2011/232.pdf
   3203 
   3204      [Billy Bob Brumley and Nicola Tuveri]
   3205 
   3206  Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
   3207 
   3208   *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
   3209      [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
   3210 
   3211   *) Fix bug in string printing code: if *any* escaping is enabled we must
   3212      escape the escape character (backslash) or the resulting string is
   3213      ambiguous.
   3214      [Steve Henson]
   3215 
   3216  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
   3217 
   3218   *) Disable code workaround for ancient and obsolete Netscape browsers
   3219      and servers: an attacker can use it in a ciphersuite downgrade attack.
   3220      Thanks to Martin Rex for discovering this bug. CVE-2010-4180
   3221      [Steve Henson]
   3222 
   3223   *) Fixed J-PAKE implementation error, originally discovered by
   3224      Sebastien Martini, further info and confirmation from Stefan
   3225      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
   3226      [Ben Laurie]
   3227 
   3228  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
   3229 
   3230   *) Fix extension code to avoid race conditions which can result in a buffer
   3231      overrun vulnerability: resumed sessions must not be modified as they can
   3232      be shared by multiple threads. CVE-2010-3864
   3233      [Steve Henson]
   3234 
   3235   *) Fix WIN32 build system to correctly link an ENGINE directory into
   3236      a DLL. 
   3237      [Steve Henson]
   3238 
   3239  Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
   3240 
   3241   *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
   3242      (CVE-2010-1633)
   3243      [Steve Henson, Peter-Michael Hager <hager (a] dortmund.net>]
   3244 
   3245  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
   3246 
   3247   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
   3248      context. The operation can be customised via the ctrl mechanism in
   3249      case ENGINEs want to include additional functionality.
   3250      [Steve Henson]
   3251 
   3252   *) Tolerate yet another broken PKCS#8 key format: private key value negative.
   3253      [Steve Henson]
   3254 
   3255   *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
   3256      output hashes compatible with older versions of OpenSSL.
   3257      [Willy Weisz <weisz (a] vcpc.univie.ac.at>]
   3258 
   3259   *) Fix compression algorithm handling: if resuming a session use the
   3260      compression algorithm of the resumed session instead of determining
   3261      it from client hello again. Don't allow server to change algorithm.
   3262      [Steve Henson]
   3263 
   3264   *) Add load_crls() function to apps tidying load_certs() too. Add option
   3265      to verify utility to allow additional CRLs to be included.
   3266      [Steve Henson]
   3267 
   3268   *) Update OCSP request code to permit adding custom headers to the request:
   3269      some responders need this.
   3270      [Steve Henson]
   3271 
   3272   *) The function EVP_PKEY_sign() returns <=0 on error: check return code
   3273      correctly.
   3274      [Julia Lawall <julia (a] diku.dk>]
   3275 
   3276   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
   3277      needlessly dereferenced structures, used obsolete functions and
   3278      didn't handle all updated verify codes correctly.
   3279      [Steve Henson]
   3280 
   3281   *) Disable MD2 in the default configuration.
   3282      [Steve Henson]
   3283 
   3284   *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
   3285      indicate the initial BIO being pushed or popped. This makes it possible
   3286      to determine whether the BIO is the one explicitly called or as a result
   3287      of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
   3288      it handles reference counts correctly and doesn't zero out the I/O bio
   3289      when it is not being explicitly popped. WARNING: applications which
   3290      included workarounds for the old buggy behaviour will need to be modified
   3291      or they could free up already freed BIOs.
   3292      [Steve Henson]
   3293 
   3294   *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
   3295      renaming to all platforms (within the 0.9.8 branch, this was
   3296      done conditionally on Netware platforms to avoid a name clash).
   3297      [Guenter <lists (a] gknw.net>]
   3298 
   3299   *) Add ECDHE and PSK support to DTLS.
   3300      [Michael Tuexen <tuexen (a] fh-muenster.de>]
   3301 
   3302   *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
   3303      be used on C++.
   3304      [Steve Henson]
   3305 
   3306   *) Add "missing" function EVP_MD_flags() (without this the only way to
   3307      retrieve a digest flags is by accessing the structure directly. Update
   3308      EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
   3309      or cipher is registered as in the "from" argument. Print out all
   3310      registered digests in the dgst usage message instead of manually 
   3311      attempting to work them out.
   3312      [Steve Henson]
   3313 
   3314   *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
   3315      this allows the use of compression and extensions. Change default cipher
   3316      string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
   3317      by default unless an application cipher string requests it.
   3318      [Steve Henson]
   3319 
   3320   *) Alter match criteria in PKCS12_parse(). It used to try to use local
   3321      key ids to find matching certificates and keys but some PKCS#12 files
   3322      don't follow the (somewhat unwritten) rules and this strategy fails.
   3323      Now just gather all certificates together and the first private key
   3324      then look for the first certificate that matches the key.
   3325      [Steve Henson]
   3326 
   3327   *) Support use of registered digest and cipher names for dgst and cipher
   3328      commands instead of having to add each one as a special case. So now
   3329      you can do:
   3330 
   3331         openssl sha256 foo
   3332 
   3333      as well as:
   3334 
   3335         openssl dgst -sha256 foo
   3336 
   3337      and this works for ENGINE based algorithms too.
   3338 
   3339      [Steve Henson]
   3340 
   3341   *) Update Gost ENGINE to support parameter files.
   3342      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   3343 
   3344   *) Support GeneralizedTime in ca utility. 
   3345      [Oliver Martin <oliver (a] volatilevoid.net>, Steve Henson]
   3346 
   3347   *) Enhance the hash format used for certificate directory links. The new
   3348      form uses the canonical encoding (meaning equivalent names will work
   3349      even if they aren't identical) and uses SHA1 instead of MD5. This form
   3350      is incompatible with the older format and as a result c_rehash should
   3351      be used to rebuild symbolic links.
   3352      [Steve Henson]
   3353 
   3354   *) Make PKCS#8 the default write format for private keys, replacing the
   3355      traditional format. This form is standardised, more secure and doesn't
   3356      include an implicit MD5 dependency.
   3357      [Steve Henson]
   3358 
   3359   *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
   3360      committed to OpenSSL should pass this lot as a minimum.
   3361      [Steve Henson]
   3362 
   3363   *) Add session ticket override functionality for use by EAP-FAST.
   3364      [Jouni Malinen <j (a] w1.fi>]
   3365 
   3366   *) Modify HMAC functions to return a value. Since these can be implemented
   3367      in an ENGINE errors can occur.
   3368      [Steve Henson]
   3369 
   3370   *) Type-checked OBJ_bsearch_ex.
   3371      [Ben Laurie]
   3372 
   3373   *) Type-checked OBJ_bsearch. Also some constification necessitated
   3374      by type-checking.  Still to come: TXT_DB, bsearch(?),
   3375      OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
   3376      CONF_VALUE.
   3377      [Ben Laurie]
   3378 
   3379   *) New function OPENSSL_gmtime_adj() to add a specific number of days and
   3380      seconds to a tm structure directly, instead of going through OS
   3381      specific date routines. This avoids any issues with OS routines such
   3382      as the year 2038 bug. New *_adj() functions for ASN1 time structures
   3383      and X509_time_adj_ex() to cover the extended range. The existing
   3384      X509_time_adj() is still usable and will no longer have any date issues.
   3385      [Steve Henson]
   3386 
   3387   *) Delta CRL support. New use deltas option which will attempt to locate
   3388      and search any appropriate delta CRLs available.
   3389 
   3390      This work was sponsored by Google.
   3391      [Steve Henson]
   3392 
   3393   *) Support for CRLs partitioned by reason code. Reorganise CRL processing
   3394      code and add additional score elements. Validate alternate CRL paths
   3395      as part of the CRL checking and indicate a new error "CRL path validation
   3396      error" in this case. Applications wanting additional details can use
   3397      the verify callback and check the new "parent" field. If this is not
   3398      NULL CRL path validation is taking place. Existing applications won't
   3399      see this because it requires extended CRL support which is off by
   3400      default.
   3401 
   3402      This work was sponsored by Google.
   3403      [Steve Henson]
   3404 
   3405   *) Support for freshest CRL extension.
   3406 
   3407      This work was sponsored by Google.
   3408      [Steve Henson]
   3409 
   3410   *) Initial indirect CRL support. Currently only supported in the CRLs
   3411      passed directly and not via lookup. Process certificate issuer
   3412      CRL entry extension and lookup CRL entries by bother issuer name
   3413      and serial number. Check and process CRL issuer entry in IDP extension.
   3414 
   3415      This work was sponsored by Google.
   3416      [Steve Henson]
   3417 
   3418   *) Add support for distinct certificate and CRL paths. The CRL issuer
   3419      certificate is validated separately in this case. Only enabled if
   3420      an extended CRL support flag is set: this flag will enable additional
   3421      CRL functionality in future.
   3422 
   3423      This work was sponsored by Google.
   3424      [Steve Henson]
   3425 
   3426   *) Add support for policy mappings extension.
   3427 
   3428      This work was sponsored by Google.
   3429      [Steve Henson]
   3430 
   3431   *) Fixes to pathlength constraint, self issued certificate handling,
   3432      policy processing to align with RFC3280 and PKITS tests.
   3433 
   3434      This work was sponsored by Google.
   3435      [Steve Henson]
   3436 
   3437   *) Support for name constraints certificate extension. DN, email, DNS
   3438      and URI types are currently supported.
   3439 
   3440      This work was sponsored by Google.
   3441      [Steve Henson]
   3442 
   3443   *) To cater for systems that provide a pointer-based thread ID rather
   3444      than numeric, deprecate the current numeric thread ID mechanism and
   3445      replace it with a structure and associated callback type. This
   3446      mechanism allows a numeric "hash" to be extracted from a thread ID in
   3447      either case, and on platforms where pointers are larger than 'long',
   3448      mixing is done to help ensure the numeric 'hash' is usable even if it
   3449      can't be guaranteed unique. The default mechanism is to use "&errno"
   3450      as a pointer-based thread ID to distinguish between threads.
   3451 
   3452      Applications that want to provide their own thread IDs should now use
   3453      CRYPTO_THREADID_set_callback() to register a callback that will call
   3454      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
   3455 
   3456      Note that ERR_remove_state() is now deprecated, because it is tied
   3457      to the assumption that thread IDs are numeric.  ERR_remove_state(0)
   3458      to free the current thread's error state should be replaced by
   3459      ERR_remove_thread_state(NULL).
   3460 
   3461      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
   3462      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
   3463      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
   3464      application was previously providing a numeric thread callback that
   3465      was inappropriate for distinguishing threads, then uniqueness might
   3466      have been obtained with &errno that happened immediately in the
   3467      intermediate development versions of OpenSSL; this is no longer the
   3468      case, the numeric thread callback will now override the automatic use
   3469      of &errno.)
   3470      [Geoff Thorpe, with help from Bodo Moeller]
   3471 
   3472   *) Initial support for different CRL issuing certificates. This covers a
   3473      simple case where the self issued certificates in the chain exist and
   3474      the real CRL issuer is higher in the existing chain.
   3475 
   3476      This work was sponsored by Google.
   3477      [Steve Henson]
   3478 
   3479   *) Removed effectively defunct crypto/store from the build.
   3480      [Ben Laurie]
   3481 
   3482   *) Revamp of STACK to provide stronger type-checking. Still to come:
   3483      TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
   3484      ASN1_STRING, CONF_VALUE.
   3485      [Ben Laurie]
   3486 
   3487   *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
   3488      RAM on SSL connections.  This option can save about 34k per idle SSL.
   3489      [Nick Mathewson]
   3490 
   3491   *) Revamp of LHASH to provide stronger type-checking. Still to come:
   3492      STACK, TXT_DB, bsearch, qsort.
   3493      [Ben Laurie]
   3494 
   3495   *) Initial support for Cryptographic Message Syntax (aka CMS) based
   3496      on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
   3497      support for data, signedData, compressedData, digestedData and
   3498      encryptedData, envelopedData types included. Scripts to check against
   3499      RFC4134 examples draft and interop and consistency checks of many
   3500      content types and variants.
   3501      [Steve Henson]
   3502 
   3503   *) Add options to enc utility to support use of zlib compression BIO.
   3504      [Steve Henson]
   3505 
   3506   *) Extend mk1mf to support importing of options and assembly language
   3507      files from Configure script, currently only included in VC-WIN32.
   3508      The assembly language rules can now optionally generate the source
   3509      files from the associated perl scripts.
   3510      [Steve Henson]
   3511 
   3512   *) Implement remaining functionality needed to support GOST ciphersuites.
   3513      Interop testing has been performed using CryptoPro implementations.
   3514      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   3515 
   3516   *) s390x assembler pack.
   3517      [Andy Polyakov]
   3518 
   3519   *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
   3520      "family."
   3521      [Andy Polyakov]
   3522 
   3523   *) Implement Opaque PRF Input TLS extension as specified in
   3524      draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
   3525      official specification yet and no extension type assignment by
   3526      IANA exists, this extension (for now) will have to be explicitly
   3527      enabled when building OpenSSL by providing the extension number
   3528      to use.  For example, specify an option
   3529 
   3530          -DTLSEXT_TYPE_opaque_prf_input=0x9527
   3531 
   3532      to the "config" or "Configure" script to enable the extension,
   3533      assuming extension number 0x9527 (which is a completely arbitrary
   3534      and unofficial assignment based on the MD5 hash of the Internet
   3535      Draft).  Note that by doing so, you potentially lose
   3536      interoperability with other TLS implementations since these might
   3537      be using the same extension number for other purposes.
   3538 
   3539      SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
   3540      opaque PRF input value to use in the handshake.  This will create
   3541      an interal copy of the length-'len' string at 'src', and will
   3542      return non-zero for success.
   3543 
   3544      To get more control and flexibility, provide a callback function
   3545      by using
   3546 
   3547           SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
   3548           SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
   3549 
   3550      where
   3551 
   3552           int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
   3553           void *arg;
   3554 
   3555      Callback function 'cb' will be called in handshakes, and is
   3556      expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
   3557      Argument 'arg' is for application purposes (the value as given to
   3558      SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
   3559      be provided to the callback function).  The callback function
   3560      has to return non-zero to report success: usually 1 to use opaque
   3561      PRF input just if possible, or 2 to enforce use of the opaque PRF
   3562      input.  In the latter case, the library will abort the handshake
   3563      if opaque PRF input is not successfully negotiated.
   3564 
   3565      Arguments 'peerinput' and 'len' given to the callback function
   3566      will always be NULL and 0 in the case of a client.  A server will
   3567      see the client's opaque PRF input through these variables if
   3568      available (NULL and 0 otherwise).  Note that if the server
   3569      provides an opaque PRF input, the length must be the same as the
   3570      length of the client's opaque PRF input.
   3571 
   3572      Note that the callback function will only be called when creating
   3573      a new session (session resumption can resume whatever was
   3574      previously negotiated), and will not be called in SSL 2.0
   3575      handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
   3576      SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
   3577      for applications that need to enforce opaque PRF input.
   3578 
   3579      [Bodo Moeller]
   3580 
   3581   *) Update ssl code to support digests other than SHA1+MD5 for handshake
   3582      MAC. 
   3583 
   3584      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   3585 
   3586   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   3587      RFC4507bis. The encrypted ticket format is an encrypted encoded
   3588      SSL_SESSION structure, that way new session features are automatically
   3589      supported.
   3590 
   3591      If a client application caches session in an SSL_SESSION structure
   3592      support is transparent because tickets are now stored in the encoded
   3593      SSL_SESSION.
   3594      
   3595      The SSL_CTX structure automatically generates keys for ticket
   3596      protection in servers so again support should be possible
   3597      with no application modification.
   3598 
   3599      If a client or server wishes to disable RFC4507 support then the option
   3600      SSL_OP_NO_TICKET can be set.
   3601 
   3602      Add a TLS extension debugging callback to allow the contents of any client
   3603      or server extensions to be examined.
   3604 
   3605      This work was sponsored by Google.
   3606      [Steve Henson]
   3607 
   3608   *) Final changes to avoid use of pointer pointer casts in OpenSSL.
   3609      OpenSSL should now compile cleanly on gcc 4.2
   3610      [Peter Hartley <pdh (a] utter.chaos.org.uk>, Steve Henson]
   3611 
   3612   *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
   3613      support including streaming MAC support: this is required for GOST
   3614      ciphersuite support.
   3615      [Victor B. Wagner <vitus (a] cryptocom.ru>, Steve Henson]
   3616 
   3617   *) Add option -stream to use PKCS#7 streaming in smime utility. New
   3618      function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
   3619      to output in BER and PEM format.
   3620      [Steve Henson]
   3621 
   3622   *) Experimental support for use of HMAC via EVP_PKEY interface. This
   3623      allows HMAC to be handled via the EVP_DigestSign*() interface. The
   3624      EVP_PKEY "key" in this case is the HMAC key, potentially allowing
   3625      ENGINE support for HMAC keys which are unextractable. New -mac and
   3626      -macopt options to dgst utility.
   3627      [Steve Henson]
   3628 
   3629   *) New option -sigopt to dgst utility. Update dgst to use
   3630      EVP_Digest{Sign,Verify}*. These two changes make it possible to use
   3631      alternative signing parameters such as X9.31 or PSS in the dgst 
   3632      utility.
   3633      [Steve Henson]
   3634 
   3635   *) Change ssl_cipher_apply_rule(), the internal function that does
   3636      the work each time a ciphersuite string requests enabling
   3637      ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
   3638      removing ("!foo+bar") a class of ciphersuites: Now it maintains
   3639      the order of disabled ciphersuites such that those ciphersuites
   3640      that most recently went from enabled to disabled not only stay
   3641      in order with respect to each other, but also have higher priority
   3642      than other disabled ciphersuites the next time ciphersuites are
   3643      enabled again.
   3644 
   3645      This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
   3646      the same ciphersuites as with "HIGH" alone, but in a specific
   3647      order where the PSK ciphersuites come first (since they are the
   3648      most recently disabled ciphersuites when "HIGH" is parsed).
   3649 
   3650      Also, change ssl_create_cipher_list() (using this new
   3651      funcionality) such that between otherwise identical
   3652      cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
   3653      the default order.
   3654      [Bodo Moeller]
   3655 
   3656   *) Change ssl_create_cipher_list() so that it automatically
   3657      arranges the ciphersuites in reasonable order before starting
   3658      to process the rule string.  Thus, the definition for "DEFAULT"
   3659      (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
   3660      remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
   3661      This makes it much easier to arrive at a reasonable default order
   3662      in applications for which anonymous ciphers are OK (meaning
   3663      that you can't actually use DEFAULT).
   3664      [Bodo Moeller; suggested by Victor Duchovni]
   3665 
   3666   *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
   3667      processing) into multiple integers instead of setting
   3668      "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
   3669      "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
   3670      (These masks as well as the individual bit definitions are hidden
   3671      away into the non-exported interface ssl/ssl_locl.h, so this
   3672      change to the definition of the SSL_CIPHER structure shouldn't
   3673      affect applications.)  This give us more bits for each of these
   3674      categories, so there is no longer a need to coagulate AES128 and
   3675      AES256 into a single algorithm bit, and to coagulate Camellia128
   3676      and Camellia256 into a single algorithm bit, which has led to all
   3677      kinds of kludges.
   3678 
   3679      Thus, among other things, the kludge introduced in 0.9.7m and
   3680      0.9.8e for masking out AES256 independently of AES128 or masking
   3681      out Camellia256 independently of AES256 is not needed here in 0.9.9.
   3682 
   3683      With the change, we also introduce new ciphersuite aliases that
   3684      so far were missing: "AES128", "AES256", "CAMELLIA128", and
   3685      "CAMELLIA256".
   3686      [Bodo Moeller]
   3687 
   3688   *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
   3689      Use the leftmost N bytes of the signature input if the input is
   3690      larger than the prime q (with N being the size in bytes of q).
   3691      [Nils Larsch]
   3692 
   3693   *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
   3694      it yet and it is largely untested.
   3695      [Steve Henson]
   3696 
   3697   *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
   3698      [Nils Larsch]
   3699 
   3700   *) Initial incomplete changes to avoid need for function casts in OpenSSL
   3701      some compilers (gcc 4.2 and later) reject their use. Safestack is
   3702      reimplemented.  Update ASN1 to avoid use of legacy functions. 
   3703      [Steve Henson]
   3704 
   3705   *) Win32/64 targets are linked with Winsock2.
   3706      [Andy Polyakov]
   3707 
   3708   *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
   3709      to external functions. This can be used to increase CRL handling 
   3710      efficiency especially when CRLs are very large by (for example) storing
   3711      the CRL revoked certificates in a database.
   3712      [Steve Henson]
   3713 
   3714   *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
   3715      new CRLs added to a directory can be used. New command line option
   3716      -verify_return_error to s_client and s_server. This causes real errors
   3717      to be returned by the verify callback instead of carrying on no matter
   3718      what. This reflects the way a "real world" verify callback would behave.
   3719      [Steve Henson]
   3720 
   3721   *) GOST engine, supporting several GOST algorithms and public key formats.
   3722      Kindly donated by Cryptocom.
   3723      [Cryptocom]
   3724 
   3725   *) Partial support for Issuing Distribution Point CRL extension. CRLs
   3726      partitioned by DP are handled but no indirect CRL or reason partitioning
   3727      (yet). Complete overhaul of CRL handling: now the most suitable CRL is
   3728      selected via a scoring technique which handles IDP and AKID in CRLs.
   3729      [Steve Henson]
   3730 
   3731   *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
   3732      will ultimately be used for all verify operations: this will remove the
   3733      X509_STORE dependency on certificate verification and allow alternative
   3734      lookup methods.  X509_STORE based implementations of these two callbacks.
   3735      [Steve Henson]
   3736 
   3737   *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
   3738      Modify get_crl() to find a valid (unexpired) CRL if possible.
   3739      [Steve Henson]
   3740 
   3741   *) New function X509_CRL_match() to check if two CRLs are identical. Normally
   3742      this would be called X509_CRL_cmp() but that name is already used by
   3743      a function that just compares CRL issuer names. Cache several CRL 
   3744      extensions in X509_CRL structure and cache CRLDP in X509.
   3745      [Steve Henson]
   3746 
   3747   *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
   3748      this maps equivalent X509_NAME structures into a consistent structure.
   3749      Name comparison can then be performed rapidly using memcmp().
   3750      [Steve Henson]
   3751 
   3752   *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
   3753      utility.
   3754      [Steve Henson]
   3755 
   3756   *) Allow digests to supply their own micalg string for S/MIME type using
   3757      the ctrl EVP_MD_CTRL_MICALG.
   3758      [Steve Henson]
   3759 
   3760   *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
   3761      EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
   3762      ctrl. It can then customise the structure before and/or after signing
   3763      if necessary.
   3764      [Steve Henson]
   3765 
   3766   *) New function OBJ_add_sigid() to allow application defined signature OIDs
   3767      to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
   3768      to free up any added signature OIDs.
   3769      [Steve Henson]
   3770 
   3771   *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
   3772      EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
   3773      digest and cipher tables. New options added to openssl utility:
   3774      list-message-digest-algorithms and list-cipher-algorithms.
   3775      [Steve Henson]
   3776 
   3777   *) Change the array representation of binary polynomials: the list
   3778      of degrees of non-zero coefficients is now terminated with -1.
   3779      Previously it was terminated with 0, which was also part of the
   3780      value; thus, the array representation was not applicable to
   3781      polynomials where t^0 has coefficient zero.  This change makes
   3782      the array representation useful in a more general context.
   3783      [Douglas Stebila]
   3784 
   3785   *) Various modifications and fixes to SSL/TLS cipher string
   3786      handling.  For ECC, the code now distinguishes between fixed ECDH
   3787      with RSA certificates on the one hand and with ECDSA certificates
   3788      on the other hand, since these are separate ciphersuites.  The
   3789      unused code for Fortezza ciphersuites has been removed.
   3790 
   3791      For consistency with EDH, ephemeral ECDH is now called "EECDH"
   3792      (not "ECDHE").  For consistency with the code for DH
   3793      certificates, use of ECDH certificates is now considered ECDH
   3794      authentication, not RSA or ECDSA authentication (the latter is
   3795      merely the CA's signing algorithm and not actively used in the
   3796      protocol).
   3797 
   3798      The temporary ciphersuite alias "ECCdraft" is no longer
   3799      available, and ECC ciphersuites are no longer excluded from "ALL"
   3800      and "DEFAULT".  The following aliases now exist for RFC 4492
   3801      ciphersuites, most of these by analogy with the DH case:
   3802 
   3803          kECDHr   - ECDH cert, signed with RSA
   3804          kECDHe   - ECDH cert, signed with ECDSA
   3805          kECDH    - ECDH cert (signed with either RSA or ECDSA)
   3806          kEECDH   - ephemeral ECDH
   3807          ECDH     - ECDH cert or ephemeral ECDH
   3808 
   3809          aECDH    - ECDH cert
   3810          aECDSA   - ECDSA cert
   3811          ECDSA    - ECDSA cert
   3812 
   3813          AECDH    - anonymous ECDH
   3814          EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
   3815 
   3816      [Bodo Moeller]
   3817 
   3818   *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
   3819      Use correct micalg parameters depending on digest(s) in signed message.
   3820      [Steve Henson]
   3821 
   3822   *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
   3823      an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
   3824      [Steve Henson]
   3825 
   3826   *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
   3827      an engine to register a method. Add ENGINE lookups for methods and
   3828      functional reference processing.
   3829      [Steve Henson]
   3830 
   3831   *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
   3832      EVP_{Sign,Verify}* which allow an application to customise the signature
   3833      process.
   3834      [Steve Henson]
   3835 
   3836   *) New -resign option to smime utility. This adds one or more signers
   3837      to an existing PKCS#7 signedData structure. Also -md option to use an
   3838      alternative message digest algorithm for signing.
   3839      [Steve Henson]
   3840 
   3841   *) Tidy up PKCS#7 routines and add new functions to make it easier to
   3842      create PKCS7 structures containing multiple signers. Update smime
   3843      application to support multiple signers.
   3844      [Steve Henson]
   3845 
   3846   *) New -macalg option to pkcs12 utility to allow setting of an alternative
   3847      digest MAC.
   3848      [Steve Henson]
   3849 
   3850   *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
   3851      Reorganize PBE internals to lookup from a static table using NIDs,
   3852      add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
   3853      EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
   3854      PRF which will be automatically used with PBES2.
   3855      [Steve Henson]
   3856 
   3857   *) Replace the algorithm specific calls to generate keys in "req" with the
   3858      new API.
   3859      [Steve Henson]
   3860 
   3861   *) Update PKCS#7 enveloped data routines to use new API. This is now
   3862      supported by any public key method supporting the encrypt operation. A
   3863      ctrl is added to allow the public key algorithm to examine or modify
   3864      the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
   3865      a no op.
   3866      [Steve Henson]
   3867 
   3868   *) Add a ctrl to asn1 method to allow a public key algorithm to express
   3869      a default digest type to use. In most cases this will be SHA1 but some
   3870      algorithms (such as GOST) need to specify an alternative digest. The
   3871      return value indicates how strong the preference is 1 means optional and
   3872      2 is mandatory (that is it is the only supported type). Modify
   3873      ASN1_item_sign() to accept a NULL digest argument to indicate it should
   3874      use the default md. Update openssl utilities to use the default digest
   3875      type for signing if it is not explicitly indicated.
   3876      [Steve Henson]
   3877 
   3878   *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
   3879      EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
   3880      signing method from the key type. This effectively removes the link
   3881      between digests and public key types.
   3882      [Steve Henson]
   3883 
   3884   *) Add an OID cross reference table and utility functions. Its purpose is to
   3885      translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
   3886      rsaEncryption. This will allow some of the algorithm specific hackery
   3887      needed to use the correct OID to be removed. 
   3888      [Steve Henson]
   3889 
   3890   *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
   3891      structures for PKCS7_sign(). They are now set up by the relevant public
   3892      key ASN1 method.
   3893      [Steve Henson]
   3894 
   3895   *) Add provisional EC pkey method with support for ECDSA and ECDH.
   3896      [Steve Henson]
   3897 
   3898   *) Add support for key derivation (agreement) in the API, DH method and
   3899      pkeyutl.
   3900      [Steve Henson]
   3901 
   3902   *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
   3903      public and private key formats. As a side effect these add additional 
   3904      command line functionality not previously available: DSA signatures can be
   3905      generated and verified using pkeyutl and DH key support and generation in
   3906      pkey, genpkey.
   3907      [Steve Henson]
   3908 
   3909   *) BeOS support.
   3910      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   3911 
   3912   *) New make target "install_html_docs" installs HTML renditions of the
   3913      manual pages.
   3914      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   3915 
   3916   *) New utility "genpkey" this is analogous to "genrsa" etc except it can
   3917      generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
   3918      support key and parameter generation and add initial key generation
   3919      functionality for RSA.
   3920      [Steve Henson]
   3921 
   3922   *) Add functions for main EVP_PKEY_method operations. The undocumented
   3923      functions EVP_PKEY_{encrypt,decrypt} have been renamed to
   3924      EVP_PKEY_{encrypt,decrypt}_old. 
   3925      [Steve Henson]
   3926 
   3927   *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
   3928      key API, doesn't do much yet.
   3929      [Steve Henson]
   3930 
   3931   *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
   3932      public key algorithms. New option to openssl utility:
   3933      "list-public-key-algorithms" to print out info.
