Home | History | Annotate | Line # | Download | only in dist
      2  OpenSSL CHANGES
      3  _______________
      5  This is a high-level summary of the most important changes.
      6  For a full list of changes, see the git commit log; for example,
      7  https://github.com/openssl/openssl/commits/ and pick the appropriate
      8  release branch.
     10  Changes between 1.1.0g and 1.1.0h [27 Mar 2018]
     12   *) Constructed ASN.1 types with a recursive definition could exceed the stack
     14      Constructed ASN.1 types with a recursive definition (such as can be found
     15      in PKCS7) could eventually exceed the stack given malicious input with
     16      excessive recursion. This could result in a Denial Of Service attack. There
     17      are no such structures used within SSL/TLS that come from untrusted sources
     18      so this is considered safe.
     20      This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
     21      project.
     22      (CVE-2018-0739)
     23      [Matt Caswell]
     25   *) Incorrect CRYPTO_memcmp on HP-UX PA-RISC
     27      Because of an implementation bug the PA-RISC CRYPTO_memcmp function is
     28      effectively reduced to only comparing the least significant bit of each
     29      byte. This allows an attacker to forge messages that would be considered as
     30      authenticated in an amount of tries lower than that guaranteed by the
     31      security claims of the scheme. The module can only be compiled by the
     32      HP-UX assembler, so that only HP-UX PA-RISC targets are affected.
     34      This issue was reported to OpenSSL on 2nd March 2018 by Peter Waltenberg
     35      (IBM).
     36      (CVE-2018-0733)
     37      [Andy Polyakov]
     39   *) Add a build target 'build_all_generated', to build all generated files
     40      and only that.  This can be used to prepare everything that requires
     41      things like perl for a system that lacks perl and then move everything
     42      to that system and do the rest of the build there.
     43      [Richard Levitte]
     45   *) Backport SSL_OP_NO_RENGOTIATION
     47      OpenSSL 1.0.2 and below had the ability to disable renegotiation using the
     48      (undocumented) SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag. Due to the opacity
     49      changes this is no longer possible in 1.1.0. Therefore the new
     50      SSL_OP_NO_RENEGOTIATION option from 1.1.1-dev has been backported to
     51      1.1.0 to provide equivalent functionality.
     53      Note that if an application built against 1.1.0h headers (or above) is run
     54      using an older version of 1.1.0 (prior to 1.1.0h) then the option will be
     55      accepted but nothing will happen, i.e. renegotiation will not be prevented.
     56      [Matt Caswell]
     58   *) Removed the OS390-Unix config target.  It relied on a script that doesn't
     59      exist.
     60      [Rich Salz]
     62   *) rsaz_1024_mul_avx2 overflow bug on x86_64
     64      There is an overflow bug in the AVX2 Montgomery multiplication procedure
     65      used in exponentiation with 1024-bit moduli. No EC algorithms are affected.
     66      Analysis suggests that attacks against RSA and DSA as a result of this
     67      defect would be very difficult to perform and are not believed likely.
     68      Attacks against DH1024 are considered just feasible, because most of the
     69      work necessary to deduce information about a private key may be performed
     70      offline. The amount of resources required for such an attack would be
     71      significant. However, for an attack on TLS to be meaningful, the server
     72      would have to share the DH1024 private key among multiple clients, which is
     73      no longer an option since CVE-2016-0701.
     75      This only affects processors that support the AVX2 but not ADX extensions
     76      like Intel Haswell (4th generation).
     78      This issue was reported to OpenSSL by David Benjamin (Google). The issue
     79      was originally found via the OSS-Fuzz project.
     80      (CVE-2017-3738)
     81      [Andy Polyakov]
     83  Changes between 1.1.0f and 1.1.0g [2 Nov 2017]
     85   *) bn_sqrx8x_internal carry bug on x86_64
     87      There is a carry propagating bug in the x86_64 Montgomery squaring
     88      procedure. No EC algorithms are affected. Analysis suggests that attacks
     89      against RSA and DSA as a result of this defect would be very difficult to
     90      perform and are not believed likely. Attacks against DH are considered just
     91      feasible (although very difficult) because most of the work necessary to
     92      deduce information about a private key may be performed offline. The amount
     93      of resources required for such an attack would be very significant and
     94      likely only accessible to a limited number of attackers. An attacker would
     95      additionally need online access to an unpatched system using the target
     96      private key in a scenario with persistent DH parameters and a private
     97      key that is shared between multiple clients.
     99      This only affects processors that support the BMI1, BMI2 and ADX extensions
    100      like Intel Broadwell (5th generation) and later or AMD Ryzen.
    102      This issue was reported to OpenSSL by the OSS-Fuzz project.
    103      (CVE-2017-3736)
    104      [Andy Polyakov]
    106   *) Malformed X.509 IPAddressFamily could cause OOB read
    108      If an X.509 certificate has a malformed IPAddressFamily extension,
    109      OpenSSL could do a one-byte buffer overread. The most likely result
    110      would be an erroneous display of the certificate in text format.
    112      This issue was reported to OpenSSL by the OSS-Fuzz project.
    113      (CVE-2017-3735)
    114      [Rich Salz]
    116   *) Ignore the '-named_curve auto' value for compatibility of applications
    117      with OpenSSL 1.0.2.
    118      [Tomas Mraz <tmraz (a] fedoraproject.org>]
    120   *) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd.
    121      [Emilia Ksper]
    123  Changes between 1.1.0e and 1.1.0f [25 May 2017]
    125   *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
    126      platform rather than 'mingw'.
    127      [Richard Levitte]
    129   *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
    130      VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
    131      which is the minimum version we support.
    132      [Richard Levitte]
    134  Changes between 1.1.0d and 1.1.0e [16 Feb 2017]
    136   *) Encrypt-Then-Mac renegotiation crash
    138      During a renegotiation handshake if the Encrypt-Then-Mac extension is
    139      negotiated where it was not in the original handshake (or vice-versa) then
    140      this can cause OpenSSL to crash (dependant on ciphersuite). Both clients
    141      and servers are affected.
    143      This issue was reported to OpenSSL by Joe Orton (Red Hat).
    144      (CVE-2017-3733)
    145      [Matt Caswell]
    147  Changes between 1.1.0c and 1.1.0d [26 Jan 2017]
    149   *) Truncated packet could crash via OOB read
    151      If one side of an SSL/TLS path is running on a 32-bit host and a specific
    152      cipher is being used, then a truncated packet can cause that host to
    153      perform an out-of-bounds read, usually resulting in a crash.
    155      This issue was reported to OpenSSL by Robert wicki of Google.
    156      (CVE-2017-3731)
    157      [Andy Polyakov]
    159   *) Bad (EC)DHE parameters cause a client crash
    161      If a malicious server supplies bad parameters for a DHE or ECDHE key
    162      exchange then this can result in the client attempting to dereference a
    163      NULL pointer leading to a client crash. This could be exploited in a Denial
    164      of Service attack.
    166      This issue was reported to OpenSSL by Guido Vranken.
    167      (CVE-2017-3730)
    168      [Matt Caswell]
    170   *) BN_mod_exp may produce incorrect results on x86_64
    172      There is a carry propagating bug in the x86_64 Montgomery squaring
    173      procedure. No EC algorithms are affected. Analysis suggests that attacks
    174      against RSA and DSA as a result of this defect would be very difficult to
    175      perform and are not believed likely. Attacks against DH are considered just
    176      feasible (although very difficult) because most of the work necessary to
    177      deduce information about a private key may be performed offline. The amount
    178      of resources required for such an attack would be very significant and
    179      likely only accessible to a limited number of attackers. An attacker would
    180      additionally need online access to an unpatched system using the target
    181      private key in a scenario with persistent DH parameters and a private
    182      key that is shared between multiple clients. For example this can occur by
    183      default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
    184      similar to CVE-2015-3193 but must be treated as a separate problem.
    186      This issue was reported to OpenSSL by the OSS-Fuzz project.
    187      (CVE-2017-3732)
    188      [Andy Polyakov]
    190  Changes between 1.1.0b and 1.1.0c [10 Nov 2016]
    192   *) ChaCha20/Poly1305 heap-buffer-overflow
    194      TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to
    195      a DoS attack by corrupting larger payloads. This can result in an OpenSSL
    196      crash. This issue is not considered to be exploitable beyond a DoS.
    198      This issue was reported to OpenSSL by Robert wicki (Google Security Team)
    199      (CVE-2016-7054)
    200      [Richard Levitte]
    202   *) CMS Null dereference
    204      Applications parsing invalid CMS structures can crash with a NULL pointer
    205      dereference. This is caused by a bug in the handling of the ASN.1 CHOICE
    206      type in OpenSSL 1.1.0 which can result in a NULL value being passed to the
    207      structure callback if an attempt is made to free certain invalid encodings.
    208      Only CHOICE structures using a callback which do not handle NULL value are
    209      affected.
    211      This issue was reported to OpenSSL by Tyler Nighswander of ForAllSecure.
    212      (CVE-2016-7053)
    213      [Stephen Henson]
    215   *) Montgomery multiplication may produce incorrect results
    217      There is a carry propagating bug in the Broadwell-specific Montgomery
    218      multiplication procedure that handles input lengths divisible by, but
    219      longer than 256 bits. Analysis suggests that attacks against RSA, DSA
    220      and DH private keys are impossible. This is because the subroutine in
    221      question is not used in operations with the private key itself and an input
    222      of the attacker's direct choice. Otherwise the bug can manifest itself as
    223      transient authentication and key negotiation failures or reproducible
    224      erroneous outcome of public-key operations with specially crafted input.
    225      Among EC algorithms only Brainpool P-512 curves are affected and one
    226      presumably can attack ECDH key negotiation. Impact was not analyzed in
    227      detail, because pre-requisites for attack are considered unlikely. Namely
    228      multiple clients have to choose the curve in question and the server has to
    229      share the private key among them, neither of which is default behaviour.
    230      Even then only clients that chose the curve will be affected.
    232      This issue was publicly reported as transient failures and was not
    233      initially recognized as a security issue. Thanks to Richard Morgan for
    234      providing reproducible case.
    235      (CVE-2016-7055)
    236      [Andy Polyakov]
    238   *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
    239      or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
    240      prevent issues where no progress is being made and the peer continually
    241      sends unrecognised record types, using up resources processing them.
    242      [Matt Caswell]
    244   *) Removed automatic addition of RPATH in shared libraries and executables,
    245      as this was a remainder from OpenSSL 1.0.x and isn't needed any more.
    246      [Richard Levitte]
    248  Changes between 1.1.0a and 1.1.0b [26 Sep 2016]
    250   *) Fix Use After Free for large message sizes
    252      The patch applied to address CVE-2016-6307 resulted in an issue where if a
    253      message larger than approx 16k is received then the underlying buffer to
    254      store the incoming message is reallocated and moved. Unfortunately a
    255      dangling pointer to the old location is left which results in an attempt to
    256      write to the previously freed location. This is likely to result in a
    257      crash, however it could potentially lead to execution of arbitrary code.
    259      This issue only affects OpenSSL 1.1.0a.
    261      This issue was reported to OpenSSL by Robert wicki.
    262      (CVE-2016-6309)
    263      [Matt Caswell]
    265  Changes between 1.1.0 and 1.1.0a [22 Sep 2016]
    267   *) OCSP Status Request extension unbounded memory growth
    269      A malicious client can send an excessively large OCSP Status Request
    270      extension. If that client continually requests renegotiation, sending a
    271      large OCSP Status Request extension each time, then there will be unbounded
    272      memory growth on the server. This will eventually lead to a Denial Of
    273      Service attack through memory exhaustion. Servers with a default
    274      configuration are vulnerable even if they do not support OCSP. Builds using
    275      the "no-ocsp" build time option are not affected.
    277      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    278      (CVE-2016-6304)
    279      [Matt Caswell]
    281   *) SSL_peek() hang on empty record
    283      OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer
    284      sends an empty record. This could be exploited by a malicious peer in a
    285      Denial Of Service attack.
    287      This issue was reported to OpenSSL by Alex Gaynor.
    288      (CVE-2016-6305)
    289      [Matt Caswell]
    291   *) Excessive allocation of memory in tls_get_message_header() and
    292      dtls1_preprocess_fragment()
    294      A (D)TLS message includes 3 bytes for its length in the header for the
    295      message. This would allow for messages up to 16Mb in length. Messages of
    296      this length are excessive and OpenSSL includes a check to ensure that a
    297      peer is sending reasonably sized messages in order to avoid too much memory
    298      being consumed to service a connection. A flaw in the logic of version
    299      1.1.0 means that memory for the message is allocated too early, prior to
    300      the excessive message length check. Due to way memory is allocated in
    301      OpenSSL this could mean an attacker could force up to 21Mb to be allocated
    302      to service a connection. This could lead to a Denial of Service through
    303      memory exhaustion. However, the excessive message length check still takes
    304      place, and this would cause the connection to immediately fail. Assuming
    305      that the application calls SSL_free() on the failed connection in a timely
    306      manner then the 21Mb of allocated memory will then be immediately freed
    307      again. Therefore the excessive memory allocation will be transitory in
    308      nature. This then means that there is only a security impact if:
    310      1) The application does not call SSL_free() in a timely manner in the event
    311      that the connection fails
    312      or
    313      2) The application is working in a constrained environment where there is
    314      very little free memory
    315      or
    316      3) The attacker initiates multiple connection attempts such that there are
    317      multiple connections in a state where memory has been allocated for the
    318      connection; SSL_free() has not yet been called; and there is insufficient
    319      memory to service the multiple requests.
    321      Except in the instance of (1) above any Denial Of Service is likely to be
    322      transitory because as soon as the connection fails the memory is
    323      subsequently freed again in the SSL_free() call. However there is an
    324      increased risk during this period of application crashes due to the lack of
    325      memory - which would then mean a more serious Denial of Service.
    327      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    328      (CVE-2016-6307 and CVE-2016-6308)
    329      [Matt Caswell]
    331   *) solaris-x86-cc, i.e. 32-bit configuration with vendor compiler,
    332      had to be removed. Primary reason is that vendor assembler can't
    333      assemble our modules with -KPIC flag. As result it, assembly
    334      support, was not even available as option. But its lack means
    335      lack of side-channel resistant code, which is incompatible with
    336      security by todays standards. Fortunately gcc is readily available
    337      prepackaged option, which we firmly point at...
    338      [Andy Polyakov]
    340  Changes between 1.0.2h and 1.1.0  [25 Aug 2016]
    342   *) Windows command-line tool supports UTF-8 opt-in option for arguments
    343      and console input. Setting OPENSSL_WIN32_UTF8 environment variable
    344      (to any value) allows Windows user to access PKCS#12 file generated
    345      with Windows CryptoAPI and protected with non-ASCII password, as well
    346      as files generated under UTF-8 locale on Linux also protected with
    347      non-ASCII password.
    348      [Andy Polyakov]
    350   *) To mitigate the SWEET32 attack (CVE-2016-2183), 3DES cipher suites
    351      have been disabled by default and removed from DEFAULT, just like RC4.
    352      See the RC4 item below to re-enable both.
    353      [Rich Salz]
    355   *) The method for finding the storage location for the Windows RAND seed file
    356      has changed. First we check %RANDFILE%. If that is not set then we check
    357      the directories %HOME%, %USERPROFILE% and %SYSTEMROOT% in that order. If
    358      all else fails we fall back to C:\.
    359      [Matt Caswell]
    361   *) The EVP_EncryptUpdate() function has had its return type changed from void
    362      to int. A return of 0 indicates and error while a return of 1 indicates
    363      success.
    364      [Matt Caswell]
    367      DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch
    368      off the constant time implementation for RSA, DSA and DH have been made
    369      no-ops and deprecated.
    370      [Matt Caswell]
    372   *) Windows RAND implementation was simplified to only get entropy by
    373      calling CryptGenRandom(). Various other RAND-related tickets
    374      were also closed.
    375      [Joseph Wylie Yandle, Rich Salz]
    377   *) The stack and lhash API's were renamed to start with OPENSSL_SK_
    378      and OPENSSL_LH_, respectively.  The old names are available
    379      with API compatibility.  They new names are now completely documented.
    380      [Rich Salz]
    382   *) Unify TYPE_up_ref(obj) methods signature.
    383      SSL_CTX_up_ref(), SSL_up_ref(), X509_up_ref(), EVP_PKEY_up_ref(),
    384      X509_CRL_up_ref(), X509_OBJECT_up_ref_count() methods are now returning an
    385      int (instead of void) like all others TYPE_up_ref() methods.
    386      So now these methods also check the return value of CRYPTO_atomic_add(),
    387      and the validity of object reference counter.
    388      [fdasilvayy (a] gmail.com]
    390   *) With Windows Visual Studio builds, the .pdb files are installed
    391      alongside the installed libraries and executables.  For a static
    392      library installation, ossl_static.pdb is the associate compiler
    393      generated .pdb file to be used when linking programs.
    394      [Richard Levitte]
    396   *) Remove openssl.spec.  Packaging files belong with the packagers.
    397      [Richard Levitte]
    399   *) Automatic Darwin/OSX configuration has had a refresh, it will now
    400      recognise x86_64 architectures automatically.  You can still decide
    401      to build for a different bitness with the environment variable
    402      KERNEL_BITS (can be 32 or 64), for example:
    404          KERNEL_BITS=32 ./config
    406      [Richard Levitte]
    408   *) Change default algorithms in pkcs8 utility to use PKCS#5 v2.0,
    409      256 bit AES and HMAC with SHA256.
    410      [Steve Henson]
    412   *) Remove support for MIPS o32 ABI on IRIX (and IRIX only).
    413      [Andy Polyakov]
    415   *) Triple-DES ciphers have been moved from HIGH to MEDIUM.
    416      [Rich Salz]
    418   *) To enable users to have their own config files and build file templates,
    419      Configure looks in the directory indicated by the environment variable
    420      OPENSSL_LOCAL_CONFIG_DIR as well as the in-source Configurations/
    421      directory.  On VMS, OPENSSL_LOCAL_CONFIG_DIR is expected to be a logical
    422      name and is used as is.
    423      [Richard Levitte]
    425   *) The following datatypes were made opaque: X509_OBJECT, X509_STORE_CTX,
    426      X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD.  The unused type
    427      X509_CERT_FILE_CTX was removed.
    428      [Rich Salz]
    430   *) "shared" builds are now the default. To create only static libraries use
    431      the "no-shared" Configure option.
    432      [Matt Caswell]
    434   *) Remove the no-aes, no-hmac, no-rsa, no-sha and no-md5 Configure options.
    435      All of these option have not worked for some while and are fundamental
    436      algorithms.
    437      [Matt Caswell]
    439   *) Make various cleanup routines no-ops and mark them as deprecated. Most
    440      global cleanup functions are no longer required because they are handled
    441      via auto-deinit (see OPENSSL_init_crypto and OPENSSL_init_ssl man pages).
    442      Explicitly de-initing can cause problems (e.g. where a library that uses
    443      OpenSSL de-inits, but an application is still using it). The affected
    444      functions are CONF_modules_free(), ENGINE_cleanup(), OBJ_cleanup(),
    445      EVP_cleanup(), BIO_sock_cleanup(), CRYPTO_cleanup_all_ex_data(),
    446      RAND_cleanup(), SSL_COMP_free_compression_methods(), ERR_free_strings() and
    447      COMP_zlib_cleanup().
    448      [Matt Caswell]
    450   *) --strict-warnings no longer enables runtime debugging options
    451      such as REF_DEBUG. Instead, debug options are automatically
    452      enabled with '--debug' builds.
    453      [Andy Polyakov, Emilia Ksper]
    455   *) Made DH and DH_METHOD opaque. The structures for managing DH objects
    456      have been moved out of the public header files. New functions for managing
    457      these have been added.
    458      [Matt Caswell]
    460   *) Made RSA and RSA_METHOD opaque. The structures for managing RSA
    461      objects have been moved out of the public header files. New
    462      functions for managing these have been added.
    463      [Richard Levitte]
    465   *) Made DSA and DSA_METHOD opaque. The structures for managing DSA objects
    466      have been moved out of the public header files. New functions for managing
    467      these have been added.
    468      [Matt Caswell]
    470   *) Made BIO and BIO_METHOD opaque. The structures for managing BIOs have been
    471      moved out of the public header files. New functions for managing these
    472      have been added.
    473      [Matt Caswell]
    475   *) Removed no-rijndael as a config option. Rijndael is an old name for AES.
    476      [Matt Caswell]
    478   *) Removed the mk1mf build scripts.
    479      [Richard Levitte]
    481   *) Headers are now wrapped, if necessary, with OPENSSL_NO_xxx, so
    482      it is always safe to #include a header now.
    483      [Rich Salz]
    485   *) Removed the aged BC-32 config and all its supporting scripts
    486      [Richard Levitte]
    488   *) Removed support for Ultrix, Netware, and OS/2.
    489      [Rich Salz]
    491   *) Add support for HKDF.
    492      [Alessandro Ghedini]
    494   *) Add support for blake2b and blake2s
    495      [Bill Cox]
    497   *) Added support for "pipelining". Ciphers that have the
    498      EVP_CIPH_FLAG_PIPELINE flag set have a capability to process multiple
    499      encryptions/decryptions simultaneously. There are currently no built-in
    500      ciphers with this property but the expectation is that engines will be able
    501      to offer it to significantly improve throughput. Support has been extended
    502      into libssl so that multiple records for a single connection can be
    503      processed in one go (for >=TLS 1.1).
    504      [Matt Caswell]
    506   *) Added the AFALG engine. This is an async capable engine which is able to
    507      offload work to the Linux kernel. In this initial version it only supports
    508      AES128-CBC. The kernel must be version 4.1.0 or greater.
    509      [Catriona Lucey]
    511   *) OpenSSL now uses a new threading API. It is no longer necessary to
    512      set locking callbacks to use OpenSSL in a multi-threaded environment. There
    513      are two supported threading models: pthreads and windows threads. It is
    514      also possible to configure OpenSSL at compile time for "no-threads". The
    515      old threading API should no longer be used. The functions have been
    516      replaced with "no-op" compatibility macros.
    517      [Alessandro Ghedini, Matt Caswell]
    519   *) Modify behavior of ALPN to invoke callback after SNI/servername
    520      callback, such that updates to the SSL_CTX affect ALPN.
    521      [Todd Short]
    523   *) Add SSL_CIPHER queries for authentication and key-exchange.
    524      [Todd Short]
    526   *) Changes to the DEFAULT cipherlist:
    527        - Prefer (EC)DHE handshakes over plain RSA.
    528        - Prefer AEAD ciphers over legacy ciphers.
    529        - Prefer ECDSA over RSA when both certificates are available.
    530        - Prefer TLSv1.2 ciphers/PRF.
    531        - Remove DSS, SEED, IDEA, CAMELLIA, and AES-CCM from the
    532          default cipherlist.
    533      [Emilia Ksper]
    535   *) Change the ECC default curve list to be this, in order: x25519,
    536      secp256r1, secp521r1, secp384r1.
    537      [Rich Salz]
    539   *) RC4 based libssl ciphersuites are now classed as "weak" ciphers and are
    540      disabled by default. They can be re-enabled using the
    541      enable-weak-ssl-ciphers option to Configure.
    542      [Matt Caswell]
    544   *) If the server has ALPN configured, but supports no protocols that the
    545      client advertises, send a fatal "no_application_protocol" alert.
    546      This behaviour is SHALL in RFC 7301, though it isn't universally
    547      implemented by other servers.
    548      [Emilia Ksper]
    550   *) Add X25519 support.
    551      Add ASN.1 and EVP_PKEY methods for X25519. This includes support
    552      for public and private key encoding using the format documented in
    553      draft-ietf-curdle-pkix-02. The corresponding EVP_PKEY method supports
    554      key generation and key derivation.
    556      TLS support complies with draft-ietf-tls-rfc4492bis-08 and uses
    557      X25519(29).
    558      [Steve Henson]
    560   *) Deprecate SRP_VBASE_get_by_user.
    561      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
    562      In order to fix an unavoidable memory leak (CVE-2016-0798),
    563      SRP_VBASE_get_by_user was changed to ignore the "fake user" SRP
    564      seed, even if the seed is configured.
    566      Users should use SRP_VBASE_get1_by_user instead. Note that in
    567      SRP_VBASE_get1_by_user, caller must free the returned value. Note
    568      also that even though configuring the SRP seed attempts to hide
    569      invalid usernames by continuing the handshake with fake
    570      credentials, this behaviour is not constant time and no strong
    571      guarantees are made that the handshake is indistinguishable from
    572      that of a valid user.
    573      [Emilia Ksper]
    575   *) Configuration change; it's now possible to build dynamic engines
    576      without having to build shared libraries and vice versa.  This
    577      only applies to the engines in engines/, those in crypto/engine/
    578      will always be built into libcrypto (i.e. "static").
    580      Building dynamic engines is enabled by default; to disable, use
    581      the configuration option "disable-dynamic-engine".
    583      The only requirements for building dynamic engines are the
    584      presence of the DSO module and building with position independent
    585      code, so they will also automatically be disabled if configuring
    586      with "disable-dso" or "disable-pic".
    589      are also taken away from openssl/opensslconf.h, as they are
    590      irrelevant.
    591      [Richard Levitte]
    593   *) Configuration change; if there is a known flag to compile
    594      position independent code, it will always be applied on the
    595      libcrypto and libssl object files, and never on the application
    596      object files.  This means other libraries that use routines from
    597      libcrypto / libssl can be made into shared libraries regardless
    598      of how OpenSSL was configured.
    600      If this isn't desirable, the configuration options "disable-pic"
    601      or "no-pic" can be used to disable the use of PIC.  This will
    602      also disable building shared libraries and dynamic engines.
    603      [Richard Levitte]
    605   *) Removed JPAKE code.  It was experimental and has no wide use.
    606      [Rich Salz]
    608   *) The INSTALL_PREFIX Makefile variable has been renamed to
    609      DESTDIR.  That makes for less confusion on what this variable
    610      is for.  Also, the configuration option --install_prefix is
    611      removed.
    612      [Richard Levitte]
    614   *) Heartbeat for TLS has been removed and is disabled by default
    615      for DTLS; configure with enable-heartbeats.  Code that uses the
    616      old #define's might need to be updated.
    617      [Emilia Ksper, Rich Salz]
    619   *) Rename REF_CHECK to REF_DEBUG.
    620      [Rich Salz]
    622   *) New "unified" build system
    624      The "unified" build system is aimed to be a common system for all
    625      platforms we support.  With it comes new support for VMS.
    627      This system builds supports building in a different directory tree
    628      than the source tree.  It produces one Makefile (for unix family
    629      or lookalikes), or one descrip.mms (for VMS).
    631      The source of information to make the Makefile / descrip.mms is
    632      small files called 'build.info', holding the necessary
    633      information for each directory with source to compile, and a
    634      template in Configurations, like unix-Makefile.tmpl or
    635      descrip.mms.tmpl.
    637      With this change, the library names were also renamed on Windows
    638      and on VMS.  They now have names that are closer to the standard
    639      on Unix, and include the major version number, and in certain
    640      cases, the architecture they are built for.  See "Notes on shared
    641      libraries" in INSTALL.
    643      We rely heavily on the perl module Text::Template.
    644      [Richard Levitte]
    646   *) Added support for auto-initialisation and de-initialisation of the library.
    647      OpenSSL no longer requires explicit init or deinit routines to be called,
    648      except in certain circumstances. See the OPENSSL_init_crypto() and
    649      OPENSSL_init_ssl() man pages for further information.
    650      [Matt Caswell]
    652   *) The arguments to the DTLSv1_listen function have changed. Specifically the
    653      "peer" argument is now expected to be a BIO_ADDR object.
    655   *) Rewrite of BIO networking library. The BIO library lacked consistent
    656      support of IPv6, and adding it required some more extensive
    657      modifications.  This introduces the BIO_ADDR and BIO_ADDRINFO types,
    658      which hold all types of addresses and chains of address information.
    659      It also introduces a new API, with functions like BIO_socket,
    660      BIO_connect, BIO_listen, BIO_lookup and a rewrite of BIO_accept.
    661      The source/sink BIOs BIO_s_connect, BIO_s_accept and BIO_s_datagram
    662      have been adapted accordingly.
    663      [Richard Levitte]
    665   *) RSA_padding_check_PKCS1_type_1 now accepts inputs with and without
    666      the leading 0-byte.
    667      [Emilia Ksper]
    669   *) CRIME protection: disable compression by default, even if OpenSSL is
    670      compiled with zlib enabled. Applications can still enable compression
    671      by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by
    672      using the SSL_CONF library to configure compression.
    673      [Emilia Ksper]
    675   *) The signature of the session callback configured with
    676      SSL_CTX_sess_set_get_cb was changed. The read-only input buffer
    677      was explicitly marked as 'const unsigned char*' instead of
    678      'unsigned char*'.
    679      [Emilia Ksper]
    681   *) Always DPURIFY. Remove the use of uninitialized memory in the
    682      RNG, and other conditional uses of DPURIFY. This makes -DPURIFY a no-op.
    683      [Emilia Ksper]
    685   *) Removed many obsolete configuration items, including
    686         DES_PTR, DES_RISC1, DES_RISC2, DES_INT
    687         MD2_CHAR, MD2_INT, MD2_LONG
    688         BF_PTR, BF_PTR2
    689         IDEA_SHORT, IDEA_LONG
    690         RC2_SHORT, RC2_LONG, RC4_LONG, RC4_CHUNK, RC4_INDEX
    691      [Rich Salz, with advice from Andy Polyakov]
    693   *) Many BN internals have been moved to an internal header file.
    694      [Rich Salz with help from Andy Polyakov]
    696   *) Configuration and writing out the results from it has changed.
    697      Files such as Makefile include/openssl/opensslconf.h and are now
    698      produced through general templates, such as Makefile.in and
    699      crypto/opensslconf.h.in and some help from the perl module
    700      Text::Template.
    702      Also, the center of configuration information is no longer
    703      Makefile.  Instead, Configure produces a perl module in
    704      configdata.pm which holds most of the config data (in the hash
    705      table %config), the target data that comes from the target
    706      configuration in one of the Configurations/*.conf files (in
    707      %target).
    708      [Richard Levitte]
    710   *) To clarify their intended purposes, the Configure options
    711      --prefix and --openssldir change their semantics, and become more
    712      straightforward and less interdependent.
    714      --prefix shall be used exclusively to give the location INSTALLTOP
    715      where programs, scripts, libraries, include files and manuals are
    716      going to be installed.  The default is now /usr/local.
    718      --openssldir shall be used exclusively to give the default
    719      location OPENSSLDIR where certificates, private keys, CRLs are
    720      managed.  This is also where the default openssl.cnf gets
    721      installed.
    722      If the directory given with this option is a relative path, the
    723      values of both the --prefix value and the --openssldir value will
    724      be combined to become OPENSSLDIR.
    725      The default for --openssldir is INSTALLTOP/ssl.
    727      Anyone who uses --openssldir to specify where OpenSSL is to be
    728      installed MUST change to use --prefix instead.
    729      [Richard Levitte]
    731   *) The GOST engine was out of date and therefore it has been removed. An up
    732      to date GOST engine is now being maintained in an external repository.
    733      See: https://wiki.openssl.org/index.php/Binaries. Libssl still retains
    734      support for GOST ciphersuites (these are only activated if a GOST engine
    735      is present).