   3934      [Steve Henson]
   3935 
   3936   *) Implement the Supported Elliptic Curves Extension for
   3937      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   3938      [Douglas Stebila]
   3939 
   3940   *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
   3941      EVP_CIPHER structures to avoid later problems in EVP_cleanup().
   3942      [Steve Henson]
   3943 
   3944   *) New utilities pkey and pkeyparam. These are similar to algorithm specific
   3945      utilities such as rsa, dsa, dsaparam etc except they process any key
   3946      type.
   3947      [Steve Henson]
   3948 
   3949   *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
   3950      functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
   3951      EVP_PKEY_print_param() to print public key data from an EVP_PKEY
   3952      structure.
   3953      [Steve Henson]
   3954 
   3955   *) Initial support for pluggable public key ASN1.
   3956      De-spaghettify the public key ASN1 handling. Move public and private
   3957      key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
   3958      algorithm specific handling to a single module within the relevant
   3959      algorithm directory. Add functions to allow (near) opaque processing
   3960      of public and private key structures.
   3961      [Steve Henson]
   3962 
   3963   *) Implement the Supported Point Formats Extension for
   3964      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   3965      [Douglas Stebila]
   3966 
   3967   *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
   3968      for the psk identity [hint] and the psk callback functions to the
   3969      SSL_SESSION, SSL and SSL_CTX structure.
   3970      
   3971      New ciphersuites:
   3972          PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
   3973          PSK-AES256-CBC-SHA
   3974  
   3975      New functions:
   3976          SSL_CTX_use_psk_identity_hint
   3977          SSL_get_psk_identity_hint
   3978          SSL_get_psk_identity
   3979          SSL_use_psk_identity_hint
   3980 
   3981      [Mika Kousa and Pasi Eronen of Nokia Corporation]
   3982 
   3983   *) Add RFC 3161 compliant time stamp request creation, response generation
   3984      and response verification functionality.
   3985      [Zoltn Glzik <zglozik (a] opentsa.org>, The OpenTSA Project]
   3986 
   3987   *) Add initial support for TLS extensions, specifically for the server_name
   3988      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   3989      have new members for a host name.  The SSL data structure has an
   3990      additional member SSL_CTX *initial_ctx so that new sessions can be
   3991      stored in that context to allow for session resumption, even after the
   3992      SSL has been switched to a new SSL_CTX in reaction to a client's
   3993      server_name extension.
   3994 
   3995      New functions (subject to change):
   3996 
   3997          SSL_get_servername()
   3998          SSL_get_servername_type()
   3999          SSL_set_SSL_CTX()
   4000 
   4001      New CTRL codes and macros (subject to change):
   4002 
   4003          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
   4004                                  - SSL_CTX_set_tlsext_servername_callback()
   4005          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
   4006                                       - SSL_CTX_set_tlsext_servername_arg()
   4007          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   4008 
   4009      openssl s_client has a new '-servername ...' option.
   4010 
   4011      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   4012      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   4013      testing the HostName extension for a specific single host name ('-cert'
   4014      and '-key' remain fallbacks for handshakes without HostName
   4015      negotiation).  If the unrecognized_name alert has to be sent, this by
   4016      default is a warning; it becomes fatal with the '-servername_fatal'
   4017      option.
   4018 
   4019      [Peter Sylvester,  Remy Allais, Christophe Renou]
   4020 
   4021   *) Whirlpool hash implementation is added.
   4022      [Andy Polyakov]
   4023 
   4024   *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
   4025      bn(64,32). Because of instruction set limitations it doesn't have
   4026      any negative impact on performance. This was done mostly in order
   4027      to make it possible to share assembler modules, such as bn_mul_mont
   4028      implementations, between 32- and 64-bit builds without hassle.
   4029      [Andy Polyakov]
   4030 
   4031   *) Move code previously exiled into file crypto/ec/ec2_smpt.c
   4032      to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
   4033      macro.
   4034      [Bodo Moeller]
   4035 
   4036   *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
   4037      dedicated Montgomery multiplication procedure, is introduced.
   4038      BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
   4039      "64-bit" performance on certain 32-bit targets.
   4040      [Andy Polyakov]
   4041 
   4042   *) New option SSL_OP_NO_COMP to disable use of compression selectively
   4043      in SSL structures. New SSL ctrl to set maximum send fragment size. 
   4044      Save memory by seeting the I/O buffer sizes dynamically instead of
   4045      using the maximum available value.
   4046      [Steve Henson]
   4047 
   4048   *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
   4049      in addition to the text details.
   4050      [Bodo Moeller]
   4051 
   4052   *) Very, very preliminary EXPERIMENTAL support for printing of general
   4053      ASN1 structures. This currently produces rather ugly output and doesn't
   4054      handle several customised structures at all.
   4055      [Steve Henson]
   4056 
   4057   *) Integrated support for PVK file format and some related formats such
   4058      as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
   4059      these in the 'rsa' and 'dsa' utilities.
   4060      [Steve Henson]
   4061 
   4062   *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
   4063      [Steve Henson]
   4064 
   4065   *) Remove the ancient ASN1_METHOD code. This was only ever used in one
   4066      place for the (very old) "NETSCAPE" format certificates which are now
   4067      handled using new ASN1 code equivalents.
   4068      [Steve Henson]
   4069 
   4070   *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
   4071      pointer and make the SSL_METHOD parameter in SSL_CTX_new,
   4072      SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
   4073      [Nils Larsch]
   4074 
   4075   *) Modify CRL distribution points extension code to print out previously
   4076      unsupported fields. Enhance extension setting code to allow setting of
   4077      all fields.
   4078      [Steve Henson]
   4079 
   4080   *) Add print and set support for Issuing Distribution Point CRL extension.
   4081      [Steve Henson]
   4082 
   4083   *) Change 'Configure' script to enable Camellia by default.
   4084      [NTT]
   4085 
   4086  Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
   4087 
   4088   *) When rejecting SSL/TLS records due to an incorrect version number, never
   4089      update s->server with a new major version number.  As of
   4090      - OpenSSL 0.9.8m if 'short' is a 16-bit type,
   4091      - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
   4092      the previous behavior could result in a read attempt at NULL when
   4093      receiving specific incorrect SSL/TLS records once record payload
   4094      protection is active.  (CVE-2010-0740)
   4095      [Bodo Moeller, Adam Langley <agl (a] chromium.org>]
   4096 
   4097   *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
   4098      could be crashed if the relevant tables were not present (e.g. chrooted).
   4099      [Tomas Hoger <thoger (a] redhat.com>]
   4100 
   4101  Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
   4102 
   4103   *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
   4104      [Martin Olsson, Neel Mehta]
   4105 
   4106   *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
   4107      accommodate for stack sorting, always a write lock!).
   4108      [Bodo Moeller]
   4109 
   4110   *) On some versions of WIN32 Heap32Next is very slow. This can cause
   4111      excessive delays in the RAND_poll(): over a minute. As a workaround
   4112      include a time check in the inner Heap32Next loop too.
   4113      [Steve Henson]
   4114 
   4115   *) The code that handled flushing of data in SSL/TLS originally used the
   4116      BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
   4117      the problem outlined in PR#1949. The fix suggested there however can
   4118      trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
   4119      of Apache). So instead simplify the code to flush unconditionally.
   4120      This should be fine since flushing with no data to flush is a no op.
   4121      [Steve Henson]
   4122 
   4123   *) Handle TLS versions 2.0 and later properly and correctly use the
   4124      highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
   4125      off ancient servers have a habit of sticking around for a while...
   4126      [Steve Henson]
   4127 
   4128   *) Modify compression code so it frees up structures without using the
   4129      ex_data callbacks. This works around a problem where some applications
   4130      call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
   4131      restarting) then use compression (e.g. SSL with compression) later.
   4132      This results in significant per-connection memory leaks and
   4133      has caused some security issues including CVE-2008-1678 and
   4134      CVE-2009-4355.
   4135      [Steve Henson]
   4136 
   4137   *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
   4138      change when encrypting or decrypting.
   4139      [Bodo Moeller]
   4140 
   4141   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
   4142      connect and renegotiate with servers which do not support RI.
   4143      Until RI is more widely deployed this option is enabled by default.
   4144      [Steve Henson]
   4145 
   4146   *) Add "missing" ssl ctrls to clear options and mode.
   4147      [Steve Henson]
   4148 
   4149   *) If client attempts to renegotiate and doesn't support RI respond with
   4150      a no_renegotiation alert as required by RFC5746.  Some renegotiating
   4151      TLS clients will continue a connection gracefully when they receive
   4152      the alert. Unfortunately OpenSSL mishandled this alert and would hang
   4153      waiting for a server hello which it will never receive. Now we treat a
   4154      received no_renegotiation alert as a fatal error. This is because
   4155      applications requesting a renegotiation might well expect it to succeed
   4156      and would have no code in place to handle the server denying it so the
   4157      only safe thing to do is to terminate the connection.
   4158      [Steve Henson]
   4159 
   4160   *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
   4161      peer supports secure renegotiation and 0 otherwise. Print out peer
   4162      renegotiation support in s_client/s_server.
   4163      [Steve Henson]
   4164 
   4165   *) Replace the highly broken and deprecated SPKAC certification method with
   4166      the updated NID creation version. This should correctly handle UTF8.
   4167      [Steve Henson]
   4168 
   4169   *) Implement RFC5746. Re-enable renegotiation but require the extension
   4170      as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
   4171      turns out to be a bad idea. It has been replaced by
   4172      SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
   4173      SSL_CTX_set_options(). This is really not recommended unless you
   4174      know what you are doing.
   4175      [Eric Rescorla <ekr (a] networkresonance.com>, Ben Laurie, Steve Henson]
   4176 
   4177   *) Fixes to stateless session resumption handling. Use initial_ctx when
   4178      issuing and attempting to decrypt tickets in case it has changed during
   4179      servername handling. Use a non-zero length session ID when attempting
   4180      stateless session resumption: this makes it possible to determine if
   4181      a resumption has occurred immediately after receiving server hello
   4182      (several places in OpenSSL subtly assume this) instead of later in
   4183      the handshake.
   4184      [Steve Henson]
   4185 
   4186   *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
   4187      CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
   4188      fixes for a few places where the return code is not checked
   4189      correctly.
   4190      [Julia Lawall <julia (a] diku.dk>]
   4191 
   4192   *) Add --strict-warnings option to Configure script to include devteam
   4193      warnings in other configurations.
   4194      [Steve Henson]
   4195 
   4196   *) Add support for --libdir option and LIBDIR variable in makefiles. This
   4197      makes it possible to install openssl libraries in locations which
   4198      have names other than "lib", for example "/usr/lib64" which some
   4199      systems need.
   4200      [Steve Henson, based on patch from Jeremy Utley]
   4201 
   4202   *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
   4203      X690 8.9.12 and can produce some misleading textual output of OIDs.
   4204      [Steve Henson, reported by Dan Kaminsky]
   4205 
   4206   *) Delete MD2 from algorithm tables. This follows the recommendation in
   4207      several standards that it is not used in new applications due to
   4208      several cryptographic weaknesses. For binary compatibility reasons
   4209      the MD2 API is still compiled in by default.
   4210      [Steve Henson]
   4211 
   4212   *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
   4213      and restored.
   4214      [Steve Henson]
   4215 
   4216   *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
   4217      OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
   4218      clash.
   4219      [Guenter <lists (a] gknw.net>]
   4220 
   4221   *) Fix the server certificate chain building code to use X509_verify_cert(),
   4222      it used to have an ad-hoc builder which was unable to cope with anything
   4223      other than a simple chain.
   4224      [David Woodhouse <dwmw2 (a] infradead.org>, Steve Henson]
   4225 
   4226   *) Don't check self signed certificate signatures in X509_verify_cert()
   4227      by default (a flag can override this): it just wastes time without
   4228      adding any security. As a useful side effect self signed root CAs
   4229      with non-FIPS digests are now usable in FIPS mode.
   4230      [Steve Henson]
   4231 
   4232   *) In dtls1_process_out_of_seq_message() the check if the current message
   4233      is already buffered was missing. For every new message was memory
   4234      allocated, allowing an attacker to perform an denial of service attack
   4235      with sending out of seq handshake messages until there is no memory
   4236      left. Additionally every future messege was buffered, even if the
   4237      sequence number made no sense and would be part of another handshake.
   4238      So only messages with sequence numbers less than 10 in advance will be
   4239      buffered.  (CVE-2009-1378)
   4240      [Robin Seggelmann, discovered by Daniel Mentz] 	
   4241 
   4242   *) Records are buffered if they arrive with a future epoch to be
   4243      processed after finishing the corresponding handshake. There is
   4244      currently no limitation to this buffer allowing an attacker to perform
   4245      a DOS attack with sending records with future epochs until there is no
   4246      memory left. This patch adds the pqueue_size() function to determine
   4247      the size of a buffer and limits the record buffer to 100 entries.
   4248      (CVE-2009-1377)
   4249      [Robin Seggelmann, discovered by Daniel Mentz] 	
   4250 
   4251   *) Keep a copy of frag->msg_header.frag_len so it can be used after the
   4252      parent structure is freed.  (CVE-2009-1379)
   4253      [Daniel Mentz] 	
   4254 
   4255   *) Handle non-blocking I/O properly in SSL_shutdown() call.
   4256      [Darryl Miles <darryl-mailinglists (a] netbauds.net>]
   4257 
   4258   *) Add 2.5.4.* OIDs
   4259      [Ilya O. <vrghost (a] gmail.com>]
   4260 
   4261  Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
   4262 
   4263   *) Disable renegotiation completely - this fixes a severe security
   4264      problem (CVE-2009-3555) at the cost of breaking all
   4265      renegotiation. Renegotiation can be re-enabled by setting
   4266      SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION in s3->flags at
   4267      run-time. This is really not recommended unless you know what
   4268      you're doing.
   4269      [Ben Laurie]
   4270 
   4271  Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
   4272 
   4273   *) Don't set val to NULL when freeing up structures, it is freed up by
   4274      underlying code. If sizeof(void *) > sizeof(long) this can result in
   4275      zeroing past the valid field. (CVE-2009-0789)
   4276      [Paolo Ganci <Paolo.Ganci (a] AdNovum.CH>]
   4277 
   4278   *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
   4279      checked correctly. This would allow some invalid signed attributes to
   4280      appear to verify correctly. (CVE-2009-0591)
   4281      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   4282 
   4283   *) Reject UniversalString and BMPString types with invalid lengths. This
   4284      prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
   4285      a legal length. (CVE-2009-0590)
   4286      [Steve Henson]
   4287 
   4288   *) Set S/MIME signing as the default purpose rather than setting it 
   4289      unconditionally. This allows applications to override it at the store
   4290      level.
   4291      [Steve Henson]
   4292 
   4293   *) Permit restricted recursion of ASN1 strings. This is needed in practice
   4294      to handle some structures.
   4295      [Steve Henson]
   4296 
   4297   *) Improve efficiency of mem_gets: don't search whole buffer each time
   4298      for a '\n'
   4299      [Jeremy Shapiro <jnshapir (a] us.ibm.com>]
   4300 
   4301   *) New -hex option for openssl rand.
   4302      [Matthieu Herrb]
   4303 
   4304   *) Print out UTF8String and NumericString when parsing ASN1.
   4305      [Steve Henson]
   4306 
   4307   *) Support NumericString type for name components.
   4308      [Steve Henson]
   4309 
   4310   *) Allow CC in the environment to override the automatically chosen
   4311      compiler. Note that nothing is done to ensure flags work with the
   4312      chosen compiler.
   4313      [Ben Laurie]
   4314 
   4315  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
   4316 
   4317   *) Properly check EVP_VerifyFinal() and similar return values
   4318      (CVE-2008-5077).
   4319      [Ben Laurie, Bodo Moeller, Google Security Team]
   4320 
   4321   *) Enable TLS extensions by default.
   4322      [Ben Laurie]
   4323 
   4324   *) Allow the CHIL engine to be loaded, whether the application is
   4325      multithreaded or not. (This does not release the developer from the
   4326      obligation to set up the dynamic locking callbacks.)
   4327      [Sander Temme <sander (a] temme.net>]
   4328 
   4329   *) Use correct exit code if there is an error in dgst command.
   4330      [Steve Henson; problem pointed out by Roland Dirlewanger]
   4331 
   4332   *) Tweak Configure so that you need to say "experimental-jpake" to enable
   4333      JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
   4334      [Bodo Moeller]
   4335 
   4336   *) Add experimental JPAKE support, including demo authentication in
   4337      s_client and s_server.
   4338      [Ben Laurie]
   4339 
   4340   *) Set the comparison function in v3_addr_canonize().
   4341      [Rob Austein <sra (a] hactrn.net>]
   4342 
   4343   *) Add support for XMPP STARTTLS in s_client.
   4344      [Philip Paeps <philip (a] freebsd.org>]
   4345 
   4346   *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
   4347      to ensure that even with this option, only ciphersuites in the
   4348      server's preference list will be accepted.  (Note that the option
   4349      applies only when resuming a session, so the earlier behavior was
   4350      just about the algorithm choice for symmetric cryptography.)
   4351      [Bodo Moeller]
   4352 
   4353  Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
   4354 
   4355   *) Fix NULL pointer dereference if a DTLS server received
   4356      ChangeCipherSpec as first record (CVE-2009-1386).
   4357      [PR #1679]
   4358 
   4359   *) Fix a state transition in s3_srvr.c and d1_srvr.c
   4360      (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
   4361      [Nagendra Modadugu]
   4362 
   4363   *) The fix in 0.9.8c that supposedly got rid of unsafe
   4364      double-checked locking was incomplete for RSA blinding,
   4365      addressing just one layer of what turns out to have been
   4366      doubly unsafe triple-checked locking.
   4367 
   4368      So now fix this for real by retiring the MONT_HELPER macro
   4369      in crypto/rsa/rsa_eay.c.
   4370 
   4371      [Bodo Moeller; problem pointed out by Marius Schilder]
   4372 
   4373   *) Various precautionary measures:
   4374 
   4375      - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
   4376 
   4377      - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
   4378        (NB: This would require knowledge of the secret session ticket key
   4379        to exploit, in which case you'd be SOL either way.)
   4380 
   4381      - Change bn_nist.c so that it will properly handle input BIGNUMs
   4382        outside the expected range.
   4383 
   4384      - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
   4385        builds.
   4386 
   4387      [Neel Mehta, Bodo Moeller]
   4388 
   4389   *) Allow engines to be "soft loaded" - i.e. optionally don't die if
   4390      the load fails. Useful for distros.
   4391      [Ben Laurie and the FreeBSD team]
   4392 
   4393   *) Add support for Local Machine Keyset attribute in PKCS#12 files.
   4394      [Steve Henson]
   4395 
   4396   *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
   4397      [Huang Ying]
   4398 
   4399   *) Expand ENGINE to support engine supplied SSL client certificate functions.
   4400 
   4401      This work was sponsored by Logica.
   4402      [Steve Henson]
   4403 
   4404   *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
   4405      keystores. Support for SSL/TLS client authentication too.
   4406      Not compiled unless enable-capieng specified to Configure.
   4407 
   4408      This work was sponsored by Logica.
   4409      [Steve Henson]
   4410 
   4411   *) Fix bug in X509_ATTRIBUTE creation: don't set attribute using
   4412      ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
   4413      attribute creation routines such as certificate requests and PKCS#12
   4414      files.
   4415      [Steve Henson]
   4416 
   4417  Changes between 0.9.8g and 0.9.8h  [28 May 2008]
   4418 
   4419   *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
   4420      handshake which could lead to a cilent crash as found using the
   4421      Codenomicon TLS test suite (CVE-2008-1672) 
   4422      [Steve Henson, Mark Cox]
   4423 
   4424   *) Fix double free in TLS server name extensions which could lead to
   4425      a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
   4426      [Joe Orton]
   4427 
   4428   *) Clear error queue in SSL_CTX_use_certificate_chain_file()
   4429 
   4430      Clear the error queue to ensure that error entries left from
   4431      older function calls do not interfere with the correct operation.
   4432      [Lutz Jaenicke, Erik de Castro Lopo]
   4433 
   4434   *) Remove root CA certificates of commercial CAs:
   4435 
   4436      The OpenSSL project does not recommend any specific CA and does not
   4437      have any policy with respect to including or excluding any CA.
   4438      Therefore it does not make any sense to ship an arbitrary selection
   4439      of root CA certificates with the OpenSSL software.
   4440      [Lutz Jaenicke]
   4441 
   4442   *) RSA OAEP patches to fix two separate invalid memory reads.
   4443      The first one involves inputs when 'lzero' is greater than
   4444      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
   4445      before the beginning of from). The second one involves inputs where
   4446      the 'db' section contains nothing but zeroes (there is a one-byte
   4447      invalid read after the end of 'db').
   4448      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   4449 
   4450   *) Partial backport from 0.9.9-dev:
   4451 
   4452      Introduce bn_mul_mont (dedicated Montgomery multiplication
   4453      procedure) as a candidate for BIGNUM assembler implementation.
   4454      While 0.9.9-dev uses assembler for various architectures, only
   4455      x86_64 is available by default here in the 0.9.8 branch, and
   4456      32-bit x86 is available through a compile-time setting.
   4457 
   4458      To try the 32-bit x86 assembler implementation, use Configure
   4459      option "enable-montasm" (which exists only for this backport).
   4460 
   4461      As "enable-montasm" for 32-bit x86 disclaims code stability
   4462      anyway, in this constellation we activate additional code
   4463      backported from 0.9.9-dev for further performance improvements,
   4464      namely BN_from_montgomery_word.  (To enable this otherwise,
   4465      e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
   4466 
   4467      [Andy Polyakov (backport partially by Bodo Moeller)]
   4468 
   4469   *) Add TLS session ticket callback. This allows an application to set
   4470      TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
   4471      values. This is useful for key rollover for example where several key
   4472      sets may exist with different names.
   4473      [Steve Henson]
   4474 
   4475   *) Reverse ENGINE-internal logic for caching default ENGINE handles.
   4476      This was broken until now in 0.9.8 releases, such that the only way
   4477      a registered ENGINE could be used (assuming it initialises
   4478      successfully on the host) was to explicitly set it as the default
   4479      for the relevant algorithms. This is in contradiction with 0.9.7
   4480      behaviour and the documentation. With this fix, when an ENGINE is
   4481      registered into a given algorithm's table of implementations, the
   4482      'uptodate' flag is reset so that auto-discovery will be used next
   4483      time a new context for that algorithm attempts to select an
   4484      implementation.
   4485      [Ian Lister (tweaked by Geoff Thorpe)]
   4486 
   4487   *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
   4488      implementation in the following ways:
   4489 
   4490      Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
   4491      hard coded.
   4492 
   4493      Lack of BER streaming support means one pass streaming processing is
   4494      only supported if data is detached: setting the streaming flag is
   4495      ignored for embedded content.
   4496 
   4497      CMS support is disabled by default and must be explicitly enabled
   4498      with the enable-cms configuration option.
   4499      [Steve Henson]
   4500 
   4501   *) Update the GMP engine glue to do direct copies between BIGNUM and
   4502      mpz_t when openssl and GMP use the same limb size. Otherwise the
   4503      existing "conversion via a text string export" trick is still used.
   4504      [Paul Sheer <paulsheer (a] gmail.com>]
   4505 
   4506   *) Zlib compression BIO. This is a filter BIO which compressed and
   4507      uncompresses any data passed through it.
   4508      [Steve Henson]
   4509 
   4510   *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
   4511      RFC3394 compatible AES key wrapping.
   4512      [Steve Henson]
   4513 
   4514   *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
   4515      sets string data without copying. X509_ALGOR_set0() and
   4516      X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
   4517      data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
   4518      from an X509_ATTRIBUTE structure optionally checking it occurs only
   4519      once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
   4520      data.
   4521      [Steve Henson]
   4522 
   4523   *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
   4524      to get the expected BN_FLG_CONSTTIME behavior.
   4525      [Bodo Moeller (Google)]
   4526   
   4527   *) Netware support:
   4528 
   4529      - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
   4530      - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
   4531      - added some more tests to do_tests.pl
   4532      - fixed RunningProcess usage so that it works with newer LIBC NDKs too
   4533      - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
   4534      - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
   4535        netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
   4536      - various changes to netware.pl to enable gcc-cross builds on Win32
   4537        platform
   4538      - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
   4539      - various changes to fix missing prototype warnings
   4540      - fixed x86nasm.pl to create correct asm files for NASM COFF output
   4541      - added AES, WHIRLPOOL and CPUID assembler code to build files
   4542      - added missing AES assembler make rules to mk1mf.pl
   4543      - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
   4544      [Guenter Knauf <eflash (a] gmx.net>]
   4545 
   4546   *) Implement certificate status request TLS extension defined in RFC3546.
   4547      A client can set the appropriate parameters and receive the encoded
   4548      OCSP response via a callback. A server can query the supplied parameters
   4549      and set the encoded OCSP response in the callback. Add simplified examples
   4550      to s_client and s_server.
   4551      [Steve Henson]
   4552 
   4553  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
   4554 
   4555   *) Fix various bugs:
   4556      + Binary incompatibility of ssl_ctx_st structure
   4557      + DTLS interoperation with non-compliant servers
   4558      + Don't call get_session_cb() without proposed session
   4559      + Fix ia64 assembler code
   4560      [Andy Polyakov, Steve Henson]
   4561 
   4562  Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
   4563 
   4564   *) DTLS Handshake overhaul. There were longstanding issues with
   4565      OpenSSL DTLS implementation, which were making it impossible for
   4566      RFC 4347 compliant client to communicate with OpenSSL server.
   4567      Unfortunately just fixing these incompatibilities would "cut off"
   4568      pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
   4569      server keeps tolerating non RFC compliant syntax. The opposite is
   4570      not true, 0.9.8f client can not communicate with earlier server.
   4571      This update even addresses CVE-2007-4995.
   4572      [Andy Polyakov]
   4573 
   4574   *) Changes to avoid need for function casts in OpenSSL: some compilers
   4575      (gcc 4.2 and later) reject their use.
   4576      [Kurt Roeckx <kurt (a] roeckx.be>, Peter Hartley <pdh (a] utter.chaos.org.uk>,
   4577       Steve Henson]
   4578   
   4579   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   4580      RFC4507bis. The encrypted ticket format is an encrypted encoded
   4581      SSL_SESSION structure, that way new session features are automatically
   4582      supported.
   4583 
   4584      If a client application caches session in an SSL_SESSION structure
   4585      support is transparent because tickets are now stored in the encoded
   4586      SSL_SESSION.
   4587      
   4588      The SSL_CTX structure automatically generates keys for ticket
   4589      protection in servers so again support should be possible
   4590      with no application modification.
   4591 
   4592      If a client or server wishes to disable RFC4507 support then the option
   4593      SSL_OP_NO_TICKET can be set.
   4594 
   4595      Add a TLS extension debugging callback to allow the contents of any client
   4596      or server extensions to be examined.
   4597 
   4598      This work was sponsored by Google.
   4599      [Steve Henson]
   4600 
   4601   *) Add initial support for TLS extensions, specifically for the server_name
   4602      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   4603      have new members for a host name.  The SSL data structure has an
   4604      additional member SSL_CTX *initial_ctx so that new sessions can be
   4605      stored in that context to allow for session resumption, even after the
   4606      SSL has been switched to a new SSL_CTX in reaction to a client's
   4607      server_name extension.
   4608 
   4609      New functions (subject to change):
   4610 
   4611          SSL_get_servername()
   4612          SSL_get_servername_type()
   4613          SSL_set_SSL_CTX()
   4614 
   4615      New CTRL codes and macros (subject to change):
   4616 
   4617          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
   4618                                  - SSL_CTX_set_tlsext_servername_callback()
   4619          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
   4620                                       - SSL_CTX_set_tlsext_servername_arg()
   4621          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   4622 
   4623      openssl s_client has a new '-servername ...' option.
   4624 
   4625      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   4626      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   4627      testing the HostName extension for a specific single host name ('-cert'
   4628      and '-key' remain fallbacks for handshakes without HostName
   4629      negotiation).  If the unrecognized_name alert has to be sent, this by
   4630      default is a warning; it becomes fatal with the '-servername_fatal'
   4631      option.
   4632 
   4633      [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
   4634 
   4635   *) Add AES and SSE2 assembly language support to VC++ build.
   4636      [Steve Henson]
   4637 
   4638   *) Mitigate attack on final subtraction in Montgomery reduction.
   4639      [Andy Polyakov]
   4640 
   4641   *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
   4642      (which previously caused an internal error).
   4643      [Bodo Moeller]
   4644 
   4645   *) Squeeze another 10% out of IGE mode when in != out.
   4646      [Ben Laurie]
   4647 
   4648   *) AES IGE mode speedup.
   4649      [Dean Gaudet (Google)]
   4650 
   4651   *) Add the Korean symmetric 128-bit cipher SEED (see
   4652      http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
   4653      add SEED ciphersuites from RFC 4162:
   4654 
   4655         TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
   4656         TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"
   4657         TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"
   4658         TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
   4659 
   4660      To minimize changes between patchlevels in the OpenSSL 0.9.8
   4661      series, SEED remains excluded from compilation unless OpenSSL
   4662      is configured with 'enable-seed'.
   4663      [KISA, Bodo Moeller]
   4664 
   4665   *) Mitigate branch prediction attacks, which can be practical if a
   4666      single processor is shared, allowing a spy process to extract
   4667      information.  For detailed background information, see
   4668      http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
   4669      J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
   4670      and Necessary Software Countermeasures").  The core of the change
   4671      are new versions BN_div_no_branch() and
   4672      BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
   4673      respectively, which are slower, but avoid the security-relevant
   4674      conditional branches.  These are automatically called by BN_div()
   4675      and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
   4676      of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
   4677      remove a conditional branch.
   4678 
   4679      BN_FLG_CONSTTIME is the new name for the previous
   4680      BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
   4681      modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
   4682      in the exponent causes BN_mod_exp_mont() to use the alternative
   4683      implementation in BN_mod_exp_mont_consttime().)  The old name
   4684      remains as a deprecated alias.
   4685 
   4686      Similarly, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
   4687      RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
   4688      constant-time implementations for more than just exponentiation.
   4689      Here too the old name is kept as a deprecated alias.
   4690 
   4691      BN_BLINDING_new() will now use BN_dup() for the modulus so that
   4692      the BN_BLINDING structure gets an independent copy of the
   4693      modulus.  This means that the previous "BIGNUM *m" argument to
   4694      BN_BLINDING_new() and to BN_BLINDING_create_param() now
   4695      essentially becomes "const BIGNUM *m", although we can't actually
   4696      change this in the header file before 0.9.9.  It allows
   4697      RSA_setup_blinding() to use BN_with_flags() on the modulus to
   4698      enable BN_FLG_CONSTTIME.
   4699 
   4700      [Matthew D Wood (Intel Corp)]
   4701 
   4702   *) In the SSL/TLS server implementation, be strict about session ID
   4703      context matching (which matters if an application uses a single
   4704      external cache for different purposes).  Previously,
   4705      out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
   4706      set.  This did ensure strict client verification, but meant that,
   4707      with applications using a single external cache for quite
   4708      different requirements, clients could circumvent ciphersuite
   4709      restrictions for a given session ID context by starting a session
   4710      in a different context.
   4711      [Bodo Moeller]
   4712 
   4713   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   4714      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   4715      authentication-only ciphersuites.
   4716      [Bodo Moeller]
   4717 
   4718   *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
   4719      not complete and could lead to a possible single byte overflow
   4720      (CVE-2007-5135) [Ben Laurie]
   4721 
   4722  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
   4723 
   4724   *) Since AES128 and AES256 (and similarly Camellia128 and
   4725      Camellia256) share a single mask bit in the logic of
   4726      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   4727      kludge to work properly if AES128 is available and AES256 isn't
   4728      (or if Camellia128 is available and Camellia256 isn't).
   4729      [Victor Duchovni]
   4730 
   4731   *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
   4732      (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
   4733      When a point or a seed is encoded in a BIT STRING, we need to
   4734      prevent the removal of trailing zero bits to get the proper DER
   4735      encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
   4736      of a NamedBitList, for which trailing 0 bits need to be removed.)
   4737      [Bodo Moeller]
   4738 
   4739   *) Have SSL/TLS server implementation tolerate "mismatched" record
   4740      protocol version while receiving ClientHello even if the
   4741      ClientHello is fragmented.  (The server can't insist on the
   4742      particular protocol version it has chosen before the ServerHello
   4743      message has informed the client about his choice.)
   4744      [Bodo Moeller]
   4745 
   4746   *) Add RFC 3779 support.
   4747      [Rob Austein for ARIN, Ben Laurie]
   4748 
   4749   *) Load error codes if they are not already present instead of using a
   4750      static variable. This allows them to be cleanly unloaded and reloaded.
   4751      Improve header file function name parsing.
   4752      [Steve Henson]
   4753 
   4754   *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
   4755      or CAPABILITY handshake as required by RFCs.
   4756      [Goetz Babin-Ebell]
   4757 
   4758  Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
   4759 
   4760   *) Introduce limits to prevent malicious keys being able to
   4761      cause a denial of service.  (CVE-2006-2940)
   4762      [Steve Henson, Bodo Moeller]
   4763 
   4764   *) Fix ASN.1 parsing of certain invalid structures that can result
   4765      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   4766 
   4767   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   4768      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   4769 
   4770   *) Fix SSL client code which could crash if connecting to a
   4771      malicious SSLv2 server.  (CVE-2006-4343)
   4772      [Tavis Ormandy and Will Drewry, Google Security Team]
   4773 
   4774   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
   4775      match only those.  Before that, "AES256-SHA" would be interpreted
   4776      as a pattern and match "AES128-SHA" too (since AES128-SHA got
   4777      the same strength classification in 0.9.7h) as we currently only
   4778      have a single AES bit in the ciphersuite description bitmap.
   4779      That change, however, also applied to ciphersuite strings such as
   4780      "RC4-MD5" that intentionally matched multiple ciphersuites --
   4781      namely, SSL 2.0 ciphersuites in addition to the more common ones
   4782      from SSL 3.0/TLS 1.0.
   4783 
   4784      So we change the selection algorithm again: Naming an explicit
   4785      ciphersuite selects this one ciphersuite, and any other similar
   4786      ciphersuite (same bitmap) from *other* protocol versions.
   4787      Thus, "RC4-MD5" again will properly select both the SSL 2.0
   4788      ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
   4789 
   4790      Since SSL 2.0 does not have any ciphersuites for which the
   4791      128/256 bit distinction would be relevant, this works for now.
   4792      The proper fix will be to use different bits for AES128 and
   4793      AES256, which would have avoided the problems from the beginning;
   4794      however, bits are scarce, so we can only do this in a new release
   4795      (not just a patchlevel) when we can change the SSL_CIPHER
   4796      definition to split the single 'unsigned long mask' bitmap into
   4797      multiple values to extend the available space.
   4798 
   4799      [Bodo Moeller]
   4800 
   4801  Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
   4802 
   4803   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   4804      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   4805 
   4806   *) Add AES IGE and biIGE modes.
   4807      [Ben Laurie]
   4808 
   4809   *) Change the Unix randomness entropy gathering to use poll() when
   4810      possible instead of select(), since the latter has some
   4811      undesirable limitations.
   4812      [Darryl Miles via Richard Levitte and Bodo Moeller]
   4813 
   4814   *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
   4815      treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
   4816      cannot be implicitly activated as part of, e.g., the "AES" alias.
   4817      However, please upgrade to OpenSSL 0.9.9[-dev] for
   4818      non-experimental use of the ECC ciphersuites to get TLS extension
   4819      support, which is required for curve and point format negotiation
   4820      to avoid potential handshake problems.
   4821      [Bodo Moeller]
   4822 
   4823   *) Disable rogue ciphersuites:
   4824 
   4825       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   4826       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   4827       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   4828 
   4829      The latter two were purportedly from
   4830      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   4831      appear there.
   4832 
   4833      Also deactivate the remaining ciphersuites from
   4834      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   4835      unofficial, and the ID has long expired.
   4836      [Bodo Moeller]
   4837 
   4838   *) Fix RSA blinding Heisenbug (problems sometimes occurred on
   4839      dual-core machines) and other potential thread-safety issues.
   4840      [Bodo Moeller]
   4841 
   4842   *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
   4843      versions), which is now available for royalty-free use
   4844      (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
   4845      Also, add Camellia TLS ciphersuites from RFC 4132.
   4846 
   4847      To minimize changes between patchlevels in the OpenSSL 0.9.8
   4848      series, Camellia remains excluded from compilation unless OpenSSL
   4849      is configured with 'enable-camellia'.
   4850      [NTT]
   4851 
   4852   *) Disable the padding bug check when compression is in use. The padding
   4853      bug check assumes the first packet is of even length, this is not
   4854      necessarily true if compresssion is enabled and can result in false
   4855      positives causing handshake failure. The actual bug test is ancient
   4856      code so it is hoped that implementations will either have fixed it by
   4857      now or any which still have the bug do not support compression.
   4858      [Steve Henson]
   4859 
   4860  Changes between 0.9.8a and 0.9.8b  [04 May 2006]
   4861 
   4862   *) When applying a cipher rule check to see if string match is an explicit
   4863      cipher suite and only match that one cipher suite if it is.
   4864      [Steve Henson]
   4865 
   4866   *) Link in manifests for VC++ if needed.
   4867      [Austin Ziegler <halostatue (a] gmail.com>]
   4868 
   4869   *) Update support for ECC-based TLS ciphersuites according to
   4870      draft-ietf-tls-ecc-12.txt with proposed changes (but without
   4871      TLS extensions, which are supported starting with the 0.9.9
   4872      branch, not in the OpenSSL 0.9.8 branch).
   4873      [Douglas Stebila]
   4874 
   4875   *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
   4876      opaque EVP_CIPHER_CTX handling.
   4877      [Steve Henson]
   4878 
   4879   *) Fixes and enhancements to zlib compression code. We now only use
   4880      "zlib1.dll" and use the default __cdecl calling convention on Win32
   4881      to conform with the standards mentioned here:
   4882            http://www.zlib.net/DLL_FAQ.txt
   4883      Static zlib linking now works on Windows and the new --with-zlib-include
   4884      --with-zlib-lib options to Configure can be used to supply the location
   4885      of the headers and library. Gracefully handle case where zlib library
   4886      can't be loaded.
   4887      [Steve Henson]
   4888 
   4889   *) Several fixes and enhancements to the OID generation code. The old code
   4890      sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
   4891      handle numbers larger than ULONG_MAX, truncated printing and had a
   4892      non standard OBJ_obj2txt() behaviour.
   4893      [Steve Henson]
   4894 
   4895   *) Add support for building of engines under engine/ as shared libraries
   4896      under VC++ build system.
   4897      [Steve Henson]
   4898 
   4899   *) Corrected the numerous bugs in the Win32 path splitter in DSO.
   4900      Hopefully, we will not see any false combination of paths any more.
   4901      [Richard Levitte]
   4902 
   4903  Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
   4904 
   4905   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   4906      (part of SSL_OP_ALL).  This option used to disable the
   4907      countermeasure against man-in-the-middle protocol-version
   4908      rollback in the SSL 2.0 server implementation, which is a bad
   4909      idea.  (CVE-2005-2969)
   4910 
   4911      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   4912      for Information Security, National Institute of Advanced Industrial
   4913      Science and Technology [AIST], Japan)]
   4914 
   4915   *) Add two function to clear and return the verify parameter flags.
   4916      [Steve Henson]
   4917 
   4918   *) Keep cipherlists sorted in the source instead of sorting them at
   4919      runtime, thus removing the need for a lock.
   4920      [Nils Larsch]
   4921 
   4922   *) Avoid some small subgroup attacks in Diffie-Hellman.
   4923      [Nick Mathewson and Ben Laurie]
   4924 
   4925   *) Add functions for well-known primes.
   4926      [Nick Mathewson]
   4927 
   4928   *) Extended Windows CE support.
   4929      [Satoshi Nakamura and Andy Polyakov]
   4930 
   4931   *) Initialize SSL_METHOD structures at compile time instead of during
   4932      runtime, thus removing the need for a lock.
   4933      [Steve Henson]
   4934 
   4935   *) Make PKCS7_decrypt() work even if no certificate is supplied by
   4936      attempting to decrypt each encrypted key in turn. Add support to
   4937      smime utility.
   4938      [Steve Henson]
   4939 
   4940  Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
   4941 
   4942   [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
   4943   OpenSSL 0.9.8.]
   4944 
   4945   *) Add libcrypto.pc and libssl.pc for those who feel they need them.
   4946      [Richard Levitte]
   4947 
   4948   *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
   4949      key into the same file any more.
   4950      [Richard Levitte]
   4951 
   4952   *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
   4953      [Andy Polyakov]
   4954 
   4955   *) Add -utf8 command line and config file option to 'ca'.
   4956      [Stefan <stf (a] udoma.org]
   4957 
   4958   *) Removed the macro des_crypt(), as it seems to conflict with some
   4959      libraries.  Use DES_crypt().
   4960      [Richard Levitte]
   4961 
   4962   *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
   4963      involves renaming the source and generated shared-libs for
   4964      both. The engines will accept the corrected or legacy ids
   4965      ('ncipher' and '4758_cca' respectively) when binding. NB,
   4966      this only applies when building 'shared'.
   4967      [Corinna Vinschen <vinschen (a] redhat.com> and Geoff Thorpe]
   4968 
   4969   *) Add attribute functions to EVP_PKEY structure. Modify
   4970      PKCS12_create() to recognize a CSP name attribute and
   4971      use it. Make -CSP option work again in pkcs12 utility.
   4972      [Steve Henson]
   4973 
   4974   *) Add new functionality to the bn blinding code:
   4975      - automatic re-creation of the BN_BLINDING parameters after
   4976        a fixed number of uses (currently 32)
   4977      - add new function for parameter creation
   4978      - introduce flags to control the update behaviour of the
   4979        BN_BLINDING parameters
   4980      - hide BN_BLINDING structure
   4981      Add a second BN_BLINDING slot to the RSA structure to improve
   4982      performance when a single RSA object is shared among several
   4983      threads.
   4984      [Nils Larsch]
   4985 
   4986   *) Add support for DTLS.
   4987      [Nagendra Modadugu <nagendra (a] cs.stanford.edu> and Ben Laurie]
   4988 
   4989   *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
   4990      to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
   4991      [Walter Goulet]
   4992 
   4993   *) Remove buggy and incomplete DH cert support from
   4994      ssl/ssl_rsa.c and ssl/s3_both.c
   4995      [Nils Larsch]
   4996 
   4997   *) Use SHA-1 instead of MD5 as the default digest algorithm for
   4998      the apps/openssl applications.
   4999      [Nils Larsch]
   5000 
   5001   *) Compile clean with "-Wall -Wmissing-prototypes
   5002      -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
   5003      DEBUG_SAFESTACK must also be set.
   5004      [Ben Laurie]
   5005 
   5006   *) Change ./Configure so that certain algorithms can be disabled by default.
   5007      The new counterpiece to "no-xxx" is "enable-xxx".
   5008 
   5009      The patented RC5 and MDC2 algorithms will now be disabled unless
   5010      "enable-rc5" and "enable-mdc2", respectively, are specified.
   5011 
   5012      (IDEA remains enabled despite being patented.  This is because IDEA
   5013      is frequently required for interoperability, and there is no license
   5014      fee for non-commercial use.  As before, "no-idea" can be used to
   5015      avoid this algorithm.)
   5016 
   5017      [Bodo Moeller]
   5018 
   5019   *) Add processing of proxy certificates (see RFC 3820).  This work was
   5020      sponsored by KTH (The Royal Institute of Technology in Stockholm) and
   5021      EGEE (Enabling Grids for E-science in Europe).
   5022      [Richard Levitte]
   5023 
   5024   *) RC4 performance overhaul on modern architectures/implementations, such
   5025      as Intel P4, IA-64 and AMD64.
   5026      [Andy Polyakov]
   5027 
   5028   *) New utility extract-section.pl. This can be used specify an alternative
   5029      section number in a pod file instead of having to treat each file as
   5030      a separate case in Makefile. This can be done by adding two lines to the
   5031      pod file:
   5032 
   5033      =for comment openssl_section:XXX
   5034 
   5035      The blank line is mandatory.
   5036 
   5037      [Steve Henson]
   5038 
   5039   *) New arguments -certform, -keyform and -pass for s_client and s_server
   5040      to allow alternative format key and certificate files and passphrase
   5041      sources.
   5042      [Steve Henson]
   5043 
   5044   *) New structure X509_VERIFY_PARAM which combines current verify parameters,
   5045      update associated structures and add various utility functions.
   5046 
   5047      Add new policy related verify parameters, include policy checking in 
   5048      standard verify code. Enhance 'smime' application with extra parameters
   5049      to support policy checking and print out.
   5050      [Steve Henson]
   5051 
   5052   *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
   5053      Nehemiah processors. These extensions support AES encryption in hardware
   5054      as well as RNG (though RNG support is currently disabled).
   5055      [Michal Ludvig <michal (a] logix.cz>, with help from Andy Polyakov]
   5056 
   5057   *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
   5058      [Geoff Thorpe]
   5059 
   5060   *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
   5061      [Andy Polyakov and a number of other people]
   5062 
   5063   *) Improved PowerPC platform support. Most notably BIGNUM assembler
   5064      implementation contributed by IBM.
   5065      [Suresh Chari, Peter Waltenberg, Andy Polyakov]
   5066 
   5067   *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
   5068      exponent rather than 'unsigned long'. There is a corresponding change to
   5069      the new 'rsa_keygen' element of the RSA_METHOD structure.
   5070      [Jelte Jansen, Geoff Thorpe]
   5071 
   5072   *) Functionality for creating the initial serial number file is now
   5073      moved from CA.pl to the 'ca' utility with a new option -create_serial.
   5074 
   5075      (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
   5076      number file to 1, which is bound to cause problems.  To avoid
   5077      the problems while respecting compatibility between different 0.9.7
   5078      patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
   5079      CA.pl for serial number initialization.  With the new release 0.9.8,
   5080      we can fix the problem directly in the 'ca' utility.)
   5081      [Steve Henson]
   5082 
   5083   *) Reduced header interdepencies by declaring more opaque objects in
   5084      ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
   5085      give fewer recursive includes, which could break lazy source code - so
   5086      this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
   5087      developers should define this symbol when building and using openssl to
   5088      ensure they track the recommended behaviour, interfaces, [etc], but
   5089      backwards-compatible behaviour prevails when this isn't defined.
   5090      [Geoff Thorpe]
   5091 
   5092   *) New function X509_POLICY_NODE_print() which prints out policy nodes.
   5093      [Steve Henson]
   5094 
   5095   *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
   5096      This will generate a random key of the appropriate length based on the 
   5097      cipher context. The EVP_CIPHER can provide its own random key generation
   5098      routine to support keys of a specific form. This is used in the des and 
   5099      3des routines to generate a key of the correct parity. Update S/MIME
   5100      code to use new functions and hence generate correct parity DES keys.
   5101      Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
   5102      valid (weak or incorrect parity).
   5103      [Steve Henson]
   5104 
   5105   *) Add a local set of CRLs that can be used by X509_verify_cert() as well
   5106      as looking them up. This is useful when the verified structure may contain
   5107      CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
   5108      present unless the new PKCS7_NO_CRL flag is asserted.
   5109      [Steve Henson]
   5110 
   5111   *) Extend ASN1 oid configuration module. It now additionally accepts the
   5112      syntax:
   5113 
   5114      shortName = some long name, 1.2.3.4
   5115      [Steve Henson]
   5116 
   5117   *) Reimplemented the BN_CTX implementation. There is now no more static
   5118      limitation on the number of variables it can handle nor the depth of the
   5119      "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
   5120      information can now expand as required, and rather than having a single
   5121      static array of bignums, BN_CTX now uses a linked-list of such arrays
   5122      allowing it to expand on demand whilst maintaining the usefulness of
   5123      BN_CTX's "bundling".
   5124      [Geoff Thorpe]
   5125 
   5126   *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
   5127      to allow all RSA operations to function using a single BN_CTX.
   5128      [Geoff Thorpe]
   5129 
   5130   *) Preliminary support for certificate policy evaluation and checking. This
   5131      is initially intended to pass the tests outlined in "Conformance Testing
   5132      of Relying Party Client Certificate Path Processing Logic" v1.07.
   5133      [Steve Henson]
   5134 
   5135   *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
   5136      remained unused and not that useful. A variety of other little bignum
   5137      tweaks and fixes have also been made continuing on from the audit (see
   5138      below).
   5139      [Geoff Thorpe]
   5140 
   5141   *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
   5142      associated ASN1, EVP and SSL functions and old ASN1 macros.
   5143      [Richard Levitte]
   5144 
   5145   *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
   5146      and this should never fail. So the return value from the use of
   5147      BN_set_word() (which can fail due to needless expansion) is now deprecated;
   5148      if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
   5149      [Geoff Thorpe]
   5150 
   5151   *) BN_CTX_get() should return zero-valued bignums, providing the same
   5152      initialised value as BN_new().
   5153      [Geoff Thorpe, suggested by Ulf Mller]
   5154 
   5155   *) Support for inhibitAnyPolicy certificate extension.
   5156      [Steve Henson]
   5157 
   5158   *) An audit of the BIGNUM code is underway, for which debugging code is
   5159      enabled when BN_DEBUG is defined. This makes stricter enforcements on what
   5160      is considered valid when processing BIGNUMs, and causes execution to
   5161      assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
   5162      further steps are taken to deliberately pollute unused data in BIGNUM
   5163      structures to try and expose faulty code further on. For now, openssl will
   5164      (in its default mode of operation) continue to tolerate the inconsistent
   5165      forms that it has tolerated in the past, but authors and packagers should
   5166      consider trying openssl and their own applications when compiled with
   5167      these debugging symbols defined. It will help highlight potential bugs in
   5168      their own code, and will improve the test coverage for OpenSSL itself. At
   5169      some point, these tighter rules will become openssl's default to improve
   5170      maintainability, though the assert()s and other overheads will remain only
   5171      in debugging configurations. See bn.h for more details.
   5172      [Geoff Thorpe, Nils Larsch, Ulf Mller]
   5173 
   5174   *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
   5175      that can only be obtained through BN_CTX_new() (which implicitly
   5176      initialises it). The presence of this function only made it possible
   5177      to overwrite an existing structure (and cause memory leaks).
   5178      [Geoff Thorpe]
   5179 
   5180   *) Because of the callback-based approach for implementing LHASH as a
   5181      template type, lh_insert() adds opaque objects to hash-tables and
   5182      lh_doall() or lh_doall_arg() are typically used with a destructor callback
   5183      to clean up those corresponding objects before destroying the hash table
   5184      (and losing the object pointers). So some over-zealous constifications in
   5185      LHASH have been relaxed so that lh_insert() does not take (nor store) the
   5186      objects as "const" and the lh_doall[_arg] callback wrappers are not
   5187      prototyped to have "const" restrictions on the object pointers they are
   5188      given (and so aren't required to cast them away any more).
   5189      [Geoff Thorpe]
   5190 
   5191   *) The tmdiff.h API was so ugly and minimal that our own timing utility
   5192      (speed) prefers to use its own implementation. The two implementations
   5193      haven't been consolidated as yet (volunteers?) but the tmdiff API has had
   5194      its object type properly exposed (MS_TM) instead of casting to/from "char
   5195      *". This may still change yet if someone realises MS_TM and "ms_time_***"
   5196      aren't necessarily the greatest nomenclatures - but this is what was used
   5197      internally to the implementation so I've used that for now.
   5198      [Geoff Thorpe]
   5199 
   5200   *) Ensure that deprecated functions do not get compiled when
   5201      OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
   5202      the self-tests were still using deprecated key-generation functions so
   5203      these have been updated also.
   5204      [Geoff Thorpe]
   5205 
   5206   *) Reorganise PKCS#7 code to separate the digest location functionality
   5207      into PKCS7_find_digest(), digest addition into PKCS7_bio_add_digest().
   5208      New function PKCS7_set_digest() to set the digest type for PKCS#7
   5209      digestedData type. Add additional code to correctly generate the
   5210      digestedData type and add support for this type in PKCS7 initialization
   5211      functions.
   5212      [Steve Henson]
   5213 
   5214   *) New function PKCS7_set0_type_other() this initializes a PKCS7 
   5215      structure of type "other".
   5216      [Steve Henson]
   5217 
   5218   *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
   5219      sure the loop does correctly stop and breaking ("division by zero")
   5220      modulus operations are not performed. The (pre-generated) prime
   5221      table crypto/bn/bn_prime.h was already correct, but it could not be
   5222      re-generated on some platforms because of the "division by zero"
   5223      situation in the script.
   5224      [Ralf S. Engelschall]
   5225 
   5226   *) Update support for ECC-based TLS ciphersuites according to
   5227      draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
   5228      SHA-1 now is only used for "small" curves (where the
   5229      representation of a field element takes up to 24 bytes); for
   5230      larger curves, the field element resulting from ECDH is directly
   5231      used as premaster secret.
   5232      [Douglas Stebila (Sun Microsystems Laboratories)]
   5233 
   5234   *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
   5235      curve secp160r1 to the tests.
   5236      [Douglas Stebila (Sun Microsystems Laboratories)]
   5237 
   5238   *) Add the possibility to load symbols globally with DSO.
   5239      [Gtz Babin-Ebell <babin-ebell (a] trustcenter.de> via Richard Levitte]
   5240 
   5241   *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
   5242      control of the error stack.
   5243      [Richard Levitte]
   5244 
   5245   *) Add support for STORE in ENGINE.
   5246      [Richard Levitte]
   5247 
   5248   *) Add the STORE type.  The intention is to provide a common interface
   5249      to certificate and key stores, be they simple file-based stores, or
   5250      HSM-type store, or LDAP stores, or...
   5251      NOTE: The code is currently UNTESTED and isn't really used anywhere.
   5252      [Richard Levitte]
   5253 
   5254   *) Add a generic structure called OPENSSL_ITEM.  This can be used to
   5255      pass a list of arguments to any function as well as provide a way
   5256      for a function to pass data back to the caller.
   5257      [Richard Levitte]
   5258 
   5259   *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
   5260      works like BUF_strdup() but can be used to duplicate a portion of
   5261      a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
   5262      a memory area.
   5263      [Richard Levitte]
   5264 
   5265   *) Add the function sk_find_ex() which works like sk_find(), but will
   5266      return an index to an element even if an exact match couldn't be
   5267      found.  The index is guaranteed to point at the element where the
   5268      searched-for key would be inserted to preserve sorting order.
   5269      [Richard Levitte]
   5270 
   5271   *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
   5272      takes an extra flags argument for optional functionality.  Currently,
   5273      the following flags are defined:
   5274 
   5275 	OBJ_BSEARCH_VALUE_ON_NOMATCH
   5276 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   5277 	element where the comparing function returns a negative or zero
   5278 	number.
   5279 
   5280 	OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
   5281 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   5282 	element where the comparing function returns zero.  This is useful
   5283 	if there are more than one element where the comparing function
   5284 	returns zero.
   5285      [Richard Levitte]
   5286 
   5287   *) Make it possible to create self-signed certificates with 'openssl ca'
   5288      in such a way that the self-signed certificate becomes part of the
   5289      CA database and uses the same mechanisms for serial number generation
   5290      as all other certificate signing.  The new flag '-selfsign' enables
   5291      this functionality.  Adapt CA.sh and CA.pl.in.
   5292      [Richard Levitte]
   5293 
   5294   *) Add functionality to check the public key of a certificate request
   5295      against a given private.  This is useful to check that a certificate
   5296      request can be signed by that key (self-signing).
   5297      [Richard Levitte]
   5298 
   5299   *) Make it possible to have multiple active certificates with the same
   5300      subject in the CA index file.  This is done only if the keyword
   5301      'unique_subject' is set to 'no' in the main CA section (default
   5302      if 'CA_default') of the configuration file.  The value is saved
   5303      with the database itself in a separate index attribute file,
   5304      named like the index file with '.attr' appended to the name.
   5305      [Richard Levitte]
   5306 
   5307   *) Generate muti valued AVAs using '+' notation in config files for
   5308      req and dirName.
   5309      [Steve Henson]
   5310 
   5311   *) Support for nameConstraints certificate extension.
   5312      [Steve Henson]
   5313 
   5314   *) Support for policyConstraints certificate extension.
   5315      [Steve Henson]
   5316 
   5317   *) Support for policyMappings certificate extension.
   5318      [Steve Henson]
   5319 
   5320   *) Make sure the default DSA_METHOD implementation only uses its
   5321      dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
   5322      and change its own handlers to be NULL so as to remove unnecessary
   5323      indirection. This lets alternative implementations fallback to the
   5324      default implementation more easily.
   5325      [Geoff Thorpe]
   5326 
   5327   *) Support for directoryName in GeneralName related extensions
   5328      in config files.
   5329      [Steve Henson]
   5330 
   5331   *) Make it possible to link applications using Makefile.shared.
   5332      Make that possible even when linking against static libraries!
   5333      [Richard Levitte]
   5334 
   5335   *) Support for single pass processing for S/MIME signing. This now
   5336      means that S/MIME signing can be done from a pipe, in addition
   5337      cleartext signing (multipart/signed type) is effectively streaming
   5338      and the signed data does not need to be all held in memory.
   5339 
   5340      This is done with a new flag PKCS7_STREAM. When this flag is set
   5341      PKCS7_sign() only initializes the PKCS7 structure and the actual signing
   5342      is done after the data is output (and digests calculated) in
   5343      SMIME_write_PKCS7().
   5344      [Steve Henson]
   5345 
   5346   *) Add full support for -rpath/-R, both in shared libraries and
   5347      applications, at least on the platforms where it's known how
   5348      to do it.
   5349      [Richard Levitte]
   5350 
   5351   *) In crypto/ec/ec_mult.c, implement fast point multiplication with
   5352      precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
   5353      will now compute a table of multiples of the generator that
   5354      makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
   5355      faster (notably in the case of a single point multiplication,
   5356      scalar * generator).
   5357      [Nils Larsch, Bodo Moeller]
   5358 
   5359   *) IPv6 support for certificate extensions. The various extensions
   5360      which use the IP:a.b.c.d can now take IPv6 addresses using the
   5361      formats of RFC1884 2.2 . IPv6 addresses are now also displayed
   5362      correctly.
   5363      [Steve Henson]
   5364 
   5365   *) Added an ENGINE that implements RSA by performing private key
   5366      exponentiations with the GMP library. The conversions to and from
   5367      GMP's mpz_t format aren't optimised nor are any montgomery forms
   5368      cached, and on x86 it appears OpenSSL's own performance has caught up.