    736      [Matt Caswell]
    738   *) EGD is no longer supported by default; use enable-egd when
    739      configuring.
    740      [Ben Kaduk and Rich Salz]
    742   *) The distribution now has Makefile.in files, which are used to
    743      create Makefile's when Configure is run.  *Configure must be run
    744      before trying to build now.*
    745      [Rich Salz]
    747   *) The return value for SSL_CIPHER_description() for error conditions
    748      has changed.
    749      [Rich Salz]
    751   *) Support for RFC6698/RFC7671 DANE TLSA peer authentication.
    753      Obtaining and performing DNSSEC validation of TLSA records is
    754      the application's responsibility.  The application provides
    755      the TLSA records of its choice to OpenSSL, and these are then
    756      used to authenticate the peer.
    758      The TLSA records need not even come from DNS.  They can, for
    759      example, be used to implement local end-entity certificate or
    760      trust-anchor "pinning", where the "pin" data takes the form
    761      of TLSA records, which can augment or replace verification
    762      based on the usual WebPKI public certification authorities.
    763      [Viktor Dukhovni]
    765   *) Revert default OPENSSL_NO_DEPRECATED setting.  Instead OpenSSL
    766      continues to support deprecated interfaces in default builds.
    767      However, applications are strongly advised to compile their
    768      source files with -DOPENSSL_API_COMPAT=0x10100000L, which hides
    769      the declarations of all interfaces deprecated in 0.9.8, 1.0.0
    770      or the 1.1.0 releases.
    772      In environments in which all applications have been ported to
    773      not use any deprecated interfaces OpenSSL's Configure script
    774      should be used with the --api=1.1.0 option to entirely remove
    775      support for the deprecated features from the library and
    776      unconditionally disable them in the installed headers.
    777      Essentially the same effect can be achieved with the "no-deprecated"
    778      argument to Configure, except that this will always restrict
    779      the build to just the latest API, rather than a fixed API
    780      version.
    782      As applications are ported to future revisions of the API,
    783      they should update their compile-time OPENSSL_API_COMPAT define
    784      accordingly, but in most cases should be able to continue to
    785      compile with later releases.
    787      The OPENSSL_API_COMPAT versions for 1.0.0, and 0.9.8 are
    788      0x10000000L and 0x00908000L, respectively.  However those
    789      versions did not support the OPENSSL_API_COMPAT feature, and
    790      so applications are not typically tested for explicit support
    791      of just the undeprecated features of either release.
    792      [Viktor Dukhovni]
    794   *) Add support for setting the minimum and maximum supported protocol.
    795      It can bet set via the SSL_set_min_proto_version() and
    796      SSL_set_max_proto_version(), or via the SSL_CONF's MinProtocol and
    797      MaxProtcol.  It's recommended to use the new APIs to disable
    798      protocols instead of disabling individual protocols using
    799      SSL_set_options() or SSL_CONF's Protocol.  This change also
    800      removes support for disabling TLS 1.2 in the OpenSSL TLS
    801      client at compile time by defining OPENSSL_NO_TLS1_2_CLIENT.
    802      [Kurt Roeckx]
    804   *) Support for ChaCha20 and Poly1305 added to libcrypto and libssl.
    805      [Andy Polyakov]
    807   *) New EC_KEY_METHOD, this replaces the older ECDSA_METHOD and ECDH_METHOD
    808      and integrates ECDSA and ECDH functionality into EC. Implementations can
    809      now redirect key generation and no longer need to convert to or from
    810      ECDSA_SIG format.
    812      Note: the ecdsa.h and ecdh.h headers are now no longer needed and just
    813      include the ec.h header file instead.
    814      [Steve Henson]
    816   *) Remove support for all 40 and 56 bit ciphers.  This includes all the export
    817      ciphers who are no longer supported and drops support the ephemeral RSA key
    818      exchange. The LOW ciphers currently doesn't have any ciphers in it.
    819      [Kurt Roeckx]
    822      opaque.  For HMAC_CTX, the following constructors and destructors
    823      were added:
    825         HMAC_CTX *HMAC_CTX_new(void);
    826         void HMAC_CTX_free(HMAC_CTX *ctx);
    828      For EVP_MD and EVP_CIPHER, complete APIs to create, fill and
    829      destroy such methods has been added.  See EVP_MD_meth_new(3) and
    830      EVP_CIPHER_meth_new(3) for documentation.
    832      Additional changes:
    833      1) EVP_MD_CTX_cleanup(), EVP_CIPHER_CTX_cleanup() and
    834         HMAC_CTX_cleanup() were removed.  HMAC_CTX_reset() and
    835         EVP_MD_CTX_reset() should be called instead to reinitialise
    836         an already created structure.
    837      2) For consistency with the majority of our object creators and
    838         destructors, EVP_MD_CTX_(create|destroy) were renamed to
    839         EVP_MD_CTX_(new|free).  The old names are retained as macros
    840         for deprecated builds.
    841      [Richard Levitte]
    843   *) Added ASYNC support. Libcrypto now includes the async sub-library to enable
    844      cryptographic operations to be performed asynchronously as long as an
    845      asynchronous capable engine is used. See the ASYNC_start_job() man page for
    846      further details. Libssl has also had this capability integrated with the
    847      introduction of the new mode SSL_MODE_ASYNC and associated error
    848      SSL_ERROR_WANT_ASYNC. See the SSL_CTX_set_mode() and SSL_get_error() man
    849      pages. This work was developed in partnership with Intel Corp.
    850      [Matt Caswell]
    852   *) SSL_{CTX_}set_ecdh_auto() has been removed and ECDH is support is
    853      always enabled now.  If you want to disable the support you should
    854      exclude it using the list of supported ciphers. This also means that the
    855      "-no_ecdhe" option has been removed from s_server.
    856      [Kurt Roeckx]
    858   *) SSL_{CTX}_set_tmp_ecdh() which can set 1 EC curve now internally calls
    859      SSL_{CTX_}set1_curves() which can set a list.
    860      [Kurt Roeckx]
    862   *) Remove support for SSL_{CTX_}set_tmp_ecdh_callback().  You should set the
    863      curve you want to support using SSL_{CTX_}set1_curves().
    864      [Kurt Roeckx]
    866   *) State machine rewrite. The state machine code has been significantly
    867      refactored in order to remove much duplication of code and solve issues
    868      with the old code (see ssl/statem/README for further details). This change
    869      does have some associated API changes. Notably the SSL_state() function
    870      has been removed and replaced by SSL_get_state which now returns an
    871      "OSSL_HANDSHAKE_STATE" instead of an int. SSL_set_state() has been removed
    872      altogether. The previous handshake states defined in ssl.h and ssl3.h have
    873      also been removed.
    874      [Matt Caswell]
    876   *) All instances of the string "ssleay" in the public API were replaced
    877      with OpenSSL (case-matching; e.g., OPENSSL_VERSION for #define's)
    878      Some error codes related to internal RSA_eay API's were renamed.
    879      [Rich Salz]
    881   *) The demo files in crypto/threads were moved to demo/threads.
    882      [Rich Salz]
    884   *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron, gmp,
    885      sureware and ubsec.
    886      [Matt Caswell, Rich Salz]
    888   *) New ASN.1 embed macro.
    890      New ASN.1 macro ASN1_EMBED. This is the same as ASN1_SIMPLE except the
    891      structure is not allocated: it is part of the parent. That is instead of
    893      FOO *x;
    895      it must be:
    897      FOO x;
    899      This reduces memory fragmentation and make it impossible to accidentally
    900      set a mandatory field to NULL.
    902      This currently only works for some fields specifically a SEQUENCE, CHOICE,
    903      or ASN1_STRING type which is part of a parent SEQUENCE. Since it is
    904      equivalent to ASN1_SIMPLE it cannot be tagged, OPTIONAL, SET OF or
    905      SEQUENCE OF.
    906      [Steve Henson]
    908   *) Remove EVP_CHECK_DES_KEY, a compile-time option that never compiled.
    909      [Emilia Ksper]
    911   *) Removed DES and RC4 ciphersuites from DEFAULT. Also removed RC2 although
    912      in 1.0.2 EXPORT was already removed and the only RC2 ciphersuite is also
    913      an EXPORT one. COMPLEMENTOFDEFAULT has been updated accordingly to add
    914      DES and RC4 ciphersuites.
    915      [Matt Caswell]
    917   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
    918      This changes the decoding behaviour for some invalid messages,
    919      though the change is mostly in the more lenient direction, and
    920      legacy behaviour is preserved as much as possible.
    921      [Emilia Ksper]
    923   *) Fix no-stdio build.
    924     [ David Woodhouse <David.Woodhouse (a] intel.com> and also
    925       Ivan Nestlerode <ivan.nestlerode (a] sonos.com> ]
    927   *) New testing framework
    928      The testing framework has been largely rewritten and is now using
    929      perl and the perl modules Test::Harness and an extended variant of
    930      Test::More called OpenSSL::Test to do its work.  All test scripts in
    931      test/ have been rewritten into test recipes, and all direct calls to
    932      executables in test/Makefile have become individual recipes using the
    933      simplified testing OpenSSL::Test::Simple.
    935      For documentation on our testing modules, do:
    937         perldoc test/testlib/OpenSSL/Test/Simple.pm
    938         perldoc test/testlib/OpenSSL/Test.pm
    940      [Richard Levitte]
    942   *) Revamped memory debug; only -DCRYPTO_MDEBUG and -DCRYPTO_MDEBUG_ABORT
    943      are used; the latter aborts on memory leaks (usually checked on exit).
    944      Some undocumented "set malloc, etc., hooks" functions were removed
    945      and others were changed.  All are now documented.
    946      [Rich Salz]
    948   *) In DSA_generate_parameters_ex, if the provided seed is too short,
    949      return an error
    950      [Rich Salz and Ismo Puustinen <ismo.puustinen (a] intel.com>]
    952   *) Rewrite PSK to support ECDHE_PSK, DHE_PSK and RSA_PSK. Add ciphersuites
    953      from RFC4279, RFC4785, RFC5487, RFC5489.
    955      Thanks to Christian J. Dietrich and Giuseppe D'Angelo for the
    956      original RSA_PSK patch.
    957      [Steve Henson]
    959   *) Dropped support for the SSL3_FLAGS_DELAY_CLIENT_FINISHED flag. This SSLeay
    960      era flag was never set throughout the codebase (only read). Also removed
    961      SSL3_FLAGS_POP_BUFFER which was only used if
    962      SSL3_FLAGS_DELAY_CLIENT_FINISHED was also set.
    963      [Matt Caswell]
    965   *) Changed the default name options in the "ca", "crl", "req" and "x509"
    966      to be "oneline" instead of "compat".
    967      [Richard Levitte]
    969   *) Remove SSL_OP_TLS_BLOCK_PADDING_BUG. This is SSLeay legacy, we're
    970      not aware of clients that still exhibit this bug, and the workaround
    971      hasn't been working properly for a while.
    972      [Emilia Ksper]
    974   *) The return type of BIO_number_read() and BIO_number_written() as well as
    975      the corresponding num_read and num_write members in the BIO structure has
    976      changed from unsigned long to uint64_t. On platforms where an unsigned
    977      long is 32 bits (e.g. Windows) these counters could overflow if >4Gb is
    978      transferred.
    979      [Matt Caswell]
    981   *) Given the pervasive nature of TLS extensions it is inadvisable to run
    982      OpenSSL without support for them. It also means that maintaining
    983      the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably
    984      not well tested). Therefore the OPENSSL_NO_TLSEXT option has been removed.
    985      [Matt Caswell]
    987   *) Removed support for the two export grade static DH ciphersuites
    988      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
    989      were newly added (along with a number of other static DH ciphersuites) to
    990      1.0.2. However the two export ones have *never* worked since they were
    991      introduced. It seems strange in any case to be adding new export
    992      ciphersuites, and given "logjam" it also does not seem correct to fix them.
    993      [Matt Caswell]
    995   *) Version negotiation has been rewritten. In particular SSLv23_method(),
    996      SSLv23_client_method() and SSLv23_server_method() have been deprecated,
    997      and turned into macros which simply call the new preferred function names
    998      TLS_method(), TLS_client_method() and TLS_server_method(). All new code
    999      should use the new names instead. Also as part of this change the ssl23.h
   1000      header file has been removed.
   1001      [Matt Caswell]
   1003   *) Support for Kerberos ciphersuites in TLS (RFC2712) has been removed. This
   1004      code and the associated standard is no longer considered fit-for-purpose.
   1005      [Matt Caswell]
   1007   *) RT2547 was closed.  When generating a private key, try to make the
   1008      output file readable only by the owner.  This behavior change might
   1009      be noticeable when interacting with other software.
   1011   *) Documented all exdata functions.  Added CRYPTO_free_ex_index.
   1012      Added a test.
   1013      [Rich Salz]
   1015   *) Added HTTP GET support to the ocsp command.
   1016      [Rich Salz]
   1018   *) Changed default digest for the dgst and enc commands from MD5 to
   1019      sha256
   1020      [Rich Salz]
   1022   *) RAND_pseudo_bytes has been deprecated. Users should use RAND_bytes instead.
   1023      [Matt Caswell]
   1025   *) Added support for TLS extended master secret from
   1026      draft-ietf-tls-session-hash-03.txt. Thanks for Alfredo Pironti for an
   1027      initial patch which was a great help during development.
   1028      [Steve Henson]
   1030   *) All libssl internal structures have been removed from the public header
   1031      files, and the OPENSSL_NO_SSL_INTERN option has been removed (since it is
   1032      now redundant). Users should not attempt to access internal structures
   1033      directly. Instead they should use the provided API functions.
   1034      [Matt Caswell]
   1036   *) config has been changed so that by default OPENSSL_NO_DEPRECATED is used.
   1037      Access to deprecated functions can be re-enabled by running config with
   1038      "enable-deprecated". In addition applications wishing to use deprecated
   1039      functions must define OPENSSL_USE_DEPRECATED. Note that this new behaviour
   1040      will, by default, disable some transitive includes that previously existed
   1041      in the header files (e.g. ec.h will no longer, by default, include bn.h)
   1042      [Matt Caswell]
   1044   *) Added support for OCB mode. OpenSSL has been granted a patent license
   1045      compatible with the OpenSSL license for use of OCB. Details are available
   1046      at https://www.openssl.org/source/OCB-patent-grant-OpenSSL.pdf. Support
   1047      for OCB can be removed by calling config with no-ocb.
   1048      [Matt Caswell]
   1050   *) SSLv2 support has been removed.  It still supports receiving a SSLv2
   1051      compatible client hello.
   1052      [Kurt Roeckx]
   1054   *) Increased the minimal RSA keysize from 256 to 512 bits [Rich Salz],
   1055      done while fixing the error code for the key-too-small case.
   1056      [Annie Yousar <a.yousar (a] informatik.hu-berlin.de>]
   1058   *) CA.sh has been removed; use CA.pl instead.
   1059      [Rich Salz]
   1061   *) Removed old DES API.
   1062      [Rich Salz]
   1064   *) Remove various unsupported platforms:
   1065         Sony NEWS4
   1066         BEOS and BEOS_R5
   1067         NeXT
   1068         SUNOS
   1069         MPE/iX
   1070         Sinix/ReliantUNIX RM400
   1071         DGUX
   1072         NCR
   1073         Tandem
   1074         Cray
   1075         16-bit platforms such as WIN16
   1076      [Rich Salz]
   1078   *) Clean up OPENSSL_NO_xxx #define's
   1079         Use setbuf() and remove OPENSSL_NO_SETVBUF_IONBF
   1080         Rename OPENSSL_SYSNAME_xxx to OPENSSL_SYS_xxx
   1081         OPENSSL_NO_EC{DH,DSA} merged into OPENSSL_NO_EC
   1082         OPENSSL_NO_RIPEMD160, OPENSSL_NO_RIPEMD merged into OPENSSL_NO_RMD160
   1083         OPENSSL_NO_FP_API merged into OPENSSL_NO_STDIO
   1087         OPENSSL_NO_X509 OPENSSL_NO_X509_VERIFY
   1088         Remove MS_STATIC; it's a relic from platforms <32 bits.
   1089      [Rich Salz]
   1091   *) Cleaned up dead code
   1092         Remove all but one '#ifdef undef' which is to be looked at.
   1093      [Rich Salz]
   1095   *) Clean up calling of xxx_free routines.
   1096         Just like free(), fix most of the xxx_free routines to accept
   1097         NULL.  Remove the non-null checks from callers.  Save much code.
   1098      [Rich Salz]
   1100   *) Add secure heap for storage of private keys (when possible).
   1101      Add BIO_s_secmem(), CBIGNUM, etc.
   1102      Contributed by Akamai Technologies under our Corporate CLA.
   1103      [Rich Salz]
   1105   *) Experimental support for a new, fast, unbiased prime candidate generator,
   1106      bn_probable_prime_dh_coprime(). Not currently used by any prime generator.
   1107      [Felix Laurie von Massenbach <felix (a] erbridge.co.uk>]
   1109   *) New output format NSS in the sess_id command line tool. This allows
   1110      exporting the session id and the master key in NSS keylog format.
   1111      [Martin Kaiser <martin (a] kaiser.cx>]
   1113   *) Harmonize version and its documentation. -f flag is used to display
   1114      compilation flags.
   1115      [mancha <mancha1 (a] zoho.com>]
   1117   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
   1118      in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
   1119      [mancha <mancha1 (a] zoho.com>]
   1121   *) Fix some double frees. These are not thought to be exploitable.
   1122      [mancha <mancha1 (a] zoho.com>]
   1124   *) A missing bounds check in the handling of the TLS heartbeat extension
   1125      can be used to reveal up to 64k of memory to a connected client or
   1126      server.
   1128      Thanks for Neel Mehta of Google Security for discovering this bug and to
   1129      Adam Langley <agl (a] chromium.org> and Bodo Moeller <bmoeller (a] acm.org> for
   1130      preparing the fix (CVE-2014-0160)
   1131      [Adam Langley, Bodo Moeller]
   1133   *) Fix for the attack described in the paper "Recovering OpenSSL
   1134      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
   1135      by Yuval Yarom and Naomi Benger. Details can be obtained from:
   1136      http://eprint.iacr.org/2014/140
   1138      Thanks to Yuval Yarom and Naomi Benger for discovering this
   1139      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
   1140      [Yuval Yarom and Naomi Benger]
   1142   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
   1143      this fixes a limitation in previous versions of OpenSSL.
   1144      [Steve Henson]
   1146   *) Experimental encrypt-then-mac support.
   1148      Experimental support for encrypt then mac from
   1149      draft-gutmann-tls-encrypt-then-mac-02.txt
   1151      To enable it set the appropriate extension number (0x42 for the test
   1152      server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x42
   1154      For non-compliant peers (i.e. just about everything) this should have no
   1155      effect.
   1159      [Steve Henson]
   1161   *) Add EVP support for key wrapping algorithms, to avoid problems with
   1162      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
   1163      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
   1164      algorithms and include tests cases.
   1165      [Steve Henson]
   1167   *) Extend CMS code to support RSA-PSS signatures and RSA-OAEP for
   1168      enveloped data.
   1169      [Steve Henson]
   1171   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
   1172      MGF1 digest and OAEP label.
   1173      [Steve Henson]
   1175   *) Make openssl verify return errors.
   1176      [Chris Palmer <palmer (a] google.com> and Ben Laurie]
   1178   *) New function ASN1_TIME_diff to calculate the difference between two
   1179      ASN1_TIME structures or one structure and the current time.
   1180      [Steve Henson]
   1182   *) Update fips_test_suite to support multiple command line options. New
   1183      test to induce all self test errors in sequence and check expected
   1184      failures.
   1185      [Steve Henson]
   1187   *) Add FIPS_{rsa,dsa,ecdsa}_{sign,verify} functions which digest and
   1188      sign or verify all in one operation.
   1189      [Steve Henson]
   1191   *) Add fips_algvs: a multicall fips utility incorporating all the algorithm
   1192      test programs and fips_test_suite. Includes functionality to parse
   1193      the minimal script output of fipsalgest.pl directly.
   1194      [Steve Henson]
   1196   *) Add authorisation parameter to FIPS_module_mode_set().
   1197      [Steve Henson]
   1199   *) Add FIPS selftest for ECDH algorithm using P-224 and B-233 curves.
   1200      [Steve Henson]
   1202   *) Use separate DRBG fields for internal and external flags. New function
   1203      FIPS_drbg_health_check() to perform on demand health checking. Add
   1204      generation tests to fips_test_suite with reduced health check interval to 
   1205      demonstrate periodic health checking. Add "nodh" option to
   1206      fips_test_suite to skip very slow DH test.
   1207      [Steve Henson]
   1209   *) New function FIPS_get_cipherbynid() to lookup FIPS supported ciphers
   1210      based on NID.
   1211      [Steve Henson]
   1213   *) More extensive health check for DRBG checking many more failure modes.
   1214      New function FIPS_selftest_drbg_all() to handle every possible DRBG
   1215      combination: call this in fips_test_suite.
   1216      [Steve Henson]
   1218   *) Add support for canonical generation of DSA parameter 'g'. See 
   1219      FIPS 186-3 A.2.3.
   1221   *) Add support for HMAC DRBG from SP800-90. Update DRBG algorithm test and
   1222      POST to handle HMAC cases.
   1223      [Steve Henson]
   1225   *) Add functions FIPS_module_version() and FIPS_module_version_text()
   1226      to return numerical and string versions of the FIPS module number.
   1227      [Steve Henson]
   1229   *) Rename FIPS_mode_set and FIPS_mode to FIPS_module_mode_set and
   1230      FIPS_module_mode. FIPS_mode and FIPS_mode_set will be implemented
   1231      outside the validated module in the FIPS capable OpenSSL.
   1232      [Steve Henson]
   1234   *) Minor change to DRBG entropy callback semantics. In some cases
   1235      there is no multiple of the block length between min_len and
   1236      max_len. Allow the callback to return more than max_len bytes
   1237      of entropy but discard any extra: it is the callback's responsibility
   1238      to ensure that the extra data discarded does not impact the
   1239      requested amount of entropy.
   1240      [Steve Henson]
   1242   *) Add PRNG security strength checks to RSA, DSA and ECDSA using 
   1243      information in FIPS186-3, SP800-57 and SP800-131A.
   1244      [Steve Henson]
   1246   *) CCM support via EVP. Interface is very similar to GCM case except we
   1247      must supply all data in one chunk (i.e. no update, final) and the
   1248      message length must be supplied if AAD is used. Add algorithm test
   1249      support.
   1250      [Steve Henson]
   1252   *) Initial version of POST overhaul. Add POST callback to allow the status
   1253      of POST to be monitored and/or failures induced. Modify fips_test_suite
   1254      to use callback. Always run all selftests even if one fails.
   1255      [Steve Henson]
   1257   *) XTS support including algorithm test driver in the fips_gcmtest program.
   1258      Note: this does increase the maximum key length from 32 to 64 bytes but
   1259      there should be no binary compatibility issues as existing applications
   1260      will never use XTS mode.
   1261      [Steve Henson]
   1263   *) Extensive reorganisation of FIPS PRNG behaviour. Remove all dependencies
   1264      to OpenSSL RAND code and replace with a tiny FIPS RAND API which also
   1265      performs algorithm blocking for unapproved PRNG types. Also do not
   1266      set PRNG type in FIPS_mode_set(): leave this to the application.
   1267      Add default OpenSSL DRBG handling: sets up FIPS PRNG and seeds with
   1268      the standard OpenSSL PRNG: set additional data to a date time vector.
   1269      [Steve Henson]
   1271   *) Rename old X9.31 PRNG functions of the form FIPS_rand* to FIPS_x931*.
   1272      This shouldn't present any incompatibility problems because applications
   1273      shouldn't be using these directly and any that are will need to rethink
   1274      anyway as the X9.31 PRNG is now deprecated by FIPS 140-2
   1275      [Steve Henson]
   1277   *) Extensive self tests and health checking required by SP800-90 DRBG.
   1278      Remove strength parameter from FIPS_drbg_instantiate and always
   1279      instantiate at maximum supported strength.
   1280      [Steve Henson]
   1282   *) Add ECDH code to fips module and fips_ecdhvs for primitives only testing.
   1283      [Steve Henson]
   1285   *) New algorithm test program fips_dhvs to handle DH primitives only testing.
   1286      [Steve Henson]
   1288   *) New function DH_compute_key_padded() to compute a DH key and pad with
   1289      leading zeroes if needed: this complies with SP800-56A et al.
   1290      [Steve Henson]
   1292   *) Initial implementation of SP800-90 DRBGs for Hash and CTR. Not used by
   1293      anything, incomplete, subject to change and largely untested at present.
   1294      [Steve Henson]
   1296   *) Modify fipscanisteronly build option to only build the necessary object
   1297      files by filtering FIPS_EX_OBJ through a perl script in crypto/Makefile.
   1298      [Steve Henson]
   1300   *) Add experimental option FIPSSYMS to give all symbols in
   1301      fipscanister.o and FIPS or fips prefix. This will avoid
   1302      conflicts with future versions of OpenSSL. Add perl script
   1303      util/fipsas.pl to preprocess assembly language source files
   1304      and rename any affected symbols.
   1305      [Steve Henson]
   1307   *) Add selftest checks and algorithm block of non-fips algorithms in
   1308      FIPS mode. Remove DES2 from selftests.
   1309      [Steve Henson]
   1311   *) Add ECDSA code to fips module. Add tiny fips_ecdsa_check to just
   1312      return internal method without any ENGINE dependencies. Add new
   1313      tiny fips sign and verify functions.
   1314      [Steve Henson]
   1316   *) New build option no-ec2m to disable characteristic 2 code.
   1317      [Steve Henson]
   1319   *) New build option "fipscanisteronly". This only builds fipscanister.o
   1320      and (currently) associated fips utilities. Uses the file Makefile.fips
   1321      instead of Makefile.org as the prototype.
   1322      [Steve Henson]
   1324   *) Add some FIPS mode restrictions to GCM. Add internal IV generator.
   1325      Update fips_gcmtest to use IV generator.
   1326      [Steve Henson]
   1328   *) Initial, experimental EVP support for AES-GCM. AAD can be input by
   1329      setting output buffer to NULL. The *Final function must be
   1330      called although it will not retrieve any additional data. The tag
   1331      can be set or retrieved with a ctrl. The IV length is by default 12
   1332      bytes (96 bits) but can be set to an alternative value. If the IV
   1333      length exceeds the maximum IV length (currently 16 bytes) it cannot be
   1334      set before the key. 
   1335      [Steve Henson]
   1337   *) New flag in ciphers: EVP_CIPH_FLAG_CUSTOM_CIPHER. This means the
   1338      underlying do_cipher function handles all cipher semantics itself
   1339      including padding and finalisation. This is useful if (for example)
   1340      an ENGINE cipher handles block padding itself. The behaviour of
   1341      do_cipher is subtly changed if this flag is set: the return value
   1342      is the number of characters written to the output buffer (zero is
   1343      no longer an error code) or a negative error code. Also if the
   1344      input buffer is NULL and length 0 finalisation should be performed.
   1345      [Steve Henson]
   1347   *) If a candidate issuer certificate is already part of the constructed
   1348      path ignore it: new debug notification X509_V_ERR_PATH_LOOP for this case.
   1349      [Steve Henson]
   1351   *) Improve forward-security support: add functions
   1353        void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb)(SSL *ssl, int is_forward_secure))
   1354        void SSL_set_not_resumable_session_callback(SSL *ssl, int (*cb)(SSL *ssl, int is_forward_secure))
   1356      for use by SSL/TLS servers; the callback function will be called whenever a
   1357      new session is created, and gets to decide whether the session may be
   1358      cached to make it resumable (return 0) or not (return 1).  (As by the
   1359      SSL/TLS protocol specifications, the session_id sent by the server will be
   1360      empty to indicate that the session is not resumable; also, the server will
   1361      not generate RFC 4507 (RFC 5077) session tickets.)
   1363      A simple reasonable callback implementation is to return is_forward_secure.
   1364      This parameter will be set to 1 or 0 depending on the ciphersuite selected
   1365      by the SSL/TLS server library, indicating whether it can provide forward
   1366      security.
   1367      [Emilia Ksper <emilia.kasper (a] esat.kuleuven.be> (Google)]
   1369   *) New -verify_name option in command line utilities to set verification
   1370      parameters by name.
   1371      [Steve Henson]
   1373   *) Initial CMAC implementation. WARNING: EXPERIMENTAL, API MAY CHANGE.
   1374      Add CMAC pkey methods.
   1375      [Steve Henson]
   1377   *) Experimental renegotiation in s_server -www mode. If the client 
   1378      browses /reneg connection is renegotiated. If /renegcert it is
   1379      renegotiated requesting a certificate.
   1380      [Steve Henson]
   1382   *) Add an "external" session cache for debugging purposes to s_server. This
   1383      should help trace issues which normally are only apparent in deployed
   1384      multi-process servers.
   1385      [Steve Henson]
   1387   *) Extensive audit of libcrypto with DEBUG_UNUSED. Fix many cases where
   1388      return value is ignored. NB. The functions RAND_add(), RAND_seed(),
   1389      BIO_set_cipher() and some obscure PEM functions were changed so they
   1390      can now return an error. The RAND changes required a change to the
   1391      RAND_METHOD structure.
   1392      [Steve Henson]
   1394   *) New macro __owur for "OpenSSL Warn Unused Result". This makes use of
   1395      a gcc attribute to warn if the result of a function is ignored. This
   1396      is enable if DEBUG_UNUSED is set. Add to several functions in evp.h
   1397      whose return value is often ignored. 
   1398      [Steve Henson]
   1400   *) New -noct, -requestct, -requirect and -ctlogfile options for s_client.
   1401      These allow SCTs (signed certificate timestamps) to be requested and
   1402      validated when establishing a connection.
   1403      [Rob Percival <robpercival (a] google.com>]
   1405  Changes between 1.0.2g and 1.0.2h [3 May 2016]
   1407   *) Prevent padding oracle in AES-NI CBC MAC check
   1409      A MITM attacker can use a padding oracle attack to decrypt traffic
   1410      when the connection uses an AES CBC cipher and the server support
   1411      AES-NI.
   1413      This issue was introduced as part of the fix for Lucky 13 padding
   1414      attack (CVE-2013-0169). The padding check was rewritten to be in
   1415      constant time by making sure that always the same bytes are read and
   1416      compared against either the MAC or padding bytes. But it no longer
   1417      checked that there was enough data to have both the MAC and padding
   1418      bytes.
   1420      This issue was reported by Juraj Somorovsky using TLS-Attacker.
   1421      (CVE-2016-2107)
   1422      [Kurt Roeckx]
   1424   *) Fix EVP_EncodeUpdate overflow
   1426      An overflow can occur in the EVP_EncodeUpdate() function which is used for
   1427      Base64 encoding of binary data. If an attacker is able to supply very large
   1428      amounts of input data then a length check can overflow resulting in a heap
   1429      corruption.
   1431      Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by
   1432      the PEM_write_bio* family of functions. These are mainly used within the
   1433      OpenSSL command line applications, so any application which processes data
   1434      from an untrusted source and outputs it as a PEM file should be considered
   1435      vulnerable to this issue. User applications that call these APIs directly
   1436      with large amounts of untrusted data may also be vulnerable.