   5369      However there are likely to be other architectures where GMP could
   5370      provide a boost. This ENGINE is not built in by default, but it can be
   5371      specified at Configure time and should be accompanied by the necessary
   5372      linker additions, eg;
   5373          ./config -DOPENSSL_USE_GMP -lgmp
   5374      [Geoff Thorpe]
   5375 
   5376   *) "openssl engine" will not display ENGINE/DSO load failure errors when
   5377      testing availability of engines with "-t" - the old behaviour is
   5378      produced by increasing the feature's verbosity with "-tt".
   5379      [Geoff Thorpe]
   5380 
   5381   *) ECDSA routines: under certain error conditions uninitialized BN objects
   5382      could be freed. Solution: make sure initialization is performed early
   5383      enough. (Reported and fix supplied by Nils Larsch <nla (a] trustcenter.de>
   5384      via PR#459)
   5385      [Lutz Jaenicke]
   5386 
   5387   *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
   5388      and DH_METHOD (eg. by ENGINE implementations) to override the normal
   5389      software implementations. For DSA and DH, parameter generation can
   5390      also be overridden by providing the appropriate method callbacks.
   5391      [Geoff Thorpe]
   5392 
   5393   *) Change the "progress" mechanism used in key-generation and
   5394      primality testing to functions that take a new BN_GENCB pointer in
   5395      place of callback/argument pairs. The new API functions have "_ex"
   5396      postfixes and the older functions are reimplemented as wrappers for
   5397      the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
   5398      declarations of the old functions to help (graceful) attempts to
   5399      migrate to the new functions. Also, the new key-generation API
   5400      functions operate on a caller-supplied key-structure and return
   5401      success/failure rather than returning a key or NULL - this is to
   5402      help make "keygen" another member function of RSA_METHOD etc.
   5403 
   5404      Example for using the new callback interface:
   5405 
   5406           int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
   5407           void *my_arg = ...;
   5408           BN_GENCB my_cb;
   5409 
   5410           BN_GENCB_set(&my_cb, my_callback, my_arg);
   5411 
   5412           return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
   5413           /* For the meaning of a, b in calls to my_callback(), see the
   5414            * documentation of the function that calls the callback.
   5415            * cb will point to my_cb; my_arg can be retrieved as cb->arg.
   5416            * my_callback should return 1 if it wants BN_is_prime_ex()
   5417            * to continue, or 0 to stop.
   5418            */
   5419 
   5420      [Geoff Thorpe]
   5421 
   5422   *) Change the ZLIB compression method to be stateful, and make it
   5423      available to TLS with the number defined in 
   5424      draft-ietf-tls-compression-04.txt.
   5425      [Richard Levitte]
   5426 
   5427   *) Add the ASN.1 structures and functions for CertificatePair, which
   5428      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
   5429 
   5430      CertificatePair ::= SEQUENCE {
   5431         forward		[0]	Certificate OPTIONAL,
   5432         reverse		[1]	Certificate OPTIONAL,
   5433         -- at least one of the pair shall be present -- }
   5434 
   5435      Also implement the PEM functions to read and write certificate
   5436      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
   5437 
   5438      This needed to be defined, mostly for the sake of the LDAP
   5439      attribute crossCertificatePair, but may prove useful elsewhere as
   5440      well.
   5441      [Richard Levitte]
   5442 
   5443   *) Make it possible to inhibit symlinking of shared libraries in
   5444      Makefile.shared, for Cygwin's sake.
   5445      [Richard Levitte]
   5446 
   5447   *) Extend the BIGNUM API by creating a function 
   5448           void BN_set_negative(BIGNUM *a, int neg);
   5449      and a macro that behave like
   5450           int  BN_is_negative(const BIGNUM *a);
   5451 
   5452      to avoid the need to access 'a->neg' directly in applications.
   5453      [Nils Larsch]
   5454 
   5455   *) Implement fast modular reduction for pseudo-Mersenne primes
   5456      used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
   5457      EC_GROUP_new_curve_GFp() will now automatically use this
   5458      if applicable.
   5459      [Nils Larsch <nla (a] trustcenter.de>]
   5460 
   5461   *) Add new lock type (CRYPTO_LOCK_BN).
   5462      [Bodo Moeller]
   5463 
   5464   *) Change the ENGINE framework to automatically load engines
   5465      dynamically from specific directories unless they could be
   5466      found to already be built in or loaded.  Move all the
   5467      current engines except for the cryptodev one to a new
   5468      directory engines/.
   5469      The engines in engines/ are built as shared libraries if
   5470      the "shared" options was given to ./Configure or ./config.
   5471      Otherwise, they are inserted in libcrypto.a.
   5472      /usr/local/ssl/engines is the default directory for dynamic
   5473      engines, but that can be overridden at configure time through
   5474      the usual use of --prefix and/or --openssldir, and at run
   5475      time with the environment variable OPENSSL_ENGINES.
   5476      [Geoff Thorpe and Richard Levitte]
   5477 
   5478   *) Add Makefile.shared, a helper makefile to build shared
   5479      libraries.  Adapt Makefile.org.
   5480      [Richard Levitte]
   5481 
   5482   *) Add version info to Win32 DLLs.
   5483      [Peter 'Luna' Runestig" <peter (a] runestig.com>]
   5484 
   5485   *) Add new 'medium level' PKCS#12 API. Certificates and keys
   5486      can be added using this API to created arbitrary PKCS#12
   5487      files while avoiding the low level API.
   5488 
   5489      New options to PKCS12_create(), key or cert can be NULL and
   5490      will then be omitted from the output file. The encryption
   5491      algorithm NIDs can be set to -1 for no encryption, the mac
   5492      iteration count can be set to 0 to omit the mac.
   5493 
   5494      Enhance pkcs12 utility by making the -nokeys and -nocerts
   5495      options work when creating a PKCS#12 file. New option -nomac
   5496      to omit the mac, NONE can be set for an encryption algorithm.
   5497      New code is modified to use the enhanced PKCS12_create()
   5498      instead of the low level API.
   5499      [Steve Henson]
   5500 
   5501   *) Extend ASN1 encoder to support indefinite length constructed
   5502      encoding. This can output sequences tags and octet strings in
   5503      this form. Modify pk7_asn1.c to support indefinite length
   5504      encoding. This is experimental and needs additional code to
   5505      be useful, such as an ASN1 bio and some enhanced streaming
   5506      PKCS#7 code.
   5507 
   5508      Extend template encode functionality so that tagging is passed
   5509      down to the template encoder.
   5510      [Steve Henson]
   5511 
   5512   *) Let 'openssl req' fail if an argument to '-newkey' is not
   5513      recognized instead of using RSA as a default.
   5514      [Bodo Moeller]
   5515 
   5516   *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
   5517      As these are not official, they are not included in "ALL";
   5518      the "ECCdraft" ciphersuite group alias can be used to select them.
   5519      [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
   5520 
   5521   *) Add ECDH engine support.
   5522      [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
   5523 
   5524   *) Add ECDH in new directory crypto/ecdh/.
   5525      [Douglas Stebila (Sun Microsystems Laboratories)]
   5526 
   5527   *) Let BN_rand_range() abort with an error after 100 iterations
   5528      without success (which indicates a broken PRNG).
   5529      [Bodo Moeller]
   5530 
   5531   *) Change BN_mod_sqrt() so that it verifies that the input value
   5532      is really the square of the return value.  (Previously,
   5533      BN_mod_sqrt would show GIGO behaviour.)
   5534      [Bodo Moeller]
   5535 
   5536   *) Add named elliptic curves over binary fields from X9.62, SECG,
   5537      and WAP/WTLS; add OIDs that were still missing.
   5538 
   5539      [Sheueling Chang Shantz and Douglas Stebila
   5540      (Sun Microsystems Laboratories)]
   5541 
   5542   *) Extend the EC library for elliptic curves over binary fields
   5543      (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
   5544      New EC_METHOD:
   5545 
   5546           EC_GF2m_simple_method
   5547 
   5548      New API functions:
   5549 
   5550           EC_GROUP_new_curve_GF2m
   5551           EC_GROUP_set_curve_GF2m
   5552           EC_GROUP_get_curve_GF2m
   5553           EC_POINT_set_affine_coordinates_GF2m
   5554           EC_POINT_get_affine_coordinates_GF2m
   5555           EC_POINT_set_compressed_coordinates_GF2m
   5556 
   5557      Point compression for binary fields is disabled by default for
   5558      patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
   5559      enable it).
   5560 
   5561      As binary polynomials are represented as BIGNUMs, various members
   5562      of the EC_GROUP and EC_POINT data structures can be shared
   5563      between the implementations for prime fields and binary fields;
   5564      the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
   5565      are essentially identical to their ..._GFp counterparts.
   5566      (For simplicity, the '..._GFp' prefix has been dropped from
   5567      various internal method names.)
   5568 
   5569      An internal 'field_div' method (similar to 'field_mul' and
   5570      'field_sqr') has been added; this is used only for binary fields.
   5571 
   5572      [Sheueling Chang Shantz and Douglas Stebila
   5573      (Sun Microsystems Laboratories)]
   5574 
   5575   *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
   5576      through methods ('mul', 'precompute_mult').
   5577 
   5578      The generic implementations (now internally called 'ec_wNAF_mul'
   5579      and 'ec_wNAF_precomputed_mult') remain the default if these
   5580      methods are undefined.
   5581 
   5582      [Sheueling Chang Shantz and Douglas Stebila
   5583      (Sun Microsystems Laboratories)]
   5584 
   5585   *) New function EC_GROUP_get_degree, which is defined through
   5586      EC_METHOD.  For curves over prime fields, this returns the bit
   5587      length of the modulus.
   5588 
   5589      [Sheueling Chang Shantz and Douglas Stebila
   5590      (Sun Microsystems Laboratories)]
   5591 
   5592   *) New functions EC_GROUP_dup, EC_POINT_dup.
   5593      (These simply call ..._new  and ..._copy).
   5594 
   5595      [Sheueling Chang Shantz and Douglas Stebila
   5596      (Sun Microsystems Laboratories)]
   5597 
   5598   *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
   5599      Polynomials are represented as BIGNUMs (where the sign bit is not
   5600      used) in the following functions [macros]:  
   5601 
   5602           BN_GF2m_add
   5603           BN_GF2m_sub             [= BN_GF2m_add]
   5604           BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
   5605           BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
   5606           BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
   5607           BN_GF2m_mod_inv
   5608           BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
   5609           BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
   5610           BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
   5611           BN_GF2m_cmp             [= BN_ucmp]
   5612 
   5613      (Note that only the 'mod' functions are actually for fields GF(2^m).
   5614      BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
   5615 
   5616      For some functions, an the irreducible polynomial defining a
   5617      field can be given as an 'unsigned int[]' with strictly
   5618      decreasing elements giving the indices of those bits that are set;
   5619      i.e., p[] represents the polynomial
   5620           f(t) = t^p[0] + t^p[1] + ... + t^p[k]
   5621      where
   5622           p[0] > p[1] > ... > p[k] = 0.
   5623      This applies to the following functions:
   5624 
   5625           BN_GF2m_mod_arr
   5626           BN_GF2m_mod_mul_arr
   5627           BN_GF2m_mod_sqr_arr
   5628           BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
   5629           BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
   5630           BN_GF2m_mod_exp_arr
   5631           BN_GF2m_mod_sqrt_arr
   5632           BN_GF2m_mod_solve_quad_arr
   5633           BN_GF2m_poly2arr
   5634           BN_GF2m_arr2poly
   5635 
   5636      Conversion can be performed by the following functions:
   5637 
   5638           BN_GF2m_poly2arr
   5639           BN_GF2m_arr2poly
   5640 
   5641      bntest.c has additional tests for binary polynomial arithmetic.
   5642 
   5643      Two implementations for BN_GF2m_mod_div() are available.
   5644      The default algorithm simply uses BN_GF2m_mod_inv() and
   5645      BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
   5646      if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
   5647      copyright notice in crypto/bn/bn_gf2m.c before enabling it).
   5648 
   5649      [Sheueling Chang Shantz and Douglas Stebila
   5650      (Sun Microsystems Laboratories)]
   5651 
   5652   *) Add new error code 'ERR_R_DISABLED' that can be used when some
   5653      functionality is disabled at compile-time.
   5654      [Douglas Stebila <douglas.stebila (a] sun.com>]
   5655 
   5656   *) Change default behaviour of 'openssl asn1parse' so that more
   5657      information is visible when viewing, e.g., a certificate:
   5658 
   5659      Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
   5660      mode the content of non-printable OCTET STRINGs is output in a
   5661      style similar to INTEGERs, but with '[HEX DUMP]' prepended to
   5662      avoid the appearance of a printable string.
   5663      [Nils Larsch <nla (a] trustcenter.de>]
   5664 
   5665   *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
   5666      functions
   5667           EC_GROUP_set_asn1_flag()
   5668           EC_GROUP_get_asn1_flag()
   5669           EC_GROUP_set_point_conversion_form()
   5670           EC_GROUP_get_point_conversion_form()
   5671      These control ASN1 encoding details:
   5672      - Curves (i.e., groups) are encoded explicitly unless asn1_flag
   5673        has been set to OPENSSL_EC_NAMED_CURVE.
   5674      - Points are encoded in uncompressed form by default; options for
   5675        asn1_for are as for point2oct, namely
   5676           POINT_CONVERSION_COMPRESSED
   5677           POINT_CONVERSION_UNCOMPRESSED
   5678           POINT_CONVERSION_HYBRID
   5679 
   5680      Also add 'seed' and 'seed_len' members to EC_GROUP with access
   5681      functions
   5682           EC_GROUP_set_seed()
   5683           EC_GROUP_get0_seed()
   5684           EC_GROUP_get_seed_len()
   5685      This is used only for ASN1 purposes (so far).
   5686      [Nils Larsch <nla (a] trustcenter.de>]
   5687 
   5688   *) Add 'field_type' member to EC_METHOD, which holds the NID
   5689      of the appropriate field type OID.  The new function
   5690      EC_METHOD_get_field_type() returns this value.
   5691      [Nils Larsch <nla (a] trustcenter.de>]
   5692 
   5693   *) Add functions 
   5694           EC_POINT_point2bn()
   5695           EC_POINT_bn2point()
   5696           EC_POINT_point2hex()
   5697           EC_POINT_hex2point()
   5698      providing useful interfaces to EC_POINT_point2oct() and
   5699      EC_POINT_oct2point().
   5700      [Nils Larsch <nla (a] trustcenter.de>]
   5701 
   5702   *) Change internals of the EC library so that the functions
   5703           EC_GROUP_set_generator()
   5704           EC_GROUP_get_generator()
   5705           EC_GROUP_get_order()
   5706           EC_GROUP_get_cofactor()
   5707      are implemented directly in crypto/ec/ec_lib.c and not dispatched
   5708      to methods, which would lead to unnecessary code duplication when
   5709      adding different types of curves.
   5710      [Nils Larsch <nla (a] trustcenter.de> with input by Bodo Moeller]
   5711 
   5712   *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
   5713      arithmetic, and such that modified wNAFs are generated
   5714      (which avoid length expansion in many cases).
   5715      [Bodo Moeller]
   5716 
   5717   *) Add a function EC_GROUP_check_discriminant() (defined via
   5718      EC_METHOD) that verifies that the curve discriminant is non-zero.
   5719 
   5720      Add a function EC_GROUP_check() that makes some sanity tests
   5721      on a EC_GROUP, its generator and order.  This includes
   5722      EC_GROUP_check_discriminant().
   5723      [Nils Larsch <nla (a] trustcenter.de>]
   5724 
   5725   *) Add ECDSA in new directory crypto/ecdsa/.
   5726 
   5727      Add applications 'openssl ecparam' and 'openssl ecdsa'
   5728      (these are based on 'openssl dsaparam' and 'openssl dsa').
   5729 
   5730      ECDSA support is also included in various other files across the
   5731      library.  Most notably,
   5732      - 'openssl req' now has a '-newkey ecdsa:file' option;
   5733      - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
   5734      - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
   5735        d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
   5736        them suitable for ECDSA where domain parameters must be
   5737        extracted before the specific public key;
   5738      - ECDSA engine support has been added.
   5739      [Nils Larsch <nla (a] trustcenter.de>]
   5740 
   5741   *) Include some named elliptic curves, and add OIDs from X9.62,
   5742      SECG, and WAP/WTLS.  Each curve can be obtained from the new
   5743      function
   5744           EC_GROUP_new_by_curve_name(),
   5745      and the list of available named curves can be obtained with
   5746           EC_get_builtin_curves().
   5747      Also add a 'curve_name' member to EC_GROUP objects, which can be
   5748      accessed via
   5749          EC_GROUP_set_curve_name()
   5750          EC_GROUP_get_curve_name()
   5751      [Nils Larsch <larsch (a] trustcenter.de, Bodo Moeller]
   5752  
   5753   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   5754      was actually never needed) and in BN_mul().  The removal in BN_mul()
   5755      required a small change in bn_mul_part_recursive() and the addition
   5756      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   5757      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   5758      bn_sub_words() and bn_add_words() except they take arrays with
   5759      differing sizes.
   5760      [Richard Levitte]
   5761 
   5762  Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
   5763 
   5764   *) Cleanse PEM buffers before freeing them since they may contain 
   5765      sensitive data.
   5766      [Benjamin Bennett <ben (a] psc.edu>]
   5767 
   5768   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   5769      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   5770      authentication-only ciphersuites.
   5771      [Bodo Moeller]
   5772 
   5773   *) Since AES128 and AES256 share a single mask bit in the logic of
   5774      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   5775      kludge to work properly if AES128 is available and AES256 isn't.
   5776      [Victor Duchovni]
   5777 
   5778   *) Expand security boundary to match 1.1.1 module.
   5779      [Steve Henson]
   5780 
   5781   *) Remove redundant features: hash file source, editing of test vectors
   5782      modify fipsld to use external fips_premain.c signature.
   5783      [Steve Henson]
   5784 
   5785   *) New perl script mkfipsscr.pl to create shell scripts or batch files to
   5786      run algorithm test programs.
   5787      [Steve Henson]
   5788 
   5789   *) Make algorithm test programs more tolerant of whitespace.
   5790      [Steve Henson]
   5791 
   5792   *) Have SSL/TLS server implementation tolerate "mismatched" record
   5793      protocol version while receiving ClientHello even if the
   5794      ClientHello is fragmented.  (The server can't insist on the
   5795      particular protocol version it has chosen before the ServerHello
   5796      message has informed the client about his choice.)
   5797      [Bodo Moeller]
   5798 
   5799   *) Load error codes if they are not already present instead of using a
   5800      static variable. This allows them to be cleanly unloaded and reloaded.
   5801      [Steve Henson]
   5802 
   5803  Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
   5804 
   5805   *) Introduce limits to prevent malicious keys being able to
   5806      cause a denial of service.  (CVE-2006-2940)
   5807      [Steve Henson, Bodo Moeller]
   5808 
   5809   *) Fix ASN.1 parsing of certain invalid structures that can result
   5810      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   5811 
   5812   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   5813      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   5814 
   5815   *) Fix SSL client code which could crash if connecting to a
   5816      malicious SSLv2 server.  (CVE-2006-4343)
   5817      [Tavis Ormandy and Will Drewry, Google Security Team]
   5818 
   5819   *) Change ciphersuite string processing so that an explicit
   5820      ciphersuite selects this one ciphersuite (so that "AES256-SHA"
   5821      will no longer include "AES128-SHA"), and any other similar
   5822      ciphersuite (same bitmap) from *other* protocol versions (so that
   5823      "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
   5824      SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
   5825      changes from 0.9.8b and 0.9.8d.
   5826      [Bodo Moeller]
   5827 
   5828  Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
   5829 
   5830   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   5831      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   5832 
   5833   *) Change the Unix randomness entropy gathering to use poll() when
   5834      possible instead of select(), since the latter has some
   5835      undesirable limitations.
   5836      [Darryl Miles via Richard Levitte and Bodo Moeller]
   5837 
   5838   *) Disable rogue ciphersuites:
   5839 
   5840       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   5841       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   5842       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   5843 
   5844      The latter two were purportedly from
   5845      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   5846      appear there.
   5847 
   5848      Also deactive the remaining ciphersuites from
   5849      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   5850      unofficial, and the ID has long expired.
   5851      [Bodo Moeller]
   5852 
   5853   *) Fix RSA blinding Heisenbug (problems sometimes occurred on
   5854      dual-core machines) and other potential thread-safety issues.
   5855      [Bodo Moeller]
   5856 
   5857  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
   5858 
   5859   *) Adapt fipsld and the build system to link against the validated FIPS
   5860      module in FIPS mode.
   5861      [Steve Henson]
   5862 
   5863   *) Fixes for VC++ 2005 build under Windows.
   5864      [Steve Henson]
   5865 
   5866   *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
   5867      from a Windows bash shell such as MSYS. It is autodetected from the
   5868      "config" script when run from a VC++ environment. Modify standard VC++
   5869      build to use fipscanister.o from the GNU make build. 
   5870      [Steve Henson]
   5871 
   5872  Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
   5873 
   5874   *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
   5875      The value now differs depending on if you build for FIPS or not.
   5876      BEWARE!  A program linked with a shared FIPSed libcrypto can't be
   5877      safely run with a non-FIPSed libcrypto, as it may crash because of
   5878      the difference induced by this change.
   5879      [Andy Polyakov]
   5880 
   5881  Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
   5882 
   5883   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   5884      (part of SSL_OP_ALL).  This option used to disable the
   5885      countermeasure against man-in-the-middle protocol-version
   5886      rollback in the SSL 2.0 server implementation, which is a bad
   5887      idea.  (CVE-2005-2969)
   5888 
   5889      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   5890      for Information Security, National Institute of Advanced Industrial
   5891      Science and Technology [AIST], Japan)]
   5892 
   5893   *) Minimal support for X9.31 signatures and PSS padding modes. This is
   5894      mainly for FIPS compliance and not fully integrated at this stage.
   5895      [Steve Henson]
   5896 
   5897   *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
   5898      the exponentiation using a fixed-length exponent.  (Otherwise,
   5899      the information leaked through timing could expose the secret key
   5900      after many signatures; cf. Bleichenbacher's attack on DSA with
   5901      biased k.)
   5902      [Bodo Moeller]
   5903 
   5904   *) Make a new fixed-window mod_exp implementation the default for
   5905      RSA, DSA, and DH private-key operations so that the sequence of
   5906      squares and multiplies and the memory access pattern are
   5907      independent of the particular secret key.  This will mitigate
   5908      cache-timing and potential related attacks.
   5909 
   5910      BN_mod_exp_mont_consttime() is the new exponentiation implementation,
   5911      and this is automatically used by BN_mod_exp_mont() if the new flag
   5912      BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
   5913      will use this BN flag for private exponents unless the flag
   5914      RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
   5915      DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
   5916 
   5917      [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
   5918 
   5919   *) Change the client implementation for SSLv23_method() and
   5920      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
   5921      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
   5922      (Previously, the SSL 2.0 backwards compatible Client Hello
   5923      message format would be used even with SSL_OP_NO_SSLv2.)
   5924      [Bodo Moeller]
   5925 
   5926   *) Add support for smime-type MIME parameter in S/MIME messages which some
   5927      clients need.
   5928      [Steve Henson]
   5929 
   5930   *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
   5931      a threadsafe manner. Modify rsa code to use new function and add calls
   5932      to dsa and dh code (which had race conditions before).
   5933      [Steve Henson]
   5934 
   5935   *) Include the fixed error library code in the C error file definitions
   5936      instead of fixing them up at runtime. This keeps the error code
   5937      structures constant.
   5938      [Steve Henson]
   5939 
   5940  Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
   5941 
   5942   [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
   5943   OpenSSL 0.9.8.]
   5944 
   5945   *) Fixes for newer kerberos headers. NB: the casts are needed because
   5946      the 'length' field is signed on one version and unsigned on another
   5947      with no (?) obvious way to tell the difference, without these VC++
   5948      complains. Also the "definition" of FAR (blank) is no longer included
   5949      nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
   5950      some needed definitions.
   5951      [Steve Henson]
   5952 
   5953   *) Undo Cygwin change.
   5954      [Ulf Mller]
   5955 
   5956   *) Added support for proxy certificates according to RFC 3820.
   5957      Because they may be a security thread to unaware applications,
   5958      they must be explicitly allowed in run-time.  See
   5959      docs/HOWTO/proxy_certificates.txt for further information.
   5960      [Richard Levitte]
   5961 
   5962  Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
   5963 
   5964   *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
   5965      server and client random values. Previously
   5966      (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
   5967      less random data when sizeof(time_t) > 4 (some 64 bit platforms).
   5968 
   5969      This change has negligible security impact because:
   5970 
   5971      1. Server and client random values still have 24 bytes of pseudo random
   5972         data.
   5973 
   5974      2. Server and client random values are sent in the clear in the initial
   5975         handshake.
   5976 
   5977      3. The master secret is derived using the premaster secret (48 bytes in
   5978         size for static RSA ciphersuites) as well as client server and random
   5979         values.
   5980 
   5981      The OpenSSL team would like to thank the UK NISCC for bringing this issue
   5982      to our attention. 
   5983 
   5984      [Stephen Henson, reported by UK NISCC]
   5985 
   5986   *) Use Windows randomness collection on Cygwin.
   5987      [Ulf Mller]
   5988 
   5989   *) Fix hang in EGD/PRNGD query when communication socket is closed
   5990      prematurely by EGD/PRNGD.
   5991      [Darren Tucker <dtucker (a] zip.com.au> via Lutz Jnicke, resolves #1014]
   5992 
   5993   *) Prompt for pass phrases when appropriate for PKCS12 input format.
   5994      [Steve Henson]
   5995 
   5996   *) Back-port of selected performance improvements from development
   5997      branch, as well as improved support for PowerPC platforms.
   5998      [Andy Polyakov]
   5999 
   6000   *) Add lots of checks for memory allocation failure, error codes to indicate
   6001      failure and freeing up memory if a failure occurs.
   6002      [Nauticus Networks SSL Team <openssl (a] nauticusnet.com>, Steve Henson]
   6003 
   6004   *) Add new -passin argument to dgst.
   6005      [Steve Henson]
   6006 
   6007   *) Perform some character comparisons of different types in X509_NAME_cmp:
   6008      this is needed for some certificates that re-encode DNs into UTF8Strings
   6009      (in violation of RFC3280) and can't or won't issue name rollover
   6010      certificates.
   6011      [Steve Henson]
   6012 
   6013   *) Make an explicit check during certificate validation to see that
   6014      the CA setting in each certificate on the chain is correct.  As a
   6015      side effect always do the following basic checks on extensions,
   6016      not just when there's an associated purpose to the check:
   6017 
   6018       - if there is an unhandled critical extension (unless the user
   6019         has chosen to ignore this fault)
   6020       - if the path length has been exceeded (if one is set at all)
   6021       - that certain extensions fit the associated purpose (if one has
   6022         been given)
   6023      [Richard Levitte]
   6024 
   6025  Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
   6026 
   6027   *) Avoid a race condition when CRLs are checked in a multi threaded 
   6028      environment. This would happen due to the reordering of the revoked
   6029      entries during signature checking and serial number lookup. Now the
   6030      encoding is cached and the serial number sort performed under a lock.
   6031      Add new STACK function sk_is_sorted().
   6032      [Steve Henson]
   6033 
   6034   *) Add Delta CRL to the extension code.
   6035      [Steve Henson]
   6036 
   6037   *) Various fixes to s3_pkt.c so alerts are sent properly.
   6038      [David Holmes <d.holmes (a] f5.com>]
   6039 
   6040   *) Reduce the chances of duplicate issuer name and serial numbers (in
   6041      violation of RFC3280) using the OpenSSL certificate creation utilities.
   6042      This is done by creating a random 64 bit value for the initial serial
   6043      number when a serial number file is created or when a self signed
   6044      certificate is created using 'openssl req -x509'. The initial serial
   6045      number file is created using 'openssl x509 -next_serial' in CA.pl
   6046      rather than being initialized to 1.
   6047      [Steve Henson]
   6048 
   6049  Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
   6050 
   6051   *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
   6052      by using the Codenomicon TLS Test Tool (CVE-2004-0079)                    
   6053      [Joe Orton, Steve Henson]   
   6054 
   6055   *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
   6056      (CVE-2004-0112)
   6057      [Joe Orton, Steve Henson]   
   6058 
   6059   *) Make it possible to have multiple active certificates with the same
   6060      subject in the CA index file.  This is done only if the keyword
   6061      'unique_subject' is set to 'no' in the main CA section (default
   6062      if 'CA_default') of the configuration file.  The value is saved
   6063      with the database itself in a separate index attribute file,
   6064      named like the index file with '.attr' appended to the name.
   6065      [Richard Levitte]
   6066 
   6067   *) X509 verify fixes. Disable broken certificate workarounds when 
   6068      X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
   6069      keyUsage extension present. Don't accept CRLs with unhandled critical
   6070      extensions: since verify currently doesn't process CRL extensions this
   6071      rejects a CRL with *any* critical extensions. Add new verify error codes
   6072      for these cases.
   6073      [Steve Henson]
   6074 
   6075   *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
   6076      A clarification of RFC2560 will require the use of OCTET STRINGs and 
   6077      some implementations cannot handle the current raw format. Since OpenSSL
   6078      copies and compares OCSP nonces as opaque blobs without any attempt at
   6079      parsing them this should not create any compatibility issues.