   1438      This issue was reported by Guido Vranken.
   1439      (CVE-2016-2105)
   1440      [Matt Caswell]
   1442   *) Fix EVP_EncryptUpdate overflow
   1444      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
   1445      is able to supply very large amounts of input data after a previous call to
   1446      EVP_EncryptUpdate() with a partial block then a length check can overflow
   1447      resulting in a heap corruption. Following an analysis of all OpenSSL
   1448      internal usage of the EVP_EncryptUpdate() function all usage is one of two
   1449      forms. The first form is where the EVP_EncryptUpdate() call is known to be
   1450      the first called function after an EVP_EncryptInit(), and therefore that
   1451      specific call must be safe. The second form is where the length passed to
   1452      EVP_EncryptUpdate() can be seen from the code to be some small value and
   1453      therefore there is no possibility of an overflow. Since all instances are
   1454      one of these two forms, it is believed that there can be no overflows in
   1455      internal code due to this problem. It should be noted that
   1456      EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
   1457      Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
   1458      of these calls have also been analysed too and it is believed there are no
   1459      instances in internal usage where an overflow could occur.
   1461      This issue was reported by Guido Vranken.
   1462      (CVE-2016-2106)
   1463      [Matt Caswell]
   1465   *) Prevent ASN.1 BIO excessive memory allocation
   1467      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
   1468      a short invalid encoding can cause allocation of large amounts of memory
   1469      potentially consuming excessive resources or exhausting memory.
   1471      Any application parsing untrusted data through d2i BIO functions is
   1472      affected. The memory based functions such as d2i_X509() are *not* affected.
   1473      Since the memory based functions are used by the TLS library, TLS
   1474      applications are not affected.
   1476      This issue was reported by Brian Carpenter.
   1477      (CVE-2016-2109)
   1478      [Stephen Henson]
   1480   *) EBCDIC overread
   1482      ASN1 Strings that are over 1024 bytes can cause an overread in applications
   1483      using the X509_NAME_oneline() function on EBCDIC systems. This could result
   1484      in arbitrary stack data being returned in the buffer.
   1486      This issue was reported by Guido Vranken.
   1487      (CVE-2016-2176)
   1488      [Matt Caswell]
   1490   *) Modify behavior of ALPN to invoke callback after SNI/servername
   1491      callback, such that updates to the SSL_CTX affect ALPN.
   1492      [Todd Short]
   1494   *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
   1495      default.
   1496      [Kurt Roeckx]
   1498   *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
   1499      methods are enabled and ssl2 is disabled the methods return NULL.
   1500      [Kurt Roeckx]
   1502  Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
   1504   * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
   1505     Builds that are not configured with "enable-weak-ssl-ciphers" will not
   1506     provide any "EXPORT" or "LOW" strength ciphers.
   1507     [Viktor Dukhovni]
   1509   * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
   1510     is by default disabled at build-time.  Builds that are not configured with
   1511     "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
   1512     users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
   1513     will need to explicitly call either of:
   1515         SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
   1516     or
   1517         SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
   1519     as appropriate.  Even if either of those is used, or the application
   1520     explicitly uses the version-specific SSLv2_method() or its client and
   1521     server variants, SSLv2 ciphers vulnerable to exhaustive search key
   1522     recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
   1523     ciphers, and SSLv2 56-bit DES are no longer available.
   1524     (CVE-2016-0800)
   1525     [Viktor Dukhovni]
   1527   *) Fix a double-free in DSA code
   1529      A double free bug was discovered when OpenSSL parses malformed DSA private
   1530      keys and could lead to a DoS attack or memory corruption for applications
   1531      that receive DSA private keys from untrusted sources.  This scenario is
   1532      considered rare.
   1534      This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
   1535      libFuzzer.
   1536      (CVE-2016-0705)
   1537      [Stephen Henson]
   1539   *) Disable SRP fake user seed to address a server memory leak.
   1541      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
   1543      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
   1544      In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
   1545      was changed to ignore the "fake user" SRP seed, even if the seed
   1546      is configured.
   1548      Users should use SRP_VBASE_get1_by_user instead. Note that in
   1549      SRP_VBASE_get1_by_user, caller must free the returned value. Note
   1550      also that even though configuring the SRP seed attempts to hide
   1551      invalid usernames by continuing the handshake with fake
   1552      credentials, this behaviour is not constant time and no strong
   1553      guarantees are made that the handshake is indistinguishable from
   1554      that of a valid user.
   1555      (CVE-2016-0798)
   1556      [Emilia Ksper]
   1558   *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
   1560      In the BN_hex2bn function the number of hex digits is calculated using an
   1561      int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
   1562      large values of |i| this can result in |bn_expand| not allocating any
   1563      memory because |i * 4| is negative. This can leave the internal BIGNUM data
   1564      field as NULL leading to a subsequent NULL ptr deref. For very large values
   1565      of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
   1566      In this case memory is allocated to the internal BIGNUM data field, but it
   1567      is insufficiently sized leading to heap corruption. A similar issue exists
   1568      in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
   1569      is ever called by user applications with very large untrusted hex/dec data.
   1570      This is anticipated to be a rare occurrence.
   1572      All OpenSSL internal usage of these functions use data that is not expected
   1573      to be untrusted, e.g. config file data or application command line
   1574      arguments. If user developed applications generate config file data based
   1575      on untrusted data then it is possible that this could also lead to security
   1576      consequences. This is also anticipated to be rare.
   1578      This issue was reported to OpenSSL by Guido Vranken.
   1579      (CVE-2016-0797)
   1580      [Matt Caswell]
   1582   *) Fix memory issues in BIO_*printf functions
   1584      The internal |fmtstr| function used in processing a "%s" format string in
   1585      the BIO_*printf functions could overflow while calculating the length of a
   1586      string and cause an OOB read when printing very long strings.
   1588      Additionally the internal |doapr_outch| function can attempt to write to an
   1589      OOB memory location (at an offset from the NULL pointer) in the event of a
   1590      memory allocation failure. In 1.0.2 and below this could be caused where
   1591      the size of a buffer to be allocated is greater than INT_MAX. E.g. this
   1592      could be in processing a very long "%s" format string. Memory leaks can
   1593      also occur.
   1595      The first issue may mask the second issue dependent on compiler behaviour.
   1596      These problems could enable attacks where large amounts of untrusted data
   1597      is passed to the BIO_*printf functions. If applications use these functions
   1598      in this way then they could be vulnerable. OpenSSL itself uses these
   1599      functions when printing out human-readable dumps of ASN.1 data. Therefore
   1600      applications that print this data could be vulnerable if the data is from
   1601      untrusted sources. OpenSSL command line applications could also be
   1602      vulnerable where they print out ASN.1 data, or if untrusted data is passed
   1603      as command line arguments.
   1605      Libssl is not considered directly vulnerable. Additionally certificates etc
   1606      received via remote connections via libssl are also unlikely to be able to
   1607      trigger these issues because of message size limits enforced within libssl.
   1609      This issue was reported to OpenSSL Guido Vranken.
   1610      (CVE-2016-0799)
   1611      [Matt Caswell]
   1613   *) Side channel attack on modular exponentiation
   1615      A side-channel attack was found which makes use of cache-bank conflicts on
   1616      the Intel Sandy-Bridge microarchitecture which could lead to the recovery
   1617      of RSA keys.  The ability to exploit this issue is limited as it relies on
   1618      an attacker who has control of code in a thread running on the same
   1619      hyper-threaded core as the victim thread which is performing decryptions.
   1621      This issue was reported to OpenSSL by Yuval Yarom, The University of
   1622      Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
   1623      Nadia Heninger, University of Pennsylvania with more information at
   1624      http://cachebleed.info.
   1625      (CVE-2016-0702)
   1626      [Andy Polyakov]
   1628   *) Change the req app to generate a 2048-bit RSA/DSA key by default,
   1629      if no keysize is specified with default_bits. This fixes an
   1630      omission in an earlier change that changed all RSA/DSA key generation
   1631      apps to use 2048 bits by default.
   1632      [Emilia Ksper]
   1634  Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
   1635   *) DH small subgroups
   1637      Historically OpenSSL only ever generated DH parameters based on "safe"
   1638      primes. More recently (in version 1.0.2) support was provided for
   1639      generating X9.42 style parameter files such as those required for RFC 5114
   1640      support. The primes used in such files may not be "safe". Where an
   1641      application is using DH configured with parameters based on primes that are
   1642      not "safe" then an attacker could use this fact to find a peer's private
   1643      DH exponent. This attack requires that the attacker complete multiple
   1644      handshakes in which the peer uses the same private DH exponent. For example
   1645      this could be used to discover a TLS server's private DH exponent if it's
   1646      reusing the private DH exponent or it's using a static DH ciphersuite.
   1648      OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
   1649      TLS. It is not on by default. If the option is not set then the server
   1650      reuses the same private DH exponent for the life of the server process and
   1651      would be vulnerable to this attack. It is believed that many popular
   1652      applications do set this option and would therefore not be at risk.
   1654      The fix for this issue adds an additional check where a "q" parameter is
   1655      available (as is the case in X9.42 based parameters). This detects the
   1656      only known attack, and is the only possible defense for static DH
   1657      ciphersuites. This could have some performance impact.
   1659      Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
   1660      default and cannot be disabled. This could have some performance impact.
   1662      This issue was reported to OpenSSL by Antonio Sanso (Adobe).
   1663      (CVE-2016-0701)
   1664      [Matt Caswell]
   1666   *) SSLv2 doesn't block disabled ciphers
   1668      A malicious client can negotiate SSLv2 ciphers that have been disabled on
   1669      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
   1670      been disabled, provided that the SSLv2 protocol was not also disabled via
   1671      SSL_OP_NO_SSLv2.
   1673      This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
   1674      and Sebastian Schinzel.
   1675      (CVE-2015-3197)
   1676      [Viktor Dukhovni]
   1678  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
   1680   *) BN_mod_exp may produce incorrect results on x86_64
   1682      There is a carry propagating bug in the x86_64 Montgomery squaring
   1683      procedure. No EC algorithms are affected. Analysis suggests that attacks
   1684      against RSA and DSA as a result of this defect would be very difficult to
   1685      perform and are not believed likely. Attacks against DH are considered just
   1686      feasible (although very difficult) because most of the work necessary to
   1687      deduce information about a private key may be performed offline. The amount
   1688      of resources required for such an attack would be very significant and
   1689      likely only accessible to a limited number of attackers. An attacker would
   1690      additionally need online access to an unpatched system using the target
   1691      private key in a scenario with persistent DH parameters and a private
   1692      key that is shared between multiple clients. For example this can occur by
   1693      default in OpenSSL DHE based SSL/TLS ciphersuites.
   1695      This issue was reported to OpenSSL by Hanno Bck.
   1696      (CVE-2015-3193)
   1697      [Andy Polyakov]
   1699   *) Certificate verify crash with missing PSS parameter
   1701      The signature verification routines will crash with a NULL pointer
   1702      dereference if presented with an ASN.1 signature using the RSA PSS
   1703      algorithm and absent mask generation function parameter. Since these
   1704      routines are used to verify certificate signature algorithms this can be
   1705      used to crash any certificate verification operation and exploited in a
   1706      DoS attack. Any application which performs certificate verification is
   1707      vulnerable including OpenSSL clients and servers which enable client
   1708      authentication.
   1710      This issue was reported to OpenSSL by Loc Jonas Etienne (Qnective AG).
   1711      (CVE-2015-3194)
   1712      [Stephen Henson]
   1714   *) X509_ATTRIBUTE memory leak
   1716      When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
   1717      memory. This structure is used by the PKCS#7 and CMS routines so any
   1718      application which reads PKCS#7 or CMS data from untrusted sources is
   1719      affected. SSL/TLS is not affected.
   1721      This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
   1722      libFuzzer.
   1723      (CVE-2015-3195)
   1724      [Stephen Henson]
   1726   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
   1727      This changes the decoding behaviour for some invalid messages,
   1728      though the change is mostly in the more lenient direction, and
   1729      legacy behaviour is preserved as much as possible.
   1730      [Emilia Ksper]
   1732   *) In DSA_generate_parameters_ex, if the provided seed is too short,
   1733      return an error
   1734      [Rich Salz and Ismo Puustinen <ismo.puustinen (a] intel.com>]
   1736  Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
   1738   *) Alternate chains certificate forgery
   1740      During certificate verification, OpenSSL will attempt to find an
   1741      alternative certificate chain if the first attempt to build such a chain
   1742      fails. An error in the implementation of this logic can mean that an
   1743      attacker could cause certain checks on untrusted certificates to be
   1744      bypassed, such as the CA flag, enabling them to use a valid leaf
   1745      certificate to act as a CA and "issue" an invalid certificate.
   1747      This issue was reported to OpenSSL by Adam Langley/David Benjamin
   1748      (Google/BoringSSL).
   1749      [Matt Caswell]
   1751  Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
   1753   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
   1754      incompatibility in the handling of HMAC. The previous ABI has now been
   1755      restored.
   1756      [Matt Caswell]
   1758  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
   1760   *) Malformed ECParameters causes infinite loop
   1762      When processing an ECParameters structure OpenSSL enters an infinite loop
   1763      if the curve specified is over a specially malformed binary polynomial
   1764      field.
   1766      This can be used to perform denial of service against any
   1767      system which processes public keys, certificate requests or
   1768      certificates.  This includes TLS clients and TLS servers with
   1769      client authentication enabled.
   1771      This issue was reported to OpenSSL by Joseph Barr-Pixton.
   1772      (CVE-2015-1788)
   1773      [Andy Polyakov]
   1775   *) Exploitable out-of-bounds read in X509_cmp_time
   1777      X509_cmp_time does not properly check the length of the ASN1_TIME
   1778      string and can read a few bytes out of bounds. In addition,
   1779      X509_cmp_time accepts an arbitrary number of fractional seconds in the
   1780      time string.
   1782      An attacker can use this to craft malformed certificates and CRLs of
   1783      various sizes and potentially cause a segmentation fault, resulting in
   1784      a DoS on applications that verify certificates or CRLs. TLS clients
   1785      that verify CRLs are affected. TLS clients and servers with client
   1786      authentication enabled may be affected if they use custom verification
   1787      callbacks.
   1789      This issue was reported to OpenSSL by Robert Swiecki (Google), and
   1790      independently by Hanno Bck.
   1791      (CVE-2015-1789)
   1792      [Emilia Ksper]
   1794   *) PKCS7 crash with missing EnvelopedContent
   1796      The PKCS#7 parsing code does not handle missing inner EncryptedContent
   1797      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
   1798      with missing content and trigger a NULL pointer dereference on parsing.
   1800      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
   1801      structures from untrusted sources are affected. OpenSSL clients and
   1802      servers are not affected.
   1804      This issue was reported to OpenSSL by Michal Zalewski (Google).
   1805      (CVE-2015-1790)
   1806      [Emilia Ksper]
   1808   *) CMS verify infinite loop with unknown hash function
   1810      When verifying a signedData message the CMS code can enter an infinite loop
   1811      if presented with an unknown hash function OID. This can be used to perform
   1812      denial of service against any system which verifies signedData messages using
   1813      the CMS code.
   1814      This issue was reported to OpenSSL by Johannes Bauer.
   1815      (CVE-2015-1792)
   1816      [Stephen Henson]
   1818   *) Race condition handling NewSessionTicket
   1820      If a NewSessionTicket is received by a multi-threaded client when attempting to
   1821      reuse a previous ticket then a race condition can occur potentially leading to
   1822      a double free of the ticket data.
   1823      (CVE-2015-1791)
   1824      [Matt Caswell]
   1826   *) Only support 256-bit or stronger elliptic curves with the
   1827      'ecdh_auto' setting (server) or by default (client). Of supported
   1828      curves, prefer P-256 (both).
   1829      [Emilia Kasper]
   1831  Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
   1833   *) ClientHello sigalgs DoS fix
   1835      If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
   1836      invalid signature algorithms extension a NULL pointer dereference will
   1837      occur. This can be exploited in a DoS attack against the server.
   1839      This issue was was reported to OpenSSL by David Ramos of Stanford
   1840      University.
   1841      (CVE-2015-0291)
   1842      [Stephen Henson and Matt Caswell]
   1844   *) Multiblock corrupted pointer fix
   1846      OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
   1847      feature only applies on 64 bit x86 architecture platforms that support AES
   1848      NI instructions. A defect in the implementation of "multiblock" can cause
   1849      OpenSSL's internal write buffer to become incorrectly set to NULL when
   1850      using non-blocking IO. Typically, when the user application is using a
   1851      socket BIO for writing, this will only result in a failed connection.
   1852      However if some other BIO is used then it is likely that a segmentation
   1853      fault will be triggered, thus enabling a potential DoS attack.
   1855      This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
   1856      (CVE-2015-0290)
   1857      [Matt Caswell]
   1859   *) Segmentation fault in DTLSv1_listen fix
   1861      The DTLSv1_listen function is intended to be stateless and processes the
   1862      initial ClientHello from many peers. It is common for user code to loop
   1863      over the call to DTLSv1_listen until a valid ClientHello is received with
   1864      an associated cookie. A defect in the implementation of DTLSv1_listen means
   1865      that state is preserved in the SSL object from one invocation to the next
   1866      that can lead to a segmentation fault. Errors processing the initial
   1867      ClientHello can trigger this scenario. An example of such an error could be
   1868      that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
   1869      server.
   1871      This issue was reported to OpenSSL by Per Allansson.
   1872      (CVE-2015-0207)
   1873      [Matt Caswell]
   1875   *) Segmentation fault in ASN1_TYPE_cmp fix
   1877      The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
   1878      made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
   1879      certificate signature algorithm consistency this can be used to crash any
   1880      certificate verification operation and exploited in a DoS attack. Any
   1881      application which performs certificate verification is vulnerable including
   1882      OpenSSL clients and servers which enable client authentication.
   1883      (CVE-2015-0286)
   1884      [Stephen Henson]
   1886   *) Segmentation fault for invalid PSS parameters fix
   1888      The signature verification routines will crash with a NULL pointer
   1889      dereference if presented with an ASN.1 signature using the RSA PSS
   1890      algorithm and invalid parameters. Since these routines are used to verify
   1891      certificate signature algorithms this can be used to crash any
   1892      certificate verification operation and exploited in a DoS attack. Any
   1893      application which performs certificate verification is vulnerable including
   1894      OpenSSL clients and servers which enable client authentication.
   1896      This issue was was reported to OpenSSL by Brian Carpenter.
   1897      (CVE-2015-0208)
   1898      [Stephen Henson]
   1900   *) ASN.1 structure reuse memory corruption fix
   1902      Reusing a structure in ASN.1 parsing may allow an attacker to cause
   1903      memory corruption via an invalid write. Such reuse is and has been
   1904      strongly discouraged and is believed to be rare.
   1906      Applications that parse structures containing CHOICE or ANY DEFINED BY
   1907      components may be affected. Certificate parsing (d2i_X509 and related
   1908      functions) are however not affected. OpenSSL clients and servers are
   1909      not affected.
   1910      (CVE-2015-0287)
   1911      [Stephen Henson]
   1913   *) PKCS7 NULL pointer dereferences fix
   1915      The PKCS#7 parsing code does not handle missing outer ContentInfo
   1916      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
   1917      missing content and trigger a NULL pointer dereference on parsing.
   1919      Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
   1920      otherwise parse PKCS#7 structures from untrusted sources are
   1921      affected. OpenSSL clients and servers are not affected.
   1923      This issue was reported to OpenSSL by Michal Zalewski (Google).
   1924      (CVE-2015-0289)
   1925      [Emilia Ksper]
   1927   *) DoS via reachable assert in SSLv2 servers fix
   1929      A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
   1930      servers that both support SSLv2 and enable export cipher suites by sending
   1931      a specially crafted SSLv2 CLIENT-MASTER-KEY message.
   1933      This issue was discovered by Sean Burford (Google) and Emilia Ksper
   1934      (OpenSSL development team).
   1935      (CVE-2015-0293)
   1936      [Emilia Ksper]
   1938   *) Empty CKE with client auth and DHE fix
   1940      If client auth is used then a server can seg fault in the event of a DHE
   1941      ciphersuite being selected and a zero length ClientKeyExchange message
   1942      being sent by the client. This could be exploited in a DoS attack.
   1943      (CVE-2015-1787)
   1944      [Matt Caswell]
   1946   *) Handshake with unseeded PRNG fix
   1948      Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
   1949      with an unseeded PRNG. The conditions are:
   1950      - The client is on a platform where the PRNG has not been seeded
   1951      automatically, and the user has not seeded manually
   1952      - A protocol specific client method version has been used (i.e. not
   1953      SSL_client_methodv23)
   1954      - A ciphersuite is used that does not require additional random data from
   1955      the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
   1957      If the handshake succeeds then the client random that has been used will
   1958      have been generated from a PRNG with insufficient entropy and therefore the
   1959      output may be predictable.
   1961      For example using the following command with an unseeded openssl will
   1962      succeed on an unpatched platform:
   1964      openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
   1965      (CVE-2015-0285)
   1966      [Matt Caswell]
   1968   *) Use After Free following d2i_ECPrivatekey error fix
   1970      A malformed EC private key file consumed via the d2i_ECPrivateKey function
   1971      could cause a use after free condition. This, in turn, could cause a double
   1972      free in several private key parsing functions (such as d2i_PrivateKey
   1973      or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
   1974      for applications that receive EC private keys from untrusted
   1975      sources. This scenario is considered rare.
   1977      This issue was discovered by the BoringSSL project and fixed in their
   1978      commit 517073cd4b.
   1979      (CVE-2015-0209)
   1980      [Matt Caswell]
   1982   *) X509_to_X509_REQ NULL pointer deref fix
   1984      The function X509_to_X509_REQ will crash with a NULL pointer dereference if
   1985      the certificate key is invalid. This function is rarely used in practice.
   1987      This issue was discovered by Brian Carpenter.
   1988      (CVE-2015-0288)
   1989      [Stephen Henson]
   1991   *) Removed the export ciphers from the DEFAULT ciphers
   1992      [Kurt Roeckx]
   1994  Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
   1996   *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
   1997      ARMv5 through ARMv8, as opposite to "locking" it to single one.
   1998      So far those who have to target multiple platforms would compromise
   1999      and argue that binary targeting say ARMv5 would still execute on
   2000      ARMv8. "Universal" build resolves this compromise by providing
   2001      near-optimal performance even on newer platforms.
   2002      [Andy Polyakov]
   2004   *) Accelerated NIST P-256 elliptic curve implementation for x86_64
   2005      (other platforms pending).
   2006      [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
   2008   *) Add support for the SignedCertificateTimestampList certificate and
   2009      OCSP response extensions from RFC6962.
   2010      [Rob Stradling]
   2012   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
   2013      for corner cases. (Certain input points at infinity could lead to
   2014      bogus results, with non-infinity inputs mapped to infinity too.)
   2015      [Bodo Moeller]
   2017   *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
   2018      This covers AES, SHA256/512 and GHASH. "Initial" means that most
   2019      common cases are optimized and there still is room for further
   2020      improvements. Vector Permutation AES for Altivec is also added.
   2021      [Andy Polyakov]
   2023   *) Add support for little-endian ppc64 Linux target.
   2024      [Marcelo Cerri (IBM)]
   2026   *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
   2027      SHA1, SHA256 and GHASH. "Initial" means that most common cases
   2028      are optimized and there still is room for further improvements.
   2029      Both 32- and 64-bit modes are supported.
   2030      [Andy Polyakov, Ard Biesheuvel (Linaro)]
   2032   *) Improved ARMv7 NEON support.
   2033      [Andy Polyakov]
   2035   *) Support for SPARC Architecture 2011 crypto extensions, first
   2036      implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
   2037      SHA256/512, MD5, GHASH and modular exponentiation.
   2038      [Andy Polyakov, David Miller]
   2040   *) Accelerated modular exponentiation for Intel processors, a.k.a.
   2041      RSAZ.
   2042      [Shay Gueron & Vlad Krasnov (Intel Corp)]
   2044   *) Support for new and upcoming Intel processors, including AVX2,
   2045      BMI and SHA ISA extensions. This includes additional "stitched"
   2046      implementations, AESNI-SHA256 and GCM, and multi-buffer support
   2047      for TLS encrypt.
   2049      This work was sponsored by Intel Corp.
   2050      [Andy Polyakov]
   2052   *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
   2053      supports both DTLS 1.2 and 1.0 and should use whatever version the peer
   2054      supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
   2055      [Steve Henson]
   2057   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
   2058      this fixes a limitation in previous versions of OpenSSL.
   2059      [Steve Henson]
   2061   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
   2062      MGF1 digest and OAEP label.
   2063      [Steve Henson]
   2065   *) Add EVP support for key wrapping algorithms, to avoid problems with
   2066      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
   2067      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
   2068      algorithms and include tests cases.
   2069      [Steve Henson]
   2071   *) Add functions to allocate and set the fields of an ECDSA_METHOD
   2072      structure.
   2073      [Douglas E. Engert, Steve Henson]
   2075   *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
   2076      difference in days and seconds between two tm or ASN1_TIME structures.
   2077      [Steve Henson]
   2079   *) Add -rev test option to s_server to just reverse order of characters
   2080      received by client and send back to server. Also prints an abbreviated
   2081      summary of the connection parameters.
   2082      [Steve Henson]
   2084   *) New option -brief for s_client and s_server to print out a brief summary
   2085      of connection parameters.
   2086      [Steve Henson]
   2088   *) Add callbacks for arbitrary TLS extensions.
   2089      [Trevor Perrin <trevp (a] trevp.net> and Ben Laurie]
   2091   *) New option -crl_download in several openssl utilities to download CRLs
   2092      from CRLDP extension in certificates.
   2093      [Steve Henson]
   2095   *) New options -CRL and -CRLform for s_client and s_server for CRLs.
   2096      [Steve Henson]
   2098   *) New function X509_CRL_diff to generate a delta CRL from the difference
   2099      of two full CRLs. Add support to "crl" utility.
   2100      [Steve Henson]
   2102   *) New functions to set lookup_crls function and to retrieve
   2103      X509_STORE from X509_STORE_CTX.
   2104      [Steve Henson]
   2106   *) Print out deprecated issuer and subject unique ID fields in
   2107      certificates.
   2108      [Steve Henson]
   2110   *) Extend OCSP I/O functions so they can be used for simple general purpose
   2111      HTTP as well as OCSP. New wrapper function which can be used to download
   2112      CRLs using the OCSP API.
   2113      [Steve Henson]
   2115   *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
   2116      [Steve Henson]
   2118   *) SSL_CONF* functions. These provide a common framework for application
   2119      configuration using configuration files or command lines.
   2120      [Steve Henson]
   2122   *) SSL/TLS tracing code. This parses out SSL/TLS records using the
   2123      message callback and prints the results. Needs compile time option
   2124      "enable-ssl-trace". New options to s_client and s_server to enable
   2125      tracing.
   2126      [Steve Henson]
   2128   *) New ctrl and macro to retrieve supported points extensions.
   2129      Print out extension in s_server and s_client.
   2130      [Steve Henson]
   2132   *) New functions to retrieve certificate signature and signature
   2133      OID NID.
   2134      [Steve Henson]
   2136   *) Add functions to retrieve and manipulate the raw cipherlist sent by a
   2137      client to OpenSSL.
   2138      [Steve Henson]
   2140   *) New Suite B modes for TLS code. These use and enforce the requirements
   2141      of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
   2142      only use Suite B curves. The Suite B modes can be set by using the
   2143      strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
   2144      [Steve Henson]
   2146   *) New chain verification flags for Suite B levels of security. Check
   2147      algorithms are acceptable when flags are set in X509_verify_cert.
   2148      [Steve Henson]
   2150   *) Make tls1_check_chain return a set of flags indicating checks passed
   2151      by a certificate chain. Add additional tests to handle client
   2152      certificates: checks for matching certificate type and issuer name
   2153      comparison.
   2154      [Steve Henson]
   2156   *) If an attempt is made to use a signature algorithm not in the peer
   2157      preference list abort the handshake. If client has no suitable
   2158      signature algorithms in response to a certificate request do not
   2159      use the certificate.
   2160      [Steve Henson]
   2162   *) If server EC tmp key is not in client preference list abort handshake.
   2163      [Steve Henson]
   2165   *) Add support for certificate stores in CERT structure. This makes it
   2166      possible to have different stores per SSL structure or one store in
   2167      the parent SSL_CTX. Include distinct stores for certificate chain
   2168      verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
   2169      to build and store a certificate chain in CERT structure: returning
   2170      an error if the chain cannot be built: this will allow applications
   2171      to test if a chain is correctly configured.
   2173      Note: if the CERT based stores are not set then the parent SSL_CTX
   2174      store is used to retain compatibility with existing behaviour.
   2176      [Steve Henson]
   2178   *) New function ssl_set_client_disabled to set a ciphersuite disabled
   2179      mask based on the current session, check mask when sending client
   2180      hello and checking the requested ciphersuite.
   2181      [Steve Henson]
   2183   *) New ctrls to retrieve and set certificate types in a certificate
   2184      request message. Print out received values in s_client. If certificate
   2185      types is not set with custom values set sensible values based on
   2186      supported signature algorithms.
   2187      [Steve Henson]
   2189   *) Support for distinct client and server supported signature algorithms.
   2190      [Steve Henson]
   2192   *) Add certificate callback. If set this is called whenever a certificate
   2193      is required by client or server. An application can decide which
   2194      certificate chain to present based on arbitrary criteria: for example
   2195      supported signature algorithms. Add very simple example to s_server.
   2196      This fixes many of the problems and restrictions of the existing client
   2197      certificate callback: for example you can now clear an existing
   2198      certificate and specify the whole chain.
   2199      [Steve Henson]
   2201   *) Add new "valid_flags" field to CERT_PKEY structure which determines what
   2202      the certificate can be used for (if anything). Set valid_flags field 
   2203      in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
   2204      to have similar checks in it.
   2206      Add new "cert_flags" field to CERT structure and include a "strict mode".
   2207      This enforces some TLS certificate requirements (such as only permitting
   2208      certificate signature algorithms contained in the supported algorithms
   2209      extension) which some implementations ignore: this option should be used
   2210      with caution as it could cause interoperability issues.
   2211      [Steve Henson]
   2213   *) Update and tidy signature algorithm extension processing. Work out
   2214      shared signature algorithms based on preferences and peer algorithms
   2215      and print them out in s_client and s_server. Abort handshake if no
   2216      shared signature algorithms.
   2217      [Steve Henson]
   2219   *) Add new functions to allow customised supported signature algorithms
   2220      for SSL and SSL_CTX structures. Add options to s_client and s_server
   2221      to support them.
   2222      [Steve Henson]
   2224   *) New function SSL_certs_clear() to delete all references to certificates
   2225      from an SSL structure. Before this once a certificate had been added
   2226      it couldn't be removed.
   2227      [Steve Henson]
   2229   *) Integrate hostname, email address and IP address checking with certificate
   2230      verification. New verify options supporting checking in openssl utility.
   2231      [Steve Henson]
   2233   *) Fixes and wildcard matching support to hostname and email checking
   2234      functions. Add manual page.
   2235      [Florian Weimer (Red Hat Product Security Team)]
   2237   *) New functions to check a hostname email or IP address against a
   2238      certificate. Add options x509 utility to print results of checks against
   2239      a certificate.
   2240      [Steve Henson]
   2242   *) Fix OCSP checking.
   2243      [Rob Stradling <rob.stradling (a] comodo.com> and Ben Laurie]
   2245   *) Initial experimental support for explicitly trusted non-root CAs. 
   2246      OpenSSL still tries to build a complete chain to a root but if an
   2247      intermediate CA has a trust setting included that is used. The first
   2248      setting is used: whether to trust (e.g., -addtrust option to the x509
   2249      utility) or reject.
   2250      [Steve Henson]
   2252   *) Add -trusted_first option which attempts to find certificates in the
   2253      trusted store even if an untrusted chain is also supplied.
   2254      [Steve Henson]
   2256   *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
   2257      platform support for Linux and Android.
   2258      [Andy Polyakov]
   2260   *) Support for linux-x32, ILP32 environment in x86_64 framework.
   2261      [Andy Polyakov]
   2263   *) Experimental multi-implementation support for FIPS capable OpenSSL.
   2264      When in FIPS mode the approved implementations are used as normal,
   2265      when not in FIPS mode the internal unapproved versions are used instead.
   2266      This means that the FIPS capable OpenSSL isn't forced to use the
   2267      (often lower performance) FIPS implementations outside FIPS mode.
   2268      [Steve Henson]
   2270   *) Transparently support X9.42 DH parameters when calling
   2271      PEM_read_bio_DHparameters. This means existing applications can handle
   2272      the new parameter format automatically.
   2273      [Steve Henson]
   2275   *) Initial experimental support for X9.42 DH parameter format: mainly
   2276      to support use of 'q' parameter for RFC5114 parameters.
   2277      [Steve Henson]
   2279   *) Add DH parameters from RFC5114 including test data to dhtest.
   2280      [Steve Henson]
   2282   *) Support for automatic EC temporary key parameter selection. If enabled
   2283      the most preferred EC parameters are automatically used instead of
   2284      hardcoded fixed parameters. Now a server just has to call:
   2285      SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
   2286      support ECDH and use the most appropriate parameters.
   2287      [Steve Henson]
   2289   *) Enhance and tidy EC curve and point format TLS extension code. Use
   2290      static structures instead of allocation if default values are used.
   2291      New ctrls to set curves we wish to support and to retrieve shared curves.
   2292      Print out shared curves in s_server. New options to s_server and s_client
   2293      to set list of supported curves.
   2294      [Steve Henson]
   2296   *) New ctrls to retrieve supported signature algorithms and 
   2297      supported curve values as an array of NIDs. Extend openssl utility
   2298      to print out received values.
   2299      [Steve Henson]
   2301   *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
   2302      between NIDs and the more common NIST names such as "P-256". Enhance
   2303      ecparam utility and ECC method to recognise the NIST names for curves.
   2304      [Steve Henson]
   2306   *) Enhance SSL/TLS certificate chain handling to support different
   2307      chains for each certificate instead of one chain in the parent SSL_CTX.
   2308      [Steve Henson]
   2310   *) Support for fixed DH ciphersuite client authentication: where both
   2311      server and client use DH certificates with common parameters.
   2312      [Steve Henson]
   2314   *) Support for fixed DH ciphersuites: those requiring DH server
   2315      certificates.
   2316      [Steve Henson]
   2318   *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
   2319      the certificate.
   2320      Note: Related 1.0.2-beta specific macros X509_get_cert_info,
   2321      X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
   2322      X509_CINF_get_signature were reverted post internal team review.
   2324  Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
   2326   *) Build fixes for the Windows and OpenVMS platforms
   2327      [Matt Caswell and Richard Levitte]
   2329  Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
   2331   *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
   2332      message can cause a segmentation fault in OpenSSL due to a NULL pointer
   2333      dereference. This could lead to a Denial Of Service attack. Thanks to
   2334      Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
   2335      (CVE-2014-3571)
   2336      [Steve Henson]
   2338   *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
   2339      dtls1_buffer_record function under certain conditions. In particular this
   2340      could occur if an attacker sent repeated DTLS records with the same
   2341      sequence number but for the next epoch. The memory leak could be exploited
   2342      by an attacker in a Denial of Service attack through memory exhaustion.
   2343      Thanks to Chris Mueller for reporting this issue.
   2344      (CVE-2015-0206)
   2345      [Matt Caswell]
   2347   *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
   2348      built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
   2349      method would be set to NULL which could later result in a NULL pointer
   2350      dereference. Thanks to Frank Schmirler for reporting this issue.
   2351      (CVE-2014-3569)
   2352      [Kurt Roeckx]
   2354   *) Abort handshake if server key exchange message is omitted for ephemeral
   2355      ECDH ciphersuites.
   2357      Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
   2358      reporting this issue.
   2359      (CVE-2014-3572)
   2360      [Steve Henson]
   2362   *) Remove non-export ephemeral RSA code on client and server. This code
   2363      violated the TLS standard by allowing the use of temporary RSA keys in
   2364      non-export ciphersuites and could be used by a server to effectively
   2365      downgrade the RSA key length used to a value smaller than the server
   2366      certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
   2367      INRIA or reporting this issue.
   2368      (CVE-2015-0204)
   2369      [Steve Henson]
   2371   *) Fixed issue where DH client certificates are accepted without verification.
   2372      An OpenSSL server will accept a DH certificate for client authentication
   2373      without the certificate verify message. This effectively allows a client to
   2374      authenticate without the use of a private key. This only affects servers
   2375      which trust a client certificate authority which issues certificates
   2376      containing DH keys: these are extremely rare and hardly ever encountered.
   2377      Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
   2378      this issue.
   2379      (CVE-2015-0205)
   2380      [Steve Henson]
   2382   *) Ensure that the session ID context of an SSL is updated when its
   2383      SSL_CTX is updated via SSL_set_SSL_CTX.
   2385      The session ID context is typically set from the parent SSL_CTX,
   2386      and can vary with the CTX.
   2387      [Adam Langley]
   2389   *) Fix various certificate fingerprint issues.
   2391      By using non-DER or invalid encodings outside the signed portion of a
   2392      certificate the fingerprint can be changed without breaking the signature.
   2393      Although no details of the signed portion of the certificate can be changed
   2394      this can cause problems with some applications: e.g. those using the
   2395      certificate fingerprint for blacklists.
   2397      1. Reject signatures with non zero unused bits.
   2399      If the BIT STRING containing the signature has non zero unused bits reject
   2400      the signature. All current signature algorithms require zero unused bits.
   2402      2. Check certificate algorithm consistency.
   2404      Check the AlgorithmIdentifier inside TBS matches the one in the
   2405      certificate signature. NB: this will result in signature failure
   2406      errors for some broken certificates.
   2408      Thanks to Konrad Kraszewski from Google for reporting this issue.
   2410      3. Check DSA/ECDSA signatures use DER.
   2412      Re-encode DSA/ECDSA signatures and compare with the original received
   2413      signature. Return an error if there is a mismatch.
   2415      This will reject various cases including garbage after signature
   2416      (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
   2417      program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
   2418      (negative or with leading zeroes).
   2420      Further analysis was conducted and fixes were developed by Stephen Henson
   2421      of the OpenSSL core team.
   2423      (CVE-2014-8275)
   2424      [Steve Henson]
   2426    *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
   2427       results on some platforms, including x86_64. This bug occurs at random
   2428       with a very low probability, and is not known to be exploitable in any
   2429       way, though its exact impact is difficult to determine. Thanks to Pieter
   2430       Wuille (Blockstream) who reported this issue and also suggested an initial
   2431       fix. Further analysis was conducted by the OpenSSL development team and
   2432       Adam Langley of Google. The final fix was developed by Andy Polyakov of
   2433       the OpenSSL core team.
   2434       (CVE-2014-3570)
   2435       [Andy Polyakov]
   2437    *) Do not resume sessions on the server if the negotiated protocol
   2438       version does not match the session's version. Resuming with a different
   2439       version, while not strictly forbidden by the RFC, is of questionable
   2440       sanity and breaks all known clients.
   2441       [David Benjamin, Emilia Ksper]
   2443    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
   2444       early CCS messages during renegotiation. (Note that because
   2445       renegotiation is encrypted, this early CCS was not exploitable.)
   2446       [Emilia Ksper]
   2448    *) Tighten client-side session ticket handling during renegotiation:
   2449       ensure that the client only accepts a session ticket if the server sends
   2450       the extension anew in the ServerHello. Previously, a TLS client would
   2451       reuse the old extension state and thus accept a session ticket if one was
   2452       announced in the initial ServerHello.
   2454       Similarly, ensure that the client requires a session ticket if one
   2455       was advertised in the ServerHello. Previously, a TLS client would
   2456       ignore a missing NewSessionTicket message.
   2457       [Emilia Ksper]
   2459  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
   2461   *) SRTP Memory Leak.
   2463      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
   2464      sends a carefully crafted handshake message, to cause OpenSSL to fail
   2465      to free up to 64k of memory causing a memory leak. This could be
   2466      exploited in a Denial Of Service attack. This issue affects OpenSSL
   2467      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
   2468      whether SRTP is used or configured. Implementations of OpenSSL that
   2469      have been compiled with OPENSSL_NO_SRTP defined are not affected.
   2471      The fix was developed by the OpenSSL team.
   2472      (CVE-2014-3513)
   2473      [OpenSSL team]
   2475   *) Session Ticket Memory Leak.
   2477      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
   2478      integrity of that ticket is first verified. In the event of a session
   2479      ticket integrity check failing, OpenSSL will fail to free memory
   2480      causing a memory leak. By sending a large number of invalid session
   2481      tickets an attacker could exploit this issue in a Denial Of Service
   2482      attack.
   2483      (CVE-2014-3567)
   2484      [Steve Henson]
   2486   *) Build option no-ssl3 is incomplete.
   2488      When OpenSSL is configured with "no-ssl3" as a build option, servers
   2489      could accept and complete a SSL 3.0 handshake, and clients could be
   2490      configured to send them.
   2491      (CVE-2014-3568)
   2492      [Akamai and the OpenSSL team]
   2494   *) Add support for TLS_FALLBACK_SCSV.
   2495      Client applications doing fallback retries should call
   2496      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
   2497      (CVE-2014-3566)
   2498      [Adam Langley, Bodo Moeller]
   2500   *) Add additional DigestInfo checks.
   2502      Re-encode DigestInto in DER and check against the original when
   2503      verifying RSA signature: this will reject any improperly encoded
   2504      DigestInfo structures.
   2506      Note: this is a precautionary measure and no attacks are currently known.
   2508      [Steve Henson]
   2510  Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
   2512   *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
   2513      SRP code can be overrun an internal buffer. Add sanity check that
   2514      g, A, B < N to SRP code.
   2516      Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
   2517      Group for discovering this issue.
   2518      (CVE-2014-3512)
   2519      [Steve Henson]
   2521   *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
   2522      TLS 1.0 instead of higher protocol versions when the ClientHello message
   2523      is badly fragmented. This allows a man-in-the-middle attacker to force a
   2524      downgrade to TLS 1.0 even if both the server and the client support a
   2525      higher protocol version, by modifying the client's TLS records.
   2527      Thanks to David Benjamin and Adam Langley (Google) for discovering and
   2528      researching this issue.
   2529      (CVE-2014-3511)
   2530      [David Benjamin]
   2532   *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
   2533      to a denial of service attack. A malicious server can crash the client
   2534      with a null pointer dereference (read) by specifying an anonymous (EC)DH
   2535      ciphersuite and sending carefully crafted handshake messages.
   2537      Thanks to Felix Grbert (Google) for discovering and researching this
   2538      issue.
   2539      (CVE-2014-3510)
   2540      [Emilia Ksper]
   2542   *) By sending carefully crafted DTLS packets an attacker could cause openssl
   2543      to leak memory. This can be exploited through a Denial of Service attack.
   2544      Thanks to Adam Langley for discovering and researching this issue.
   2545      (CVE-2014-3507)
   2546      [Adam Langley]
   2548   *) An attacker can force openssl to consume large amounts of memory whilst
   2549      processing DTLS handshake messages. This can be exploited through a
   2550      Denial of Service attack.
   2551      Thanks to Adam Langley for discovering and researching this issue.
   2552      (CVE-2014-3506)
   2553      [Adam Langley]
   2555   *) An attacker can force an error condition which causes openssl to crash
   2556      whilst processing DTLS packets due to memory being freed twice. This
   2557      can be exploited through a Denial of Service attack.
   2558      Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
   2559      this issue.
   2560      (CVE-2014-3505)
   2561      [Adam Langley]
   2563   *) If a multithreaded client connects to a malicious server using a resumed
   2564      session and the server sends an ec point format extension it could write
   2565      up to 255 bytes to freed memory.
   2567      Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
   2568      issue.
   2569      (CVE-2014-3509)
   2570      [Gabor Tyukasz]
   2572   *) A malicious server can crash an OpenSSL client with a null pointer
   2573      dereference (read) by specifying an SRP ciphersuite even though it was not
   2574      properly negotiated with the client. This can be exploited through a
   2575      Denial of Service attack.
   2577      Thanks to Joonas Kuorilehto and Riku Hietamki (Codenomicon) for
   2578      discovering and researching this issue.
   2579      (CVE-2014-5139)
   2580      [Steve Henson]
   2582   *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
   2583      X509_name_oneline, X509_name_print_ex et al. to leak some information
   2584      from the stack. Applications may be affected if they echo pretty printing
   2585      output to the attacker.
   2587      Thanks to Ivan Fratric (Google) for discovering this issue.
   2588      (CVE-2014-3508)
   2589      [Emilia Ksper, and Steve Henson]
   2591   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
   2592      for corner cases. (Certain input points at infinity could lead to
   2593      bogus results, with non-infinity inputs mapped to infinity too.)
   2594      [Bodo Moeller]
   2596  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
   2598   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
   2599      handshake can force the use of weak keying material in OpenSSL
   2600      SSL/TLS clients and servers.
   2602      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
   2603      researching this issue. (CVE-2014-0224)
   2604      [KIKUCHI Masashi, Steve Henson]
   2606   *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
   2607      OpenSSL DTLS client the code can be made to recurse eventually crashing
   2608      in a DoS attack.
   2610      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
   2611      (CVE-2014-0221)
   2612      [Imre Rad, Steve Henson]
   2614   *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
   2615      be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
   2616      client or server. This is potentially exploitable to run arbitrary
   2617      code on a vulnerable client or server.
   2619      Thanks to Jri Aedla for reporting this issue. (CVE-2014-0195)
   2620      [Jri Aedla, Steve Henson]
   2622   *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
   2623      are subject to a denial of service attack.
   2625      Thanks to Felix Grbert and Ivan Fratric at Google for discovering
   2626      this issue. (CVE-2014-3470)
   2627      [Felix Grbert, Ivan Fratric, Steve Henson]
   2629   *) Harmonize version and its documentation. -f flag is used to display
   2630      compilation flags.
   2631      [mancha <mancha1 (a] zoho.com>]
   2633   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
   2634      in i2d_ECPrivateKey.
   2635      [mancha <mancha1 (a] zoho.com>]
   2637   *) Fix some double frees. These are not thought to be exploitable.
   2638      [mancha <mancha1 (a] zoho.com>]
   2640  Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
   2642   *) A missing bounds check in the handling of the TLS heartbeat extension
   2643      can be used to reveal up to 64k of memory to a connected client or
   2644      server.
   2646      Thanks for Neel Mehta of Google Security for discovering this bug and to
   2647      Adam Langley <agl (a] chromium.org> and Bodo Moeller <bmoeller (a] acm.org> for
   2648      preparing the fix (CVE-2014-0160)
   2649      [Adam Langley, Bodo Moeller]
   2651   *) Fix for the attack described in the paper "Recovering OpenSSL
   2652      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
   2653      by Yuval Yarom and Naomi Benger. Details can be obtained from:
   2654      http://eprint.iacr.org/2014/140
   2656      Thanks to Yuval Yarom and Naomi Benger for discovering this
   2657      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
   2658      [Yuval Yarom and Naomi Benger]
   2660   *) TLS pad extension: draft-agl-tls-padding-03
   2662      Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
   2663      TLS client Hello record length value would otherwise be > 255 and
   2664      less that 512 pad with a dummy extension containing zeroes so it
   2665      is at least 512 bytes long.
   2667      [Adam Langley, Steve Henson]
   2669  Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
   2671   *) Fix for TLS record tampering bug. A carefully crafted invalid 
   2672      handshake could crash OpenSSL with a NULL pointer exception.
   2673      Thanks to Anton Johansson for reporting this issues.
   2674      (CVE-2013-4353)
   2676   *) Keep original DTLS digest and encryption contexts in retransmission
   2677      structures so we can use the previous session parameters if they need
   2678      to be resent. (CVE-2013-6450)
   2679      [Steve Henson]
   2681   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
   2682      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
   2683      Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
   2684      several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
   2685      is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
   2686      10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
   2687      [Rob Stradling, Adam Langley]
   2689  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
   2691   *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
   2692      supporting platforms or when small records were transferred.
   2693      [Andy Polyakov, Steve Henson]
   2695  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
   2697   *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
   2699      This addresses the flaw in CBC record processing discovered by 
   2700      Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
   2701      at: http://www.isg.rhul.ac.uk/tls/     
   2703      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   2704      Security Group at Royal Holloway, University of London
   2705      (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
   2706      Emilia Ksper for the initial patch.
   2707      (CVE-2013-0169)
   2708      [Emilia Ksper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
   2710   *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
   2711      ciphersuites which can be exploited in a denial of service attack.
   2712      Thanks go to and to Adam Langley <agl (a] chromium.org> for discovering
   2713      and detecting this bug and to Wolfgang Ettlinger
   2714      <wolfgang.ettlinger (a] gmail.com> for independently discovering this issue.
   2715      (CVE-2012-2686)
   2716      [Adam Langley]
   2718   *) Return an error when checking OCSP signatures when key is NULL.
   2719      This fixes a DoS attack. (CVE-2013-0166)
   2720      [Steve Henson]
   2722   *) Make openssl verify return errors.
   2723      [Chris Palmer <palmer (a] google.com> and Ben Laurie]
   2725   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
   2726      the right response is stapled. Also change SSL_get_certificate()
   2727      so it returns the certificate actually sent.
   2728      See http://rt.openssl.org/Ticket/Display.html?id=2836.
   2729      [Rob Stradling <rob.stradling (a] comodo.com>]
   2731   *) Fix possible deadlock when decoding public keys.
   2732      [Steve Henson]
   2734   *) Don't use TLS 1.0 record version number in initial client hello
   2735      if renegotiating.
   2736      [Steve Henson]
   2738  Changes between 1.0.1b and 1.0.1c [10 May 2012]
   2740   *) Sanity check record length before skipping explicit IV in TLS
   2741      1.2, 1.1 and DTLS to fix DoS attack.
   2743      Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
   2744      fuzzing as a service testing platform.
   2745      (CVE-2012-2333)
   2746      [Steve Henson]
   2748   *) Initialise tkeylen properly when encrypting CMS messages.
   2749      Thanks to Solar Designer of Openwall for reporting this issue.
   2750      [Steve Henson]
   2752   *) In FIPS mode don't try to use composite ciphers as they are not
   2753      approved.
   2754      [Steve Henson]
   2756  Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
   2758   *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
   2759      1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
   2760      mean any application compiled against OpenSSL 1.0.0 headers setting
   2761      SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
   2762      TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
   2763      0x10000000L Any application which was previously compiled against
   2764      OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
   2765      will need to be recompiled as a result. Letting be results in
   2766      inability to disable specifically TLS 1.1 and in client context,
   2767      in unlike event, limit maximum offered version to TLS 1.0 [see below].
   2768      [Steve Henson]
   2770   *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
   2771      disable just protocol X, but all protocols above X *if* there are
   2772      protocols *below* X still enabled. In more practical terms it means
   2773      that if application wants to disable TLS1.0 in favor of TLS1.1 and
   2774      above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
   2775      SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
   2776      client side.
   2777      [Andy Polyakov]
   2779  Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
   2781   *) Check for potentially exploitable overflows in asn1_d2i_read_bio
   2782      BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
   2783      in CRYPTO_realloc_clean.
   2785      Thanks to Tavis Ormandy, Google Security Team, for discovering this
   2786      issue and to Adam Langley <agl (a] chromium.org> for fixing it.
   2787      (CVE-2012-2110)
   2788      [Adam Langley (Google), Tavis Ormandy, Google Security Team]
   2790   *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
   2791      [Adam Langley]
   2793   *) Workarounds for some broken servers that "hang" if a client hello
   2794      record length exceeds 255 bytes.
   2796      1. Do not use record version number > TLS 1.0 in initial client
   2797         hello: some (but not all) hanging servers will now work.
   2798      2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
   2799 	the number of ciphers sent in the client hello. This should be
   2800         set to an even number, such as 50, for example by passing:
   2801         -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
   2802         Most broken servers should now work.
   2803      3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
   2804 	TLS 1.2 client support entirely.
   2805      [Steve Henson]
   2807   *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
   2808      [Andy Polyakov]
   2810  Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
   2812   *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
   2813      STRING form instead of a DigestInfo.
   2814      [Steve Henson]
   2816   *) The format used for MDC2 RSA signatures is inconsistent between EVP
   2817      and the RSA_sign/RSA_verify functions. This was made more apparent when
   2818      OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
   2819      those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
   2820      the correct format in RSA_verify so both forms transparently work.
   2821      [Steve Henson]
   2823   *) Some servers which support TLS 1.0 can choke if we initially indicate
   2824      support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
   2825      encrypted premaster secret. As a workaround use the maximum permitted
   2826      client version in client hello, this should keep such servers happy
   2827      and still work with previous versions of OpenSSL.
   2828      [Steve Henson]
   2830   *) Add support for TLS/DTLS heartbeats.
   2831      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   2833   *) Add support for SCTP.
   2834      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   2836   *) Improved PRNG seeding for VOS.
   2837      [Paul Green <Paul.Green (a] stratus.com>]
   2839   *) Extensive assembler packs updates, most notably:
   2841 	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
   2842 	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
   2843 	- x86_64:       bit-sliced AES implementation;
   2844 	- ARM:          NEON support, contemporary platforms optimizations;
   2845 	- s390x:        z196 support;
   2846 	- *:            GHASH and GF(2^m) multiplication implementations;
   2848      [Andy Polyakov]
   2850   *) Make TLS-SRP code conformant with RFC 5054 API cleanup
   2851      (removal of unnecessary code)
   2852      [Peter Sylvester <peter.sylvester (a] edelweb.fr>]
   2854   *) Add TLS key material exporter from RFC 5705.
   2855      [Eric Rescorla]
   2857   *) Add DTLS-SRTP negotiation from RFC 5764.
   2858      [Eric Rescorla]
   2860   *) Add Next Protocol Negotiation,
   2861      http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
   2862      disabled with a no-npn flag to config or Configure. Code donated
   2863      by Google.
   2864      [Adam Langley <agl (a] google.com> and Ben Laurie]
   2866   *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
   2867      NIST-P256, NIST-P521, with constant-time single point multiplication on
   2868      typical inputs. Compiler support for the nonstandard type __uint128_t is
   2869      required to use this (present in gcc 4.4 and later, for 64-bit builds).
   2870      Code made available under Apache License version 2.0.
   2872      Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
   2873      line to include this in your build of OpenSSL, and run "make depend" (or
   2874      "make update"). This enables the following EC_METHODs:
   2876          EC_GFp_nistp224_method()
   2877          EC_GFp_nistp256_method()
   2878          EC_GFp_nistp521_method()
   2880      EC_GROUP_new_by_curve_name() will automatically use these (while
   2881      EC_GROUP_new_curve_GFp() currently prefers the more flexible
   2882      implementations).
   2883      [Emilia Ksper, Adam Langley, Bodo Moeller (Google)]
   2885   *) Use type ossl_ssize_t instad of ssize_t which isn't available on
   2886      all platforms. Move ssize_t definition from e_os.h to the public
   2887      header file e_os2.h as it now appears in public header file cms.h
   2888      [Steve Henson]
   2890   *) New -sigopt option to the ca, req and x509 utilities. Additional
   2891      signature parameters can be passed using this option and in
   2892      particular PSS. 
   2893      [Steve Henson]
   2895   *) Add RSA PSS signing function. This will generate and set the
   2896      appropriate AlgorithmIdentifiers for PSS based on those in the
   2897      corresponding EVP_MD_CTX structure. No application support yet.
   2898      [Steve Henson]
   2900   *) Support for companion algorithm specific ASN1 signing routines.
   2901      New function ASN1_item_sign_ctx() signs a pre-initialised
   2902      EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
   2903      the appropriate parameters.
   2904      [Steve Henson]
   2906   *) Add new algorithm specific ASN1 verification initialisation function
   2907      to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
   2908      handling will be the same no matter what EVP_PKEY_METHOD is used.
   2909      Add a PSS handler to support verification of PSS signatures: checked
   2910      against a number of sample certificates.
   2911      [Steve Henson]
   2913   *) Add signature printing for PSS. Add PSS OIDs.
   2914      [Steve Henson, Martin Kaiser <lists (a] kaiser.cx>]
   2916   *) Add algorithm specific signature printing. An individual ASN1 method
   2917      can now print out signatures instead of the standard hex dump. 
   2919      More complex signatures (e.g. PSS) can print out more meaningful
   2920      information. Include DSA version that prints out the signature
   2921      parameters r, s.
   2922      [Steve Henson]
   2924   *) Password based recipient info support for CMS library: implementing
   2925      RFC3211.
   2926      [Steve Henson]
   2928   *) Split password based encryption into PBES2 and PBKDF2 functions. This
   2929      neatly separates the code into cipher and PBE sections and is required
   2930      for some algorithms that split PBES2 into separate pieces (such as
   2931      password based CMS).
   2932      [Steve Henson]
   2934   *) Session-handling fixes:
   2935      - Fix handling of connections that are resuming with a session ID,
   2936        but also support Session Tickets.
   2937      - Fix a bug that suppressed issuing of a new ticket if the client
   2938        presented a ticket with an expired session.
   2939      - Try to set the ticket lifetime hint to something reasonable.
   2940      - Make tickets shorter by excluding irrelevant information.
   2941      - On the client side, don't ignore renewed tickets.
   2942      [Adam Langley, Bodo Moeller (Google)]
   2944   *) Fix PSK session representation.
   2945      [Bodo Moeller]
   2947   *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
   2949      This work was sponsored by Intel.
   2950      [Andy Polyakov]
   2952   *) Add GCM support to TLS library. Some custom code is needed to split
   2953      the IV between the fixed (from PRF) and explicit (from TLS record)
   2954      portions. This adds all GCM ciphersuites supported by RFC5288 and 
   2955      RFC5289. Generalise some AES* cipherstrings to include GCM and
   2956      add a special AESGCM string for GCM only.
   2957      [Steve Henson]
   2959   *) Expand range of ctrls for AES GCM. Permit setting invocation
   2960      field on decrypt and retrieval of invocation field only on encrypt.
   2961      [Steve Henson]
   2963   *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
   2964      As required by RFC5289 these ciphersuites cannot be used if for
   2965      versions of TLS earlier than 1.2.
   2966      [Steve Henson]
   2968   *) For FIPS capable OpenSSL interpret a NULL default public key method
   2969      as unset and return the appropriate default but do *not* set the default.
   2970      This means we can return the appropriate method in applications that
   2971      switch between FIPS and non-FIPS modes.
   2972      [Steve Henson]
   2974   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
   2975      ENGINE is used then we cannot handle that in the FIPS module so we
   2976      keep original code iff non-FIPS operations are allowed.
   2977      [Steve Henson]
   2979   *) Add -attime option to openssl utilities.
   2980      [Peter Eckersley <pde (a] eff.org>, Ben Laurie and Steve Henson]
   2982   *) Redirect DSA and DH operations to FIPS module in FIPS mode.
   2983      [Steve Henson]
   2985   *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
   2986      FIPS EC methods unconditionally for now.
   2987      [Steve Henson]
   2989   *) New build option no-ec2m to disable characteristic 2 code.
   2990      [Steve Henson]
   2992   *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
   2993      all cases can be covered as some introduce binary incompatibilities.
   2994      [Steve Henson]
   2996   *) Redirect RSA operations to FIPS module including keygen,
   2997      encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
   2998      [Steve Henson]
   3000   *) Add similar low level API blocking to ciphers.
   3001      [Steve Henson]
   3003   *) Low level digest APIs are not approved in FIPS mode: any attempt
   3004      to use these will cause a fatal error. Applications that *really* want
   3005      to use them can use the private_* version instead.
   3006      [Steve Henson]
   3008   *) Redirect cipher operations to FIPS module for FIPS builds. 
   3009      [Steve Henson]
   3011   *) Redirect digest operations to FIPS module for FIPS builds. 
   3012      [Steve Henson]
   3014   *) Update build system to add "fips" flag which will link in fipscanister.o
   3015      for static and shared library builds embedding a signature if needed.
   3016      [Steve Henson]
   3018   *) Output TLS supported curves in preference order instead of numerical
   3019      order. This is currently hardcoded for the highest order curves first.
   3020      This should be configurable so applications can judge speed vs strength.
   3021      [Steve Henson]
   3023   *) Add TLS v1.2 server support for client authentication. 
   3024      [Steve Henson]
   3026   *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
   3027      and enable MD5.
   3028      [Steve Henson]
   3030   *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
   3031      FIPS modules versions.
   3032      [Steve Henson]
   3034   *) Add TLS v1.2 client side support for client authentication. Keep cache
   3035      of handshake records longer as we don't know the hash algorithm to use
   3036      until after the certificate request message is received.
   3037      [Steve Henson]
   3039   *) Initial TLS v1.2 client support. Add a default signature algorithms
   3040      extension including all the algorithms we support. Parse new signature
   3041      format in client key exchange. Relax some ECC signing restrictions for
   3042      TLS v1.2 as indicated in RFC5246.
   3043      [Steve Henson]
   3045   *) Add server support for TLS v1.2 signature algorithms extension. Switch
   3046      to new signature format when needed using client digest preference.
   3047      All server ciphersuites should now work correctly in TLS v1.2. No client
   3048      support yet and no support for client certificates.
   3049      [Steve Henson]
   3051   *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
   3052      to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
   3053      ciphersuites. At present only RSA key exchange ciphersuites work with
   3054      TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
   3055      SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
   3056      and version checking.
   3057      [Steve Henson]
   3059   *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
   3060      with this defined it will not be affected by any changes to ssl internal
   3061      structures. Add several utility functions to allow openssl application
   3062      to work with OPENSSL_NO_SSL_INTERN defined.
   3063      [Steve Henson]
   3065   *) A long standing patch to add support for SRP from EdelWeb (Peter
   3066      Sylvester and Christophe Renou) was integrated.
   3067      [Christophe Renou <christophe.renou (a] edelweb.fr>, Peter Sylvester
   3068      <peter.sylvester (a] edelweb.fr>, Tom Wu <tjw (a] cs.stanford.edu>, and
   3069      Ben Laurie]
   3071   *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
   3072      [Steve Henson]
   3074   *) Permit abbreviated handshakes when renegotiating using the function
   3075      SSL_renegotiate_abbreviated().
   3076      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   3078   *) Add call to ENGINE_register_all_complete() to
   3079      ENGINE_load_builtin_engines(), so some implementations get used
   3080      automatically instead of needing explicit application support.