   6080      [Steve Henson]
   6081 
   6082   *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
   6083      calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
   6084      this HMAC (and other) operations are several times slower than OpenSSL
   6085      < 0.9.7.
   6086      [Steve Henson]
   6087 
   6088   *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
   6089      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   6090 
   6091   *) Use the correct content when signing type "other".
   6092      [Steve Henson]
   6093 
   6094  Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
   6095 
   6096   *) Fix various bugs revealed by running the NISCC test suite:
   6097 
   6098      Stop out of bounds reads in the ASN1 code when presented with
   6099      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   6100      
   6101      Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
   6102 
   6103      If verify callback ignores invalid public key errors don't try to check
   6104      certificate signature with the NULL public key.
   6105 
   6106      [Steve Henson]
   6107 
   6108   *) New -ignore_err option in ocsp application to stop the server
   6109      exiting on the first error in a request.
   6110      [Steve Henson]
   6111 
   6112   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   6113      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   6114      specifications.
   6115      [Steve Henson]
   6116 
   6117   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   6118      extra data after the compression methods not only for TLS 1.0
   6119      but also for SSL 3.0 (as required by the specification).
   6120      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   6121 
   6122   *) Change X509_certificate_type() to mark the key as exported/exportable
   6123      when it's 512 *bits* long, not 512 bytes.
   6124      [Richard Levitte]
   6125 
   6126   *) Change AES_cbc_encrypt() so it outputs exact multiple of
   6127      blocks during encryption.
   6128      [Richard Levitte]
   6129 
   6130   *) Various fixes to base64 BIO and non blocking I/O. On write 
   6131      flushes were not handled properly if the BIO retried. On read
   6132      data was not being buffered properly and had various logic bugs.
   6133      This also affects blocking I/O when the data being decoded is a
   6134      certain size.
   6135      [Steve Henson]
   6136 
   6137   *) Various S/MIME bugfixes and compatibility changes:
   6138      output correct application/pkcs7 MIME type if
   6139      PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
   6140      Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
   6141      of files as .eml work). Correctly handle very long lines in MIME
   6142      parser.
   6143      [Steve Henson]
   6144 
   6145  Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
   6146 
   6147   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   6148      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   6149      a protocol version number mismatch like a decryption error
   6150      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   6151      [Bodo Moeller]
   6152 
   6153   *) Turn on RSA blinding by default in the default implementation
   6154      to avoid a timing attack. Applications that don't want it can call
   6155      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   6156      They would be ill-advised to do so in most cases.
   6157      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   6158 
   6159   *) Change RSA blinding code so that it works when the PRNG is not
   6160      seeded (in this case, the secret RSA exponent is abused as
   6161      an unpredictable seed -- if it is not unpredictable, there
   6162      is no point in blinding anyway).  Make RSA blinding thread-safe
   6163      by remembering the creator's thread ID in rsa->blinding and
   6164      having all other threads use local one-time blinding factors
   6165      (this requires more computation than sharing rsa->blinding, but
   6166      avoids excessive locking; and if an RSA object is not shared
   6167      between threads, blinding will still be very fast).
   6168      [Bodo Moeller]
   6169 
   6170   *) Fixed a typo bug that would cause ENGINE_set_default() to set an
   6171      ENGINE as defaults for all supported algorithms irrespective of
   6172      the 'flags' parameter. 'flags' is now honoured, so applications
   6173      should make sure they are passing it correctly.
   6174      [Geoff Thorpe]
   6175 
   6176   *) Target "mingw" now allows native Windows code to be generated in
   6177      the Cygwin environment as well as with the MinGW compiler.
   6178      [Ulf Moeller] 
   6179 
   6180  Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
   6181 
   6182   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   6183      via timing by performing a MAC computation even if incorrect
   6184      block cipher padding has been found.  This is a countermeasure
   6185      against active attacks where the attacker has to distinguish
   6186      between bad padding and a MAC verification error. (CVE-2003-0078)
   6187 
   6188      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   6189      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   6190      Martin Vuagnoux (EPFL, Ilion)]
   6191 
   6192   *) Make the no-err option work as intended.  The intention with no-err
   6193      is not to have the whole error stack handling routines removed from
   6194      libcrypto, it's only intended to remove all the function name and
   6195      reason texts, thereby removing some of the footprint that may not
   6196      be interesting if those errors aren't displayed anyway.
   6197 
   6198      NOTE: it's still possible for any application or module to have it's
   6199      own set of error texts inserted.  The routines are there, just not
   6200      used by default when no-err is given.
   6201      [Richard Levitte]
   6202 
   6203   *) Add support for FreeBSD on IA64.
   6204      [dirk.meyer (a] dinoex.sub.org via Richard Levitte, resolves #454]
   6205 
   6206   *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
   6207      Kerberos function mit_des_cbc_cksum().  Before this change,
   6208      the value returned by DES_cbc_cksum() was like the one from
   6209      mit_des_cbc_cksum(), except the bytes were swapped.
   6210      [Kevin Greaney <Kevin.Greaney (a] hp.com> and Richard Levitte]
   6211 
   6212   *) Allow an application to disable the automatic SSL chain building.
   6213      Before this a rather primitive chain build was always performed in
   6214      ssl3_output_cert_chain(): an application had no way to send the 
   6215      correct chain if the automatic operation produced an incorrect result.
   6216 
   6217      Now the chain builder is disabled if either:
   6218 
   6219      1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
   6220 
   6221      2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
   6222 
   6223      The reasoning behind this is that an application would not want the
   6224      auto chain building to take place if extra chain certificates are
   6225      present and it might also want a means of sending no additional
   6226      certificates (for example the chain has two certificates and the
   6227      root is omitted).
   6228      [Steve Henson]
   6229 
   6230   *) Add the possibility to build without the ENGINE framework.
   6231      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   6232 
   6233   *) Under Win32 gmtime() can return NULL: check return value in
   6234      OPENSSL_gmtime(). Add error code for case where gmtime() fails.
   6235      [Steve Henson]
   6236 
   6237   *) DSA routines: under certain error conditions uninitialized BN objects
   6238      could be freed. Solution: make sure initialization is performed early
   6239      enough. (Reported and fix supplied by Ivan D Nestlerode <nestler (a] MIT.EDU>,
   6240      Nils Larsch <nla (a] trustcenter.de> via PR#459)
   6241      [Lutz Jaenicke]
   6242 
   6243   *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
   6244      checked on reconnect on the client side, therefore session resumption
   6245      could still fail with a "ssl session id is different" error. This
   6246      behaviour is masked when SSL_OP_ALL is used due to
   6247      SSL_OP_MICROSOFT_SESS_ID_BUG being set.
   6248      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   6249      followup to PR #377.
   6250      [Lutz Jaenicke]
   6251 
   6252   *) IA-32 assembler support enhancements: unified ELF targets, support
   6253      for SCO/Caldera platforms, fix for Cygwin shared build.
   6254      [Andy Polyakov]
   6255 
   6256   *) Add support for FreeBSD on sparc64.  As a consequence, support for
   6257      FreeBSD on non-x86 processors is separate from x86 processors on
   6258      the config script, much like the NetBSD support.
   6259      [Richard Levitte & Kris Kennaway <kris (a] obsecurity.org>]
   6260 
   6261  Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
   6262 
   6263   [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
   6264   OpenSSL 0.9.7.]
   6265 
   6266   *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
   6267      code (06) was taken as the first octet of the session ID and the last
   6268      octet was ignored consequently. As a result SSLv2 client side session
   6269      caching could not have worked due to the session ID mismatch between
   6270      client and server.
   6271      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   6272      PR #377.
   6273      [Lutz Jaenicke]
   6274 
   6275   *) Change the declaration of needed Kerberos libraries to use EX_LIBS
   6276      instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
   6277      removed entirely.
   6278      [Richard Levitte]
   6279 
   6280   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
   6281      seems that in spite of existing for more than a year, many application
   6282      author have done nothing to provide the necessary callbacks, which
   6283      means that this particular engine will not work properly anywhere.
   6284      This is a very unfortunate situation which forces us, in the name
   6285      of usability, to give the hw_ncipher.c a static lock, which is part
   6286      of libcrypto.
   6287      NOTE: This is for the 0.9.7 series ONLY.  This hack will never
   6288      appear in 0.9.8 or later.  We EXPECT application authors to have
   6289      dealt properly with this when 0.9.8 is released (unless we actually
   6290      make such changes in the libcrypto locking code that changes will
   6291      have to be made anyway).
   6292      [Richard Levitte]
   6293 
   6294   *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
   6295      octets have been read, EOF or an error occurs. Without this change
   6296      some truncated ASN1 structures will not produce an error.
   6297      [Steve Henson]
   6298 
   6299   *) Disable Heimdal support, since it hasn't been fully implemented.
   6300      Still give the possibility to force the use of Heimdal, but with
   6301      warnings and a request that patches get sent to openssl-dev.
   6302      [Richard Levitte]
   6303 
   6304   *) Add the VC-CE target, introduce the WINCE sysname, and add
   6305      INSTALL.WCE and appropriate conditionals to make it build.
   6306      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   6307 
   6308   *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
   6309      cygssl-x.y.z.dll, where x, y and z are the major, minor and
   6310      edit numbers of the version.
   6311      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   6312 
   6313   *) Introduce safe string copy and catenation functions
   6314      (BUF_strlcpy() and BUF_strlcat()).
   6315      [Ben Laurie (CHATS) and Richard Levitte]
   6316 
   6317   *) Avoid using fixed-size buffers for one-line DNs.
   6318      [Ben Laurie (CHATS)]
   6319 
   6320   *) Add BUF_MEM_grow_clean() to avoid information leakage when
   6321      resizing buffers containing secrets, and use where appropriate.
   6322      [Ben Laurie (CHATS)]
   6323 
   6324   *) Avoid using fixed size buffers for configuration file location.
   6325      [Ben Laurie (CHATS)]
   6326 
   6327   *) Avoid filename truncation for various CA files.
   6328      [Ben Laurie (CHATS)]
   6329 
   6330   *) Use sizeof in preference to magic numbers.
   6331      [Ben Laurie (CHATS)]
   6332 
   6333   *) Avoid filename truncation in cert requests.
   6334      [Ben Laurie (CHATS)]
   6335 
   6336   *) Add assertions to check for (supposedly impossible) buffer
   6337      overflows.
   6338      [Ben Laurie (CHATS)]
   6339 
   6340   *) Don't cache truncated DNS entries in the local cache (this could
   6341      potentially lead to a spoofing attack).
   6342      [Ben Laurie (CHATS)]
   6343 
   6344   *) Fix various buffers to be large enough for hex/decimal
   6345      representations in a platform independent manner.
   6346      [Ben Laurie (CHATS)]
   6347 
   6348   *) Add CRYPTO_realloc_clean() to avoid information leakage when
   6349      resizing buffers containing secrets, and use where appropriate.
   6350      [Ben Laurie (CHATS)]
   6351 
   6352   *) Add BIO_indent() to avoid much slightly worrying code to do
   6353      indents.
   6354      [Ben Laurie (CHATS)]
   6355 
   6356   *) Convert sprintf()/BIO_puts() to BIO_printf().
   6357      [Ben Laurie (CHATS)]
   6358 
   6359   *) buffer_gets() could terminate with the buffer only half
   6360      full. Fixed.
   6361      [Ben Laurie (CHATS)]
   6362 
   6363   *) Add assertions to prevent user-supplied crypto functions from
   6364      overflowing internal buffers by having large block sizes, etc.
   6365      [Ben Laurie (CHATS)]
   6366 
   6367   *) New OPENSSL_assert() macro (similar to assert(), but enabled
   6368      unconditionally).
   6369      [Ben Laurie (CHATS)]
   6370 
   6371   *) Eliminate unused copy of key in RC4.
   6372      [Ben Laurie (CHATS)]
   6373 
   6374   *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
   6375      [Ben Laurie (CHATS)]
   6376 
   6377   *) Fix off-by-one error in EGD path.
   6378      [Ben Laurie (CHATS)]
   6379 
   6380   *) If RANDFILE path is too long, ignore instead of truncating.
   6381      [Ben Laurie (CHATS)]
   6382 
   6383   *) Eliminate unused and incorrectly sized X.509 structure
   6384      CBCParameter.
   6385      [Ben Laurie (CHATS)]
   6386 
   6387   *) Eliminate unused and dangerous function knumber().
   6388      [Ben Laurie (CHATS)]
   6389 
   6390   *) Eliminate unused and dangerous structure, KSSL_ERR.
   6391      [Ben Laurie (CHATS)]
   6392 
   6393   *) Protect against overlong session ID context length in an encoded
   6394      session object. Since these are local, this does not appear to be
   6395      exploitable.
   6396      [Ben Laurie (CHATS)]
   6397 
   6398   *) Change from security patch (see 0.9.6e below) that did not affect
   6399      the 0.9.6 release series:
   6400 
   6401      Remote buffer overflow in SSL3 protocol - an attacker could
   6402      supply an oversized master key in Kerberos-enabled versions.
   6403      (CVE-2002-0657)
   6404      [Ben Laurie (CHATS)]
   6405 
   6406   *) Change the SSL kerb5 codes to match RFC 2712.
   6407      [Richard Levitte]
   6408 
   6409   *) Make -nameopt work fully for req and add -reqopt switch.
   6410      [Michael Bell <michael.bell (a] rz.hu-berlin.de>, Steve Henson]
   6411 
   6412   *) The "block size" for block ciphers in CFB and OFB mode should be 1.
   6413      [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve (a] opera.com>]
   6414 
   6415   *) Make sure tests can be performed even if the corresponding algorithms
   6416      have been removed entirely.  This was also the last step to make
   6417      OpenSSL compilable with DJGPP under all reasonable conditions.
   6418      [Richard Levitte, Doug Kaufman <dkaufman (a] rahul.net>]
   6419 
   6420   *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
   6421      to allow version independent disabling of normally unselected ciphers,
   6422      which may be activated as a side-effect of selecting a single cipher.
   6423 
   6424      (E.g., cipher list string "RSA" enables ciphersuites that are left
   6425      out of "ALL" because they do not provide symmetric encryption.
   6426      "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
   6427      [Lutz Jaenicke, Bodo Moeller]
   6428 
   6429   *) Add appropriate support for separate platform-dependent build
   6430      directories.  The recommended way to make a platform-dependent
   6431      build directory is the following (tested on Linux), maybe with
   6432      some local tweaks:
   6433 
   6434 	# Place yourself outside of the OpenSSL source tree.  In
   6435 	# this example, the environment variable OPENSSL_SOURCE
   6436 	# is assumed to contain the absolute OpenSSL source directory.
   6437 	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
   6438 	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
   6439 	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
   6440 		mkdir -p `dirname $F`
   6441 		ln -s $OPENSSL_SOURCE/$F $F
   6442 	done
   6443 
   6444      To be absolutely sure not to disturb the source tree, a "make clean"
   6445      is a good thing.  If it isn't successful, don't worry about it,
   6446      it probably means the source directory is very clean.
   6447      [Richard Levitte]
   6448 
   6449   *) Make sure any ENGINE control commands make local copies of string
   6450      pointers passed to them whenever necessary. Otherwise it is possible
   6451      the caller may have overwritten (or deallocated) the original string
   6452      data when a later ENGINE operation tries to use the stored values.
   6453      [Gtz Babin-Ebell <babinebell (a] trustcenter.de>]
   6454 
   6455   *) Improve diagnostics in file reading and command-line digests.
   6456      [Ben Laurie aided and abetted by Solar Designer <solar (a] openwall.com>]
   6457 
   6458   *) Add AES modes CFB and OFB to the object database.  Correct an
   6459      error in AES-CFB decryption.
   6460      [Richard Levitte]
   6461 
   6462   *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
   6463      allows existing EVP_CIPHER_CTX structures to be reused after
   6464      calling EVP_*Final(). This behaviour is used by encryption
   6465      BIOs and some applications. This has the side effect that
   6466      applications must explicitly clean up cipher contexts with
   6467      EVP_CIPHER_CTX_cleanup() or they will leak memory.
   6468      [Steve Henson]
   6469 
   6470   *) Check the values of dna and dnb in bn_mul_recursive before calling
   6471      bn_mul_comba (a non zero value means the a or b arrays do not contain
   6472      n2 elements) and fallback to bn_mul_normal if either is not zero.
   6473      [Steve Henson]
   6474 
   6475   *) Fix escaping of non-ASCII characters when using the -subj option
   6476      of the "openssl req" command line tool. (Robert Joop <joop (a] fokus.gmd.de>)
   6477      [Lutz Jaenicke]
   6478 
   6479   *) Make object definitions compliant to LDAP (RFC2256): SN is the short
   6480      form for "surname", serialNumber has no short form.
   6481      Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
   6482      therefore remove "mail" short name for "internet 7".
   6483      The OID for unique identifiers in X509 certificates is
   6484      x500UniqueIdentifier, not uniqueIdentifier.
   6485      Some more OID additions. (Michael Bell <michael.bell (a] rz.hu-berlin.de>)
   6486      [Lutz Jaenicke]
   6487 
   6488   *) Add an "init" command to the ENGINE config module and auto initialize
   6489      ENGINEs. Without any "init" command the ENGINE will be initialized 
   6490      after all ctrl commands have been executed on it. If init=1 the 
   6491      ENGINE is initailized at that point (ctrls before that point are run
   6492      on the uninitialized ENGINE and after on the initialized one). If
   6493      init=0 then the ENGINE will not be iniatialized at all.
   6494      [Steve Henson]
   6495 
   6496   *) Fix the 'app_verify_callback' interface so that the user-defined
   6497      argument is actually passed to the callback: In the
   6498      SSL_CTX_set_cert_verify_callback() prototype, the callback
   6499      declaration has been changed from
   6500           int (*cb)()
   6501      into
   6502           int (*cb)(X509_STORE_CTX *,void *);
   6503      in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
   6504           i=s->ctx->app_verify_callback(&ctx)
   6505      has been changed into
   6506           i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
   6507 
   6508      To update applications using SSL_CTX_set_cert_verify_callback(),
   6509      a dummy argument can be added to their callback functions.
   6510      [D. K. Smetters <smetters (a] parc.xerox.com>]
   6511 
   6512   *) Added the '4758cca' ENGINE to support IBM 4758 cards.
   6513      [Maurice Gittens <maurice (a] gittens.nl>, touchups by Geoff Thorpe]
   6514 
   6515   *) Add and OPENSSL_LOAD_CONF define which will cause
   6516      OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
   6517      This allows older applications to transparently support certain
   6518      OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
   6519      Two new functions OPENSSL_add_all_algorithms_noconf() which will never
   6520      load the config file and OPENSSL_add_all_algorithms_conf() which will
   6521      always load it have also been added.
   6522      [Steve Henson]
   6523 
   6524   *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
   6525      Adjust NIDs and EVP layer.
   6526      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   6527 
   6528   *) Config modules support in openssl utility.
   6529 
   6530      Most commands now load modules from the config file,
   6531      though in a few (such as version) this isn't done 
   6532      because it couldn't be used for anything.
   6533 
   6534      In the case of ca and req the config file used is
   6535      the same as the utility itself: that is the -config
   6536      command line option can be used to specify an
   6537      alternative file.
   6538      [Steve Henson]
   6539 
   6540   *) Move default behaviour from OPENSSL_config(). If appname is NULL
   6541      use "openssl_conf" if filename is NULL use default openssl config file.
   6542      [Steve Henson]
   6543 
   6544   *) Add an argument to OPENSSL_config() to allow the use of an alternative
   6545      config section name. Add a new flag to tolerate a missing config file
   6546      and move code to CONF_modules_load_file().
   6547      [Steve Henson]
   6548 
   6549   *) Support for crypto accelerator cards from Accelerated Encryption
   6550      Processing, www.aep.ie.  (Use engine 'aep')
   6551      The support was copied from 0.9.6c [engine] and adapted/corrected
   6552      to work with the new engine framework.
   6553      [AEP Inc. and Richard Levitte]
   6554 
   6555   *) Support for SureWare crypto accelerator cards from Baltimore
   6556      Technologies.  (Use engine 'sureware')
   6557      The support was copied from 0.9.6c [engine] and adapted
   6558      to work with the new engine framework.
   6559      [Richard Levitte]
   6560 
   6561   *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
   6562      make the newer ENGINE framework commands for the CHIL engine work.
   6563      [Toomas Kiisk <vix (a] cyber.ee> and Richard Levitte]
   6564 
   6565   *) Make it possible to produce shared libraries on ReliantUNIX.
   6566      [Robert Dahlem <Robert.Dahlem (a] ffm2.siemens.de> via Richard Levitte]
   6567 
   6568   *) Add the configuration target debug-linux-ppro.
   6569      Make 'openssl rsa' use the general key loading routines
   6570      implemented in apps.c, and make those routines able to
   6571      handle the key format FORMAT_NETSCAPE and the variant
   6572      FORMAT_IISSGC.
   6573      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   6574 
   6575  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   6576      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   6577 
   6578   *) Add -keyform to rsautl, and document -engine.
   6579      [Richard Levitte, inspired by Toomas Kiisk <vix (a] cyber.ee>]
   6580 
   6581   *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
   6582      BIO_R_NO_SUCH_FILE error code rather than the generic
   6583      ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
   6584      [Ben Laurie]
   6585 
   6586   *) Add new functions
   6587           ERR_peek_last_error
   6588           ERR_peek_last_error_line
   6589           ERR_peek_last_error_line_data.
   6590      These are similar to
   6591           ERR_peek_error
   6592           ERR_peek_error_line
   6593           ERR_peek_error_line_data,
   6594      but report on the latest error recorded rather than the first one
   6595      still in the error queue.
   6596      [Ben Laurie, Bodo Moeller]
   6597         
   6598   *) default_algorithms option in ENGINE config module. This allows things
   6599      like:
   6600      default_algorithms = ALL
   6601      default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
   6602      [Steve Henson]
   6603 
   6604   *) Preliminary ENGINE config module.
   6605      [Steve Henson]
   6606 
   6607   *) New experimental application configuration code.
   6608      [Steve Henson]
   6609 
   6610   *) Change the AES code to follow the same name structure as all other
   6611      symmetric ciphers, and behave the same way.  Move everything to
   6612      the directory crypto/aes, thereby obsoleting crypto/rijndael.
   6613      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   6614 
   6615   *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
   6616      [Ben Laurie and Theo de Raadt]
   6617 
   6618   *) Add option to output public keys in req command.
   6619      [Massimiliano Pala madwolf (a] openca.org]
   6620 
   6621   *) Use wNAFs in EC_POINTs_mul() for improved efficiency
   6622      (up to about 10% better than before for P-192 and P-224).
   6623      [Bodo Moeller]
   6624 
   6625   *) New functions/macros
   6626 
   6627           SSL_CTX_set_msg_callback(ctx, cb)
   6628           SSL_CTX_set_msg_callback_arg(ctx, arg)
   6629           SSL_set_msg_callback(ssl, cb)
   6630           SSL_set_msg_callback_arg(ssl, arg)
   6631 
   6632      to request calling a callback function
   6633 
   6634           void cb(int write_p, int version, int content_type,
   6635                   const void *buf, size_t len, SSL *ssl, void *arg)
   6636 
   6637      whenever a protocol message has been completely received
   6638      (write_p == 0) or sent (write_p == 1).  Here 'version' is the
   6639      protocol version  according to which the SSL library interprets
   6640      the current protocol message (SSL2_VERSION, SSL3_VERSION, or
   6641      TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
   6642      the content type as defined in the SSL 3.0/TLS 1.0 protocol
   6643      specification (change_cipher_spec(20), alert(21), handshake(22)).
   6644      'buf' and 'len' point to the actual message, 'ssl' to the
   6645      SSL object, and 'arg' is the application-defined value set by
   6646      SSL[_CTX]_set_msg_callback_arg().
   6647 
   6648      'openssl s_client' and 'openssl s_server' have new '-msg' options
   6649      to enable a callback that displays all protocol messages.
   6650      [Bodo Moeller]
   6651 
   6652   *) Change the shared library support so shared libraries are built as
   6653      soon as the corresponding static library is finished, and thereby get
   6654      openssl and the test programs linked against the shared library.
   6655      This still only happens when the keyword "shard" has been given to
   6656      the configuration scripts.
   6657 
   6658      NOTE: shared library support is still an experimental thing, and
   6659      backward binary compatibility is still not guaranteed.
   6660      ["Maciej W. Rozycki" <macro (a] ds2.pg.gda.pl> and Richard Levitte]
   6661 
   6662   *) Add support for Subject Information Access extension.
   6663      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   6664 
   6665   *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
   6666      additional bytes when new memory had to be allocated, not just
   6667      when reusing an existing buffer.
   6668      [Bodo Moeller]
   6669 
   6670   *) New command line and configuration option 'utf8' for the req command.
   6671      This allows field values to be specified as UTF8 strings.
   6672      [Steve Henson]
   6673 
   6674   *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
   6675      runs for the former and machine-readable output for the latter.
   6676      [Ben Laurie]
   6677 
   6678   *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
   6679      of the e-mail address in the DN (i.e., it will go into a certificate
   6680      extension only).  The new configuration file option 'email_in_dn = no'
   6681      has the same effect.
   6682      [Massimiliano Pala madwolf (a] openca.org]
   6683 
   6684   *) Change all functions with names starting with des_ to be starting
   6685      with DES_ instead.  Add wrappers that are compatible with libdes,
   6686      but are named _ossl_old_des_*.  Finally, add macros that map the
   6687      des_* symbols to the corresponding _ossl_old_des_* if libdes
   6688      compatibility is desired.  If OpenSSL 0.9.6c compatibility is
   6689      desired, the des_* symbols will be mapped to DES_*, with one
   6690      exception.
   6691 
   6692      Since we provide two compatibility mappings, the user needs to
   6693      define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
   6694      compatibility is desired.  The default (i.e., when that macro
   6695      isn't defined) is OpenSSL 0.9.6c compatibility.
   6696 
   6697      There are also macros that enable and disable the support of old
   6698      des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
   6699      and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
   6700      are defined, the default will apply: to support the old des routines.
   6701 
   6702      In either case, one must include openssl/des.h to get the correct
   6703      definitions.  Do not try to just include openssl/des_old.h, that
   6704      won't work.
   6705 
   6706      NOTE: This is a major break of an old API into a new one.  Software
   6707      authors are encouraged to switch to the DES_ style functions.  Some
   6708      time in the future, des_old.h and the libdes compatibility functions
   6709      will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
   6710      default), and then completely removed.
   6711      [Richard Levitte]
   6712 
   6713   *) Test for certificates which contain unsupported critical extensions.
   6714      If such a certificate is found during a verify operation it is 
   6715      rejected by default: this behaviour can be overridden by either
   6716      handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
   6717      by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
   6718      X509_supported_extension() has also been added which returns 1 if a
   6719      particular extension is supported.
   6720      [Steve Henson]
   6721 
   6722   *) Modify the behaviour of EVP cipher functions in similar way to digests
   6723      to retain compatibility with existing code.
   6724      [Steve Henson]
   6725 
   6726   *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
   6727      compatibility with existing code. In particular the 'ctx' parameter does
   6728      not have to be to be initialized before the call to EVP_DigestInit() and
   6729      it is tidied up after a call to EVP_DigestFinal(). New function
   6730      EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
   6731      EVP_MD_CTX_copy() changed to not require the destination to be
   6732      initialized valid and new function EVP_MD_CTX_copy_ex() added which
   6733      requires the destination to be valid.
   6734 
   6735      Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
   6736      EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
   6737      [Steve Henson]
   6738 
   6739   *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
   6740      so that complete 'Handshake' protocol structures are kept in memory
   6741      instead of overwriting 'msg_type' and 'length' with 'body' data.
   6742      [Bodo Moeller]
   6743 
   6744   *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
   6745      [Massimo Santin via Richard Levitte]
   6746 
   6747   *) Major restructuring to the underlying ENGINE code. This includes
   6748      reduction of linker bloat, separation of pure "ENGINE" manipulation
   6749      (initialisation, etc) from functionality dealing with implementations
   6750      of specific crypto iterfaces. This change also introduces integrated
   6751      support for symmetric ciphers and digest implementations - so ENGINEs
   6752      can now accelerate these by providing EVP_CIPHER and EVP_MD
   6753      implementations of their own. This is detailed in crypto/engine/README
   6754      as it couldn't be adequately described here. However, there are a few
   6755      API changes worth noting - some RSA, DSA, DH, and RAND functions that
   6756      were changed in the original introduction of ENGINE code have now
   6757      reverted back - the hooking from this code to ENGINE is now a good
   6758      deal more passive and at run-time, operations deal directly with
   6759      RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
   6760      dereferencing through an ENGINE pointer any more. Also, the ENGINE
   6761      functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
   6762      they were not being used by the framework as there is no concept of a
   6763      BIGNUM_METHOD and they could not be generalised to the new
   6764      'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
   6765      ENGINE_cpy() has been removed as it cannot be consistently defined in
   6766      the new code.
   6767      [Geoff Thorpe]
   6768 
   6769   *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
   6770      [Steve Henson]
   6771 
   6772   *) Change mkdef.pl to sort symbols that get the same entry number,
   6773      and make sure the automatically generated functions ERR_load_*
   6774      become part of libeay.num as well.
   6775      [Richard Levitte]
   6776 
   6777   *) New function SSL_renegotiate_pending().  This returns true once
   6778      renegotiation has been requested (either SSL_renegotiate() call
   6779      or HelloRequest/ClientHello received from the peer) and becomes
   6780      false once a handshake has been completed.
   6781      (For servers, SSL_renegotiate() followed by SSL_do_handshake()
   6782      sends a HelloRequest, but does not ensure that a handshake takes
   6783      place.  SSL_renegotiate_pending() is useful for checking if the
   6784      client has followed the request.)
   6785      [Bodo Moeller]
   6786 
   6787   *) New SSL option SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION.
   6788      By default, clients may request session resumption even during
   6789      renegotiation (if session ID contexts permit); with this option,
   6790      session resumption is possible only in the first handshake.
   6791 
   6792      SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
   6793      more bits available for options that should not be part of
   6794      SSL_OP_ALL (such as SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION).
   6795      [Bodo Moeller]
   6796 
   6797   *) Add some demos for certificate and certificate request creation.
   6798      [Steve Henson]
   6799 
   6800   *) Make maximum certificate chain size accepted from the peer application
   6801      settable (SSL*_get/set_max_cert_list()), as proposed by
   6802      "Douglas E. Engert" <deengert (a] anl.gov>.
   6803      [Lutz Jaenicke]
   6804 
   6805   *) Add support for shared libraries for Unixware-7
   6806      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   6807      [Lutz Jaenicke]
   6808 
   6809   *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
   6810      be done prior to destruction. Use this to unload error strings from
   6811      ENGINEs that load their own error strings. NB: This adds two new API
   6812      functions to "get" and "set" this destroy handler in an ENGINE.
   6813      [Geoff Thorpe]
   6814 
   6815   *) Alter all existing ENGINE implementations (except "openssl" and
   6816      "openbsd") to dynamically instantiate their own error strings. This
   6817      makes them more flexible to be built both as statically-linked ENGINEs
   6818      and self-contained shared-libraries loadable via the "dynamic" ENGINE.
   6819      Also, add stub code to each that makes building them as self-contained
   6820      shared-libraries easier (see README.ENGINE).
   6821      [Geoff Thorpe]
   6822 
   6823   *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
   6824      implementations into applications that are completely implemented in
   6825      self-contained shared-libraries. The "dynamic" ENGINE exposes control
   6826      commands that can be used to configure what shared-library to load and
   6827      to control aspects of the way it is handled. Also, made an update to
   6828      the README.ENGINE file that brings its information up-to-date and
   6829      provides some information and instructions on the "dynamic" ENGINE
   6830      (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
   6831      [Geoff Thorpe]
   6832 
   6833   *) Make it possible to unload ranges of ERR strings with a new
   6834      "ERR_unload_strings" function.
   6835      [Geoff Thorpe]
   6836 
   6837   *) Add a copy() function to EVP_MD.
   6838      [Ben Laurie]
   6839 
   6840   *) Make EVP_MD routines take a context pointer instead of just the
   6841      md_data void pointer.
   6842      [Ben Laurie]
   6843 
   6844   *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
   6845      that the digest can only process a single chunk of data
   6846      (typically because it is provided by a piece of
   6847      hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
   6848      is only going to provide a single chunk of data, and hence the
   6849      framework needn't accumulate the data for oneshot drivers.
   6850      [Ben Laurie]
   6851 
   6852   *) As with "ERR", make it possible to replace the underlying "ex_data"
   6853      functions. This change also alters the storage and management of global
   6854      ex_data state - it's now all inside ex_data.c and all "class" code (eg.
   6855      RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
   6856      index counters. The API functions that use this state have been changed
   6857      to take a "class_index" rather than pointers to the class's local STACK
   6858      and counter, and there is now an API function to dynamically create new
   6859      classes. This centralisation allows us to (a) plug a lot of the
   6860      thread-safety problems that existed, and (b) makes it possible to clean
   6861      up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
   6862      such data would previously have always leaked in application code and
   6863      workarounds were in place to make the memory debugging turn a blind eye
   6864      to it. Application code that doesn't use this new function will still
   6865      leak as before, but their memory debugging output will announce it now
   6866      rather than letting it slide.
   6867 
   6868      Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
   6869      induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
   6870      has a return value to indicate success or failure.
   6871      [Geoff Thorpe]
   6872 
   6873   *) Make it possible to replace the underlying "ERR" functions such that the
   6874      global state (2 LHASH tables and 2 locks) is only used by the "default"
   6875      implementation. This change also adds two functions to "get" and "set"
   6876      the implementation prior to it being automatically set the first time
   6877      any other ERR function takes place. Ie. an application can call "get",
   6878      pass the return value to a module it has just loaded, and that module
   6879      can call its own "set" function using that value. This means the
   6880      module's "ERR" operations will use (and modify) the error state in the
   6881      application and not in its own statically linked copy of OpenSSL code.
   6882      [Geoff Thorpe]
   6883 
   6884   *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
   6885      reference counts. This performs normal REF_PRINT/REF_CHECK macros on
   6886      the operation, and provides a more encapsulated way for external code
   6887      (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
   6888      to use these functions rather than manually incrementing the counts.
   6889 
   6890      Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
   6891      [Geoff Thorpe]
   6892 
   6893   *) Add EVP test program.
   6894      [Ben Laurie]
   6895 
   6896   *) Add symmetric cipher support to ENGINE. Expect the API to change!
   6897      [Ben Laurie]
   6898 
   6899   *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
   6900      X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
   6901      X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
   6902      These allow a CRL to be built without having to access X509_CRL fields
   6903      directly. Modify 'ca' application to use new functions.
   6904      [Steve Henson]
   6905 
   6906   *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
   6907      bug workarounds. Rollback attack detection is a security feature.
   6908      The problem will only arise on OpenSSL servers when TLSv1 is not
   6909      available (sslv3_server_method() or SSL_OP_NO_TLSv1).
   6910      Software authors not wanting to support TLSv1 will have special reasons
   6911      for their choice and can explicitly enable this option.
   6912      [Bodo Moeller, Lutz Jaenicke]
   6913 
   6914   *) Rationalise EVP so it can be extended: don't include a union of
   6915      cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
   6916      (similar to those existing for EVP_CIPHER_CTX).
   6917      Usage example:
   6918 
   6919          EVP_MD_CTX md;
   6920 
   6921          EVP_MD_CTX_init(&md);             /* new function call */
   6922          EVP_DigestInit(&md, EVP_sha1());
   6923          EVP_DigestUpdate(&md, in, len);
   6924          EVP_DigestFinal(&md, out, NULL);
   6925          EVP_MD_CTX_cleanup(&md);          /* new function call */
   6926 
   6927      [Ben Laurie]
   6928 
   6929   *) Make DES key schedule conform to the usual scheme, as well as
   6930      correcting its structure. This means that calls to DES functions
   6931      now have to pass a pointer to a des_key_schedule instead of a
   6932      plain des_key_schedule (which was actually always a pointer
   6933      anyway): E.g.,
   6934 
   6935          des_key_schedule ks;
   6936 
   6937 	 des_set_key_checked(..., &ks);
   6938 	 des_ncbc_encrypt(..., &ks, ...);
   6939 
   6940      (Note that a later change renames 'des_...' into 'DES_...'.)
   6941      [Ben Laurie]
   6942 
   6943   *) Initial reduction of linker bloat: the use of some functions, such as
   6944      PEM causes large amounts of unused functions to be linked in due to
   6945      poor organisation. For example pem_all.c contains every PEM function
   6946      which has a knock on effect of linking in large amounts of (unused)
   6947      ASN1 code. Grouping together similar functions and splitting unrelated
   6948      functions prevents this.
   6949      [Steve Henson]
   6950 
   6951   *) Cleanup of EVP macros.
   6952      [Ben Laurie]
   6953 
   6954   *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
   6955      correct _ecb suffix.
   6956      [Ben Laurie]
   6957 
   6958   *) Add initial OCSP responder support to ocsp application. The
   6959      revocation information is handled using the text based index
   6960      use by the ca application. The responder can either handle
   6961      requests generated internally, supplied in files (for example
   6962      via a CGI script) or using an internal minimal server.
   6963      [Steve Henson]
   6964 
   6965   *) Add configuration choices to get zlib compression for TLS.
   6966      [Richard Levitte]
   6967 
   6968   *) Changes to Kerberos SSL for RFC 2712 compliance:
   6969      1.  Implemented real KerberosWrapper, instead of just using
   6970          KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw (a] sxw.org.uk>]
   6971      2.  Implemented optional authenticator field of KerberosWrapper.
   6972 
   6973      Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
   6974      and authenticator structs; see crypto/krb5/.
   6975 
   6976      Generalized Kerberos calls to support multiple Kerberos libraries.
   6977      [Vern Staats <staatsvr (a] asc.hpc.mil>,
   6978       Jeffrey Altman <jaltman (a] columbia.edu>
   6979       via Richard Levitte]
   6980 
   6981   *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
   6982      already does with RSA. testdsa.h now has 'priv_key/pub_key'
   6983      values for each of the key sizes rather than having just
   6984      parameters (and 'speed' generating keys each time).
   6985      [Geoff Thorpe]
   6986 
   6987   *) Speed up EVP routines.
   6988      Before:
   6989 encrypt
   6990 type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
   6991 des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
   6992 des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
   6993 des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
   6994 decrypt
   6995 des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
   6996 des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
   6997 des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
   6998      After:
   6999 encrypt
   7000 des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
   7001 decrypt
   7002 des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   7003      [Ben Laurie]
   7004 
   7005   *) Added the OS2-EMX target.
   7006      ["Brian Havard" <brianh (a] kheldar.apana.org.au> and Richard Levitte]
   7007 
   7008   *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
   7009      to support NCONF routines in extension code. New function CONF_set_nconf()
   7010      to allow functions which take an NCONF to also handle the old LHASH
   7011      structure: this means that the old CONF compatible routines can be
   7012      retained (in particular wrt extensions) without having to duplicate the
   7013      code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
   7014      [Steve Henson]
   7015 
   7016   *) Enhance the general user interface with mechanisms for inner control
   7017      and with possibilities to have yes/no kind of prompts.
   7018      [Richard Levitte]
   7019 
   7020   *) Change all calls to low level digest routines in the library and
   7021      applications to use EVP. Add missing calls to HMAC_cleanup() and
   7022      don't assume HMAC_CTX can be copied using memcpy().
   7023      [Verdon Walker <VWalker (a] novell.com>, Steve Henson]
   7024 
   7025   *) Add the possibility to control engines through control names but with
   7026      arbitrary arguments instead of just a string.
   7027      Change the key loaders to take a UI_METHOD instead of a callback
   7028      function pointer.  NOTE: this breaks binary compatibility with earlier
   7029      versions of OpenSSL [engine].
   7030      Adapt the nCipher code for these new conditions and add a card insertion
   7031      callback.
   7032      [Richard Levitte]
   7033 
   7034   *) Enhance the general user interface with mechanisms to better support
   7035      dialog box interfaces, application-defined prompts, the possibility
   7036      to use defaults (for example default passwords from somewhere else)
   7037      and interrupts/cancellations.
   7038      [Richard Levitte]
   7039 
   7040   *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
   7041      attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
   7042      [Steve Henson]
   7043 
   7044   *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
   7045      tidy up some unnecessarily weird code in 'sk_new()').
   7046      [Geoff, reported by Diego Tartara <dtartara (a] novamens.com>]
   7047 
   7048   *) Change the key loading routines for ENGINEs to use the same kind
   7049      callback (pem_password_cb) as all other routines that need this
   7050      kind of callback.
   7051      [Richard Levitte]
   7052 
   7053   *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
   7054      256 bit (=32 byte) keys. Of course seeding with more entropy bytes
   7055      than this minimum value is recommended.
   7056      [Lutz Jaenicke]
   7057 
   7058   *) New random seeder for OpenVMS, using the system process statistics
   7059      that are easily reachable.
   7060      [Richard Levitte]
   7061 
   7062   *) Windows apparently can't transparently handle global
   7063      variables defined in DLLs. Initialisations such as:
   7064 
   7065         const ASN1_ITEM *it = &ASN1_INTEGER_it;
   7066 
   7067      won't compile. This is used by the any applications that need to
   7068      declare their own ASN1 modules. This was fixed by adding the option
   7069      EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
   7070      needed for static libraries under Win32.
   7071      [Steve Henson]
   7072 
   7073   *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
   7074      setting of purpose and trust fields. New X509_STORE trust and
   7075      purpose functions and tidy up setting in other SSL functions.
   7076      [Steve Henson]
   7077 
   7078   *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
   7079      structure. These are inherited by X509_STORE_CTX when it is 
   7080      initialised. This allows various defaults to be set in the
   7081      X509_STORE structure (such as flags for CRL checking and custom
   7082      purpose or trust settings) for functions which only use X509_STORE_CTX
   7083      internally such as S/MIME.
   7084 
   7085      Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
   7086      trust settings if they are not set in X509_STORE. This allows X509_STORE
   7087      purposes and trust (in S/MIME for example) to override any set by default.
   7088 
   7089      Add command line options for CRL checking to smime, s_client and s_server
   7090      applications.
   7091      [Steve Henson]
   7092 
   7093   *) Initial CRL based revocation checking. If the CRL checking flag(s)
   7094      are set then the CRL is looked up in the X509_STORE structure and
   7095      its validity and signature checked, then if the certificate is found
   7096      in the CRL the verify fails with a revoked error.
   7097 
   7098      Various new CRL related callbacks added to X509_STORE_CTX structure.
   7099 
   7100      Command line options added to 'verify' application to support this.
   7101 
   7102      This needs some additional work, such as being able to handle multiple
   7103      CRLs with different times, extension based lookup (rather than just
   7104      by subject name) and ultimately more complete V2 CRL extension
   7105      handling.
   7106      [Steve Henson]
   7107 
   7108   *) Add a general user interface API (crypto/ui/).  This is designed
   7109      to replace things like des_read_password and friends (backward
   7110      compatibility functions using this new API are provided).
   7111      The purpose is to remove prompting functions from the DES code
   7112      section as well as provide for prompting through dialog boxes in
   7113      a window system and the like.
   7114      [Richard Levitte]
   7115 
   7116   *) Add "ex_data" support to ENGINE so implementations can add state at a
   7117      per-structure level rather than having to store it globally.
   7118      [Geoff]
   7119 
   7120   *) Make it possible for ENGINE structures to be copied when retrieved by
   7121      ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
   7122      This causes the "original" ENGINE structure to act like a template,
   7123      analogous to the RSA vs. RSA_METHOD type of separation. Because of this
   7124      operational state can be localised to each ENGINE structure, despite the
   7125      fact they all share the same "methods". New ENGINE structures returned in
   7126      this case have no functional references and the return value is the single
   7127      structural reference. This matches the single structural reference returned
   7128      by ENGINE_by_id() normally, when it is incremented on the pre-existing
   7129      ENGINE structure.
   7130      [Geoff]
   7131 
   7132   *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
   7133      needs to match any other type at all we need to manually clear the
   7134      tag cache.
   7135      [Steve Henson]
   7136 
   7137   *) Changes to the "openssl engine" utility to include;
   7138      - verbosity levels ('-v', '-vv', and '-vvv') that provide information
   7139        about an ENGINE's available control commands.
   7140      - executing control commands from command line arguments using the
   7141        '-pre' and '-post' switches. '-post' is only used if '-t' is
   7142        specified and the ENGINE is successfully initialised. The syntax for
   7143        the individual commands are colon-separated, for example;
   7144 	 openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
   7145      [Geoff]
   7146 
   7147   *) New dynamic control command support for ENGINEs. ENGINEs can now
   7148      declare their own commands (numbers), names (strings), descriptions,
   7149      and input types for run-time discovery by calling applications. A
   7150      subset of these commands are implicitly classed as "executable"
   7151      depending on their input type, and only these can be invoked through
   7152      the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
   7153      can be based on user input, config files, etc). The distinction is
   7154      that "executable" commands cannot return anything other than a boolean
   7155      result and can only support numeric or string input, whereas some
   7156      discoverable commands may only be for direct use through
   7157      ENGINE_ctrl(), eg. supporting the exchange of binary data, function
   7158      pointers, or other custom uses. The "executable" commands are to
   7159      support parameterisations of ENGINE behaviour that can be
   7160      unambiguously defined by ENGINEs and used consistently across any
   7161      OpenSSL-based application. Commands have been added to all the
   7162      existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
   7163      control over shared-library paths without source code alterations.
   7164      [Geoff]
   7165 
   7166   *) Changed all ENGINE implementations to dynamically allocate their
   7167      ENGINEs rather than declaring them statically. Apart from this being
   7168      necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
   7169      this also allows the implementations to compile without using the
   7170      internal engine_int.h header.
   7171      [Geoff]
   7172 
   7173   *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
   7174      'const' value. Any code that should be able to modify a RAND_METHOD
   7175      should already have non-const pointers to it (ie. they should only
   7176      modify their own ones).
   7177      [Geoff]
   7178 
   7179   *) Made a variety of little tweaks to the ENGINE code.
   7180      - "atalla" and "ubsec" string definitions were moved from header files
   7181        to C code. "nuron" string definitions were placed in variables
   7182        rather than hard-coded - allowing parameterisation of these values
   7183        later on via ctrl() commands.
   7184      - Removed unused "#if 0"'d code.
   7185      - Fixed engine list iteration code so it uses ENGINE_free() to release
   7186        structural references.
   7187      - Constified the RAND_METHOD element of ENGINE structures.
   7188      - Constified various get/set functions as appropriate and added
   7189        missing functions (including a catch-all ENGINE_cpy that duplicates
   7190        all ENGINE values onto a new ENGINE except reference counts/state).
   7191      - Removed NULL parameter checks in get/set functions. Setting a method
   7192        or function to NULL is a way of cancelling out a previously set
   7193        value.  Passing a NULL ENGINE parameter is just plain stupid anyway
   7194        and doesn't justify the extra error symbols and code.
   7195      - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
   7196        flags from engine_int.h to engine.h.
   7197      - Changed prototypes for ENGINE handler functions (init(), finish(),
   7198        ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
   7199      [Geoff]
   7200 
   7201   *) Implement binary inversion algorithm for BN_mod_inverse in addition
   7202      to the algorithm using long division.  The binary algorithm can be
   7203      used only if the modulus is odd.  On 32-bit systems, it is faster
   7204      only for relatively small moduli (roughly 20-30% for 128-bit moduli,
   7205      roughly 5-15% for 256-bit moduli), so we use it only for moduli
   7206      up to 450 bits.  In 64-bit environments, the binary algorithm
   7207      appears to be advantageous for much longer moduli; here we use it
   7208      for moduli up to 2048 bits.
   7209      [Bodo Moeller]
   7210 
   7211   *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
   7212      could not support the combine flag in choice fields.
   7213      [Steve Henson]
   7214 
   7215   *) Add a 'copy_extensions' option to the 'ca' utility. This copies
   7216      extensions from a certificate request to the certificate.
   7217      [Steve Henson]
   7218 
   7219   *) Allow multiple 'certopt' and 'nameopt' options to be separated
   7220      by commas. Add 'namopt' and 'certopt' options to the 'ca' config
   7221      file: this allows the display of the certificate about to be
   7222      signed to be customised, to allow certain fields to be included
   7223      or excluded and extension details. The old system didn't display
   7224      multicharacter strings properly, omitted fields not in the policy
   7225      and couldn't display additional details such as extensions.
   7226      [Steve Henson]
   7227 
   7228   *) Function EC_POINTs_mul for multiple scalar multiplication
   7229      of an arbitrary number of elliptic curve points
   7230           \sum scalars[i]*points[i],
   7231      optionally including the generator defined for the EC_GROUP:
   7232           scalar*generator +  \sum scalars[i]*points[i].
   7233 
   7234      EC_POINT_mul is a simple wrapper function for the typical case
   7235      that the point list has just one item (besides the optional
   7236      generator).
   7237      [Bodo Moeller]
   7238 
   7239   *) First EC_METHODs for curves over GF(p):
   7240 
   7241      EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
   7242      operations and provides various method functions that can also
   7243      operate with faster implementations of modular arithmetic.     
   7244 
   7245      EC_GFp_mont_method() reuses most functions that are part of
   7246      EC_GFp_simple_method, but uses Montgomery arithmetic.
   7247 
   7248      [Bodo Moeller; point addition and point doubling
   7249      implementation directly derived from source code provided by
   7250      Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>]
   7251 
   7252   *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
   7253      crypto/ec/ec_lib.c):
   7254 
   7255      Curves are EC_GROUP objects (with an optional group generator)
   7256      based on EC_METHODs that are built into the library.
   7257 
   7258      Points are EC_POINT objects based on EC_GROUP objects.
   7259 
   7260      Most of the framework would be able to handle curves over arbitrary
   7261      finite fields, but as there are no obvious types for fields other
   7262      than GF(p), some functions are limited to that for now.
   7263      [Bodo Moeller]
   7264 
   7265   *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
   7266      that the file contains a complete HTTP response.
   7267      [Richard Levitte]
   7268 
   7269   *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
   7270      change the def and num file printf format specifier from "%-40sXXX"
   7271      to "%-39s XXX". The latter will always guarantee a space after the
   7272      field while the former will cause them to run together if the field
   7273      is 40 of more characters long.
   7274      [Steve Henson]
   7275 
   7276   *) Constify the cipher and digest 'method' functions and structures
   7277      and modify related functions to take constant EVP_MD and EVP_CIPHER
   7278      pointers.
   7279      [Steve Henson]
   7280 
   7281   *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
   7282      in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
   7283      [Bodo Moeller]
   7284 
   7285   *) Modify EVP_Digest*() routines so they now return values. Although the
   7286      internal software routines can never fail additional hardware versions
   7287      might.
   7288      [Steve Henson]
   7289 
   7290   *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
   7291 
   7292      Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
   7293      (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
   7294 
   7295      ASN1 error codes
   7296           ERR_R_NESTED_ASN1_ERROR
   7297           ...
   7298           ERR_R_MISSING_ASN1_EOS
   7299      were 4 .. 9, conflicting with
   7300           ERR_LIB_RSA (= ERR_R_RSA_LIB)
   7301           ...
   7302           ERR_LIB_PEM (= ERR_R_PEM_LIB).
   7303      They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
   7304 
   7305      Add new error code 'ERR_R_INTERNAL_ERROR'.
   7306      [Bodo Moeller]
   7307 
   7308   *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
   7309      suffices.
   7310      [Bodo Moeller]
   7311 
   7312   *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
   7313      sets the subject name for a new request or supersedes the
   7314      subject name in a given request. Formats that can be parsed are
   7315           'CN=Some Name, OU=myOU, C=IT'
   7316      and
   7317           'CN=Some Name/OU=myOU/C=IT'.
   7318 
   7319      Add options '-batch' and '-verbose' to 'openssl req'.
   7320      [Massimiliano Pala <madwolf (a] hackmasters.net>]
   7321 
   7322   *) Introduce the possibility to access global variables through
   7323      functions on platform were that's the best way to handle exporting
   7324      global variables in shared libraries.  To enable this functionality,
   7325      one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
   7326      "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
   7327      is normally done by Configure or something similar).
   7328 
   7329      To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
   7330      in the source file (foo.c) like this:
   7331 
   7332 	OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
   7333 	OPENSSL_IMPLEMENT_GLOBAL(double,bar);
   7334 
   7335      To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
   7336      and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
   7337 
   7338 	OPENSSL_DECLARE_GLOBAL(int,foo);
   7339 	#define foo OPENSSL_GLOBAL_REF(foo)
   7340 	OPENSSL_DECLARE_GLOBAL(double,bar);
   7341 	#define bar OPENSSL_GLOBAL_REF(bar)
   7342 
   7343      The #defines are very important, and therefore so is including the
   7344      header file everywhere where the defined globals are used.
   7345 
   7346      The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
   7347      of ASN.1 items, but that structure is a bit different.
   7348 
   7349      The largest change is in util/mkdef.pl which has been enhanced with
   7350      better and easier to understand logic to choose which symbols should
   7351      go into the Windows .def files as well as a number of fixes and code
   7352      cleanup (among others, algorithm keywords are now sorted
   7353      lexicographically to avoid constant rewrites).
   7354      [Richard Levitte]
   7355 
   7356   *) In BN_div() keep a copy of the sign of 'num' before writing the
   7357      result to 'rm' because if rm==num the value will be overwritten
   7358      and produce the wrong result if 'num' is negative: this caused
   7359      problems with BN_mod() and BN_nnmod().
   7360      [Steve Henson]
   7361 
   7362   *) Function OCSP_request_verify(). This checks the signature on an
   7363      OCSP request and verifies the signer certificate. The signer
   7364      certificate is just checked for a generic purpose and OCSP request
   7365      trust settings.
   7366      [Steve Henson]
   7367 
   7368   *) Add OCSP_check_validity() function to check the validity of OCSP
   7369      responses. OCSP responses are prepared in real time and may only
   7370      be a few seconds old. Simply checking that the current time lies
   7371      between thisUpdate and nextUpdate max reject otherwise valid responses
   7372      caused by either OCSP responder or client clock inaccuracy. Instead
   7373      we allow thisUpdate and nextUpdate to fall within a certain period of
   7374      the current time. The age of the response can also optionally be
   7375      checked. Two new options -validity_period and -status_age added to
   7376      ocsp utility.
   7377      [Steve Henson]
   7378 
   7379   *) If signature or public key algorithm is unrecognized print out its
   7380      OID rather that just UNKNOWN.
   7381      [Steve Henson]
   7382 
   7383   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
   7384      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
   7385      ID to be generated from the issuer certificate alone which can then be
   7386      passed to OCSP_id_issuer_cmp().
   7387      [Steve Henson]
   7388 
   7389   *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
   7390      ASN1 modules to export functions returning ASN1_ITEM pointers
   7391      instead of the ASN1_ITEM structures themselves. This adds several
   7392      new macros which allow the underlying ASN1 function/structure to
   7393      be accessed transparently. As a result code should not use ASN1_ITEM
   7394      references directly (such as &X509_it) but instead use the relevant
   7395      macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
   7396      use of the new ASN1 code on platforms where exporting structures
   7397      is problematical (for example in shared libraries) but exporting
   7398      functions returning pointers to structures is not.
   7399      [Steve Henson]
   7400 
   7401   *) Add support for overriding the generation of SSL/TLS session IDs.
   7402      These callbacks can be registered either in an SSL_CTX or per SSL.
   7403      The purpose of this is to allow applications to control, if they wish,
   7404      the arbitrary values chosen for use as session IDs, particularly as it
   7405      can be useful for session caching in multiple-server environments. A
   7406      command-line switch for testing this (and any client code that wishes
   7407      to use such a feature) has been added to "s_server".
   7408      [Geoff Thorpe, Lutz Jaenicke]
   7409 
   7410   *) Modify mkdef.pl to recognise and parse preprocessor conditionals
   7411      of the form '#if defined(...) || defined(...) || ...' and
   7412      '#if !defined(...) && !defined(...) && ...'.  This also avoids
   7413      the growing number of special cases it was previously handling.
   7414      [Richard Levitte]
   7415 
   7416   *) Make all configuration macros available for application by making
   7417      sure they are available in opensslconf.h, by giving them names starting
   7418      with "OPENSSL_" to avoid conflicts with other packages and by making
   7419      sure e_os2.h will cover all platform-specific cases together with
   7420      opensslconf.h.
   7421      Additionally, it is now possible to define configuration/platform-
   7422      specific names (called "system identities").  In the C code, these
   7423      are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
   7424      macro with the name beginning with "OPENSSL_SYS_", which is determined
   7425      from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
   7426      what is available.
   7427      [Richard Levitte]
   7428 
   7429   *) New option -set_serial to 'req' and 'x509' this allows the serial
   7430      number to use to be specified on the command line. Previously self
   7431      signed certificates were hard coded with serial number 0 and the 
   7432      CA options of 'x509' had to use a serial number in a file which was
   7433      auto incremented.
   7434      [Steve Henson]
   7435 
   7436   *) New options to 'ca' utility to support V2 CRL entry extensions.
   7437      Currently CRL reason, invalidity date and hold instruction are
   7438      supported. Add new CRL extensions to V3 code and some new objects.
   7439      [Steve Henson]
   7440 
   7441   *) New function EVP_CIPHER_CTX_set_padding() this is used to
   7442      disable standard block padding (aka PKCS#5 padding) in the EVP
   7443      API, which was previously mandatory. This means that the data is
   7444      not padded in any way and so the total length much be a multiple
   7445      of the block size, otherwise an error occurs.
   7446      [Steve Henson]
   7447 
   7448   *) Initial (incomplete) OCSP SSL support.
   7449      [Steve Henson]
   7450 
   7451   *) New function OCSP_parse_url(). This splits up a URL into its host,
   7452      port and path components: primarily to parse OCSP URLs. New -url
   7453      option to ocsp utility.
   7454      [Steve Henson]
   7455 
   7456   *) New nonce behavior. The return value of OCSP_check_nonce() now 
   7457      reflects the various checks performed. Applications can decide
   7458      whether to tolerate certain situations such as an absent nonce
   7459      in a response when one was present in a request: the ocsp application
   7460      just prints out a warning. New function OCSP_add1_basic_nonce()
   7461      this is to allow responders to include a nonce in a response even if
   7462      the request is nonce-less.
   7463      [Steve Henson]
   7464 
   7465   *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
   7466      skipped when using openssl x509 multiple times on a single input file,
   7467      e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
   7468      [Bodo Moeller]
   7469 
   7470   *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
   7471      set string type: to handle setting ASN1_TIME structures. Fix ca
   7472      utility to correctly initialize revocation date of CRLs.