   3081      [Steve Henson]
   3083   *) Add support for TLS key exporter as described in RFC5705.
   3084      [Robin Seggelmann <seggelmann (a] fh-muenster.de>, Steve Henson]
   3086   *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
   3087      a few changes are required:
   3089        Add SSL_OP_NO_TLSv1_1 flag.
   3090        Add TLSv1_1 methods.
   3091        Update version checking logic to handle version 1.1.
   3092        Add explicit IV handling (ported from DTLS code).
   3093        Add command line options to s_client/s_server.
   3094      [Steve Henson]
   3096  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
   3098   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
   3099      in CMS and PKCS7 code. When RSA decryption fails use a random key for
   3100      content decryption and always return the same error. Note: this attack
   3101      needs on average 2^20 messages so it only affects automated senders. The
   3102      old behaviour can be re-enabled in the CMS code by setting the
   3103      CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
   3104      an MMA defence is not necessary.
   3105      Thanks to Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering
   3106      this issue. (CVE-2012-0884)
   3107      [Steve Henson]
   3109   *) Fix CVE-2011-4619: make sure we really are receiving a 
   3110      client hello before rejecting multiple SGC restarts. Thanks to
   3111      Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering this bug.
   3112      [Steve Henson]
   3114  Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
   3116   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
   3117      Thanks to Antonio Martin, Enterprise Secure Access Research and
   3118      Development, Cisco Systems, Inc. for discovering this bug and
   3119      preparing a fix. (CVE-2012-0050)
   3120      [Antonio Martin]
   3122  Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
   3124   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
   3125      of the Vaudenay padding oracle attack on CBC mode encryption
   3126      which enables an efficient plaintext recovery attack against
   3127      the OpenSSL implementation of DTLS. Their attack exploits timing
   3128      differences arising during decryption processing. A research
   3129      paper describing this attack can be found at:
   3130                   http://www.isg.rhul.ac.uk/~kp/dtls.pdf
   3131      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   3132      Security Group at Royal Holloway, University of London
   3133      (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
   3134      <seggelmann (a] fh-muenster.de> and Michael Tuexen <tuexen (a] fh-muenster.de>
   3135      for preparing the fix. (CVE-2011-4108)
   3136      [Robin Seggelmann, Michael Tuexen]
   3138   *) Clear bytes used for block padding of SSL 3.0 records.
   3139      (CVE-2011-4576)
   3140      [Adam Langley (Google)]
   3142   *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
   3143      Kadianakis <desnacked (a] gmail.com> for discovering this issue and
   3144      Adam Langley for preparing the fix. (CVE-2011-4619)
   3145      [Adam Langley (Google)]
   3147   *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
   3148      [Andrey Kulikov <amdeich (a] gmail.com>]
   3150   *) Prevent malformed RFC3779 data triggering an assertion failure.
   3151      Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
   3152      and Rob Austein <sra (a] hactrn.net> for fixing it. (CVE-2011-4577)
   3153      [Rob Austein <sra (a] hactrn.net>]
   3155   *) Improved PRNG seeding for VOS.
   3156      [Paul Green <Paul.Green (a] stratus.com>]
   3158   *) Fix ssl_ciph.c set-up race.
   3159      [Adam Langley (Google)]
   3161   *) Fix spurious failures in ecdsatest.c.
   3162      [Emilia Ksper (Google)]
   3164   *) Fix the BIO_f_buffer() implementation (which was mixing different
   3165      interpretations of the '..._len' fields).
   3166      [Adam Langley (Google)]
   3168   *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
   3169      BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
   3170      threads won't reuse the same blinding coefficients.
   3172      This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
   3173      lock to call BN_BLINDING_invert_ex, and avoids one use of
   3174      BN_BLINDING_update for each BN_BLINDING structure (previously,
   3175      the last update always remained unused).
   3176      [Emilia Ksper (Google)]
   3178   *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
   3179      [Bob Buckholz (Google)]
   3181  Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
   3183   *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
   3184      by initialising X509_STORE_CTX properly. (CVE-2011-3207)
   3185      [Kaspar Brand <ossl (a] velox.ch>]
   3187   *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
   3188      for multi-threaded use of ECDH. (CVE-2011-3210)
   3189      [Adam Langley (Google)]
   3191   *) Fix x509_name_ex_d2i memory leak on bad inputs.
   3192      [Bodo Moeller]
   3194   *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
   3195      signature public key algorithm by using OID xref utilities instead.
   3196      Before this you could only use some ECC ciphersuites with SHA1 only.
   3197      [Steve Henson]
   3199   *) Add protection against ECDSA timing attacks as mentioned in the paper
   3200      by Billy Bob Brumley and Nicola Tuveri, see:
   3202 	http://eprint.iacr.org/2011/232.pdf
   3204      [Billy Bob Brumley and Nicola Tuveri]
   3206  Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
   3208   *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
   3209      [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
   3211   *) Fix bug in string printing code: if *any* escaping is enabled we must
   3212      escape the escape character (backslash) or the resulting string is
   3213      ambiguous.
   3214      [Steve Henson]
   3216  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
   3218   *) Disable code workaround for ancient and obsolete Netscape browsers
   3219      and servers: an attacker can use it in a ciphersuite downgrade attack.
   3220      Thanks to Martin Rex for discovering this bug. CVE-2010-4180
   3221      [Steve Henson]
   3223   *) Fixed J-PAKE implementation error, originally discovered by
   3224      Sebastien Martini, further info and confirmation from Stefan
   3225      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
   3226      [Ben Laurie]
   3228  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
   3230   *) Fix extension code to avoid race conditions which can result in a buffer
   3231      overrun vulnerability: resumed sessions must not be modified as they can
   3232      be shared by multiple threads. CVE-2010-3864
   3233      [Steve Henson]
   3235   *) Fix WIN32 build system to correctly link an ENGINE directory into
   3236      a DLL. 
   3237      [Steve Henson]
   3239  Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
   3241   *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
   3242      (CVE-2010-1633)
   3243      [Steve Henson, Peter-Michael Hager <hager (a] dortmund.net>]
   3245  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
   3247   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
   3248      context. The operation can be customised via the ctrl mechanism in
   3249      case ENGINEs want to include additional functionality.
   3250      [Steve Henson]
   3252   *) Tolerate yet another broken PKCS#8 key format: private key value negative.
   3253      [Steve Henson]
   3255   *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
   3256      output hashes compatible with older versions of OpenSSL.
   3257      [Willy Weisz <weisz (a] vcpc.univie.ac.at>]
   3259   *) Fix compression algorithm handling: if resuming a session use the
   3260      compression algorithm of the resumed session instead of determining
   3261      it from client hello again. Don't allow server to change algorithm.
   3262      [Steve Henson]
   3264   *) Add load_crls() function to apps tidying load_certs() too. Add option
   3265      to verify utility to allow additional CRLs to be included.
   3266      [Steve Henson]
   3268   *) Update OCSP request code to permit adding custom headers to the request:
   3269      some responders need this.
   3270      [Steve Henson]
   3272   *) The function EVP_PKEY_sign() returns <=0 on error: check return code
   3273      correctly.
   3274      [Julia Lawall <julia (a] diku.dk>]
   3276   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
   3277      needlessly dereferenced structures, used obsolete functions and
   3278      didn't handle all updated verify codes correctly.
   3279      [Steve Henson]
   3281   *) Disable MD2 in the default configuration.
   3282      [Steve Henson]
   3284   *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
   3285      indicate the initial BIO being pushed or popped. This makes it possible
   3286      to determine whether the BIO is the one explicitly called or as a result
   3287      of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
   3288      it handles reference counts correctly and doesn't zero out the I/O bio
   3289      when it is not being explicitly popped. WARNING: applications which
   3290      included workarounds for the old buggy behaviour will need to be modified
   3291      or they could free up already freed BIOs.
   3292      [Steve Henson]
   3294   *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
   3295      renaming to all platforms (within the 0.9.8 branch, this was
   3296      done conditionally on Netware platforms to avoid a name clash).
   3297      [Guenter <lists (a] gknw.net>]
   3299   *) Add ECDHE and PSK support to DTLS.
   3300      [Michael Tuexen <tuexen (a] fh-muenster.de>]
   3302   *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
   3303      be used on C++.
   3304      [Steve Henson]
   3306   *) Add "missing" function EVP_MD_flags() (without this the only way to
   3307      retrieve a digest flags is by accessing the structure directly. Update
   3308      EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
   3309      or cipher is registered as in the "from" argument. Print out all
   3310      registered digests in the dgst usage message instead of manually 
   3311      attempting to work them out.
   3312      [Steve Henson]
   3314   *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
   3315      this allows the use of compression and extensions. Change default cipher
   3316      string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
   3317      by default unless an application cipher string requests it.
   3318      [Steve Henson]
   3320   *) Alter match criteria in PKCS12_parse(). It used to try to use local
   3321      key ids to find matching certificates and keys but some PKCS#12 files
   3322      don't follow the (somewhat unwritten) rules and this strategy fails.
   3323      Now just gather all certificates together and the first private key
   3324      then look for the first certificate that matches the key.
   3325      [Steve Henson]
   3327   *) Support use of registered digest and cipher names for dgst and cipher
   3328      commands instead of having to add each one as a special case. So now
   3329      you can do:
   3331         openssl sha256 foo
   3333      as well as:
   3335         openssl dgst -sha256 foo
   3337      and this works for ENGINE based algorithms too.
   3339      [Steve Henson]
   3341   *) Update Gost ENGINE to support parameter files.
   3342      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   3344   *) Support GeneralizedTime in ca utility. 
   3345      [Oliver Martin <oliver (a] volatilevoid.net>, Steve Henson]
   3347   *) Enhance the hash format used for certificate directory links. The new
   3348      form uses the canonical encoding (meaning equivalent names will work
   3349      even if they aren't identical) and uses SHA1 instead of MD5. This form
   3350      is incompatible with the older format and as a result c_rehash should
   3351      be used to rebuild symbolic links.
   3352      [Steve Henson]
   3354   *) Make PKCS#8 the default write format for private keys, replacing the
   3355      traditional format. This form is standardised, more secure and doesn't
   3356      include an implicit MD5 dependency.
   3357      [Steve Henson]
   3359   *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
   3360      committed to OpenSSL should pass this lot as a minimum.
   3361      [Steve Henson]
   3363   *) Add session ticket override functionality for use by EAP-FAST.
   3364      [Jouni Malinen <j (a] w1.fi>]
   3366   *) Modify HMAC functions to return a value. Since these can be implemented
   3367      in an ENGINE errors can occur.
   3368      [Steve Henson]
   3370   *) Type-checked OBJ_bsearch_ex.
   3371      [Ben Laurie]
   3373   *) Type-checked OBJ_bsearch. Also some constification necessitated
   3374      by type-checking.  Still to come: TXT_DB, bsearch(?),
   3375      OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
   3376      CONF_VALUE.
   3377      [Ben Laurie]
   3379   *) New function OPENSSL_gmtime_adj() to add a specific number of days and
   3380      seconds to a tm structure directly, instead of going through OS
   3381      specific date routines. This avoids any issues with OS routines such
   3382      as the year 2038 bug. New *_adj() functions for ASN1 time structures
   3383      and X509_time_adj_ex() to cover the extended range. The existing
   3384      X509_time_adj() is still usable and will no longer have any date issues.
   3385      [Steve Henson]
   3387   *) Delta CRL support. New use deltas option which will attempt to locate
   3388      and search any appropriate delta CRLs available.
   3390      This work was sponsored by Google.
   3391      [Steve Henson]
   3393   *) Support for CRLs partitioned by reason code. Reorganise CRL processing
   3394      code and add additional score elements. Validate alternate CRL paths
   3395      as part of the CRL checking and indicate a new error "CRL path validation
   3396      error" in this case. Applications wanting additional details can use
   3397      the verify callback and check the new "parent" field. If this is not
   3398      NULL CRL path validation is taking place. Existing applications won't
   3399      see this because it requires extended CRL support which is off by
   3400      default.
   3402      This work was sponsored by Google.
   3403      [Steve Henson]
   3405   *) Support for freshest CRL extension.
   3407      This work was sponsored by Google.
   3408      [Steve Henson]
   3410   *) Initial indirect CRL support. Currently only supported in the CRLs
   3411      passed directly and not via lookup. Process certificate issuer
   3412      CRL entry extension and lookup CRL entries by bother issuer name
   3413      and serial number. Check and process CRL issuer entry in IDP extension.
   3415      This work was sponsored by Google.
   3416      [Steve Henson]
   3418   *) Add support for distinct certificate and CRL paths. The CRL issuer
   3419      certificate is validated separately in this case. Only enabled if
   3420      an extended CRL support flag is set: this flag will enable additional
   3421      CRL functionality in future.
   3423      This work was sponsored by Google.
   3424      [Steve Henson]
   3426   *) Add support for policy mappings extension.
   3428      This work was sponsored by Google.
   3429      [Steve Henson]
   3431   *) Fixes to pathlength constraint, self issued certificate handling,
   3432      policy processing to align with RFC3280 and PKITS tests.
   3434      This work was sponsored by Google.
   3435      [Steve Henson]
   3437   *) Support for name constraints certificate extension. DN, email, DNS
   3438      and URI types are currently supported.
   3440      This work was sponsored by Google.
   3441      [Steve Henson]
   3443   *) To cater for systems that provide a pointer-based thread ID rather
   3444      than numeric, deprecate the current numeric thread ID mechanism and
   3445      replace it with a structure and associated callback type. This
   3446      mechanism allows a numeric "hash" to be extracted from a thread ID in
   3447      either case, and on platforms where pointers are larger than 'long',
   3448      mixing is done to help ensure the numeric 'hash' is usable even if it
   3449      can't be guaranteed unique. The default mechanism is to use "&errno"
   3450      as a pointer-based thread ID to distinguish between threads.
   3452      Applications that want to provide their own thread IDs should now use
   3453      CRYPTO_THREADID_set_callback() to register a callback that will call
   3454      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
   3456      Note that ERR_remove_state() is now deprecated, because it is tied
   3457      to the assumption that thread IDs are numeric.  ERR_remove_state(0)
   3458      to free the current thread's error state should be replaced by
   3459      ERR_remove_thread_state(NULL).
   3461      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
   3462      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
   3463      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
   3464      application was previously providing a numeric thread callback that
   3465      was inappropriate for distinguishing threads, then uniqueness might
   3466      have been obtained with &errno that happened immediately in the
   3467      intermediate development versions of OpenSSL; this is no longer the
   3468      case, the numeric thread callback will now override the automatic use
   3469      of &errno.)
   3470      [Geoff Thorpe, with help from Bodo Moeller]
   3472   *) Initial support for different CRL issuing certificates. This covers a
   3473      simple case where the self issued certificates in the chain exist and
   3474      the real CRL issuer is higher in the existing chain.
   3476      This work was sponsored by Google.
   3477      [Steve Henson]
   3479   *) Removed effectively defunct crypto/store from the build.
   3480      [Ben Laurie]
   3482   *) Revamp of STACK to provide stronger type-checking. Still to come:
   3483      TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
   3484      ASN1_STRING, CONF_VALUE.
   3485      [Ben Laurie]
   3487   *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
   3488      RAM on SSL connections.  This option can save about 34k per idle SSL.
   3489      [Nick Mathewson]
   3491   *) Revamp of LHASH to provide stronger type-checking. Still to come:
   3492      STACK, TXT_DB, bsearch, qsort.
   3493      [Ben Laurie]
   3495   *) Initial support for Cryptographic Message Syntax (aka CMS) based
   3496      on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
   3497      support for data, signedData, compressedData, digestedData and
   3498      encryptedData, envelopedData types included. Scripts to check against
   3499      RFC4134 examples draft and interop and consistency checks of many
   3500      content types and variants.
   3501      [Steve Henson]
   3503   *) Add options to enc utility to support use of zlib compression BIO.
   3504      [Steve Henson]
   3506   *) Extend mk1mf to support importing of options and assembly language
   3507      files from Configure script, currently only included in VC-WIN32.
   3508      The assembly language rules can now optionally generate the source
   3509      files from the associated perl scripts.
   3510      [Steve Henson]
   3512   *) Implement remaining functionality needed to support GOST ciphersuites.
   3513      Interop testing has been performed using CryptoPro implementations.
   3514      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   3516   *) s390x assembler pack.
   3517      [Andy Polyakov]
   3519   *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
   3520      "family."
   3521      [Andy Polyakov]
   3523   *) Implement Opaque PRF Input TLS extension as specified in
   3524      draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
   3525      official specification yet and no extension type assignment by
   3526      IANA exists, this extension (for now) will have to be explicitly
   3527      enabled when building OpenSSL by providing the extension number
   3528      to use.  For example, specify an option
   3530          -DTLSEXT_TYPE_opaque_prf_input=0x9527
   3532      to the "config" or "Configure" script to enable the extension,
   3533      assuming extension number 0x9527 (which is a completely arbitrary
   3534      and unofficial assignment based on the MD5 hash of the Internet
   3535      Draft).  Note that by doing so, you potentially lose
   3536      interoperability with other TLS implementations since these might
   3537      be using the same extension number for other purposes.
   3539      SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
   3540      opaque PRF input value to use in the handshake.  This will create
   3541      an interal copy of the length-'len' string at 'src', and will
   3542      return non-zero for success.
   3544      To get more control and flexibility, provide a callback function
   3545      by using
   3547           SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
   3548           SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
   3550      where
   3552           int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
   3553           void *arg;
   3555      Callback function 'cb' will be called in handshakes, and is
   3556      expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
   3557      Argument 'arg' is for application purposes (the value as given to
   3558      SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
   3559      be provided to the callback function).  The callback function
   3560      has to return non-zero to report success: usually 1 to use opaque
   3561      PRF input just if possible, or 2 to enforce use of the opaque PRF
   3562      input.  In the latter case, the library will abort the handshake
   3563      if opaque PRF input is not successfully negotiated.
   3565      Arguments 'peerinput' and 'len' given to the callback function
   3566      will always be NULL and 0 in the case of a client.  A server will
   3567      see the client's opaque PRF input through these variables if
   3568      available (NULL and 0 otherwise).  Note that if the server
   3569      provides an opaque PRF input, the length must be the same as the
   3570      length of the client's opaque PRF input.
   3572      Note that the callback function will only be called when creating
   3573      a new session (session resumption can resume whatever was
   3574      previously negotiated), and will not be called in SSL 2.0
   3575      handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
   3576      SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
   3577      for applications that need to enforce opaque PRF input.
   3579      [Bodo Moeller]
   3581   *) Update ssl code to support digests other than SHA1+MD5 for handshake
   3582      MAC. 
   3584      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   3586   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   3587      RFC4507bis. The encrypted ticket format is an encrypted encoded
   3588      SSL_SESSION structure, that way new session features are automatically
   3589      supported.
   3591      If a client application caches session in an SSL_SESSION structure
   3592      support is transparent because tickets are now stored in the encoded
   3593      SSL_SESSION.
   3595      The SSL_CTX structure automatically generates keys for ticket
   3596      protection in servers so again support should be possible
   3597      with no application modification.
   3599      If a client or server wishes to disable RFC4507 support then the option
   3600      SSL_OP_NO_TICKET can be set.
   3602      Add a TLS extension debugging callback to allow the contents of any client
   3603      or server extensions to be examined.
   3605      This work was sponsored by Google.
   3606      [Steve Henson]
   3608   *) Final changes to avoid use of pointer pointer casts in OpenSSL.
   3609      OpenSSL should now compile cleanly on gcc 4.2
   3610      [Peter Hartley <pdh (a] utter.chaos.org.uk>, Steve Henson]
   3612   *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
   3613      support including streaming MAC support: this is required for GOST
   3614      ciphersuite support.
   3615      [Victor B. Wagner <vitus (a] cryptocom.ru>, Steve Henson]
   3617   *) Add option -stream to use PKCS#7 streaming in smime utility. New
   3618      function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
   3619      to output in BER and PEM format.
   3620      [Steve Henson]
   3622   *) Experimental support for use of HMAC via EVP_PKEY interface. This
   3623      allows HMAC to be handled via the EVP_DigestSign*() interface. The
   3624      EVP_PKEY "key" in this case is the HMAC key, potentially allowing
   3625      ENGINE support for HMAC keys which are unextractable. New -mac and
   3626      -macopt options to dgst utility.
   3627      [Steve Henson]
   3629   *) New option -sigopt to dgst utility. Update dgst to use
   3630      EVP_Digest{Sign,Verify}*. These two changes make it possible to use
   3631      alternative signing parameters such as X9.31 or PSS in the dgst 
   3632      utility.
   3633      [Steve Henson]
   3635   *) Change ssl_cipher_apply_rule(), the internal function that does
   3636      the work each time a ciphersuite string requests enabling
   3637      ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
   3638      removing ("!foo+bar") a class of ciphersuites: Now it maintains
   3639      the order of disabled ciphersuites such that those ciphersuites
   3640      that most recently went from enabled to disabled not only stay
   3641      in order with respect to each other, but also have higher priority
   3642      than other disabled ciphersuites the next time ciphersuites are
   3643      enabled again.
   3645      This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
   3646      the same ciphersuites as with "HIGH" alone, but in a specific
   3647      order where the PSK ciphersuites come first (since they are the
   3648      most recently disabled ciphersuites when "HIGH" is parsed).
   3650      Also, change ssl_create_cipher_list() (using this new
   3651      funcionality) such that between otherwise identical
   3652      cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
   3653      the default order.
   3654      [Bodo Moeller]
   3656   *) Change ssl_create_cipher_list() so that it automatically
   3657      arranges the ciphersuites in reasonable order before starting
   3658      to process the rule string.  Thus, the definition for "DEFAULT"
   3659      (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
   3660      remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
   3661      This makes it much easier to arrive at a reasonable default order
   3662      in applications for which anonymous ciphers are OK (meaning
   3663      that you can't actually use DEFAULT).
   3664      [Bodo Moeller; suggested by Victor Duchovni]
   3666   *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
   3667      processing) into multiple integers instead of setting
   3668      "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
   3669      "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
   3670      (These masks as well as the individual bit definitions are hidden
   3671      away into the non-exported interface ssl/ssl_locl.h, so this
   3672      change to the definition of the SSL_CIPHER structure shouldn't
   3673      affect applications.)  This give us more bits for each of these
   3674      categories, so there is no longer a need to coagulate AES128 and
   3675      AES256 into a single algorithm bit, and to coagulate Camellia128
   3676      and Camellia256 into a single algorithm bit, which has led to all
   3677      kinds of kludges.
   3679      Thus, among other things, the kludge introduced in 0.9.7m and
   3680      0.9.8e for masking out AES256 independently of AES128 or masking
   3681      out Camellia256 independently of AES256 is not needed here in 0.9.9.
   3683      With the change, we also introduce new ciphersuite aliases that
   3684      so far were missing: "AES128", "AES256", "CAMELLIA128", and
   3685      "CAMELLIA256".
   3686      [Bodo Moeller]
   3688   *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
   3689      Use the leftmost N bytes of the signature input if the input is
   3690      larger than the prime q (with N being the size in bytes of q).
   3691      [Nils Larsch]
   3693   *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
   3694      it yet and it is largely untested.
   3695      [Steve Henson]
   3697   *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
   3698      [Nils Larsch]
   3700   *) Initial incomplete changes to avoid need for function casts in OpenSSL
   3701      some compilers (gcc 4.2 and later) reject their use. Safestack is
   3702      reimplemented.  Update ASN1 to avoid use of legacy functions. 
   3703      [Steve Henson]
   3705   *) Win32/64 targets are linked with Winsock2.
   3706      [Andy Polyakov]
   3708   *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
   3709      to external functions. This can be used to increase CRL handling 
   3710      efficiency especially when CRLs are very large by (for example) storing
   3711      the CRL revoked certificates in a database.
   3712      [Steve Henson]
   3714   *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
   3715      new CRLs added to a directory can be used. New command line option
   3716      -verify_return_error to s_client and s_server. This causes real errors
   3717      to be returned by the verify callback instead of carrying on no matter
   3718      what. This reflects the way a "real world" verify callback would behave.
   3719      [Steve Henson]
   3721   *) GOST engine, supporting several GOST algorithms and public key formats.
   3722      Kindly donated by Cryptocom.
   3723      [Cryptocom]
   3725   *) Partial support for Issuing Distribution Point CRL extension. CRLs
   3726      partitioned by DP are handled but no indirect CRL or reason partitioning
   3727      (yet). Complete overhaul of CRL handling: now the most suitable CRL is
   3728      selected via a scoring technique which handles IDP and AKID in CRLs.
   3729      [Steve Henson]
   3731   *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
   3732      will ultimately be used for all verify operations: this will remove the
   3733      X509_STORE dependency on certificate verification and allow alternative
   3734      lookup methods.  X509_STORE based implementations of these two callbacks.
   3735      [Steve Henson]
   3737   *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
   3738      Modify get_crl() to find a valid (unexpired) CRL if possible.
   3739      [Steve Henson]
   3741   *) New function X509_CRL_match() to check if two CRLs are identical. Normally
   3742      this would be called X509_CRL_cmp() but that name is already used by
   3743      a function that just compares CRL issuer names. Cache several CRL 
   3744      extensions in X509_CRL structure and cache CRLDP in X509.
   3745      [Steve Henson]
   3747   *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
   3748      this maps equivalent X509_NAME structures into a consistent structure.
   3749      Name comparison can then be performed rapidly using memcmp().
   3750      [Steve Henson]
   3752   *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
   3753      utility.
   3754      [Steve Henson]
   3756   *) Allow digests to supply their own micalg string for S/MIME type using
   3757      the ctrl EVP_MD_CTRL_MICALG.
   3758      [Steve Henson]
   3760   *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
   3761      EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
   3762      ctrl. It can then customise the structure before and/or after signing
   3763      if necessary.
   3764      [Steve Henson]
   3766   *) New function OBJ_add_sigid() to allow application defined signature OIDs
   3767      to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
   3768      to free up any added signature OIDs.
   3769      [Steve Henson]
   3771   *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
   3772      EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
   3773      digest and cipher tables. New options added to openssl utility:
   3774      list-message-digest-algorithms and list-cipher-algorithms.
   3775      [Steve Henson]
   3777   *) Change the array representation of binary polynomials: the list
   3778      of degrees of non-zero coefficients is now terminated with -1.
   3779      Previously it was terminated with 0, which was also part of the
   3780      value; thus, the array representation was not applicable to
   3781      polynomials where t^0 has coefficient zero.  This change makes
   3782      the array representation useful in a more general context.
   3783      [Douglas Stebila]
   3785   *) Various modifications and fixes to SSL/TLS cipher string
   3786      handling.  For ECC, the code now distinguishes between fixed ECDH
   3787      with RSA certificates on the one hand and with ECDSA certificates
   3788      on the other hand, since these are separate ciphersuites.  The
   3789      unused code for Fortezza ciphersuites has been removed.
   3791      For consistency with EDH, ephemeral ECDH is now called "EECDH"
   3792      (not "ECDHE").  For consistency with the code for DH
   3793      certificates, use of ECDH certificates is now considered ECDH
   3794      authentication, not RSA or ECDSA authentication (the latter is
   3795      merely the CA's signing algorithm and not actively used in the
   3796      protocol).
   3798      The temporary ciphersuite alias "ECCdraft" is no longer
   3799      available, and ECC ciphersuites are no longer excluded from "ALL"
   3800      and "DEFAULT".  The following aliases now exist for RFC 4492
   3801      ciphersuites, most of these by analogy with the DH case:
   3803          kECDHr   - ECDH cert, signed with RSA
   3804          kECDHe   - ECDH cert, signed with ECDSA
   3805          kECDH    - ECDH cert (signed with either RSA or ECDSA)
   3806          kEECDH   - ephemeral ECDH
   3807          ECDH     - ECDH cert or ephemeral ECDH
   3809          aECDH    - ECDH cert
   3810          aECDSA   - ECDSA cert
   3811          ECDSA    - ECDSA cert
   3813          AECDH    - anonymous ECDH
   3814          EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
   3816      [Bodo Moeller]
   3818   *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
   3819      Use correct micalg parameters depending on digest(s) in signed message.
   3820      [Steve Henson]
   3822   *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
   3823      an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
   3824      [Steve Henson]
   3826   *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
   3827      an engine to register a method. Add ENGINE lookups for methods and
   3828      functional reference processing.
   3829      [Steve Henson]
   3831   *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
   3832      EVP_{Sign,Verify}* which allow an application to customise the signature
   3833      process.
   3834      [Steve Henson]
   3836   *) New -resign option to smime utility. This adds one or more signers
   3837      to an existing PKCS#7 signedData structure. Also -md option to use an
   3838      alternative message digest algorithm for signing.
   3839      [Steve Henson]
   3841   *) Tidy up PKCS#7 routines and add new functions to make it easier to
   3842      create PKCS7 structures containing multiple signers. Update smime
   3843      application to support multiple signers.
   3844      [Steve Henson]
   3846   *) New -macalg option to pkcs12 utility to allow setting of an alternative
   3847      digest MAC.
   3848      [Steve Henson]
   3850   *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
   3851      Reorganize PBE internals to lookup from a static table using NIDs,
   3852      add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
   3853      EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
   3854      PRF which will be automatically used with PBES2.
   3855      [Steve Henson]
   3857   *) Replace the algorithm specific calls to generate keys in "req" with the
   3858      new API.
   3859      [Steve Henson]
   3861   *) Update PKCS#7 enveloped data routines to use new API. This is now
   3862      supported by any public key method supporting the encrypt operation. A
   3863      ctrl is added to allow the public key algorithm to examine or modify
   3864      the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
   3865      a no op.
   3866      [Steve Henson]
   3868   *) Add a ctrl to asn1 method to allow a public key algorithm to express
   3869      a default digest type to use. In most cases this will be SHA1 but some
   3870      algorithms (such as GOST) need to specify an alternative digest. The
   3871      return value indicates how strong the preference is 1 means optional and
   3872      2 is mandatory (that is it is the only supported type). Modify
   3873      ASN1_item_sign() to accept a NULL digest argument to indicate it should
   3874      use the default md. Update openssl utilities to use the default digest
   3875      type for signing if it is not explicitly indicated.
   3876      [Steve Henson]
   3878   *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
   3879      EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
   3880      signing method from the key type. This effectively removes the link
   3881      between digests and public key types.
   3882      [Steve Henson]
   3884   *) Add an OID cross reference table and utility functions. Its purpose is to
   3885      translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
   3886      rsaEncryption. This will allow some of the algorithm specific hackery
   3887      needed to use the correct OID to be removed. 
   3888      [Steve Henson]
   3890   *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
   3891      structures for PKCS7_sign(). They are now set up by the relevant public
   3892      key ASN1 method.
   3893      [Steve Henson]
   3895   *) Add provisional EC pkey method with support for ECDSA and ECDH.
   3896      [Steve Henson]
   3898   *) Add support for key derivation (agreement) in the API, DH method and
   3899      pkeyutl.
   3900      [Steve Henson]
   3902   *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
   3903      public and private key formats. As a side effect these add additional 
   3904      command line functionality not previously available: DSA signatures can be
   3905      generated and verified using pkeyutl and DH key support and generation in
   3906      pkey, genpkey.
   3907      [Steve Henson]
   3909   *) BeOS support.
   3910      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   3912   *) New make target "install_html_docs" installs HTML renditions of the
   3913      manual pages.
   3914      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   3916   *) New utility "genpkey" this is analogous to "genrsa" etc except it can
   3917      generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
   3918      support key and parameter generation and add initial key generation
   3919      functionality for RSA.
   3920      [Steve Henson]
   3922   *) Add functions for main EVP_PKEY_method operations. The undocumented
   3923      functions EVP_PKEY_{encrypt,decrypt} have been renamed to
   3924      EVP_PKEY_{encrypt,decrypt}_old. 
   3925      [Steve Henson]
   3927   *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
   3928      key API, doesn't do much yet.
   3929      [Steve Henson]
   3931   *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
   3932      public key algorithms. New option to openssl utility:
   3933      "list-public-key-algorithms" to print out info.
   3934      [Steve Henson]
   3936   *) Implement the Supported Elliptic Curves Extension for
   3937      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   3938      [Douglas Stebila]
   3940   *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
   3941      EVP_CIPHER structures to avoid later problems in EVP_cleanup().
   3942      [Steve Henson]
   3944   *) New utilities pkey and pkeyparam. These are similar to algorithm specific
   3945      utilities such as rsa, dsa, dsaparam etc except they process any key
   3946      type.
   3947      [Steve Henson]
   3949   *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
   3950      functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
   3951      EVP_PKEY_print_param() to print public key data from an EVP_PKEY
   3952      structure.
   3953      [Steve Henson]
   3955   *) Initial support for pluggable public key ASN1.
   3956      De-spaghettify the public key ASN1 handling. Move public and private
   3957      key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
   3958      algorithm specific handling to a single module within the relevant
   3959      algorithm directory. Add functions to allow (near) opaque processing
   3960      of public and private key structures.
   3961      [Steve Henson]
   3963   *) Implement the Supported Point Formats Extension for
   3964      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   3965      [Douglas Stebila]
   3967   *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
   3968      for the psk identity [hint] and the psk callback functions to the
   3969      SSL_SESSION, SSL and SSL_CTX structure.
   3971      New ciphersuites:
   3972          PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
   3973          PSK-AES256-CBC-SHA
   3975      New functions:
   3976          SSL_CTX_use_psk_identity_hint
   3977          SSL_get_psk_identity_hint
   3978          SSL_get_psk_identity
   3979          SSL_use_psk_identity_hint
   3981      [Mika Kousa and Pasi Eronen of Nokia Corporation]
   3983   *) Add RFC 3161 compliant time stamp request creation, response generation
   3984      and response verification functionality.
   3985      [Zoltn Glzik <zglozik (a] opentsa.org>, The OpenTSA Project]
   3987   *) Add initial support for TLS extensions, specifically for the server_name
   3988      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   3989      have new members for a host name.  The SSL data structure has an
   3990      additional member SSL_CTX *initial_ctx so that new sessions can be
   3991      stored in that context to allow for session resumption, even after the
   3992      SSL has been switched to a new SSL_CTX in reaction to a client's
   3993      server_name extension.
   3995      New functions (subject to change):
   3997          SSL_get_servername()
   3998          SSL_get_servername_type()
   3999          SSL_set_SSL_CTX()
   4001      New CTRL codes and macros (subject to change):
   4004                                  - SSL_CTX_set_tlsext_servername_callback()
   4006                                       - SSL_CTX_set_tlsext_servername_arg()
   4007          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   4009      openssl s_client has a new '-servername ...' option.
   4011      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   4012      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   4013      testing the HostName extension for a specific single host name ('-cert'
   4014      and '-key' remain fallbacks for handshakes without HostName
   4015      negotiation).  If the unrecognized_name alert has to be sent, this by
   4016      default is a warning; it becomes fatal with the '-servername_fatal'
   4017      option.
   4019      [Peter Sylvester,  Remy Allais, Christophe Renou]
   4021   *) Whirlpool hash implementation is added.
   4022      [Andy Polyakov]
   4024   *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
   4025      bn(64,32). Because of instruction set limitations it doesn't have
   4026      any negative impact on performance. This was done mostly in order
   4027      to make it possible to share assembler modules, such as bn_mul_mont
   4028      implementations, between 32- and 64-bit builds without hassle.
   4029      [Andy Polyakov]
   4031   *) Move code previously exiled into file crypto/ec/ec2_smpt.c
   4032      to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
   4033      macro.
   4034      [Bodo Moeller]
   4036   *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
   4037      dedicated Montgomery multiplication procedure, is introduced.
   4038      BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
   4039      "64-bit" performance on certain 32-bit targets.
   4040      [Andy Polyakov]
   4042   *) New option SSL_OP_NO_COMP to disable use of compression selectively
   4043      in SSL structures. New SSL ctrl to set maximum send fragment size. 
   4044      Save memory by seeting the I/O buffer sizes dynamically instead of
   4045      using the maximum available value.
   4046      [Steve Henson]
   4048   *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
   4049      in addition to the text details.
   4050      [Bodo Moeller]
   4052   *) Very, very preliminary EXPERIMENTAL support for printing of general
   4053      ASN1 structures. This currently produces rather ugly output and doesn't
   4054      handle several customised structures at all.
   4055      [Steve Henson]
   4057   *) Integrated support for PVK file format and some related formats such
   4058      as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
   4059      these in the 'rsa' and 'dsa' utilities.
   4060      [Steve Henson]
   4062   *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
   4063      [Steve Henson]
   4065   *) Remove the ancient ASN1_METHOD code. This was only ever used in one
   4066      place for the (very old) "NETSCAPE" format certificates which are now
   4067      handled using new ASN1 code equivalents.
   4068      [Steve Henson]
   4070   *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
   4071      pointer and make the SSL_METHOD parameter in SSL_CTX_new,
   4072      SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
   4073      [Nils Larsch]
   4075   *) Modify CRL distribution points extension code to print out previously
   4076      unsupported fields. Enhance extension setting code to allow setting of
   4077      all fields.
   4078      [Steve Henson]
   4080   *) Add print and set support for Issuing Distribution Point CRL extension.
   4081      [Steve Henson]
   4083   *) Change 'Configure' script to enable Camellia by default.
   4084      [NTT]
   4086  Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
   4088   *) When rejecting SSL/TLS records due to an incorrect version number, never
   4089      update s->server with a new major version number.  As of
   4090      - OpenSSL 0.9.8m if 'short' is a 16-bit type,
   4091      - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
   4092      the previous behavior could result in a read attempt at NULL when
   4093      receiving specific incorrect SSL/TLS records once record payload
   4094      protection is active.  (CVE-2010-0740)
   4095      [Bodo Moeller, Adam Langley <agl (a] chromium.org>]
   4097   *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
   4098      could be crashed if the relevant tables were not present (e.g. chrooted).
   4099      [Tomas Hoger <thoger (a] redhat.com>]
   4101  Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
   4103   *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
   4104      [Martin Olsson, Neel Mehta]
   4106   *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
   4107      accommodate for stack sorting, always a write lock!).
   4108      [Bodo Moeller]
   4110   *) On some versions of WIN32 Heap32Next is very slow. This can cause
   4111      excessive delays in the RAND_poll(): over a minute. As a workaround
   4112      include a time check in the inner Heap32Next loop too.
   4113      [Steve Henson]
   4115   *) The code that handled flushing of data in SSL/TLS originally used the
   4116      BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
   4117      the problem outlined in PR#1949. The fix suggested there however can
   4118      trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
   4119      of Apache). So instead simplify the code to flush unconditionally.
   4120      This should be fine since flushing with no data to flush is a no op.
   4121      [Steve Henson]
   4123   *) Handle TLS versions 2.0 and later properly and correctly use the
   4124      highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
   4125      off ancient servers have a habit of sticking around for a while...
   4126      [Steve Henson]
   4128   *) Modify compression code so it frees up structures without using the
   4129      ex_data callbacks. This works around a problem where some applications
   4130      call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
   4131      restarting) then use compression (e.g. SSL with compression) later.
   4132      This results in significant per-connection memory leaks and
   4133      has caused some security issues including CVE-2008-1678 and
   4134      CVE-2009-4355.
   4135      [Steve Henson]
   4137   *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
   4138      change when encrypting or decrypting.
   4139      [Bodo Moeller]
   4141   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
   4142      connect and renegotiate with servers which do not support RI.
   4143      Until RI is more widely deployed this option is enabled by default.
   4144      [Steve Henson]
   4146   *) Add "missing" ssl ctrls to clear options and mode.
   4147      [Steve Henson]
   4149   *) If client attempts to renegotiate and doesn't support RI respond with
   4150      a no_renegotiation alert as required by RFC5746.  Some renegotiating
   4151      TLS clients will continue a connection gracefully when they receive
   4152      the alert. Unfortunately OpenSSL mishandled this alert and would hang
   4153      waiting for a server hello which it will never receive. Now we treat a
   4154      received no_renegotiation alert as a fatal error. This is because
   4155      applications requesting a renegotiation might well expect it to succeed
   4156      and would have no code in place to handle the server denying it so the
   4157      only safe thing to do is to terminate the connection.
   4158      [Steve Henson]
   4160   *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
   4161      peer supports secure renegotiation and 0 otherwise. Print out peer
   4162      renegotiation support in s_client/s_server.
   4163      [Steve Henson]
   4165   *) Replace the highly broken and deprecated SPKAC certification method with
   4166      the updated NID creation version. This should correctly handle UTF8.
   4167      [Steve Henson]
   4169   *) Implement RFC5746. Re-enable renegotiation but require the extension
   4170      as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
   4171      turns out to be a bad idea. It has been replaced by
   4172      SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
   4173      SSL_CTX_set_options(). This is really not recommended unless you
   4174      know what you are doing.
   4175      [Eric Rescorla <ekr (a] networkresonance.com>, Ben Laurie, Steve Henson]
   4177   *) Fixes to stateless session resumption handling. Use initial_ctx when
   4178      issuing and attempting to decrypt tickets in case it has changed during
   4179      servername handling. Use a non-zero length session ID when attempting
   4180      stateless session resumption: this makes it possible to determine if
   4181      a resumption has occurred immediately after receiving server hello
   4182      (several places in OpenSSL subtly assume this) instead of later in
   4183      the handshake.
   4184      [Steve Henson]
   4186   *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
   4187      CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
   4188      fixes for a few places where the return code is not checked
   4189      correctly.
   4190      [Julia Lawall <julia (a] diku.dk>]
   4192   *) Add --strict-warnings option to Configure script to include devteam
   4193      warnings in other configurations.
   4194      [Steve Henson]
   4196   *) Add support for --libdir option and LIBDIR variable in makefiles. This
   4197      makes it possible to install openssl libraries in locations which
   4198      have names other than "lib", for example "/usr/lib64" which some
   4199      systems need.
   4200      [Steve Henson, based on patch from Jeremy Utley]
   4202   *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
   4203      X690 8.9.12 and can produce some misleading textual output of OIDs.
   4204      [Steve Henson, reported by Dan Kaminsky]
   4206   *) Delete MD2 from algorithm tables. This follows the recommendation in
   4207      several standards that it is not used in new applications due to
   4208      several cryptographic weaknesses. For binary compatibility reasons
   4209      the MD2 API is still compiled in by default.
   4210      [Steve Henson]
   4212   *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
   4213      and restored.
   4214      [Steve Henson]
   4216   *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
   4217      OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
   4218      clash.
   4219      [Guenter <lists (a] gknw.net>]
   4221   *) Fix the server certificate chain building code to use X509_verify_cert(),
   4222      it used to have an ad-hoc builder which was unable to cope with anything
   4223      other than a simple chain.
   4224      [David Woodhouse <dwmw2 (a] infradead.org>, Steve Henson]
   4226   *) Don't check self signed certificate signatures in X509_verify_cert()
   4227      by default (a flag can override this): it just wastes time without
   4228      adding any security. As a useful side effect self signed root CAs
   4229      with non-FIPS digests are now usable in FIPS mode.
   4230      [Steve Henson]
   4232   *) In dtls1_process_out_of_seq_message() the check if the current message
   4233      is already buffered was missing. For every new message was memory
   4234      allocated, allowing an attacker to perform an denial of service attack
   4235      with sending out of seq handshake messages until there is no memory
   4236      left. Additionally every future messege was buffered, even if the
   4237      sequence number made no sense and would be part of another handshake.
   4238      So only messages with sequence numbers less than 10 in advance will be
   4239      buffered.  (CVE-2009-1378)
   4240      [Robin Seggelmann, discovered by Daniel Mentz] 	
   4242   *) Records are buffered if they arrive with a future epoch to be
   4243      processed after finishing the corresponding handshake. There is
   4244      currently no limitation to this buffer allowing an attacker to perform
   4245      a DOS attack with sending records with future epochs until there is no
   4246      memory left. This patch adds the pqueue_size() function to determine
   4247      the size of a buffer and limits the record buffer to 100 entries.
   4248      (CVE-2009-1377)
   4249      [Robin Seggelmann, discovered by Daniel Mentz] 	
   4251   *) Keep a copy of frag->msg_header.frag_len so it can be used after the
   4252      parent structure is freed.  (CVE-2009-1379)
   4253      [Daniel Mentz] 	
   4255   *) Handle non-blocking I/O properly in SSL_shutdown() call.
   4256      [Darryl Miles <darryl-mailinglists (a] netbauds.net>]
   4258   *) Add 2.5.4.* OIDs
   4259      [Ilya O. <vrghost (a] gmail.com>]
   4261  Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
   4263   *) Disable renegotiation completely - this fixes a severe security
   4264      problem (CVE-2009-3555) at the cost of breaking all
   4265      renegotiation. Renegotiation can be re-enabled by setting
   4267      run-time. This is really not recommended unless you know what
   4268      you're doing.
   4269      [Ben Laurie]
   4271  Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
   4273   *) Don't set val to NULL when freeing up structures, it is freed up by
   4274      underlying code. If sizeof(void *) > sizeof(long) this can result in
   4275      zeroing past the valid field. (CVE-2009-0789)
   4276      [Paolo Ganci <Paolo.Ganci (a] AdNovum.CH>]
   4278   *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
   4279      checked correctly. This would allow some invalid signed attributes to
   4280      appear to verify correctly. (CVE-2009-0591)
   4281      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   4283   *) Reject UniversalString and BMPString types with invalid lengths. This
   4284      prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
   4285      a legal length. (CVE-2009-0590)
   4286      [Steve Henson]
   4288   *) Set S/MIME signing as the default purpose rather than setting it 
   4289      unconditionally. This allows applications to override it at the store
   4290      level.
   4291      [Steve Henson]
   4293   *) Permit restricted recursion of ASN1 strings. This is needed in practice
   4294      to handle some structures.
   4295      [Steve Henson]
   4297   *) Improve efficiency of mem_gets: don't search whole buffer each time
   4298      for a '\n'
   4299      [Jeremy Shapiro <jnshapir (a] us.ibm.com>]
   4301   *) New -hex option for openssl rand.
   4302      [Matthieu Herrb]
   4304   *) Print out UTF8String and NumericString when parsing ASN1.
   4305      [Steve Henson]
   4307   *) Support NumericString type for name components.
   4308      [Steve Henson]
   4310   *) Allow CC in the environment to override the automatically chosen
   4311      compiler. Note that nothing is done to ensure flags work with the
   4312      chosen compiler.
   4313      [Ben Laurie]
   4315  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
   4317   *) Properly check EVP_VerifyFinal() and similar return values
   4318      (CVE-2008-5077).
   4319      [Ben Laurie, Bodo Moeller, Google Security Team]
   4321   *) Enable TLS extensions by default.
   4322      [Ben Laurie]
   4324   *) Allow the CHIL engine to be loaded, whether the application is
   4325      multithreaded or not. (This does not release the developer from the
   4326      obligation to set up the dynamic locking callbacks.)
   4327      [Sander Temme <sander (a] temme.net>]
   4329   *) Use correct exit code if there is an error in dgst command.
   4330      [Steve Henson; problem pointed out by Roland Dirlewanger]
   4332   *) Tweak Configure so that you need to say "experimental-jpake" to enable
   4333      JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
   4334      [Bodo Moeller]
   4336   *) Add experimental JPAKE support, including demo authentication in
   4337      s_client and s_server.
   4338      [Ben Laurie]
   4340   *) Set the comparison function in v3_addr_canonize().
   4341      [Rob Austein <sra (a] hactrn.net>]
   4343   *) Add support for XMPP STARTTLS in s_client.
   4344      [Philip Paeps <philip (a] freebsd.org>]
   4346   *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
   4347      to ensure that even with this option, only ciphersuites in the
   4348      server's preference list will be accepted.  (Note that the option
   4349      applies only when resuming a session, so the earlier behavior was
   4350      just about the algorithm choice for symmetric cryptography.)
   4351      [Bodo Moeller]
   4353  Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
   4355   *) Fix NULL pointer dereference if a DTLS server received
   4356      ChangeCipherSpec as first record (CVE-2009-1386).
   4357      [PR #1679]
   4359   *) Fix a state transition in s3_srvr.c and d1_srvr.c
   4360      (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
   4361      [Nagendra Modadugu]
   4363   *) The fix in 0.9.8c that supposedly got rid of unsafe
   4364      double-checked locking was incomplete for RSA blinding,
   4365      addressing just one layer of what turns out to have been
   4366      doubly unsafe triple-checked locking.
   4368      So now fix this for real by retiring the MONT_HELPER macro
   4369      in crypto/rsa/rsa_eay.c.
   4371      [Bodo Moeller; problem pointed out by Marius Schilder]
   4373   *) Various precautionary measures:
   4375      - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
   4377      - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
   4378        (NB: This would require knowledge of the secret session ticket key
   4379        to exploit, in which case you'd be SOL either way.)
   4381      - Change bn_nist.c so that it will properly handle input BIGNUMs
   4382        outside the expected range.
   4384      - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
   4385        builds.
   4387      [Neel Mehta, Bodo Moeller]
   4389   *) Allow engines to be "soft loaded" - i.e. optionally don't die if
   4390      the load fails. Useful for distros.
   4391      [Ben Laurie and the FreeBSD team]
   4393   *) Add support for Local Machine Keyset attribute in PKCS#12 files.
   4394      [Steve Henson]
   4396   *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
   4397      [Huang Ying]
   4399   *) Expand ENGINE to support engine supplied SSL client certificate functions.
   4401      This work was sponsored by Logica.
   4402      [Steve Henson]
   4404   *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
   4405      keystores. Support for SSL/TLS client authentication too.
   4406      Not compiled unless enable-capieng specified to Configure.
   4408      This work was sponsored by Logica.
   4409      [Steve Henson]
   4411   *) Fix bug in X509_ATTRIBUTE creation: don't set attribute using
   4412      ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
   4413      attribute creation routines such as certificate requests and PKCS#12
   4414      files.
   4415      [Steve Henson]
   4417  Changes between 0.9.8g and 0.9.8h  [28 May 2008]
   4419   *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
   4420      handshake which could lead to a cilent crash as found using the
   4421      Codenomicon TLS test suite (CVE-2008-1672) 
   4422      [Steve Henson, Mark Cox]
   4424   *) Fix double free in TLS server name extensions which could lead to
   4425      a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
   4426      [Joe Orton]
   4428   *) Clear error queue in SSL_CTX_use_certificate_chain_file()
   4430      Clear the error queue to ensure that error entries left from
   4431      older function calls do not interfere with the correct operation.
   4432      [Lutz Jaenicke, Erik de Castro Lopo]
   4434   *) Remove root CA certificates of commercial CAs:
   4436      The OpenSSL project does not recommend any specific CA and does not
   4437      have any policy with respect to including or excluding any CA.
   4438      Therefore it does not make any sense to ship an arbitrary selection
   4439      of root CA certificates with the OpenSSL software.
   4440      [Lutz Jaenicke]
   4442   *) RSA OAEP patches to fix two separate invalid memory reads.
   4443      The first one involves inputs when 'lzero' is greater than
   4444      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
   4445      before the beginning of from). The second one involves inputs where
   4446      the 'db' section contains nothing but zeroes (there is a one-byte
   4447      invalid read after the end of 'db').
   4448      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   4450   *) Partial backport from 0.9.9-dev:
   4452      Introduce bn_mul_mont (dedicated Montgomery multiplication
   4453      procedure) as a candidate for BIGNUM assembler implementation.
   4454      While 0.9.9-dev uses assembler for various architectures, only
   4455      x86_64 is available by default here in the 0.9.8 branch, and
   4456      32-bit x86 is available through a compile-time setting.
   4458      To try the 32-bit x86 assembler implementation, use Configure
   4459      option "enable-montasm" (which exists only for this backport).
   4461      As "enable-montasm" for 32-bit x86 disclaims code stability
   4462      anyway, in this constellation we activate additional code
   4463      backported from 0.9.9-dev for further performance improvements,
   4464      namely BN_from_montgomery_word.  (To enable this otherwise,
   4465      e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
   4467      [Andy Polyakov (backport partially by Bodo Moeller)]
   4469   *) Add TLS session ticket callback. This allows an application to set
   4470      TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
   4471      values. This is useful for key rollover for example where several key
   4472      sets may exist with different names.
   4473      [Steve Henson]
   4475   *) Reverse ENGINE-internal logic for caching default ENGINE handles.
   4476      This was broken until now in 0.9.8 releases, such that the only way
   4477      a registered ENGINE could be used (assuming it initialises
   4478      successfully on the host) was to explicitly set it as the default
   4479      for the relevant algorithms. This is in contradiction with 0.9.7
   4480      behaviour and the documentation. With this fix, when an ENGINE is
   4481      registered into a given algorithm's table of implementations, the
   4482      'uptodate' flag is reset so that auto-discovery will be used next
   4483      time a new context for that algorithm attempts to select an
   4484      implementation.
   4485      [Ian Lister (tweaked by Geoff Thorpe)]
   4487   *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
   4488      implementation in the following ways:
   4490      Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
   4491      hard coded.
   4493      Lack of BER streaming support means one pass streaming processing is
   4494      only supported if data is detached: setting the streaming flag is
   4495      ignored for embedded content.
   4497      CMS support is disabled by default and must be explicitly enabled
   4498      with the enable-cms configuration option.
   4499      [Steve Henson]
   4501   *) Update the GMP engine glue to do direct copies between BIGNUM and
   4502      mpz_t when openssl and GMP use the same limb size. Otherwise the
   4503      existing "conversion via a text string export" trick is still used.
   4504      [Paul Sheer <paulsheer (a] gmail.com>]
   4506   *) Zlib compression BIO. This is a filter BIO which compressed and
   4507      uncompresses any data passed through it.
   4508      [Steve Henson]
   4510   *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
   4511      RFC3394 compatible AES key wrapping.
   4512      [Steve Henson]
   4514   *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
   4515      sets string data without copying. X509_ALGOR_set0() and
   4516      X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
   4517      data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
   4518      from an X509_ATTRIBUTE structure optionally checking it occurs only
   4519      once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
   4520      data.
   4521      [Steve Henson]
   4523   *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
   4524      to get the expected BN_FLG_CONSTTIME behavior.
   4525      [Bodo Moeller (Google)]
   4527   *) Netware support:
   4529      - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
   4530      - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
   4531      - added some more tests to do_tests.pl
   4532      - fixed RunningProcess usage so that it works with newer LIBC NDKs too
   4533      - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
   4534      - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
   4535        netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
   4536      - various changes to netware.pl to enable gcc-cross builds on Win32
   4537        platform
   4538      - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
   4539      - various changes to fix missing prototype warnings
   4540      - fixed x86nasm.pl to create correct asm files for NASM COFF output
   4541      - added AES, WHIRLPOOL and CPUID assembler code to build files
   4542      - added missing AES assembler make rules to mk1mf.pl
   4543      - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
   4544      [Guenter Knauf <eflash (a] gmx.net>]
   4546   *) Implement certificate status request TLS extension defined in RFC3546.
   4547      A client can set the appropriate parameters and receive the encoded
   4548      OCSP response via a callback. A server can query the supplied parameters
   4549      and set the encoded OCSP response in the callback. Add simplified examples
   4550      to s_client and s_server.
   4551      [Steve Henson]
   4553  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
   4555   *) Fix various bugs:
   4556      + Binary incompatibility of ssl_ctx_st structure
   4557      + DTLS interoperation with non-compliant servers
   4558      + Don't call get_session_cb() without proposed session
   4559      + Fix ia64 assembler code
   4560      [Andy Polyakov, Steve Henson]
   4562  Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
   4564   *) DTLS Handshake overhaul. There were longstanding issues with
   4565      OpenSSL DTLS implementation, which were making it impossible for
   4566      RFC 4347 compliant client to communicate with OpenSSL server.
   4567      Unfortunately just fixing these incompatibilities would "cut off"
   4568      pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
   4569      server keeps tolerating non RFC compliant syntax. The opposite is
   4570      not true, 0.9.8f client can not communicate with earlier server.
   4571      This update even addresses CVE-2007-4995.
   4572      [Andy Polyakov]
   4574   *) Changes to avoid need for function casts in OpenSSL: some compilers
   4575      (gcc 4.2 and later) reject their use.
   4576      [Kurt Roeckx <kurt (a] roeckx.be>, Peter Hartley <pdh (a] utter.chaos.org.uk>,
   4577       Steve Henson]
   4579   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   4580      RFC4507bis. The encrypted ticket format is an encrypted encoded
   4581      SSL_SESSION structure, that way new session features are automatically
   4582      supported.
   4584      If a client application caches session in an SSL_SESSION structure
   4585      support is transparent because tickets are now stored in the encoded
   4586      SSL_SESSION.
   4588      The SSL_CTX structure automatically generates keys for ticket
   4589      protection in servers so again support should be possible
   4590      with no application modification.
   4592      If a client or server wishes to disable RFC4507 support then the option
   4593      SSL_OP_NO_TICKET can be set.
   4595      Add a TLS extension debugging callback to allow the contents of any client
   4596      or server extensions to be examined.
   4598      This work was sponsored by Google.
   4599      [Steve Henson]
   4601   *) Add initial support for TLS extensions, specifically for the server_name
   4602      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   4603      have new members for a host name.  The SSL data structure has an
   4604      additional member SSL_CTX *initial_ctx so that new sessions can be
   4605      stored in that context to allow for session resumption, even after the
   4606      SSL has been switched to a new SSL_CTX in reaction to a client's
   4607      server_name extension.
   4609      New functions (subject to change):
   4611          SSL_get_servername()
   4612          SSL_get_servername_type()
   4613          SSL_set_SSL_CTX()
   4615      New CTRL codes and macros (subject to change):
   4618                                  - SSL_CTX_set_tlsext_servername_callback()
   4620                                       - SSL_CTX_set_tlsext_servername_arg()
   4621          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   4623      openssl s_client has a new '-servername ...' option.
   4625      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   4626      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   4627      testing the HostName extension for a specific single host name ('-cert'
   4628      and '-key' remain fallbacks for handshakes without HostName
   4629      negotiation).  If the unrecognized_name alert has to be sent, this by
   4630      default is a warning; it becomes fatal with the '-servername_fatal'
   4631      option.
   4633      [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
   4635   *) Add AES and SSE2 assembly language support to VC++ build.
   4636      [Steve Henson]
   4638   *) Mitigate attack on final subtraction in Montgomery reduction.
   4639      [Andy Polyakov]
   4641   *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
   4642      (which previously caused an internal error).
   4643      [Bodo Moeller]
   4645   *) Squeeze another 10% out of IGE mode when in != out.
   4646      [Ben Laurie]
   4648   *) AES IGE mode speedup.
   4649      [Dean Gaudet (Google)]
   4651   *) Add the Korean symmetric 128-bit cipher SEED (see
   4652      http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
   4653      add SEED ciphersuites from RFC 4162:
   4655         TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
   4658         TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
   4660      To minimize changes between patchlevels in the OpenSSL 0.9.8
   4661      series, SEED remains excluded from compilation unless OpenSSL
   4662      is configured with 'enable-seed'.
   4663      [KISA, Bodo Moeller]
   4665   *) Mitigate branch prediction attacks, which can be practical if a
   4666      single processor is shared, allowing a spy process to extract
   4667      information.  For detailed background information, see
   4668      http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
   4669      J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
   4670      and Necessary Software Countermeasures").  The core of the change
   4671      are new versions BN_div_no_branch() and
   4672      BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
   4673      respectively, which are slower, but avoid the security-relevant
   4674      conditional branches.  These are automatically called by BN_div()
   4675      and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
   4676      of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
   4677      remove a conditional branch.
   4679      BN_FLG_CONSTTIME is the new name for the previous
   4680      BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
   4681      modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
   4682      in the exponent causes BN_mod_exp_mont() to use the alternative
   4683      implementation in BN_mod_exp_mont_consttime().)  The old name
   4684      remains as a deprecated alias.
   4686      Similarly, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
   4687      RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
   4688      constant-time implementations for more than just exponentiation.
   4689      Here too the old name is kept as a deprecated alias.
   4691      BN_BLINDING_new() will now use BN_dup() for the modulus so that
   4692      the BN_BLINDING structure gets an independent copy of the
   4693      modulus.  This means that the previous "BIGNUM *m" argument to
   4694      BN_BLINDING_new() and to BN_BLINDING_create_param() now
   4695      essentially becomes "const BIGNUM *m", although we can't actually
   4696      change this in the header file before 0.9.9.  It allows
   4697      RSA_setup_blinding() to use BN_with_flags() on the modulus to
   4698      enable BN_FLG_CONSTTIME.
   4700      [Matthew D Wood (Intel Corp)]
   4702   *) In the SSL/TLS server implementation, be strict about session ID
   4703      context matching (which matters if an application uses a single
   4704      external cache for different purposes).  Previously,
   4705      out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
   4706      set.  This did ensure strict client verification, but meant that,
   4707      with applications using a single external cache for quite
   4708      different requirements, clients could circumvent ciphersuite
   4709      restrictions for a given session ID context by starting a session
   4710      in a different context.
   4711      [Bodo Moeller]
   4713   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   4714      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   4715      authentication-only ciphersuites.
   4716      [Bodo Moeller]
   4718   *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
   4719      not complete and could lead to a possible single byte overflow
   4720      (CVE-2007-5135) [Ben Laurie]
   4722  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
   4724   *) Since AES128 and AES256 (and similarly Camellia128 and
   4725      Camellia256) share a single mask bit in the logic of
   4726      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   4727      kludge to work properly if AES128 is available and AES256 isn't
   4728      (or if Camellia128 is available and Camellia256 isn't).
   4729      [Victor Duchovni]
   4731   *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
   4732      (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
   4733      When a point or a seed is encoded in a BIT STRING, we need to
   4734      prevent the removal of trailing zero bits to get the proper DER
   4735      encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
   4736      of a NamedBitList, for which trailing 0 bits need to be removed.)
   4737      [Bodo Moeller]
   4739   *) Have SSL/TLS server implementation tolerate "mismatched" record
   4740      protocol version while receiving ClientHello even if the
   4741      ClientHello is fragmented.  (The server can't insist on the
   4742      particular protocol version it has chosen before the ServerHello
   4743      message has informed the client about his choice.)
   4744      [Bodo Moeller]
   4746   *) Add RFC 3779 support.
   4747      [Rob Austein for ARIN, Ben Laurie]
   4749   *) Load error codes if they are not already present instead of using a
   4750      static variable. This allows them to be cleanly unloaded and reloaded.