   7473      [Steve Henson]
   7474 
   7475   *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
   7476      the clients preferred ciphersuites and rather use its own preferences.
   7477      Should help to work around M$ SGC (Server Gated Cryptography) bug in
   7478      Internet Explorer by ensuring unchanged hash method during stepup.
   7479      (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
   7480      [Lutz Jaenicke]
   7481 
   7482   *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
   7483      to aes and add a new 'exist' option to print out symbols that don't
   7484      appear to exist.
   7485      [Steve Henson]
   7486 
   7487   *) Additional options to ocsp utility to allow flags to be set and
   7488      additional certificates supplied.
   7489      [Steve Henson]
   7490 
   7491   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
   7492      OCSP client a number of certificate to only verify the response
   7493      signature against.
   7494      [Richard Levitte]
   7495 
   7496   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
   7497      handle the new API. Currently only ECB, CBC modes supported. Add new
   7498      AES OIDs.
   7499 
   7500      Add TLS AES ciphersuites as described in RFC3268, "Advanced
   7501      Encryption Standard (AES) Ciphersuites for Transport Layer
   7502      Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
   7503      not enabled by default and were not part of the "ALL" ciphersuite
   7504      alias because they were not yet official; they could be
   7505      explicitly requested by specifying the "AESdraft" ciphersuite
   7506      group alias.  In the final release of OpenSSL 0.9.7, the group
   7507      alias is called "AES" and is part of "ALL".)
   7508      [Ben Laurie, Steve  Henson, Bodo Moeller]
   7509 
   7510   *) New function OCSP_copy_nonce() to copy nonce value (if present) from
   7511      request to response.
   7512      [Steve Henson]
   7513 
   7514   *) Functions for OCSP responders. OCSP_request_onereq_count(),
   7515      OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
   7516      extract information from a certificate request. OCSP_response_create()
   7517      creates a response and optionally adds a basic response structure.
   7518      OCSP_basic_add1_status() adds a complete single response to a basic
   7519      response and returns the OCSP_SINGLERESP structure just added (to allow
   7520      extensions to be included for example). OCSP_basic_add1_cert() adds a
   7521      certificate to a basic response and OCSP_basic_sign() signs a basic
   7522      response with various flags. New helper functions ASN1_TIME_check()
   7523      (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
   7524      (converts ASN1_TIME to GeneralizedTime).
   7525      [Steve Henson]
   7526 
   7527   *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
   7528      in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
   7529      structure from a certificate. X509_pubkey_digest() digests the public_key
   7530      contents: this is used in various key identifiers. 
   7531      [Steve Henson]
   7532 
   7533   *) Make sk_sort() tolerate a NULL argument.
   7534      [Steve Henson reported by Massimiliano Pala <madwolf (a] comune.modena.it>]
   7535 
   7536   *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
   7537      passed by the function are trusted implicitly. If any of them signed the
   7538      response then it is assumed to be valid and is not verified.
   7539      [Steve Henson]
   7540 
   7541   *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
   7542      to data. This was previously part of the PKCS7 ASN1 code. This
   7543      was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
   7544      [Steve Henson, reported by Kenneth R. Robinette
   7545 				<support (a] securenetterm.com>]
   7546 
   7547   *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
   7548      routines: without these tracing memory leaks is very painful.
   7549      Fix leaks in PKCS12 and PKCS7 routines.
   7550      [Steve Henson]
   7551 
   7552   *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
   7553      Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
   7554      effectively meant GeneralizedTime would never be used. Now it
   7555      is initialised to -1 but X509_time_adj() now has to check the value
   7556      and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
   7557      V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
   7558      [Steve Henson, reported by Kenneth R. Robinette
   7559 				<support (a] securenetterm.com>]
   7560 
   7561   *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
   7562      result in a zero length in the ASN1_INTEGER structure which was
   7563      not consistent with the structure when d2i_ASN1_INTEGER() was used
   7564      and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
   7565      to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
   7566      where it did not print out a minus for negative ASN1_INTEGER.
   7567      [Steve Henson]
   7568 
   7569   *) Add summary printout to ocsp utility. The various functions which
   7570      convert status values to strings have been renamed to:
   7571      OCSP_response_status_str(), OCSP_cert_status_str() and
   7572      OCSP_crl_reason_str() and are no longer static. New options
   7573      to verify nonce values and to disable verification. OCSP response
   7574      printout format cleaned up.
   7575      [Steve Henson]
   7576 
   7577   *) Add additional OCSP certificate checks. These are those specified
   7578      in RFC2560. This consists of two separate checks: the CA of the
   7579      certificate being checked must either be the OCSP signer certificate
   7580      or the issuer of the OCSP signer certificate. In the latter case the
   7581      OCSP signer certificate must contain the OCSP signing extended key
   7582      usage. This check is performed by attempting to match the OCSP
   7583      signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
   7584      in the OCSP_CERTID structures of the response.
   7585      [Steve Henson]
   7586 
   7587   *) Initial OCSP certificate verification added to OCSP_basic_verify()
   7588      and related routines. This uses the standard OpenSSL certificate
   7589      verify routines to perform initial checks (just CA validity) and
   7590      to obtain the certificate chain. Then additional checks will be
   7591      performed on the chain. Currently the root CA is checked to see
   7592      if it is explicitly trusted for OCSP signing. This is used to set
   7593      a root CA as a global signing root: that is any certificate that
   7594      chains to that CA is an acceptable OCSP signing certificate.
   7595      [Steve Henson]
   7596 
   7597   *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
   7598      extensions from a separate configuration file.
   7599      As when reading extensions from the main configuration file,
   7600      the '-extensions ...' option may be used for specifying the
   7601      section to use.
   7602      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   7603 
   7604   *) New OCSP utility. Allows OCSP requests to be generated or
   7605      read. The request can be sent to a responder and the output
   7606      parsed, outputed or printed in text form. Not complete yet:
   7607      still needs to check the OCSP response validity.
   7608      [Steve Henson]
   7609 
   7610   *) New subcommands for 'openssl ca':
   7611      'openssl ca -status <serial>' prints the status of the cert with
   7612      the given serial number (according to the index file).
   7613      'openssl ca -updatedb' updates the expiry status of certificates
   7614      in the index file.
   7615      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   7616 
   7617   *) New '-newreq-nodes' command option to CA.pl.  This is like
   7618      '-newreq', but calls 'openssl req' with the '-nodes' option
   7619      so that the resulting key is not encrypted.
   7620      [Damien Miller <djm (a] mindrot.org>]
   7621 
   7622   *) New configuration for the GNU Hurd.
   7623      [Jonathan Bartlett <johnnyb (a] wolfram.com> via Richard Levitte]
   7624 
   7625   *) Initial code to implement OCSP basic response verify. This
   7626      is currently incomplete. Currently just finds the signer's
   7627      certificate and verifies the signature on the response.
   7628      [Steve Henson]
   7629 
   7630   *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
   7631      value of OPENSSLDIR.  This is available via the new '-d' option
   7632      to 'openssl version', and is also included in 'openssl version -a'.
   7633      [Bodo Moeller]
   7634 
   7635   *) Allowing defining memory allocation callbacks that will be given
   7636      file name and line number information in additional arguments
   7637      (a const char* and an int).  The basic functionality remains, as
   7638      well as the original possibility to just replace malloc(),
   7639      realloc() and free() by functions that do not know about these
   7640      additional arguments.  To register and find out the current
   7641      settings for extended allocation functions, the following
   7642      functions are provided:
   7643 
   7644 	CRYPTO_set_mem_ex_functions
   7645 	CRYPTO_set_locked_mem_ex_functions
   7646 	CRYPTO_get_mem_ex_functions
   7647 	CRYPTO_get_locked_mem_ex_functions
   7648 
   7649      These work the same way as CRYPTO_set_mem_functions and friends.
   7650      CRYPTO_get_[locked_]mem_functions now writes 0 where such an
   7651      extended allocation function is enabled.
   7652      Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
   7653      a conventional allocation function is enabled.
   7654      [Richard Levitte, Bodo Moeller]
   7655 
   7656   *) Finish off removing the remaining LHASH function pointer casts.
   7657      There should no longer be any prototype-casting required when using
   7658      the LHASH abstraction, and any casts that remain are "bugs". See
   7659      the callback types and macros at the head of lhash.h for details
   7660      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
   7661      [Geoff Thorpe]
   7662 
   7663   *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
   7664      If /dev/[u]random devices are not available or do not return enough
   7665      entropy, EGD style sockets (served by EGD or PRNGD) will automatically
   7666      be queried.
   7667      The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
   7668      /etc/entropy will be queried once each in this sequence, querying stops
   7669      when enough entropy was collected without querying more sockets.
   7670      [Lutz Jaenicke]
   7671 
   7672   *) Change the Unix RAND_poll() variant to be able to poll several
   7673      random devices, as specified by DEVRANDOM, until a sufficient amount
   7674      of data has been collected.   We spend at most 10 ms on each file
   7675      (select timeout) and read in non-blocking mode.  DEVRANDOM now
   7676      defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
   7677      (previously it was just the string "/dev/urandom"), so on typical
   7678      platforms the 10 ms delay will never occur.
   7679      Also separate out the Unix variant to its own file, rand_unix.c.
   7680      For VMS, there's a currently-empty rand_vms.c.
   7681      [Richard Levitte]
   7682 
   7683   *) Move OCSP client related routines to ocsp_cl.c. These
   7684      provide utility functions which an application needing
   7685      to issue a request to an OCSP responder and analyse the
   7686      response will typically need: as opposed to those which an
   7687      OCSP responder itself would need which will be added later.
   7688 
   7689      OCSP_request_sign() signs an OCSP request with an API similar
   7690      to PKCS7_sign(). OCSP_response_status() returns status of OCSP
   7691      response. OCSP_response_get1_basic() extracts basic response
   7692      from response. OCSP_resp_find_status(): finds and extracts status
   7693      information from an OCSP_CERTID structure (which will be created
   7694      when the request structure is built). These are built from lower
   7695      level functions which work on OCSP_SINGLERESP structures but
   7696      won't normally be used unless the application wishes to examine
   7697      extensions in the OCSP response for example.
   7698 
   7699      Replace nonce routines with a pair of functions.
   7700      OCSP_request_add1_nonce() adds a nonce value and optionally
   7701      generates a random value. OCSP_check_nonce() checks the
   7702      validity of the nonce in an OCSP response.
   7703      [Steve Henson]
   7704 
   7705   *) Change function OCSP_request_add() to OCSP_request_add0_id().
   7706      This doesn't copy the supplied OCSP_CERTID and avoids the
   7707      need to free up the newly created id. Change return type
   7708      to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
   7709      This can then be used to add extensions to the request.
   7710      Deleted OCSP_request_new(), since most of its functionality
   7711      is now in OCSP_REQUEST_new() (and the case insensitive name
   7712      clash) apart from the ability to set the request name which
   7713      will be added elsewhere.
   7714      [Steve Henson]
   7715 
   7716   *) Update OCSP API. Remove obsolete extensions argument from
   7717      various functions. Extensions are now handled using the new
   7718      OCSP extension code. New simple OCSP HTTP function which 
   7719      can be used to send requests and parse the response.
   7720      [Steve Henson]
   7721 
   7722   *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
   7723      ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
   7724      uses the special reorder version of SET OF to sort the attributes
   7725      and reorder them to match the encoded order. This resolves a long
   7726      standing problem: a verify on a PKCS7 structure just after signing
   7727      it used to fail because the attribute order did not match the
   7728      encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
   7729      it uses the received order. This is necessary to tolerate some broken
   7730      software that does not order SET OF. This is handled by encoding
   7731      as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
   7732      to produce the required SET OF.
   7733      [Steve Henson]
   7734 
   7735   *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
   7736      OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
   7737      files to get correct declarations of the ASN.1 item variables.
   7738      [Richard Levitte]
   7739 
   7740   *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
   7741      PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
   7742      asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
   7743      NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
   7744      New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
   7745      ASN1_ITEM and no wrapper functions.
   7746      [Steve Henson]
   7747 
   7748   *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
   7749      replace the old function pointer based I/O routines. Change most of
   7750      the *_d2i_bio() and *_d2i_fp() functions to use these.
   7751      [Steve Henson]
   7752 
   7753   *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
   7754      lines, recognice more "algorithms" that can be deselected, and make
   7755      it complain about algorithm deselection that isn't recognised.
   7756      [Richard Levitte]
   7757 
   7758   *) New ASN1 functions to handle dup, sign, verify, digest, pack and
   7759      unpack operations in terms of ASN1_ITEM. Modify existing wrappers
   7760      to use new functions. Add NO_ASN1_OLD which can be set to remove
   7761      some old style ASN1 functions: this can be used to determine if old
   7762      code will still work when these eventually go away.
   7763      [Steve Henson]
   7764 
   7765   *) New extension functions for OCSP structures, these follow the
   7766      same conventions as certificates and CRLs.
   7767      [Steve Henson]
   7768 
   7769   *) New function X509V3_add1_i2d(). This automatically encodes and
   7770      adds an extension. Its behaviour can be customised with various
   7771      flags to append, replace or delete. Various wrappers added for
   7772      certificates and CRLs.
   7773      [Steve Henson]
   7774 
   7775   *) Fix to avoid calling the underlying ASN1 print routine when
   7776      an extension cannot be parsed. Correct a typo in the
   7777      OCSP_SERVICELOC extension. Tidy up print OCSP format.
   7778      [Steve Henson]
   7779 
   7780   *) Make mkdef.pl parse some of the ASN1 macros and add appropriate
   7781      entries for variables.
   7782      [Steve Henson]
   7783 
   7784   *) Add functionality to apps/openssl.c for detecting locking
   7785      problems: As the program is single-threaded, all we have
   7786      to do is register a locking callback using an array for
   7787      storing which locks are currently held by the program.
   7788      [Bodo Moeller]
   7789 
   7790   *) Use a lock around the call to CRYPTO_get_ex_new_index() in
   7791      SSL_get_ex_data_X509_STORE_idx(), which is used in
   7792      ssl_verify_cert_chain() and thus can be called at any time
   7793      during TLS/SSL handshakes so that thread-safety is essential.
   7794      Unfortunately, the ex_data design is not at all suited
   7795      for multi-threaded use, so it probably should be abolished.
   7796      [Bodo Moeller]
   7797 
   7798   *) Added Broadcom "ubsec" ENGINE to OpenSSL.
   7799      [Broadcom, tweaked and integrated by Geoff Thorpe]
   7800 
   7801   *) Move common extension printing code to new function
   7802      X509V3_print_extensions(). Reorganise OCSP print routines and
   7803      implement some needed OCSP ASN1 functions. Add OCSP extensions.
   7804      [Steve Henson]
   7805 
   7806   *) New function X509_signature_print() to remove duplication in some
   7807      print routines.
   7808      [Steve Henson]
   7809 
   7810   *) Add a special meaning when SET OF and SEQUENCE OF flags are both
   7811      set (this was treated exactly the same as SET OF previously). This
   7812      is used to reorder the STACK representing the structure to match the
   7813      encoding. This will be used to get round a problem where a PKCS7
   7814      structure which was signed could not be verified because the STACK
   7815      order did not reflect the encoded order.
   7816      [Steve Henson]
   7817 
   7818   *) Reimplement the OCSP ASN1 module using the new code.
   7819      [Steve Henson]
   7820 
   7821   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
   7822      for its ASN1 operations. The old style function pointers still exist
   7823      for now but they will eventually go away.
   7824      [Steve Henson]
   7825 
   7826   *) Merge in replacement ASN1 code from the ASN1 branch. This almost
   7827      completely replaces the old ASN1 functionality with a table driven
   7828      encoder and decoder which interprets an ASN1_ITEM structure describing
   7829      the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
   7830      largely maintained. Almost all of the old asn1_mac.h macro based ASN1
   7831      has also been converted to the new form.
   7832      [Steve Henson]
   7833 
   7834   *) Change BN_mod_exp_recp so that negative moduli are tolerated
   7835      (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
   7836      so that BN_mod_exp_mont and BN_mod_exp_mont_word work
   7837      for negative moduli.
   7838      [Bodo Moeller]
   7839 
   7840   *) Fix BN_uadd and BN_usub: Always return non-negative results instead
   7841      of not touching the result's sign bit.
   7842      [Bodo Moeller]
   7843 
   7844   *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
   7845      set.
   7846      [Bodo Moeller]
   7847 
   7848   *) Changed the LHASH code to use prototypes for callbacks, and created
   7849      macros to declare and implement thin (optionally static) functions
   7850      that provide type-safety and avoid function pointer casting for the
   7851      type-specific callbacks.
   7852      [Geoff Thorpe]
   7853 
   7854   *) Added Kerberos Cipher Suites to be used with TLS, as written in
   7855      RFC 2712.
   7856      [Veers Staats <staatsvr (a] asc.hpc.mil>,
   7857       Jeffrey Altman <jaltman (a] columbia.edu>, via Richard Levitte]
   7858 
   7859   *) Reformat the FAQ so the different questions and answers can be divided
   7860      in sections depending on the subject.
   7861      [Richard Levitte]
   7862 
   7863   *) Have the zlib compression code load ZLIB.DLL dynamically under
   7864      Windows.
   7865      [Richard Levitte]
   7866 
   7867   *) New function BN_mod_sqrt for computing square roots modulo a prime
   7868      (using the probabilistic Tonelli-Shanks algorithm unless
   7869      p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
   7870      be handled deterministically).
   7871      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   7872 
   7873   *) Make BN_mod_inverse faster by explicitly handling small quotients
   7874      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
   7875      512 bits], about 30% for larger ones [1024 or 2048 bits].)
   7876      [Bodo Moeller]
   7877 
   7878   *) New function BN_kronecker.
   7879      [Bodo Moeller]
   7880 
   7881   *) Fix BN_gcd so that it works on negative inputs; the result is
   7882      positive unless both parameters are zero.
   7883      Previously something reasonably close to an infinite loop was
   7884      possible because numbers could be growing instead of shrinking
   7885      in the implementation of Euclid's algorithm.
   7886      [Bodo Moeller]
   7887 
   7888   *) Fix BN_is_word() and BN_is_one() macros to take into account the
   7889      sign of the number in question.
   7890 
   7891      Fix BN_is_word(a,w) to work correctly for w == 0.
   7892 
   7893      The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
   7894      because its test if the absolute value of 'a' equals 'w'.
   7895      Note that BN_abs_is_word does *not* handle w == 0 reliably;
   7896      it exists mostly for use in the implementations of BN_is_zero(),
   7897      BN_is_one(), and BN_is_word().
   7898      [Bodo Moeller]
   7899 
   7900   *) New function BN_swap.
   7901      [Bodo Moeller]
   7902 
   7903   *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
   7904      the exponentiation functions are more likely to produce reasonable
   7905      results on negative inputs.
   7906      [Bodo Moeller]
   7907 
   7908   *) Change BN_mod_mul so that the result is always non-negative.
   7909      Previously, it could be negative if one of the factors was negative;
   7910      I don't think anyone really wanted that behaviour.
   7911      [Bodo Moeller]
   7912 
   7913   *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
   7914      (except for exponentiation, which stays in crypto/bn/bn_exp.c,
   7915      and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
   7916      and add new functions:
   7917 
   7918           BN_nnmod
   7919           BN_mod_sqr
   7920           BN_mod_add
   7921           BN_mod_add_quick
   7922           BN_mod_sub
   7923           BN_mod_sub_quick
   7924           BN_mod_lshift1
   7925           BN_mod_lshift1_quick
   7926           BN_mod_lshift
   7927           BN_mod_lshift_quick
   7928 
   7929      These functions always generate non-negative results.
   7930 
   7931      BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
   7932      such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
   7933 
   7934      BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
   7935      BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
   7936      be reduced modulo  m.
   7937      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   7938 
   7939 #if 0
   7940      The following entry accidentally appeared in the CHANGES file
   7941      distributed with OpenSSL 0.9.7.  The modifications described in
   7942      it do *not* apply to OpenSSL 0.9.7.
   7943 
   7944   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   7945      was actually never needed) and in BN_mul().  The removal in BN_mul()
   7946      required a small change in bn_mul_part_recursive() and the addition
   7947      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   7948      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   7949      bn_sub_words() and bn_add_words() except they take arrays with
   7950      differing sizes.
   7951      [Richard Levitte]
   7952 #endif
   7953 
   7954   *) In 'openssl passwd', verify passwords read from the terminal
   7955      unless the '-salt' option is used (which usually means that
   7956      verification would just waste user's time since the resulting
   7957      hash is going to be compared with some given password hash)
   7958      or the new '-noverify' option is used.
   7959 
   7960      This is an incompatible change, but it does not affect
   7961      non-interactive use of 'openssl passwd' (passwords on the command
   7962      line, '-stdin' option, '-in ...' option) and thus should not
   7963      cause any problems.
   7964      [Bodo Moeller]
   7965 
   7966   *) Remove all references to RSAref, since there's no more need for it.
   7967      [Richard Levitte]
   7968 
   7969   *) Make DSO load along a path given through an environment variable
   7970      (SHLIB_PATH) with shl_load().
   7971      [Richard Levitte]
   7972 
   7973   *) Constify the ENGINE code as a result of BIGNUM constification.
   7974      Also constify the RSA code and most things related to it.  In a
   7975      few places, most notable in the depth of the ASN.1 code, ugly
   7976      casts back to non-const were required (to be solved at a later
   7977      time)
   7978      [Richard Levitte]
   7979 
   7980   *) Make it so the openssl application has all engines loaded by default.
   7981      [Richard Levitte]
   7982 
   7983   *) Constify the BIGNUM routines a little more.
   7984      [Richard Levitte]
   7985 
   7986   *) Add the following functions:
   7987 
   7988 	ENGINE_load_cswift()
   7989 	ENGINE_load_chil()
   7990 	ENGINE_load_atalla()
   7991 	ENGINE_load_nuron()
   7992 	ENGINE_load_builtin_engines()
   7993 
   7994      That way, an application can itself choose if external engines that
   7995      are built-in in OpenSSL shall ever be used or not.  The benefit is
   7996      that applications won't have to be linked with libdl or other dso
   7997      libraries unless it's really needed.
   7998 
   7999      Changed 'openssl engine' to load all engines on demand.
   8000      Changed the engine header files to avoid the duplication of some
   8001      declarations (they differed!).
   8002      [Richard Levitte]
   8003 
   8004   *) 'openssl engine' can now list capabilities.
   8005      [Richard Levitte]
   8006 
   8007   *) Better error reporting in 'openssl engine'.
   8008      [Richard Levitte]
   8009 
   8010   *) Never call load_dh_param(NULL) in s_server.
   8011      [Bodo Moeller]
   8012 
   8013   *) Add engine application.  It can currently list engines by name and
   8014      identity, and test if they are actually available.
   8015      [Richard Levitte]
   8016 
   8017   *) Improve RPM specification file by forcing symbolic linking and making
   8018      sure the installed documentation is also owned by root.root.
   8019      [Damien Miller <djm (a] mindrot.org>]
   8020 
   8021   *) Give the OpenSSL applications more possibilities to make use of
   8022      keys (public as well as private) handled by engines.
   8023      [Richard Levitte]
   8024 
   8025   *) Add OCSP code that comes from CertCo.
   8026      [Richard Levitte]
   8027 
   8028   *) Add VMS support for the Rijndael code.
   8029      [Richard Levitte]
   8030 
   8031   *) Added untested support for Nuron crypto accelerator.
   8032      [Ben Laurie]
   8033 
   8034   *) Add support for external cryptographic devices.  This code was
   8035      previously distributed separately as the "engine" branch.
   8036      [Geoff Thorpe, Richard Levitte]
   8037 
   8038   *) Rework the filename-translation in the DSO code. It is now possible to
   8039      have far greater control over how a "name" is turned into a filename
   8040      depending on the operating environment and any oddities about the
   8041      different shared library filenames on each system.
   8042      [Geoff Thorpe]
   8043 
   8044   *) Support threads on FreeBSD-elf in Configure.
   8045      [Richard Levitte]
   8046 
   8047   *) Fix for SHA1 assembly problem with MASM: it produces
   8048      warnings about corrupt line number information when assembling
   8049      with debugging information. This is caused by the overlapping
   8050      of two sections.
   8051      [Bernd Matthes <mainbug (a] celocom.de>, Steve Henson]
   8052 
   8053   *) NCONF changes.
   8054      NCONF_get_number() has no error checking at all.  As a replacement,
   8055      NCONF_get_number_e() is defined (_e for "error checking") and is
   8056      promoted strongly.  The old NCONF_get_number is kept around for
   8057      binary backward compatibility.
   8058      Make it possible for methods to load from something other than a BIO,
   8059      by providing a function pointer that is given a name instead of a BIO.
   8060      For example, this could be used to load configuration data from an
   8061      LDAP server.
   8062      [Richard Levitte]
   8063 
   8064   *) Fix for non blocking accept BIOs. Added new I/O special reason
   8065      BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
   8066      with non blocking I/O was not possible because no retry code was
   8067      implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
   8068      this case.
   8069      [Steve Henson]
   8070 
   8071   *) Added the beginnings of Rijndael support.
   8072      [Ben Laurie]
   8073 
   8074   *) Fix for bug in DirectoryString mask setting. Add support for
   8075      X509_NAME_print_ex() in 'req' and X509_print_ex() function
   8076      to allow certificate printing to more controllable, additional
   8077      'certopt' option to 'x509' to allow new printing options to be
   8078      set.
   8079      [Steve Henson]
   8080 
   8081   *) Clean old EAY MD5 hack from e_os.h.
   8082      [Richard Levitte]
   8083 
   8084  Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
   8085 
   8086   *) Fix null-pointer assignment in do_change_cipher_spec() revealed
   8087      by using the Codenomicon TLS Test Tool (CVE-2004-0079)
   8088      [Joe Orton, Steve Henson]
   8089 
   8090  Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
   8091 
   8092   *) Fix additional bug revealed by the NISCC test suite:
   8093 
   8094      Stop bug triggering large recursion when presented with
   8095      certain ASN.1 tags (CVE-2003-0851)
   8096      [Steve Henson]
   8097 
   8098  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
   8099 
   8100   *) Fix various bugs revealed by running the NISCC test suite:
   8101 
   8102      Stop out of bounds reads in the ASN1 code when presented with
   8103      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   8104      
   8105      If verify callback ignores invalid public key errors don't try to check
   8106      certificate signature with the NULL public key.
   8107 
   8108      [Steve Henson]
   8109 
   8110   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   8111      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   8112      specifications.
   8113      [Steve Henson]
   8114 
   8115   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   8116      extra data after the compression methods not only for TLS 1.0
   8117      but also for SSL 3.0 (as required by the specification).
   8118      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   8119 
   8120   *) Change X509_certificate_type() to mark the key as exported/exportable
   8121      when it's 512 *bits* long, not 512 bytes.
   8122      [Richard Levitte]
   8123 
   8124  Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
   8125 
   8126   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   8127      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   8128      a protocol version number mismatch like a decryption error
   8129      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   8130      [Bodo Moeller]
   8131 
   8132   *) Turn on RSA blinding by default in the default implementation
   8133      to avoid a timing attack. Applications that don't want it can call
   8134      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   8135      They would be ill-advised to do so in most cases.
   8136      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   8137 
   8138   *) Change RSA blinding code so that it works when the PRNG is not
   8139      seeded (in this case, the secret RSA exponent is abused as
   8140      an unpredictable seed -- if it is not unpredictable, there
   8141      is no point in blinding anyway).  Make RSA blinding thread-safe
   8142      by remembering the creator's thread ID in rsa->blinding and
   8143      having all other threads use local one-time blinding factors
   8144      (this requires more computation than sharing rsa->blinding, but
   8145      avoids excessive locking; and if an RSA object is not shared
   8146      between threads, blinding will still be very fast).
   8147      [Bodo Moeller]
   8148 
   8149  Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
   8150 
   8151   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   8152      via timing by performing a MAC computation even if incorrrect
   8153      block cipher padding has been found.  This is a countermeasure
   8154      against active attacks where the attacker has to distinguish
   8155      between bad padding and a MAC verification error. (CVE-2003-0078)
   8156 
   8157      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   8158      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   8159      Martin Vuagnoux (EPFL, Ilion)]
   8160 
   8161  Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
   8162 
   8163   *) New function OPENSSL_cleanse(), which is used to cleanse a section of
   8164      memory from it's contents.  This is done with a counter that will
   8165      place alternating values in each byte.  This can be used to solve
   8166      two issues: 1) the removal of calls to memset() by highly optimizing
   8167      compilers, and 2) cleansing with other values than 0, since those can
   8168      be read through on certain media, for example a swap space on disk.
   8169      [Geoff Thorpe]
   8170 
   8171   *) Bugfix: client side session caching did not work with external caching,
   8172      because the session->cipher setting was not restored when reloading
   8173      from the external cache. This problem was masked, when
   8174      SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
   8175      (Found by Steve Haslam <steve (a] araqnid.ddts.net>.)
   8176      [Lutz Jaenicke]
   8177 
   8178   *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
   8179      length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
   8180      [Zeev Lieber <zeev-l (a] yahoo.com>]
   8181 
   8182   *) Undo an undocumented change introduced in 0.9.6e which caused
   8183      repeated calls to OpenSSL_add_all_ciphers() and 
   8184      OpenSSL_add_all_digests() to be ignored, even after calling
   8185      EVP_cleanup().
   8186      [Richard Levitte]
   8187 
   8188   *) Change the default configuration reader to deal with last line not
   8189      being properly terminated.