   4751      Improve header file function name parsing.
   4752      [Steve Henson]
   4754   *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
   4755      or CAPABILITY handshake as required by RFCs.
   4756      [Goetz Babin-Ebell]
   4758  Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
   4760   *) Introduce limits to prevent malicious keys being able to
   4761      cause a denial of service.  (CVE-2006-2940)
   4762      [Steve Henson, Bodo Moeller]
   4764   *) Fix ASN.1 parsing of certain invalid structures that can result
   4765      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   4767   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   4768      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   4770   *) Fix SSL client code which could crash if connecting to a
   4771      malicious SSLv2 server.  (CVE-2006-4343)
   4772      [Tavis Ormandy and Will Drewry, Google Security Team]
   4774   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
   4775      match only those.  Before that, "AES256-SHA" would be interpreted
   4776      as a pattern and match "AES128-SHA" too (since AES128-SHA got
   4777      the same strength classification in 0.9.7h) as we currently only
   4778      have a single AES bit in the ciphersuite description bitmap.
   4779      That change, however, also applied to ciphersuite strings such as
   4780      "RC4-MD5" that intentionally matched multiple ciphersuites --
   4781      namely, SSL 2.0 ciphersuites in addition to the more common ones
   4782      from SSL 3.0/TLS 1.0.
   4784      So we change the selection algorithm again: Naming an explicit
   4785      ciphersuite selects this one ciphersuite, and any other similar
   4786      ciphersuite (same bitmap) from *other* protocol versions.
   4787      Thus, "RC4-MD5" again will properly select both the SSL 2.0
   4788      ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
   4790      Since SSL 2.0 does not have any ciphersuites for which the
   4791      128/256 bit distinction would be relevant, this works for now.
   4792      The proper fix will be to use different bits for AES128 and
   4793      AES256, which would have avoided the problems from the beginning;
   4794      however, bits are scarce, so we can only do this in a new release
   4795      (not just a patchlevel) when we can change the SSL_CIPHER
   4796      definition to split the single 'unsigned long mask' bitmap into
   4797      multiple values to extend the available space.
   4799      [Bodo Moeller]
   4801  Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
   4803   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   4804      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   4806   *) Add AES IGE and biIGE modes.
   4807      [Ben Laurie]
   4809   *) Change the Unix randomness entropy gathering to use poll() when
   4810      possible instead of select(), since the latter has some
   4811      undesirable limitations.
   4812      [Darryl Miles via Richard Levitte and Bodo Moeller]
   4814   *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
   4815      treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
   4816      cannot be implicitly activated as part of, e.g., the "AES" alias.
   4817      However, please upgrade to OpenSSL 0.9.9[-dev] for
   4818      non-experimental use of the ECC ciphersuites to get TLS extension
   4819      support, which is required for curve and point format negotiation
   4820      to avoid potential handshake problems.
   4821      [Bodo Moeller]
   4823   *) Disable rogue ciphersuites:
   4825       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   4826       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   4827       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   4829      The latter two were purportedly from
   4830      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   4831      appear there.
   4833      Also deactivate the remaining ciphersuites from
   4834      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   4835      unofficial, and the ID has long expired.
   4836      [Bodo Moeller]
   4838   *) Fix RSA blinding Heisenbug (problems sometimes occurred on
   4839      dual-core machines) and other potential thread-safety issues.
   4840      [Bodo Moeller]
   4842   *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
   4843      versions), which is now available for royalty-free use
   4844      (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
   4845      Also, add Camellia TLS ciphersuites from RFC 4132.
   4847      To minimize changes between patchlevels in the OpenSSL 0.9.8
   4848      series, Camellia remains excluded from compilation unless OpenSSL
   4849      is configured with 'enable-camellia'.
   4850      [NTT]
   4852   *) Disable the padding bug check when compression is in use. The padding
   4853      bug check assumes the first packet is of even length, this is not
   4854      necessarily true if compresssion is enabled and can result in false
   4855      positives causing handshake failure. The actual bug test is ancient
   4856      code so it is hoped that implementations will either have fixed it by
   4857      now or any which still have the bug do not support compression.
   4858      [Steve Henson]
   4860  Changes between 0.9.8a and 0.9.8b  [04 May 2006]
   4862   *) When applying a cipher rule check to see if string match is an explicit
   4863      cipher suite and only match that one cipher suite if it is.
   4864      [Steve Henson]
   4866   *) Link in manifests for VC++ if needed.
   4867      [Austin Ziegler <halostatue (a] gmail.com>]
   4869   *) Update support for ECC-based TLS ciphersuites according to
   4870      draft-ietf-tls-ecc-12.txt with proposed changes (but without
   4871      TLS extensions, which are supported starting with the 0.9.9
   4872      branch, not in the OpenSSL 0.9.8 branch).
   4873      [Douglas Stebila]
   4875   *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
   4876      opaque EVP_CIPHER_CTX handling.
   4877      [Steve Henson]
   4879   *) Fixes and enhancements to zlib compression code. We now only use
   4880      "zlib1.dll" and use the default __cdecl calling convention on Win32
   4881      to conform with the standards mentioned here:
   4882            http://www.zlib.net/DLL_FAQ.txt
   4883      Static zlib linking now works on Windows and the new --with-zlib-include
   4884      --with-zlib-lib options to Configure can be used to supply the location
   4885      of the headers and library. Gracefully handle case where zlib library
   4886      can't be loaded.
   4887      [Steve Henson]
   4889   *) Several fixes and enhancements to the OID generation code. The old code
   4890      sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
   4891      handle numbers larger than ULONG_MAX, truncated printing and had a
   4892      non standard OBJ_obj2txt() behaviour.
   4893      [Steve Henson]
   4895   *) Add support for building of engines under engine/ as shared libraries
   4896      under VC++ build system.
   4897      [Steve Henson]
   4899   *) Corrected the numerous bugs in the Win32 path splitter in DSO.
   4900      Hopefully, we will not see any false combination of paths any more.
   4901      [Richard Levitte]
   4903  Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
   4905   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   4906      (part of SSL_OP_ALL).  This option used to disable the
   4907      countermeasure against man-in-the-middle protocol-version
   4908      rollback in the SSL 2.0 server implementation, which is a bad
   4909      idea.  (CVE-2005-2969)
   4911      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   4912      for Information Security, National Institute of Advanced Industrial
   4913      Science and Technology [AIST], Japan)]
   4915   *) Add two function to clear and return the verify parameter flags.
   4916      [Steve Henson]
   4918   *) Keep cipherlists sorted in the source instead of sorting them at
   4919      runtime, thus removing the need for a lock.
   4920      [Nils Larsch]
   4922   *) Avoid some small subgroup attacks in Diffie-Hellman.
   4923      [Nick Mathewson and Ben Laurie]
   4925   *) Add functions for well-known primes.
   4926      [Nick Mathewson]
   4928   *) Extended Windows CE support.
   4929      [Satoshi Nakamura and Andy Polyakov]
   4931   *) Initialize SSL_METHOD structures at compile time instead of during
   4932      runtime, thus removing the need for a lock.
   4933      [Steve Henson]
   4935   *) Make PKCS7_decrypt() work even if no certificate is supplied by
   4936      attempting to decrypt each encrypted key in turn. Add support to
   4937      smime utility.
   4938      [Steve Henson]
   4940  Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
   4942   [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
   4943   OpenSSL 0.9.8.]
   4945   *) Add libcrypto.pc and libssl.pc for those who feel they need them.
   4946      [Richard Levitte]
   4948   *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
   4949      key into the same file any more.
   4950      [Richard Levitte]
   4952   *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
   4953      [Andy Polyakov]
   4955   *) Add -utf8 command line and config file option to 'ca'.
   4956      [Stefan <stf (a] udoma.org]
   4958   *) Removed the macro des_crypt(), as it seems to conflict with some
   4959      libraries.  Use DES_crypt().
   4960      [Richard Levitte]
   4962   *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
   4963      involves renaming the source and generated shared-libs for
   4964      both. The engines will accept the corrected or legacy ids
   4965      ('ncipher' and '4758_cca' respectively) when binding. NB,
   4966      this only applies when building 'shared'.
   4967      [Corinna Vinschen <vinschen (a] redhat.com> and Geoff Thorpe]
   4969   *) Add attribute functions to EVP_PKEY structure. Modify
   4970      PKCS12_create() to recognize a CSP name attribute and
   4971      use it. Make -CSP option work again in pkcs12 utility.
   4972      [Steve Henson]
   4974   *) Add new functionality to the bn blinding code:
   4975      - automatic re-creation of the BN_BLINDING parameters after
   4976        a fixed number of uses (currently 32)
   4977      - add new function for parameter creation
   4978      - introduce flags to control the update behaviour of the
   4979        BN_BLINDING parameters
   4980      - hide BN_BLINDING structure
   4981      Add a second BN_BLINDING slot to the RSA structure to improve
   4982      performance when a single RSA object is shared among several
   4983      threads.
   4984      [Nils Larsch]
   4986   *) Add support for DTLS.
   4987      [Nagendra Modadugu <nagendra (a] cs.stanford.edu> and Ben Laurie]
   4989   *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
   4990      to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
   4991      [Walter Goulet]
   4993   *) Remove buggy and incomplete DH cert support from
   4994      ssl/ssl_rsa.c and ssl/s3_both.c
   4995      [Nils Larsch]
   4997   *) Use SHA-1 instead of MD5 as the default digest algorithm for
   4998      the apps/openssl applications.
   4999      [Nils Larsch]
   5001   *) Compile clean with "-Wall -Wmissing-prototypes
   5002      -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
   5003      DEBUG_SAFESTACK must also be set.
   5004      [Ben Laurie]
   5006   *) Change ./Configure so that certain algorithms can be disabled by default.
   5007      The new counterpiece to "no-xxx" is "enable-xxx".
   5009      The patented RC5 and MDC2 algorithms will now be disabled unless
   5010      "enable-rc5" and "enable-mdc2", respectively, are specified.
   5012      (IDEA remains enabled despite being patented.  This is because IDEA
   5013      is frequently required for interoperability, and there is no license
   5014      fee for non-commercial use.  As before, "no-idea" can be used to
   5015      avoid this algorithm.)
   5017      [Bodo Moeller]
   5019   *) Add processing of proxy certificates (see RFC 3820).  This work was
   5020      sponsored by KTH (The Royal Institute of Technology in Stockholm) and
   5021      EGEE (Enabling Grids for E-science in Europe).
   5022      [Richard Levitte]
   5024   *) RC4 performance overhaul on modern architectures/implementations, such
   5025      as Intel P4, IA-64 and AMD64.
   5026      [Andy Polyakov]
   5028   *) New utility extract-section.pl. This can be used specify an alternative
   5029      section number in a pod file instead of having to treat each file as
   5030      a separate case in Makefile. This can be done by adding two lines to the
   5031      pod file:
   5033      =for comment openssl_section:XXX
   5035      The blank line is mandatory.
   5037      [Steve Henson]
   5039   *) New arguments -certform, -keyform and -pass for s_client and s_server
   5040      to allow alternative format key and certificate files and passphrase
   5041      sources.
   5042      [Steve Henson]
   5044   *) New structure X509_VERIFY_PARAM which combines current verify parameters,
   5045      update associated structures and add various utility functions.
   5047      Add new policy related verify parameters, include policy checking in 
   5048      standard verify code. Enhance 'smime' application with extra parameters
   5049      to support policy checking and print out.
   5050      [Steve Henson]
   5052   *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
   5053      Nehemiah processors. These extensions support AES encryption in hardware
   5054      as well as RNG (though RNG support is currently disabled).
   5055      [Michal Ludvig <michal (a] logix.cz>, with help from Andy Polyakov]
   5057   *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
   5058      [Geoff Thorpe]
   5060   *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
   5061      [Andy Polyakov and a number of other people]
   5063   *) Improved PowerPC platform support. Most notably BIGNUM assembler
   5064      implementation contributed by IBM.
   5065      [Suresh Chari, Peter Waltenberg, Andy Polyakov]
   5067   *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
   5068      exponent rather than 'unsigned long'. There is a corresponding change to
   5069      the new 'rsa_keygen' element of the RSA_METHOD structure.
   5070      [Jelte Jansen, Geoff Thorpe]
   5072   *) Functionality for creating the initial serial number file is now
   5073      moved from CA.pl to the 'ca' utility with a new option -create_serial.
   5075      (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
   5076      number file to 1, which is bound to cause problems.  To avoid
   5077      the problems while respecting compatibility between different 0.9.7
   5078      patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
   5079      CA.pl for serial number initialization.  With the new release 0.9.8,
   5080      we can fix the problem directly in the 'ca' utility.)
   5081      [Steve Henson]
   5083   *) Reduced header interdepencies by declaring more opaque objects in
   5084      ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
   5085      give fewer recursive includes, which could break lazy source code - so
   5086      this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
   5087      developers should define this symbol when building and using openssl to
   5088      ensure they track the recommended behaviour, interfaces, [etc], but
   5089      backwards-compatible behaviour prevails when this isn't defined.
   5090      [Geoff Thorpe]
   5092   *) New function X509_POLICY_NODE_print() which prints out policy nodes.
   5093      [Steve Henson]
   5095   *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
   5096      This will generate a random key of the appropriate length based on the 
   5097      cipher context. The EVP_CIPHER can provide its own random key generation
   5098      routine to support keys of a specific form. This is used in the des and 
   5099      3des routines to generate a key of the correct parity. Update S/MIME
   5100      code to use new functions and hence generate correct parity DES keys.
   5101      Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
   5102      valid (weak or incorrect parity).
   5103      [Steve Henson]
   5105   *) Add a local set of CRLs that can be used by X509_verify_cert() as well
   5106      as looking them up. This is useful when the verified structure may contain
   5107      CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
   5108      present unless the new PKCS7_NO_CRL flag is asserted.
   5109      [Steve Henson]
   5111   *) Extend ASN1 oid configuration module. It now additionally accepts the
   5112      syntax:
   5114      shortName = some long name,
   5115      [Steve Henson]
   5117   *) Reimplemented the BN_CTX implementation. There is now no more static
   5118      limitation on the number of variables it can handle nor the depth of the
   5119      "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
   5120      information can now expand as required, and rather than having a single
   5121      static array of bignums, BN_CTX now uses a linked-list of such arrays
   5122      allowing it to expand on demand whilst maintaining the usefulness of
   5123      BN_CTX's "bundling".
   5124      [Geoff Thorpe]
   5126   *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
   5127      to allow all RSA operations to function using a single BN_CTX.
   5128      [Geoff Thorpe]
   5130   *) Preliminary support for certificate policy evaluation and checking. This
   5131      is initially intended to pass the tests outlined in "Conformance Testing
   5132      of Relying Party Client Certificate Path Processing Logic" v1.07.
   5133      [Steve Henson]
   5135   *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
   5136      remained unused and not that useful. A variety of other little bignum
   5137      tweaks and fixes have also been made continuing on from the audit (see
   5138      below).
   5139      [Geoff Thorpe]
   5141   *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
   5142      associated ASN1, EVP and SSL functions and old ASN1 macros.
   5143      [Richard Levitte]
   5145   *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
   5146      and this should never fail. So the return value from the use of
   5147      BN_set_word() (which can fail due to needless expansion) is now deprecated;
   5148      if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
   5149      [Geoff Thorpe]
   5151   *) BN_CTX_get() should return zero-valued bignums, providing the same
   5152      initialised value as BN_new().
   5153      [Geoff Thorpe, suggested by Ulf Mller]
   5155   *) Support for inhibitAnyPolicy certificate extension.
   5156      [Steve Henson]
   5158   *) An audit of the BIGNUM code is underway, for which debugging code is
   5159      enabled when BN_DEBUG is defined. This makes stricter enforcements on what
   5160      is considered valid when processing BIGNUMs, and causes execution to
   5161      assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
   5162      further steps are taken to deliberately pollute unused data in BIGNUM
   5163      structures to try and expose faulty code further on. For now, openssl will
   5164      (in its default mode of operation) continue to tolerate the inconsistent
   5165      forms that it has tolerated in the past, but authors and packagers should
   5166      consider trying openssl and their own applications when compiled with
   5167      these debugging symbols defined. It will help highlight potential bugs in
   5168      their own code, and will improve the test coverage for OpenSSL itself. At
   5169      some point, these tighter rules will become openssl's default to improve
   5170      maintainability, though the assert()s and other overheads will remain only
   5171      in debugging configurations. See bn.h for more details.
   5172      [Geoff Thorpe, Nils Larsch, Ulf Mller]
   5174   *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
   5175      that can only be obtained through BN_CTX_new() (which implicitly
   5176      initialises it). The presence of this function only made it possible
   5177      to overwrite an existing structure (and cause memory leaks).
   5178      [Geoff Thorpe]
   5180   *) Because of the callback-based approach for implementing LHASH as a
   5181      template type, lh_insert() adds opaque objects to hash-tables and
   5182      lh_doall() or lh_doall_arg() are typically used with a destructor callback
   5183      to clean up those corresponding objects before destroying the hash table
   5184      (and losing the object pointers). So some over-zealous constifications in
   5185      LHASH have been relaxed so that lh_insert() does not take (nor store) the
   5186      objects as "const" and the lh_doall[_arg] callback wrappers are not
   5187      prototyped to have "const" restrictions on the object pointers they are
   5188      given (and so aren't required to cast them away any more).
   5189      [Geoff Thorpe]
   5191   *) The tmdiff.h API was so ugly and minimal that our own timing utility
   5192      (speed) prefers to use its own implementation. The two implementations
   5193      haven't been consolidated as yet (volunteers?) but the tmdiff API has had
   5194      its object type properly exposed (MS_TM) instead of casting to/from "char
   5195      *". This may still change yet if someone realises MS_TM and "ms_time_***"
   5196      aren't necessarily the greatest nomenclatures - but this is what was used
   5197      internally to the implementation so I've used that for now.
   5198      [Geoff Thorpe]
   5200   *) Ensure that deprecated functions do not get compiled when
   5201      OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
   5202      the self-tests were still using deprecated key-generation functions so
   5203      these have been updated also.
   5204      [Geoff Thorpe]
   5206   *) Reorganise PKCS#7 code to separate the digest location functionality
   5207      into PKCS7_find_digest(), digest addition into PKCS7_bio_add_digest().
   5208      New function PKCS7_set_digest() to set the digest type for PKCS#7
   5209      digestedData type. Add additional code to correctly generate the
   5210      digestedData type and add support for this type in PKCS7 initialization
   5211      functions.
   5212      [Steve Henson]
   5214   *) New function PKCS7_set0_type_other() this initializes a PKCS7 
   5215      structure of type "other".
   5216      [Steve Henson]
   5218   *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
   5219      sure the loop does correctly stop and breaking ("division by zero")
   5220      modulus operations are not performed. The (pre-generated) prime
   5221      table crypto/bn/bn_prime.h was already correct, but it could not be
   5222      re-generated on some platforms because of the "division by zero"
   5223      situation in the script.
   5224      [Ralf S. Engelschall]
   5226   *) Update support for ECC-based TLS ciphersuites according to
   5227      draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
   5228      SHA-1 now is only used for "small" curves (where the
   5229      representation of a field element takes up to 24 bytes); for
   5230      larger curves, the field element resulting from ECDH is directly
   5231      used as premaster secret.
   5232      [Douglas Stebila (Sun Microsystems Laboratories)]
   5234   *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
   5235      curve secp160r1 to the tests.
   5236      [Douglas Stebila (Sun Microsystems Laboratories)]
   5238   *) Add the possibility to load symbols globally with DSO.
   5239      [Gtz Babin-Ebell <babin-ebell (a] trustcenter.de> via Richard Levitte]
   5241   *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
   5242      control of the error stack.
   5243      [Richard Levitte]
   5245   *) Add support for STORE in ENGINE.
   5246      [Richard Levitte]
   5248   *) Add the STORE type.  The intention is to provide a common interface
   5249      to certificate and key stores, be they simple file-based stores, or
   5250      HSM-type store, or LDAP stores, or...
   5251      NOTE: The code is currently UNTESTED and isn't really used anywhere.
   5252      [Richard Levitte]
   5254   *) Add a generic structure called OPENSSL_ITEM.  This can be used to
   5255      pass a list of arguments to any function as well as provide a way
   5256      for a function to pass data back to the caller.
   5257      [Richard Levitte]
   5259   *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
   5260      works like BUF_strdup() but can be used to duplicate a portion of
   5261      a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
   5262      a memory area.
   5263      [Richard Levitte]
   5265   *) Add the function sk_find_ex() which works like sk_find(), but will
   5266      return an index to an element even if an exact match couldn't be
   5267      found.  The index is guaranteed to point at the element where the
   5268      searched-for key would be inserted to preserve sorting order.
   5269      [Richard Levitte]
   5271   *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
   5272      takes an extra flags argument for optional functionality.  Currently,
   5273      the following flags are defined:
   5276 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   5277 	element where the comparing function returns a negative or zero
   5278 	number.
   5281 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   5282 	element where the comparing function returns zero.  This is useful
   5283 	if there are more than one element where the comparing function
   5284 	returns zero.
   5285      [Richard Levitte]
   5287   *) Make it possible to create self-signed certificates with 'openssl ca'
   5288      in such a way that the self-signed certificate becomes part of the
   5289      CA database and uses the same mechanisms for serial number generation
   5290      as all other certificate signing.  The new flag '-selfsign' enables
   5291      this functionality.  Adapt CA.sh and CA.pl.in.
   5292      [Richard Levitte]
   5294   *) Add functionality to check the public key of a certificate request
   5295      against a given private.  This is useful to check that a certificate
   5296      request can be signed by that key (self-signing).
   5297      [Richard Levitte]
   5299   *) Make it possible to have multiple active certificates with the same
   5300      subject in the CA index file.  This is done only if the keyword
   5301      'unique_subject' is set to 'no' in the main CA section (default
   5302      if 'CA_default') of the configuration file.  The value is saved
   5303      with the database itself in a separate index attribute file,
   5304      named like the index file with '.attr' appended to the name.
   5305      [Richard Levitte]
   5307   *) Generate muti valued AVAs using '+' notation in config files for
   5308      req and dirName.
   5309      [Steve Henson]
   5311   *) Support for nameConstraints certificate extension.
   5312      [Steve Henson]
   5314   *) Support for policyConstraints certificate extension.
   5315      [Steve Henson]
   5317   *) Support for policyMappings certificate extension.
   5318      [Steve Henson]
   5320   *) Make sure the default DSA_METHOD implementation only uses its
   5321      dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
   5322      and change its own handlers to be NULL so as to remove unnecessary
   5323      indirection. This lets alternative implementations fallback to the
   5324      default implementation more easily.
   5325      [Geoff Thorpe]
   5327   *) Support for directoryName in GeneralName related extensions
   5328      in config files.
   5329      [Steve Henson]
   5331   *) Make it possible to link applications using Makefile.shared.
   5332      Make that possible even when linking against static libraries!
   5333      [Richard Levitte]
   5335   *) Support for single pass processing for S/MIME signing. This now
   5336      means that S/MIME signing can be done from a pipe, in addition
   5337      cleartext signing (multipart/signed type) is effectively streaming
   5338      and the signed data does not need to be all held in memory.
   5340      This is done with a new flag PKCS7_STREAM. When this flag is set
   5341      PKCS7_sign() only initializes the PKCS7 structure and the actual signing
   5342      is done after the data is output (and digests calculated) in
   5343      SMIME_write_PKCS7().
   5344      [Steve Henson]
   5346   *) Add full support for -rpath/-R, both in shared libraries and
   5347      applications, at least on the platforms where it's known how
   5348      to do it.
   5349      [Richard Levitte]
   5351   *) In crypto/ec/ec_mult.c, implement fast point multiplication with
   5352      precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
   5353      will now compute a table of multiples of the generator that
   5354      makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
   5355      faster (notably in the case of a single point multiplication,
   5356      scalar * generator).
   5357      [Nils Larsch, Bodo Moeller]
   5359   *) IPv6 support for certificate extensions. The various extensions
   5360      which use the IP:a.b.c.d can now take IPv6 addresses using the
   5361      formats of RFC1884 2.2 . IPv6 addresses are now also displayed
   5362      correctly.
   5363      [Steve Henson]
   5365   *) Added an ENGINE that implements RSA by performing private key
   5366      exponentiations with the GMP library. The conversions to and from
   5367      GMP's mpz_t format aren't optimised nor are any montgomery forms
   5368      cached, and on x86 it appears OpenSSL's own performance has caught up.
   5369      However there are likely to be other architectures where GMP could
   5370      provide a boost. This ENGINE is not built in by default, but it can be
   5371      specified at Configure time and should be accompanied by the necessary
   5372      linker additions, eg;
   5373          ./config -DOPENSSL_USE_GMP -lgmp
   5374      [Geoff Thorpe]
   5376   *) "openssl engine" will not display ENGINE/DSO load failure errors when
   5377      testing availability of engines with "-t" - the old behaviour is
   5378      produced by increasing the feature's verbosity with "-tt".
   5379      [Geoff Thorpe]
   5381   *) ECDSA routines: under certain error conditions uninitialized BN objects
   5382      could be freed. Solution: make sure initialization is performed early
   5383      enough. (Reported and fix supplied by Nils Larsch <nla (a] trustcenter.de>
   5384      via PR#459)
   5385      [Lutz Jaenicke]
   5387   *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
   5388      and DH_METHOD (eg. by ENGINE implementations) to override the normal
   5389      software implementations. For DSA and DH, parameter generation can
   5390      also be overridden by providing the appropriate method callbacks.
   5391      [Geoff Thorpe]
   5393   *) Change the "progress" mechanism used in key-generation and
   5394      primality testing to functions that take a new BN_GENCB pointer in
   5395      place of callback/argument pairs. The new API functions have "_ex"
   5396      postfixes and the older functions are reimplemented as wrappers for
   5397      the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
   5398      declarations of the old functions to help (graceful) attempts to
   5399      migrate to the new functions. Also, the new key-generation API
   5400      functions operate on a caller-supplied key-structure and return
   5401      success/failure rather than returning a key or NULL - this is to
   5402      help make "keygen" another member function of RSA_METHOD etc.
   5404      Example for using the new callback interface:
   5406           int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
   5407           void *my_arg = ...;
   5408           BN_GENCB my_cb;
   5410           BN_GENCB_set(&my_cb, my_callback, my_arg);
   5412           return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
   5413           /* For the meaning of a, b in calls to my_callback(), see the
   5414            * documentation of the function that calls the callback.
   5415            * cb will point to my_cb; my_arg can be retrieved as cb->arg.
   5416            * my_callback should return 1 if it wants BN_is_prime_ex()
   5417            * to continue, or 0 to stop.
   5418            */
   5420      [Geoff Thorpe]
   5422   *) Change the ZLIB compression method to be stateful, and make it
   5423      available to TLS with the number defined in 
   5424      draft-ietf-tls-compression-04.txt.
   5425      [Richard Levitte]
   5427   *) Add the ASN.1 structures and functions for CertificatePair, which
   5428      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
   5430      CertificatePair ::= SEQUENCE {
   5431         forward		[0]	Certificate OPTIONAL,
   5432         reverse		[1]	Certificate OPTIONAL,
   5433         -- at least one of the pair shall be present -- }
   5435      Also implement the PEM functions to read and write certificate
   5436      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
   5438      This needed to be defined, mostly for the sake of the LDAP
   5439      attribute crossCertificatePair, but may prove useful elsewhere as
   5440      well.
   5441      [Richard Levitte]
   5443   *) Make it possible to inhibit symlinking of shared libraries in
   5444      Makefile.shared, for Cygwin's sake.
   5445      [Richard Levitte]
   5447   *) Extend the BIGNUM API by creating a function 
   5448           void BN_set_negative(BIGNUM *a, int neg);
   5449      and a macro that behave like
   5450           int  BN_is_negative(const BIGNUM *a);
   5452      to avoid the need to access 'a->neg' directly in applications.
   5453      [Nils Larsch]
   5455   *) Implement fast modular reduction for pseudo-Mersenne primes
   5456      used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
   5457      EC_GROUP_new_curve_GFp() will now automatically use this
   5458      if applicable.
   5459      [Nils Larsch <nla (a] trustcenter.de>]
   5461   *) Add new lock type (CRYPTO_LOCK_BN).
   5462      [Bodo Moeller]
   5464   *) Change the ENGINE framework to automatically load engines
   5465      dynamically from specific directories unless they could be
   5466      found to already be built in or loaded.  Move all the
   5467      current engines except for the cryptodev one to a new
   5468      directory engines/.
   5469      The engines in engines/ are built as shared libraries if
   5470      the "shared" options was given to ./Configure or ./config.
   5471      Otherwise, they are inserted in libcrypto.a.
   5472      /usr/local/ssl/engines is the default directory for dynamic
   5473      engines, but that can be overridden at configure time through
   5474      the usual use of --prefix and/or --openssldir, and at run
   5475      time with the environment variable OPENSSL_ENGINES.
   5476      [Geoff Thorpe and Richard Levitte]
   5478   *) Add Makefile.shared, a helper makefile to build shared
   5479      libraries.  Adapt Makefile.org.
   5480      [Richard Levitte]
   5482   *) Add version info to Win32 DLLs.
   5483      [Peter 'Luna' Runestig" <peter (a] runestig.com>]
   5485   *) Add new 'medium level' PKCS#12 API. Certificates and keys
   5486      can be added using this API to created arbitrary PKCS#12
   5487      files while avoiding the low level API.
   5489      New options to PKCS12_create(), key or cert can be NULL and
   5490      will then be omitted from the output file. The encryption
   5491      algorithm NIDs can be set to -1 for no encryption, the mac
   5492      iteration count can be set to 0 to omit the mac.
   5494      Enhance pkcs12 utility by making the -nokeys and -nocerts
   5495      options work when creating a PKCS#12 file. New option -nomac
   5496      to omit the mac, NONE can be set for an encryption algorithm.
   5497      New code is modified to use the enhanced PKCS12_create()
   5498      instead of the low level API.
   5499      [Steve Henson]
   5501   *) Extend ASN1 encoder to support indefinite length constructed
   5502      encoding. This can output sequences tags and octet strings in
   5503      this form. Modify pk7_asn1.c to support indefinite length
   5504      encoding. This is experimental and needs additional code to
   5505      be useful, such as an ASN1 bio and some enhanced streaming
   5506      PKCS#7 code.
   5508      Extend template encode functionality so that tagging is passed
   5509      down to the template encoder.
   5510      [Steve Henson]
   5512   *) Let 'openssl req' fail if an argument to '-newkey' is not
   5513      recognized instead of using RSA as a default.
   5514      [Bodo Moeller]
   5516   *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
   5517      As these are not official, they are not included in "ALL";
   5518      the "ECCdraft" ciphersuite group alias can be used to select them.
   5519      [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
   5521   *) Add ECDH engine support.
   5522      [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
   5524   *) Add ECDH in new directory crypto/ecdh/.
   5525      [Douglas Stebila (Sun Microsystems Laboratories)]
   5527   *) Let BN_rand_range() abort with an error after 100 iterations
   5528      without success (which indicates a broken PRNG).