   8190      [Richard Levitte]
   8191 
   8192   *) Change X509_NAME_cmp() so it applies the special rules on handling
   8193      DN values that are of type PrintableString, as well as RDNs of type
   8194      emailAddress where the value has the type ia5String.
   8195      [stefank (a] valicert.com via Richard Levitte]
   8196 
   8197   *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
   8198      the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
   8199      doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
   8200      the bitwise-OR of the two for use by the majority of applications
   8201      wanting this behaviour, and update the docs. The documented
   8202      behaviour and actual behaviour were inconsistent and had been
   8203      changing anyway, so this is more a bug-fix than a behavioural
   8204      change.
   8205      [Geoff Thorpe, diagnosed by Nadav Har'El]
   8206 
   8207   *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
   8208      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
   8209      [Bodo Moeller]
   8210 
   8211   *) Fix initialization code race conditions in
   8212         SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
   8213         SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
   8214         SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
   8215         TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
   8216         ssl2_get_cipher_by_char(),
   8217         ssl3_get_cipher_by_char().
   8218      [Patrick McCormick <patrick (a] tellme.com>, Bodo Moeller]
   8219 
   8220   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
   8221      the cached sessions are flushed, as the remove_cb() might use ex_data
   8222      contents. Bug found by Sam Varshavchik <mrsam (a] courier-mta.com>
   8223      (see [openssl.org #212]).
   8224      [Geoff Thorpe, Lutz Jaenicke]
   8225 
   8226   *) Fix typo in OBJ_txt2obj which incorrectly passed the content
   8227      length, instead of the encoding length to d2i_ASN1_OBJECT.
   8228      [Steve Henson]
   8229 
   8230  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
   8231 
   8232   *) [In 0.9.6g-engine release:]
   8233      Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
   8234      [Lynn Gazis <lgazis (a] rainbow.com>]
   8235 
   8236  Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
   8237 
   8238   *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
   8239      and get fix the header length calculation.
   8240      [Florian Weimer <Weimer (a] CERT.Uni-Stuttgart.DE>,
   8241 	Alon Kantor <alonk (a] checkpoint.com> (and others),
   8242 	Steve Henson]
   8243 
   8244   *) Use proper error handling instead of 'assertions' in buffer
   8245      overflow checks added in 0.9.6e.  This prevents DoS (the
   8246      assertions could call abort()).
   8247      [Arne Ansper <arne (a] ats.cyber.ee>, Bodo Moeller]
   8248 
   8249  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
   8250 
   8251   *) Add various sanity checks to asn1_get_length() to reject
   8252      the ASN1 length bytes if they exceed sizeof(long), will appear
   8253      negative or the content length exceeds the length of the
   8254      supplied buffer.
   8255      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   8256 
   8257   *) Fix cipher selection routines: ciphers without encryption had no flags
   8258      for the cipher strength set and where therefore not handled correctly
   8259      by the selection routines (PR #130).
   8260      [Lutz Jaenicke]
   8261 
   8262   *) Fix EVP_dsa_sha macro.
   8263      [Nils Larsch]
   8264 
   8265   *) New option
   8266           SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
   8267      for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
   8268      that was added in OpenSSL 0.9.6d.
   8269 
   8270      As the countermeasure turned out to be incompatible with some
   8271      broken SSL implementations, the new option is part of SSL_OP_ALL.
   8272      SSL_OP_ALL is usually employed when compatibility with weird SSL
   8273      implementations is desired (e.g. '-bugs' option to 's_client' and
   8274      's_server'), so the new option is automatically set in many
   8275      applications.
   8276      [Bodo Moeller]
   8277 
   8278   *) Changes in security patch:
   8279 
   8280      Changes marked "(CHATS)" were sponsored by the Defense Advanced
   8281      Research Projects Agency (DARPA) and Air Force Research Laboratory,
   8282      Air Force Materiel Command, USAF, under agreement number
   8283      F30602-01-2-0537.
   8284 
   8285   *) Add various sanity checks to asn1_get_length() to reject
   8286      the ASN1 length bytes if they exceed sizeof(long), will appear
   8287      negative or the content length exceeds the length of the
   8288      supplied buffer. (CVE-2002-0659)
   8289      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   8290 
   8291   *) Assertions for various potential buffer overflows, not known to
   8292      happen in practice.
   8293      [Ben Laurie (CHATS)]
   8294 
   8295   *) Various temporary buffers to hold ASCII versions of integers were
   8296      too small for 64 bit platforms. (CVE-2002-0655)
   8297      [Matthew Byng-Maddick <mbm (a] aldigital.co.uk> and Ben Laurie (CHATS)>
   8298 
   8299   *) Remote buffer overflow in SSL3 protocol - an attacker could
   8300      supply an oversized session ID to a client. (CVE-2002-0656)
   8301      [Ben Laurie (CHATS)]
   8302 
   8303   *) Remote buffer overflow in SSL2 protocol - an attacker could
   8304      supply an oversized client master key. (CVE-2002-0656)
   8305      [Ben Laurie (CHATS)]
   8306 
   8307  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
   8308 
   8309   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
   8310      encoded as NULL) with id-dsa-with-sha1.
   8311      [Nils Larsch <nla (a] trustcenter.de>; problem pointed out by Bodo Moeller]
   8312 
   8313   *) Check various X509_...() return values in apps/req.c.
   8314      [Nils Larsch <nla (a] trustcenter.de>]
   8315 
   8316   *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
   8317      an end-of-file condition would erroneously be flagged, when the CRLF
   8318      was just at the end of a processed block. The bug was discovered when
   8319      processing data through a buffering memory BIO handing the data to a
   8320      BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
   8321      <ptsekov (a] syntrex.com> and Nedelcho Stanev.
   8322      [Lutz Jaenicke]
   8323 
   8324   *) Implement a countermeasure against a vulnerability recently found
   8325      in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
   8326      before application data chunks to avoid the use of known IVs
   8327      with data potentially chosen by the attacker.
   8328      [Bodo Moeller]
   8329 
   8330   *) Fix length checks in ssl3_get_client_hello().
   8331      [Bodo Moeller]
   8332 
   8333   *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
   8334      to prevent ssl3_read_internal() from incorrectly assuming that
   8335      ssl3_read_bytes() found application data while handshake
   8336      processing was enabled when in fact s->s3->in_read_app_data was
   8337      merely automatically cleared during the initial handshake.
   8338      [Bodo Moeller; problem pointed out by Arne Ansper <arne (a] ats.cyber.ee>]
   8339 
   8340   *) Fix object definitions for Private and Enterprise: they were not
   8341      recognized in their shortname (=lowercase) representation. Extend
   8342      obj_dat.pl to issue an error when using undefined keywords instead
   8343      of silently ignoring the problem (Svenning Sorensen
   8344      <sss (a] sss.dnsalias.net>).
   8345      [Lutz Jaenicke]
   8346 
   8347   *) Fix DH_generate_parameters() so that it works for 'non-standard'
   8348      generators, i.e. generators other than 2 and 5.  (Previously, the
   8349      code did not properly initialise the 'add' and 'rem' values to
   8350      BN_generate_prime().)
   8351 
   8352      In the new general case, we do not insist that 'generator' is
   8353      actually a primitive root: This requirement is rather pointless;
   8354      a generator of the order-q subgroup is just as good, if not
   8355      better.
   8356      [Bodo Moeller]
   8357  
   8358   *) Map new X509 verification errors to alerts. Discovered and submitted by
   8359      Tom Wu <tom (a] arcot.com>.
   8360      [Lutz Jaenicke]
   8361 
   8362   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
   8363      returning non-zero before the data has been completely received
   8364      when using non-blocking I/O.
   8365      [Bodo Moeller; problem pointed out by John Hughes]
   8366 
   8367   *) Some of the ciphers missed the strength entry (SSL_LOW etc).
   8368      [Ben Laurie, Lutz Jaenicke]
   8369 
   8370   *) Fix bug in SSL_clear(): bad sessions were not removed (found by
   8371      Yoram Zahavi <YoramZ (a] gilian.com>).
   8372      [Lutz Jaenicke]
   8373 
   8374   *) Add information about CygWin 1.3 and on, and preserve proper
   8375      configuration for the versions before that.
   8376      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   8377 
   8378   *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
   8379      check whether we deal with a copy of a session and do not delete from
   8380      the cache in this case. Problem reported by "Izhar Shoshani Levi"
   8381      <izhar (a] checkpoint.com>.
   8382      [Lutz Jaenicke]
   8383 
   8384   *) Do not store session data into the internal session cache, if it
   8385      is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
   8386      flag is set). Proposed by Aslam <aslam (a] funk.com>.
   8387      [Lutz Jaenicke]
   8388 
   8389   *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
   8390      value is 0.
   8391      [Richard Levitte]
   8392 
   8393   *) [In 0.9.6d-engine release:]
   8394      Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   8395      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   8396 
   8397   *) Add the configuration target linux-s390x.
   8398      [Neale Ferguson <Neale.Ferguson (a] SoftwareAG-USA.com> via Richard Levitte]
   8399 
   8400   *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
   8401      ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
   8402      variable as an indication that a ClientHello message has been
   8403      received.  As the flag value will be lost between multiple
   8404      invocations of ssl3_accept when using non-blocking I/O, the
   8405      function may not be aware that a handshake has actually taken
   8406      place, thus preventing a new session from being added to the
   8407      session cache.
   8408 
   8409      To avoid this problem, we now set s->new_session to 2 instead of
   8410      using a local variable.
   8411      [Lutz Jaenicke, Bodo Moeller]
   8412 
   8413   *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
   8414      if the SSL_R_LENGTH_MISMATCH error is detected.
   8415      [Geoff Thorpe, Bodo Moeller]
   8416 
   8417   *) New 'shared_ldflag' column in Configure platform table.
   8418      [Richard Levitte]
   8419 
   8420   *) Fix EVP_CIPHER_mode macro.
   8421      ["Dan S. Camper" <dan (a] bti.net>]
   8422 
   8423   *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
   8424      type, we must throw them away by setting rr->length to 0.
   8425      [D P Chang <dpc (a] qualys.com>]
   8426 
   8427  Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
   8428 
   8429   *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
   8430      <Dominikus.Scherkl (a] biodata.com>.  (The previous implementation
   8431      worked incorrectly for those cases where  range = 10..._2  and
   8432      3*range  is two bits longer than  range.)
   8433      [Bodo Moeller]
   8434 
   8435   *) Only add signing time to PKCS7 structures if it is not already
   8436      present.
   8437      [Steve Henson]
   8438 
   8439   *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
   8440      OBJ_ld_ce should be OBJ_id_ce.
   8441      Also some ip-pda OIDs in crypto/objects/objects.txt were
   8442      incorrect (cf. RFC 3039).
   8443      [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
   8444 
   8445   *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
   8446      returns early because it has nothing to do.
   8447      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   8448 
   8449   *) [In 0.9.6c-engine release:]
   8450      Fix mutex callback return values in crypto/engine/hw_ncipher.c.
   8451      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   8452 
   8453   *) [In 0.9.6c-engine release:]
   8454      Add support for Cryptographic Appliance's keyserver technology.
   8455      (Use engine 'keyclient')
   8456      [Cryptographic Appliances and Geoff Thorpe]
   8457 
   8458   *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
   8459      is called via tools/c89.sh because arguments have to be
   8460      rearranged (all '-L' options must appear before the first object
   8461      modules).
   8462      [Richard Shapiro <rshapiro (a] abinitio.com>]
   8463 
   8464   *) [In 0.9.6c-engine release:]
   8465      Add support for Broadcom crypto accelerator cards, backported
   8466      from 0.9.7.
   8467      [Broadcom, Nalin Dahyabhai <nalin (a] redhat.com>, Mark Cox]
   8468 
   8469   *) [In 0.9.6c-engine release:]
   8470      Add support for SureWare crypto accelerator cards from 
   8471      Baltimore Technologies.  (Use engine 'sureware')
   8472      [Baltimore Technologies and Mark Cox]
   8473 
   8474   *) [In 0.9.6c-engine release:]
   8475      Add support for crypto accelerator cards from Accelerated
   8476      Encryption Processing, www.aep.ie.  (Use engine 'aep')
   8477      [AEP Inc. and Mark Cox]
   8478 
   8479   *) Add a configuration entry for gcc on UnixWare.
   8480      [Gary Benson <gbenson (a] redhat.com>]
   8481 
   8482   *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
   8483      messages are stored in a single piece (fixed-length part and
   8484      variable-length part combined) and fix various bugs found on the way.
   8485      [Bodo Moeller]
   8486 
   8487   *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
   8488      instead.  BIO_gethostbyname() does not know what timeouts are
   8489      appropriate, so entries would stay in cache even when they have
   8490      become invalid.
   8491      [Bodo Moeller; problem pointed out by Rich Salz <rsalz (a] zolera.com>
   8492 
   8493   *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
   8494      faced with a pathologically small ClientHello fragment that does
   8495      not contain client_version: Instead of aborting with an error,
   8496      simply choose the highest available protocol version (i.e.,
   8497      TLS 1.0 unless it is disabled).  In practice, ClientHello
   8498      messages are never sent like this, but this change gives us
   8499      strictly correct behaviour at least for TLS.
   8500      [Bodo Moeller]
   8501 
   8502   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
   8503      never resets s->method to s->ctx->method when called from within
   8504      one of the SSL handshake functions.
   8505      [Bodo Moeller; problem pointed out by Niko Baric]
   8506 
   8507   *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
   8508      (sent using the client's version number) if client_version is
   8509      smaller than the protocol version in use.  Also change
   8510      ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
   8511      the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
   8512      the client will at least see that alert.
   8513      [Bodo Moeller]
   8514 
   8515   *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
   8516      correctly.
   8517      [Bodo Moeller]
   8518 
   8519   *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
   8520      client receives HelloRequest while in a handshake.
   8521      [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider (a] bjss.co.uk>]
   8522 
   8523   *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
   8524      should end in 'break', not 'goto end' which circumvents various
   8525      cleanups done in state SSL_ST_OK.   But session related stuff
   8526      must be disabled for SSL_ST_OK in the case that we just sent a
   8527      HelloRequest.
   8528 
   8529      Also avoid some overhead by not calling ssl_init_wbio_buffer()
   8530      before just sending a HelloRequest.
   8531      [Bodo Moeller, Eric Rescorla <ekr (a] rtfm.com>]
   8532 
   8533   *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
   8534      reveal whether illegal block cipher padding was found or a MAC
   8535      verification error occurred.  (Neither SSLerr() codes nor alerts
   8536      are directly visible to potential attackers, but the information
   8537      may leak via logfiles.)
   8538 
   8539      Similar changes are not required for the SSL 2.0 implementation
   8540      because the number of padding bytes is sent in clear for SSL 2.0,
   8541      and the extra bytes are just ignored.  However ssl/s2_pkt.c
   8542      failed to verify that the purported number of padding bytes is in
   8543      the legal range.
   8544      [Bodo Moeller]
   8545 
   8546   *) Add OpenUNIX-8 support including shared libraries
   8547      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   8548      [Lutz Jaenicke]
   8549 
   8550   *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
   8551      'wristwatch attack' using huge encoding parameters (cf.
   8552      James H. Manger's CRYPTO 2001 paper).  Note that the
   8553      RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
   8554      encoding parameters and hence was not vulnerable.
   8555      [Bodo Moeller]
   8556 
   8557   *) BN_sqr() bug fix.
   8558      [Ulf Mller, reported by Jim Ellis <jim.ellis (a] cavium.com>]
   8559 
   8560   *) Rabin-Miller test analyses assume uniformly distributed witnesses,
   8561      so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
   8562      followed by modular reduction.
   8563      [Bodo Moeller; pointed out by Adam Young <AYoung1 (a] NCSUS.JNJ.COM>]
   8564 
   8565   *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
   8566      equivalent based on BN_pseudo_rand() instead of BN_rand().
   8567      [Bodo Moeller]
   8568 
   8569   *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
   8570      This function was broken, as the check for a new client hello message
   8571      to handle SGC did not allow these large messages.
   8572      (Tracked down by "Douglas E. Engert" <deengert (a] anl.gov>.)
   8573      [Lutz Jaenicke]
   8574 
   8575   *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
   8576      [Lutz Jaenicke]
   8577 
   8578   *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
   8579      for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton (a] netopia.com>).
   8580      [Lutz Jaenicke]
   8581 
   8582   *) Rework the configuration and shared library support for Tru64 Unix.
   8583      The configuration part makes use of modern compiler features and
   8584      still retains old compiler behavior for those that run older versions
   8585      of the OS.  The shared library support part includes a variant that
   8586      uses the RPATH feature, and is available through the special
   8587      configuration target "alpha-cc-rpath", which will never be selected
   8588      automatically.
   8589      [Tim Mooney <mooney (a] dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
   8590 
   8591   *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
   8592      with the same message size as in ssl3_get_certificate_request().
   8593      Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
   8594      messages might inadvertently be reject as too long.
   8595      [Petr Lampa <lampa (a] fee.vutbr.cz>]
   8596 
   8597   *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
   8598      [Andy Polyakov]
   8599 
   8600   *) Modified SSL library such that the verify_callback that has been set
   8601      specificly for an SSL object with SSL_set_verify() is actually being
   8602      used. Before the change, a verify_callback set with this function was
   8603      ignored and the verify_callback() set in the SSL_CTX at the time of
   8604      the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
   8605      to allow the necessary settings.
   8606      [Lutz Jaenicke]
   8607 
   8608   *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
   8609      explicitly to NULL, as at least on Solaris 8 this seems not always to be
   8610      done automatically (in contradiction to the requirements of the C
   8611      standard). This made problems when used from OpenSSH.
   8612      [Lutz Jaenicke]
   8613 
   8614   *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
   8615      dh->length and always used
   8616 
   8617           BN_rand_range(priv_key, dh->p).
   8618 
   8619      BN_rand_range() is not necessary for Diffie-Hellman, and this
   8620      specific range makes Diffie-Hellman unnecessarily inefficient if
   8621      dh->length (recommended exponent length) is much smaller than the
   8622      length of dh->p.  We could use BN_rand_range() if the order of
   8623      the subgroup was stored in the DH structure, but we only have
   8624      dh->length.
   8625 
   8626      So switch back to
   8627 
   8628           BN_rand(priv_key, l, ...)
   8629 
   8630      where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
   8631      otherwise.
   8632      [Bodo Moeller]
   8633 
   8634   *) In
   8635 
   8636           RSA_eay_public_encrypt
   8637           RSA_eay_private_decrypt
   8638           RSA_eay_private_encrypt (signing)
   8639           RSA_eay_public_decrypt (signature verification)
   8640 
   8641      (default implementations for RSA_public_encrypt,
   8642      RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
   8643      always reject numbers >= n.
   8644      [Bodo Moeller]
   8645 
   8646   *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
   8647      to synchronize access to 'locking_thread'.  This is necessary on
   8648      systems where access to 'locking_thread' (an 'unsigned long'
   8649      variable) is not atomic.
   8650      [Bodo Moeller]
   8651 
   8652   *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
   8653      *before* setting the 'crypto_lock_rand' flag.  The previous code had
   8654      a race condition if 0 is a valid thread ID.
   8655      [Travis Vitek <vitek (a] roguewave.com>]
   8656 
   8657   *) Add support for shared libraries under Irix.
   8658      [Albert Chin-A-Young <china (a] thewrittenword.com>]
   8659 
   8660   *) Add configuration option to build on Linux on both big-endian and
   8661      little-endian MIPS.
   8662      [Ralf Baechle <ralf (a] uni-koblenz.de>]
   8663 
   8664   *) Add the possibility to create shared libraries on HP-UX.
   8665      [Richard Levitte]
   8666 
   8667  Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
   8668 
   8669   *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
   8670      to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
   8671      Markku-Juhani O. Saarinen <markku-juhani.saarinen (a] nokia.com>:
   8672      PRNG state recovery was possible based on the output of
   8673      one PRNG request appropriately sized to gain knowledge on
   8674      'md' followed by enough consecutive 1-byte PRNG requests
   8675      to traverse all of 'state'.
   8676 
   8677      1. When updating 'md_local' (the current thread's copy of 'md')
   8678         during PRNG output generation, hash all of the previous
   8679         'md_local' value, not just the half used for PRNG output.
   8680 
   8681      2. Make the number of bytes from 'state' included into the hash
   8682         independent from the number of PRNG bytes requested.
   8683 
   8684      The first measure alone would be sufficient to avoid
   8685      Markku-Juhani's attack.  (Actually it had never occurred
   8686      to me that the half of 'md_local' used for chaining was the
   8687      half from which PRNG output bytes were taken -- I had always
   8688      assumed that the secret half would be used.)  The second
   8689      measure makes sure that additional data from 'state' is never
   8690      mixed into 'md_local' in small portions; this heuristically
   8691      further strengthens the PRNG.
   8692      [Bodo Moeller]
   8693 
   8694   *) Fix crypto/bn/asm/mips3.s.
   8695      [Andy Polyakov]
   8696 
   8697   *) When only the key is given to "enc", the IV is undefined. Print out
   8698      an error message in this case.
   8699      [Lutz Jaenicke]
   8700 
   8701   *) Handle special case when X509_NAME is empty in X509 printing routines.
   8702      [Steve Henson]
   8703 
   8704   *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
   8705      positive and less than q.
   8706      [Bodo Moeller]
   8707 
   8708   *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
   8709      used: it isn't thread safe and the add_lock_callback should handle
   8710      that itself.
   8711      [Paul Rose <Paul.Rose (a] bridge.com>]
   8712 
   8713   *) Verify that incoming data obeys the block size in
   8714      ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
   8715      [Bodo Moeller]
   8716 
   8717   *) Fix OAEP check.
   8718      [Ulf Mller, Bodo Mller]
   8719 
   8720   *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
   8721      RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
   8722      when fixing the server behaviour for backwards-compatible 'client
   8723      hello' messages.  (Note that the attack is impractical against
   8724      SSL 3.0 and TLS 1.0 anyway because length and version checking
   8725      means that the probability of guessing a valid ciphertext is
   8726      around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
   8727      paper.)
   8728 
   8729      Before 0.9.5, the countermeasure (hide the error by generating a
   8730      random 'decryption result') did not work properly because
   8731      ERR_clear_error() was missing, meaning that SSL_get_error() would
   8732      detect the supposedly ignored error.
   8733 
   8734      Both problems are now fixed.
   8735      [Bodo Moeller]
   8736 
   8737   *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
   8738      (previously it was 1024).
   8739      [Bodo Moeller]
   8740 
   8741   *) Fix for compatibility mode trust settings: ignore trust settings
   8742      unless some valid trust or reject settings are present.
   8743      [Steve Henson]
   8744 
   8745   *) Fix for blowfish EVP: its a variable length cipher.
   8746      [Steve Henson]
   8747 
   8748   *) Fix various bugs related to DSA S/MIME verification. Handle missing
   8749      parameters in DSA public key structures and return an error in the
   8750      DSA routines if parameters are absent.
   8751      [Steve Henson]
   8752 
   8753   *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
   8754      in the current directory if neither $RANDFILE nor $HOME was set.
   8755      RAND_file_name() in 0.9.6a returned NULL in this case.  This has
   8756      caused some confusion to Windows users who haven't defined $HOME.
   8757      Thus RAND_file_name() is changed again: e_os.h can define a
   8758      DEFAULT_HOME, which will be used if $HOME is not set.
   8759      For Windows, we use "C:"; on other platforms, we still require
   8760      environment variables.
   8761 
   8762   *) Move 'if (!initialized) RAND_poll()' into regions protected by
   8763      CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
   8764      having multiple threads call RAND_poll() concurrently.
   8765      [Bodo Moeller]
   8766 
   8767   *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
   8768      combination of a flag and a thread ID variable.
   8769      Otherwise while one thread is in ssleay_rand_bytes (which sets the
   8770      flag), *other* threads can enter ssleay_add_bytes without obeying
   8771      the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
   8772      that they do not hold after the first thread unsets add_do_not_lock).
   8773      [Bodo Moeller]
   8774 
   8775   *) Change bctest again: '-x' expressions are not available in all
   8776      versions of 'test'.
   8777      [Bodo Moeller]
   8778 
   8779  Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
   8780 
   8781   *) Fix a couple of memory leaks in PKCS7_dataDecode()
   8782      [Steve Henson, reported by Heyun Zheng <hzheng (a] atdsprint.com>]
   8783 
   8784   *) Change Configure and Makefiles to provide EXE_EXT, which will contain
   8785      the default extension for executables, if any.  Also, make the perl
   8786      scripts that use symlink() to test if it really exists and use "cp"
   8787      if it doesn't.  All this made OpenSSL compilable and installable in
   8788      CygWin.
   8789      [Richard Levitte]
   8790 
   8791   *) Fix for asn1_GetSequence() for indefinite length constructed data.
   8792      If SEQUENCE is length is indefinite just set c->slen to the total
   8793      amount of data available.
   8794      [Steve Henson, reported by shige (a] FreeBSD.org]
   8795      [This change does not apply to 0.9.7.]
   8796 
   8797   *) Change bctest to avoid here-documents inside command substitution
   8798      (workaround for FreeBSD /bin/sh bug).
   8799      For compatibility with Ultrix, avoid shell functions (introduced
   8800      in the bctest version that searches along $PATH).
   8801      [Bodo Moeller]
   8802 
   8803   *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
   8804      with des_encrypt() defined on some operating systems, like Solaris
   8805      and UnixWare.
   8806      [Richard Levitte]
   8807 
   8808   *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
   8809      On the Importance of Eliminating Errors in Cryptographic
   8810      Computations, J. Cryptology 14 (2001) 2, 101-119,
   8811      http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
   8812      [Ulf Moeller]
   8813   
   8814   *) MIPS assembler BIGNUM division bug fix. 
   8815      [Andy Polyakov]
   8816 
   8817   *) Disabled incorrect Alpha assembler code.
   8818      [Richard Levitte]
   8819 
   8820   *) Fix PKCS#7 decode routines so they correctly update the length
   8821      after reading an EOC for the EXPLICIT tag.
   8822      [Steve Henson]
   8823      [This change does not apply to 0.9.7.]
   8824 
   8825   *) Fix bug in PKCS#12 key generation routines. This was triggered
   8826      if a 3DES key was generated with a 0 initial byte. Include
   8827      PKCS12_BROKEN_KEYGEN compilation option to retain the old
   8828      (but broken) behaviour.
   8829      [Steve Henson]
   8830 
   8831   *) Enhance bctest to search for a working bc along $PATH and print
   8832      it when found.
   8833      [Tim Rice <tim (a] multitalents.net> via Richard Levitte]
   8834 
   8835   *) Fix memory leaks in err.c: free err_data string if necessary;
   8836      don't write to the wrong index in ERR_set_error_data.
   8837      [Bodo Moeller]
   8838 
   8839   *) Implement ssl23_peek (analogous to ssl23_read), which previously
   8840      did not exist.
   8841      [Bodo Moeller]
   8842 
   8843   *) Replace rdtsc with _emit statements for VC++ version 5.
   8844      [Jeremy Cooper <jeremy (a] baymoo.org>]
   8845 
   8846   *) Make it possible to reuse SSLv2 sessions.
   8847      [Richard Levitte]
   8848 
   8849   *) In copy_email() check for >= 0 as a return value for
   8850      X509_NAME_get_index_by_NID() since 0 is a valid index.
   8851      [Steve Henson reported by Massimiliano Pala <madwolf (a] opensca.org>]
   8852 
   8853   *) Avoid coredump with unsupported or invalid public keys by checking if
   8854      X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
   8855      PKCS7_verify() fails with non detached data.
   8856      [Steve Henson]
   8857 
   8858   *) Don't use getenv in library functions when run as setuid/setgid.
   8859      New function OPENSSL_issetugid().
   8860      [Ulf Moeller]
   8861 
   8862   *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
   8863      due to incorrect handling of multi-threading:
   8864 
   8865      1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
   8866 
   8867      2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
   8868 
   8869      3. Count how many times MemCheck_off() has been called so that
   8870         nested use can be treated correctly.  This also avoids 
   8871         inband-signalling in the previous code (which relied on the
   8872         assumption that thread ID 0 is impossible).
   8873      [Bodo Moeller]
   8874 
   8875   *) Add "-rand" option also to s_client and s_server.
   8876      [Lutz Jaenicke]
   8877 
   8878   *) Fix CPU detection on Irix 6.x.
   8879      [Kurt Hockenbury <khockenb (a] stevens-tech.edu> and
   8880       "Bruce W. Forsberg" <bruce.forsberg (a] baesystems.com>]
   8881 
   8882   *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
   8883      was empty.
   8884      [Steve Henson]
   8885      [This change does not apply to 0.9.7.]
   8886 
   8887   *) Use the cached encoding of an X509_NAME structure rather than
   8888      copying it. This is apparently the reason for the libsafe "errors"
   8889      but the code is actually correct.
   8890      [Steve Henson]
   8891 
   8892   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
   8893      Bleichenbacher's DSA attack.
   8894      Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
   8895      to be set and top=0 forces the highest bit to be set; top=-1 is new
   8896      and leaves the highest bit random.
   8897      [Ulf Moeller, Bodo Moeller]
   8898 
   8899   *) In the NCONF_...-based implementations for CONF_... queries
   8900      (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
   8901      a temporary CONF structure with the data component set to NULL
   8902      (which gives segmentation faults in lh_retrieve).
 &