   5529      [Bodo Moeller]
   5531   *) Change BN_mod_sqrt() so that it verifies that the input value
   5532      is really the square of the return value.  (Previously,
   5533      BN_mod_sqrt would show GIGO behaviour.)
   5534      [Bodo Moeller]
   5536   *) Add named elliptic curves over binary fields from X9.62, SECG,
   5537      and WAP/WTLS; add OIDs that were still missing.
   5539      [Sheueling Chang Shantz and Douglas Stebila
   5540      (Sun Microsystems Laboratories)]
   5542   *) Extend the EC library for elliptic curves over binary fields
   5543      (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
   5544      New EC_METHOD:
   5546           EC_GF2m_simple_method
   5548      New API functions:
   5550           EC_GROUP_new_curve_GF2m
   5551           EC_GROUP_set_curve_GF2m
   5552           EC_GROUP_get_curve_GF2m
   5553           EC_POINT_set_affine_coordinates_GF2m
   5554           EC_POINT_get_affine_coordinates_GF2m
   5555           EC_POINT_set_compressed_coordinates_GF2m
   5557      Point compression for binary fields is disabled by default for
   5558      patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
   5559      enable it).
   5561      As binary polynomials are represented as BIGNUMs, various members
   5562      of the EC_GROUP and EC_POINT data structures can be shared
   5563      between the implementations for prime fields and binary fields;
   5564      the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
   5565      are essentially identical to their ..._GFp counterparts.
   5566      (For simplicity, the '..._GFp' prefix has been dropped from
   5567      various internal method names.)
   5569      An internal 'field_div' method (similar to 'field_mul' and
   5570      'field_sqr') has been added; this is used only for binary fields.
   5572      [Sheueling Chang Shantz and Douglas Stebila
   5573      (Sun Microsystems Laboratories)]
   5575   *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
   5576      through methods ('mul', 'precompute_mult').
   5578      The generic implementations (now internally called 'ec_wNAF_mul'
   5579      and 'ec_wNAF_precomputed_mult') remain the default if these
   5580      methods are undefined.
   5582      [Sheueling Chang Shantz and Douglas Stebila
   5583      (Sun Microsystems Laboratories)]
   5585   *) New function EC_GROUP_get_degree, which is defined through
   5586      EC_METHOD.  For curves over prime fields, this returns the bit
   5587      length of the modulus.
   5589      [Sheueling Chang Shantz and Douglas Stebila
   5590      (Sun Microsystems Laboratories)]
   5592   *) New functions EC_GROUP_dup, EC_POINT_dup.
   5593      (These simply call ..._new  and ..._copy).
   5595      [Sheueling Chang Shantz and Douglas Stebila
   5596      (Sun Microsystems Laboratories)]
   5598   *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
   5599      Polynomials are represented as BIGNUMs (where the sign bit is not
   5600      used) in the following functions [macros]:  
   5602           BN_GF2m_add
   5603           BN_GF2m_sub             [= BN_GF2m_add]
   5604           BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
   5605           BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
   5606           BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
   5607           BN_GF2m_mod_inv
   5608           BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
   5609           BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
   5610           BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
   5611           BN_GF2m_cmp             [= BN_ucmp]
   5613      (Note that only the 'mod' functions are actually for fields GF(2^m).
   5614      BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
   5616      For some functions, an the irreducible polynomial defining a
   5617      field can be given as an 'unsigned int[]' with strictly
   5618      decreasing elements giving the indices of those bits that are set;
   5619      i.e., p[] represents the polynomial
   5620           f(t) = t^p[0] + t^p[1] + ... + t^p[k]
   5621      where
   5622           p[0] > p[1] > ... > p[k] = 0.
   5623      This applies to the following functions:
   5625           BN_GF2m_mod_arr
   5626           BN_GF2m_mod_mul_arr
   5627           BN_GF2m_mod_sqr_arr
   5628           BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
   5629           BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
   5630           BN_GF2m_mod_exp_arr
   5631           BN_GF2m_mod_sqrt_arr
   5632           BN_GF2m_mod_solve_quad_arr
   5633           BN_GF2m_poly2arr
   5634           BN_GF2m_arr2poly
   5636      Conversion can be performed by the following functions:
   5638           BN_GF2m_poly2arr
   5639           BN_GF2m_arr2poly
   5641      bntest.c has additional tests for binary polynomial arithmetic.
   5643      Two implementations for BN_GF2m_mod_div() are available.
   5644      The default algorithm simply uses BN_GF2m_mod_inv() and
   5645      BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
   5646      if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
   5647      copyright notice in crypto/bn/bn_gf2m.c before enabling it).
   5649      [Sheueling Chang Shantz and Douglas Stebila
   5650      (Sun Microsystems Laboratories)]
   5652   *) Add new error code 'ERR_R_DISABLED' that can be used when some
   5653      functionality is disabled at compile-time.
   5654      [Douglas Stebila <douglas.stebila (a] sun.com>]
   5656   *) Change default behaviour of 'openssl asn1parse' so that more
   5657      information is visible when viewing, e.g., a certificate:
   5659      Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
   5660      mode the content of non-printable OCTET STRINGs is output in a
   5661      style similar to INTEGERs, but with '[HEX DUMP]' prepended to
   5662      avoid the appearance of a printable string.
   5663      [Nils Larsch <nla (a] trustcenter.de>]
   5665   *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
   5666      functions
   5667           EC_GROUP_set_asn1_flag()
   5668           EC_GROUP_get_asn1_flag()
   5669           EC_GROUP_set_point_conversion_form()
   5670           EC_GROUP_get_point_conversion_form()
   5671      These control ASN1 encoding details:
   5672      - Curves (i.e., groups) are encoded explicitly unless asn1_flag
   5673        has been set to OPENSSL_EC_NAMED_CURVE.
   5674      - Points are encoded in uncompressed form by default; options for
   5675        asn1_for are as for point2oct, namely
   5680      Also add 'seed' and 'seed_len' members to EC_GROUP with access
   5681      functions
   5682           EC_GROUP_set_seed()
   5683           EC_GROUP_get0_seed()
   5684           EC_GROUP_get_seed_len()
   5685      This is used only for ASN1 purposes (so far).
   5686      [Nils Larsch <nla (a] trustcenter.de>]
   5688   *) Add 'field_type' member to EC_METHOD, which holds the NID
   5689      of the appropriate field type OID.  The new function
   5690      EC_METHOD_get_field_type() returns this value.
   5691      [Nils Larsch <nla (a] trustcenter.de>]
   5693   *) Add functions 
   5694           EC_POINT_point2bn()
   5695           EC_POINT_bn2point()
   5696           EC_POINT_point2hex()
   5697           EC_POINT_hex2point()
   5698      providing useful interfaces to EC_POINT_point2oct() and
   5699      EC_POINT_oct2point().
   5700      [Nils Larsch <nla (a] trustcenter.de>]
   5702   *) Change internals of the EC library so that the functions
   5703           EC_GROUP_set_generator()
   5704           EC_GROUP_get_generator()
   5705           EC_GROUP_get_order()
   5706           EC_GROUP_get_cofactor()
   5707      are implemented directly in crypto/ec/ec_lib.c and not dispatched
   5708      to methods, which would lead to unnecessary code duplication when
   5709      adding different types of curves.
   5710      [Nils Larsch <nla (a] trustcenter.de> with input by Bodo Moeller]
   5712   *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
   5713      arithmetic, and such that modified wNAFs are generated
   5714      (which avoid length expansion in many cases).
   5715      [Bodo Moeller]
   5717   *) Add a function EC_GROUP_check_discriminant() (defined via
   5718      EC_METHOD) that verifies that the curve discriminant is non-zero.
   5720      Add a function EC_GROUP_check() that makes some sanity tests
   5721      on a EC_GROUP, its generator and order.  This includes
   5722      EC_GROUP_check_discriminant().
   5723      [Nils Larsch <nla (a] trustcenter.de>]
   5725   *) Add ECDSA in new directory crypto/ecdsa/.
   5727      Add applications 'openssl ecparam' and 'openssl ecdsa'
   5728      (these are based on 'openssl dsaparam' and 'openssl dsa').
   5730      ECDSA support is also included in various other files across the
   5731      library.  Most notably,
   5732      - 'openssl req' now has a '-newkey ecdsa:file' option;
   5733      - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
   5734      - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
   5735        d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
   5736        them suitable for ECDSA where domain parameters must be
   5737        extracted before the specific public key;
   5738      - ECDSA engine support has been added.
   5739      [Nils Larsch <nla (a] trustcenter.de>]
   5741   *) Include some named elliptic curves, and add OIDs from X9.62,
   5742      SECG, and WAP/WTLS.  Each curve can be obtained from the new
   5743      function
   5744           EC_GROUP_new_by_curve_name(),
   5745      and the list of available named curves can be obtained with
   5746           EC_get_builtin_curves().
   5747      Also add a 'curve_name' member to EC_GROUP objects, which can be
   5748      accessed via
   5749          EC_GROUP_set_curve_name()
   5750          EC_GROUP_get_curve_name()
   5751      [Nils Larsch <larsch (a] trustcenter.de, Bodo Moeller]
   5753   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   5754      was actually never needed) and in BN_mul().  The removal in BN_mul()
   5755      required a small change in bn_mul_part_recursive() and the addition
   5756      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   5757      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   5758      bn_sub_words() and bn_add_words() except they take arrays with
   5759      differing sizes.
   5760      [Richard Levitte]
   5762  Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
   5764   *) Cleanse PEM buffers before freeing them since they may contain 
   5765      sensitive data.
   5766      [Benjamin Bennett <ben (a] psc.edu>]
   5768   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   5769      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   5770      authentication-only ciphersuites.
   5771      [Bodo Moeller]
   5773   *) Since AES128 and AES256 share a single mask bit in the logic of
   5774      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   5775      kludge to work properly if AES128 is available and AES256 isn't.
   5776      [Victor Duchovni]
   5778   *) Expand security boundary to match 1.1.1 module.
   5779      [Steve Henson]
   5781   *) Remove redundant features: hash file source, editing of test vectors
   5782      modify fipsld to use external fips_premain.c signature.
   5783      [Steve Henson]
   5785   *) New perl script mkfipsscr.pl to create shell scripts or batch files to
   5786      run algorithm test programs.
   5787      [Steve Henson]
   5789   *) Make algorithm test programs more tolerant of whitespace.
   5790      [Steve Henson]
   5792   *) Have SSL/TLS server implementation tolerate "mismatched" record
   5793      protocol version while receiving ClientHello even if the
   5794      ClientHello is fragmented.  (The server can't insist on the
   5795      particular protocol version it has chosen before the ServerHello
   5796      message has informed the client about his choice.)
   5797      [Bodo Moeller]
   5799   *) Load error codes if they are not already present instead of using a
   5800      static variable. This allows them to be cleanly unloaded and reloaded.
   5801      [Steve Henson]
   5803  Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
   5805   *) Introduce limits to prevent malicious keys being able to
   5806      cause a denial of service.  (CVE-2006-2940)
   5807      [Steve Henson, Bodo Moeller]
   5809   *) Fix ASN.1 parsing of certain invalid structures that can result
   5810      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   5812   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   5813      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   5815   *) Fix SSL client code which could crash if connecting to a
   5816      malicious SSLv2 server.  (CVE-2006-4343)
   5817      [Tavis Ormandy and Will Drewry, Google Security Team]
   5819   *) Change ciphersuite string processing so that an explicit
   5820      ciphersuite selects this one ciphersuite (so that "AES256-SHA"
   5821      will no longer include "AES128-SHA"), and any other similar
   5822      ciphersuite (same bitmap) from *other* protocol versions (so that
   5823      "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
   5824      SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
   5825      changes from 0.9.8b and 0.9.8d.
   5826      [Bodo Moeller]
   5828  Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
   5830   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   5831      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   5833   *) Change the Unix randomness entropy gathering to use poll() when
   5834      possible instead of select(), since the latter has some
   5835      undesirable limitations.
   5836      [Darryl Miles via Richard Levitte and Bodo Moeller]
   5838   *) Disable rogue ciphersuites:
   5840       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   5841       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   5842       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   5844      The latter two were purportedly from
   5845      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   5846      appear there.
   5848      Also deactive the remaining ciphersuites from
   5849      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   5850      unofficial, and the ID has long expired.
   5851      [Bodo Moeller]
   5853   *) Fix RSA blinding Heisenbug (problems sometimes occurred on
   5854      dual-core machines) and other potential thread-safety issues.
   5855      [Bodo Moeller]
   5857  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
   5859   *) Adapt fipsld and the build system to link against the validated FIPS
   5860      module in FIPS mode.
   5861      [Steve Henson]
   5863   *) Fixes for VC++ 2005 build under Windows.
   5864      [Steve Henson]
   5866   *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
   5867      from a Windows bash shell such as MSYS. It is autodetected from the
   5868      "config" script when run from a VC++ environment. Modify standard VC++
   5869      build to use fipscanister.o from the GNU make build. 
   5870      [Steve Henson]
   5872  Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
   5874   *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
   5875      The value now differs depending on if you build for FIPS or not.
   5876      BEWARE!  A program linked with a shared FIPSed libcrypto can't be
   5877      safely run with a non-FIPSed libcrypto, as it may crash because of
   5878      the difference induced by this change.
   5879      [Andy Polyakov]
   5881  Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
   5883   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   5884      (part of SSL_OP_ALL).  This option used to disable the
   5885      countermeasure against man-in-the-middle protocol-version
   5886      rollback in the SSL 2.0 server implementation, which is a bad
   5887      idea.  (CVE-2005-2969)
   5889      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   5890      for Information Security, National Institute of Advanced Industrial
   5891      Science and Technology [AIST], Japan)]
   5893   *) Minimal support for X9.31 signatures and PSS padding modes. This is
   5894      mainly for FIPS compliance and not fully integrated at this stage.
   5895      [Steve Henson]
   5897   *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
   5898      the exponentiation using a fixed-length exponent.  (Otherwise,
   5899      the information leaked through timing could expose the secret key
   5900      after many signatures; cf. Bleichenbacher's attack on DSA with
   5901      biased k.)
   5902      [Bodo Moeller]
   5904   *) Make a new fixed-window mod_exp implementation the default for
   5905      RSA, DSA, and DH private-key operations so that the sequence of
   5906      squares and multiplies and the memory access pattern are
   5907      independent of the particular secret key.  This will mitigate
   5908      cache-timing and potential related attacks.
   5910      BN_mod_exp_mont_consttime() is the new exponentiation implementation,
   5911      and this is automatically used by BN_mod_exp_mont() if the new flag
   5912      BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
   5913      will use this BN flag for private exponents unless the flag
   5915      DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
   5917      [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
   5919   *) Change the client implementation for SSLv23_method() and
   5920      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
   5921      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
   5922      (Previously, the SSL 2.0 backwards compatible Client Hello
   5923      message format would be used even with SSL_OP_NO_SSLv2.)
   5924      [Bodo Moeller]
   5926   *) Add support for smime-type MIME parameter in S/MIME messages which some
   5927      clients need.
   5928      [Steve Henson]
   5930   *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
   5931      a threadsafe manner. Modify rsa code to use new function and add calls
   5932      to dsa and dh code (which had race conditions before).
   5933      [Steve Henson]
   5935   *) Include the fixed error library code in the C error file definitions
   5936      instead of fixing them up at runtime. This keeps the error code
   5937      structures constant.
   5938      [Steve Henson]
   5940  Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
   5942   [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
   5943   OpenSSL 0.9.8.]
   5945   *) Fixes for newer kerberos headers. NB: the casts are needed because
   5946      the 'length' field is signed on one version and unsigned on another
   5947      with no (?) obvious way to tell the difference, without these VC++
   5948      complains. Also the "definition" of FAR (blank) is no longer included
   5949      nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
   5950      some needed definitions.
   5951      [Steve Henson]
   5953   *) Undo Cygwin change.
   5954      [Ulf Mller]
   5956   *) Added support for proxy certificates according to RFC 3820.
   5957      Because they may be a security thread to unaware applications,
   5958      they must be explicitly allowed in run-time.  See
   5959      docs/HOWTO/proxy_certificates.txt for further information.
   5960      [Richard Levitte]
   5962  Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
   5964   *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
   5965      server and client random values. Previously
   5966      (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
   5967      less random data when sizeof(time_t) > 4 (some 64 bit platforms).
   5969      This change has negligible security impact because:
   5971      1. Server and client random values still have 24 bytes of pseudo random
   5972         data.
   5974      2. Server and client random values are sent in the clear in the initial
   5975         handshake.
   5977      3. The master secret is derived using the premaster secret (48 bytes in
   5978         size for static RSA ciphersuites) as well as client server and random
   5979         values.
   5981      The OpenSSL team would like to thank the UK NISCC for bringing this issue
   5982      to our attention. 
   5984      [Stephen Henson, reported by UK NISCC]
   5986   *) Use Windows randomness collection on Cygwin.
   5987      [Ulf Mller]
   5989   *) Fix hang in EGD/PRNGD query when communication socket is closed
   5990      prematurely by EGD/PRNGD.
   5991      [Darren Tucker <dtucker (a] zip.com.au> via Lutz Jnicke, resolves #1014]
   5993   *) Prompt for pass phrases when appropriate for PKCS12 input format.
   5994      [Steve Henson]
   5996   *) Back-port of selected performance improvements from development
   5997      branch, as well as improved support for PowerPC platforms.
   5998      [Andy Polyakov]
   6000   *) Add lots of checks for memory allocation failure, error codes to indicate
   6001      failure and freeing up memory if a failure occurs.
   6002      [Nauticus Networks SSL Team <openssl (a] nauticusnet.com>, Steve Henson]
   6004   *) Add new -passin argument to dgst.
   6005      [Steve Henson]
   6007   *) Perform some character comparisons of different types in X509_NAME_cmp:
   6008      this is needed for some certificates that re-encode DNs into UTF8Strings
   6009      (in violation of RFC3280) and can't or won't issue name rollover
   6010      certificates.
   6011      [Steve Henson]
   6013   *) Make an explicit check during certificate validation to see that
   6014      the CA setting in each certificate on the chain is correct.  As a
   6015      side effect always do the following basic checks on extensions,
   6016      not just when there's an associated purpose to the check:
   6018       - if there is an unhandled critical extension (unless the user
   6019         has chosen to ignore this fault)
   6020       - if the path length has been exceeded (if one is set at all)
   6021       - that certain extensions fit the associated purpose (if one has
   6022         been given)
   6023      [Richard Levitte]
   6025  Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
   6027   *) Avoid a race condition when CRLs are checked in a multi threaded 
   6028      environment. This would happen due to the reordering of the revoked
   6029      entries during signature checking and serial number lookup. Now the
   6030      encoding is cached and the serial number sort performed under a lock.
   6031      Add new STACK function sk_is_sorted().
   6032      [Steve Henson]
   6034   *) Add Delta CRL to the extension code.
   6035      [Steve Henson]
   6037   *) Various fixes to s3_pkt.c so alerts are sent properly.
   6038      [David Holmes <d.holmes (a] f5.com>]
   6040   *) Reduce the chances of duplicate issuer name and serial numbers (in
   6041      violation of RFC3280) using the OpenSSL certificate creation utilities.
   6042      This is done by creating a random 64 bit value for the initial serial
   6043      number when a serial number file is created or when a self signed
   6044      certificate is created using 'openssl req -x509'. The initial serial
   6045      number file is created using 'openssl x509 -next_serial' in CA.pl
   6046      rather than being initialized to 1.
   6047      [Steve Henson]
   6049  Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
   6051   *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
   6052      by using the Codenomicon TLS Test Tool (CVE-2004-0079)                    
   6053      [Joe Orton, Steve Henson]   
   6055   *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
   6056      (CVE-2004-0112)
   6057      [Joe Orton, Steve Henson]   
   6059   *) Make it possible to have multiple active certificates with the same
   6060      subject in the CA index file.  This is done only if the keyword
   6061      'unique_subject' is set to 'no' in the main CA section (default
   6062      if 'CA_default') of the configuration file.  The value is saved
   6063      with the database itself in a separate index attribute file,
   6064      named like the index file with '.attr' appended to the name.
   6065      [Richard Levitte]
   6067   *) X509 verify fixes. Disable broken certificate workarounds when 
   6068      X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
   6069      keyUsage extension present. Don't accept CRLs with unhandled critical
   6070      extensions: since verify currently doesn't process CRL extensions this
   6071      rejects a CRL with *any* critical extensions. Add new verify error codes
   6072      for these cases.
   6073      [Steve Henson]
   6075   *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
   6076      A clarification of RFC2560 will require the use of OCTET STRINGs and 
   6077      some implementations cannot handle the current raw format. Since OpenSSL
   6078      copies and compares OCSP nonces as opaque blobs without any attempt at
   6079      parsing them this should not create any compatibility issues.
   6080      [Steve Henson]
   6082   *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
   6083      calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
   6084      this HMAC (and other) operations are several times slower than OpenSSL
   6085      < 0.9.7.
   6086      [Steve Henson]
   6088   *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
   6089      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   6091   *) Use the correct content when signing type "other".
   6092      [Steve Henson]
   6094  Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
   6096   *) Fix various bugs revealed by running the NISCC test suite:
   6098      Stop out of bounds reads in the ASN1 code when presented with
   6099      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   6101      Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
   6103      If verify callback ignores invalid public key errors don't try to check
   6104      certificate signature with the NULL public key.
   6106      [Steve Henson]
   6108   *) New -ignore_err option in ocsp application to stop the server
   6109      exiting on the first error in a request.
   6110      [Steve Henson]
   6112   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   6113      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   6114      specifications.
   6115      [Steve Henson]
   6117   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   6118      extra data after the compression methods not only for TLS 1.0
   6119      but also for SSL 3.0 (as required by the specification).
   6120      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   6122   *) Change X509_certificate_type() to mark the key as exported/exportable
   6123      when it's 512 *bits* long, not 512 bytes.
   6124      [Richard Levitte]
   6126   *) Change AES_cbc_encrypt() so it outputs exact multiple of
   6127      blocks during encryption.
   6128      [Richard Levitte]
   6130   *) Various fixes to base64 BIO and non blocking I/O. On write 
   6131      flushes were not handled properly if the BIO retried. On read
   6132      data was not being buffered properly and had various logic bugs.
   6133      This also affects blocking I/O when the data being decoded is a
   6134      certain size.
   6135      [Steve Henson]
   6137   *) Various S/MIME bugfixes and compatibility changes:
   6138      output correct application/pkcs7 MIME type if
   6139      PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
   6140      Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
   6141      of files as .eml work). Correctly handle very long lines in MIME
   6142      parser.
   6143      [Steve Henson]
   6145  Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
   6147   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   6148      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   6149      a protocol version number mismatch like a decryption error
   6150      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   6151      [Bodo Moeller]
   6153   *) Turn on RSA blinding by default in the default implementation
   6154      to avoid a timing attack. Applications that don't want it can call
   6155      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   6156      They would be ill-advised to do so in most cases.
   6157      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   6159   *) Change RSA blinding code so that it works when the PRNG is not
   6160      seeded (in this case, the secret RSA exponent is abused as
   6161      an unpredictable seed -- if it is not unpredictable, there
   6162      is no point in blinding anyway).  Make RSA blinding thread-safe
   6163      by remembering the creator's thread ID in rsa->blinding and
   6164      having all other threads use local one-time blinding factors
   6165      (this requires more computation than sharing rsa->blinding, but
   6166      avoids excessive locking; and if an RSA object is not shared
   6167      between threads, blinding will still be very fast).
   6168      [Bodo Moeller]
   6170   *) Fixed a typo bug that would cause ENGINE_set_default() to set an
   6171      ENGINE as defaults for all supported algorithms irrespective of
   6172      the 'flags' parameter. 'flags' is now honoured, so applications
   6173      should make sure they are passing it correctly.
   6174      [Geoff Thorpe]
   6176   *) Target "mingw" now allows native Windows code to be generated in
   6177      the Cygwin environment as well as with the MinGW compiler.
   6178      [Ulf Moeller] 
   6180  Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
   6182   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   6183      via timing by performing a MAC computation even if incorrect
   6184      block cipher padding has been found.  This is a countermeasure
   6185      against active attacks where the attacker has to distinguish
   6186      between bad padding and a MAC verification error. (CVE-2003-0078)
   6188      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   6189      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   6190      Martin Vuagnoux (EPFL, Ilion)]
   6192   *) Make the no-err option work as intended.  The intention with no-err
   6193      is not to have the whole error stack handling routines removed from
   6194      libcrypto, it's only intended to remove all the function name and
   6195      reason texts, thereby removing some of the footprint that may not
   6196      be interesting if those errors aren't displayed anyway.
   6198      NOTE: it's still possible for any application or module to have it's
   6199      own set of error texts inserted.  The routines are there, just not
   6200      used by default when no-err is given.
   6201      [Richard Levitte]
   6203   *) Add support for FreeBSD on IA64.
   6204      [dirk.meyer (a] dinoex.sub.org via Richard Levitte, resolves #454]
   6206   *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
   6207      Kerberos function mit_des_cbc_cksum().  Before this change,
   6208      the value returned by DES_cbc_cksum() was like the one from
   6209      mit_des_cbc_cksum(), except the bytes were swapped.
   6210      [Kevin Greaney <Kevin.Greaney (a] hp.com> and Richard Levitte]
   6212   *) Allow an application to disable the automatic SSL chain building.
   6213      Before this a rather primitive chain build was always performed in
   6214      ssl3_output_cert_chain(): an application had no way to send the 
   6215      correct chain if the automatic operation produced an incorrect result.
   6217      Now the chain builder is disabled if either:
   6219      1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
   6221      2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
   6223      The reasoning behind this is that an application would not want the
   6224      auto chain building to take place if extra chain certificates are
   6225      present and it might also want a means of sending no additional
   6226      certificates (for example the chain has two certificates and the
   6227      root is omitted).
   6228      [Steve Henson]
   6230   *) Add the possibility to build without the ENGINE framework.
   6231      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   6233   *) Under Win32 gmtime() can return NULL: check return value in
   6234      OPENSSL_gmtime(). Add error code for case where gmtime() fails.
   6235      [Steve Henson]
   6237   *) DSA routines: under certain error conditions uninitialized BN objects
   6238      could be freed. Solution: make sure initialization is performed early
   6239      enough. (Reported and fix supplied by Ivan D Nestlerode <nestler (a] MIT.EDU>,
   6240      Nils Larsch <nla (a] trustcenter.de> via PR#459)
   6241      [Lutz Jaenicke]
   6243   *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
   6244      checked on reconnect on the client side, therefore session resumption
   6245      could still fail with a "ssl session id is different" error. This
   6246      behaviour is masked when SSL_OP_ALL is used due to
   6247      SSL_OP_MICROSOFT_SESS_ID_BUG being set.
   6248      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   6249      followup to PR #377.
   6250      [Lutz Jaenicke]
   6252   *) IA-32 assembler support enhancements: unified ELF targets, support
   6253      for SCO/Caldera platforms, fix for Cygwin shared build.
   6254      [Andy Polyakov]
   6256   *) Add support for FreeBSD on sparc64.  As a consequence, support for
   6257      FreeBSD on non-x86 processors is separate from x86 processors on
   6258      the config script, much like the NetBSD support.
   6259      [Richard Levitte & Kris Kennaway <kris (a] obsecurity.org>]
   6261  Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
   6263   [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
   6264   OpenSSL 0.9.7.]
   6266   *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
   6267      code (06) was taken as the first octet of the session ID and the last
   6268      octet was ignored consequently. As a result SSLv2 client side session
   6269      caching could not have worked due to the session ID mismatch between
   6270      client and server.
   6271      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   6272      PR #377.
   6273      [Lutz Jaenicke]
   6275   *) Change the declaration of needed Kerberos libraries to use EX_LIBS
   6276      instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
   6277      removed entirely.
   6278      [Richard Levitte]
   6280   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
   6281      seems that in spite of existing for more than a year, many application
   6282      author have done nothing to provide the necessary callbacks, which
   6283      means that this particular engine will not work properly anywhere.
   6284      This is a very unfortunate situation which forces us, in the name
   6285      of usability, to give the hw_ncipher.c a static lock, which is part
   6286      of libcrypto.
   6287      NOTE: This is for the 0.9.7 series ONLY.  This hack will never
   6288      appear in 0.9.8 or later.  We EXPECT application authors to have
   6289      dealt properly with this when 0.9.8 is released (unless we actually
   6290      make such changes in the libcrypto locking code that changes will
   6291      have to be made anyway).
   6292      [Richard Levitte]
   6294   *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
   6295      octets have been read, EOF or an error occurs. Without this change
   6296      some truncated ASN1 structures will not produce an error.
   6297      [Steve Henson]
   6299   *) Disable Heimdal support, since it hasn't been fully implemented.
   6300      Still give the possibility to force the use of Heimdal, but with
   6301      warnings and a request that patches get sent to openssl-dev.
   6302      [Richard Levitte]
   6304   *) Add the VC-CE target, introduce the WINCE sysname, and add
   6305      INSTALL.WCE and appropriate conditionals to make it build.
   6306      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   6308   *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
   6309      cygssl-x.y.z.dll, where x, y and z are the major, minor and
   6310      edit numbers of the version.
   6311      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   6313   *) Introduce safe string copy and catenation functions
   6314      (BUF_strlcpy() and BUF_strlcat()).
   6315      [Ben Laurie (CHATS) and Richard Levitte]
   6317   *) Avoid using fixed-size buffers for one-line DNs.
   6318      [Ben Laurie (CHATS)]
   6320   *) Add BUF_MEM_grow_clean() to avoid information leakage when
   6321      resizing buffers containing secrets, and use where appropriate.
   6322      [Ben Laurie (CHATS)]
   6324   *) Avoid using fixed size buffers for configuration file location.
   6325      [Ben Laurie (CHATS)]
   6327   *) Avoid filename truncation for various CA files.
   6328      [Ben Laurie (CHATS)]
   6330   *) Use sizeof in preference to magic numbers.
   6331      [Ben Laurie (CHATS)]
   6333   *) Avoid filename truncation in cert requests.
   6334      [Ben Laurie (CHATS)]
   6336   *) Add assertions to check for (supposedly impossible) buffer
   6337      overflows.
   6338      [Ben Laurie (CHATS)]
   6340   *) Don't cache truncated DNS entries in the local cache (this could
   6341      potentially lead to a spoofing attack).
   6342      [Ben Laurie (CHATS)]
   6344   *) Fix various buffers to be large enough for hex/decimal
   6345      representations in a platform independent manner.
   6346      [Ben Laurie (CHATS)]
   6348   *) Add CRYPTO_realloc_clean() to avoid information leakage when
   6349      resizing buffers containing secrets, and use where appropriate.
   6350      [Ben Laurie (CHATS)]
   6352   *) Add BIO_indent() to avoid much slightly worrying code to do
   6353      indents.
   6354      [Ben Laurie (CHATS)]
   6356   *) Convert sprintf()/BIO_puts() to BIO_printf().
   6357      [Ben Laurie (CHATS)]
   6359   *) buffer_gets() could terminate with the buffer only half
   6360      full. Fixed.
   6361      [Ben Laurie (CHATS)]
   6363   *) Add assertions to prevent user-supplied crypto functions from
   6364      overflowing internal buffers by having large block sizes, etc.
   6365      [Ben Laurie (CHATS)]
   6367   *) New OPENSSL_assert() macro (similar to assert(), but enabled
   6368      unconditionally).
   6369      [Ben Laurie (CHATS)]
   6371   *) Eliminate unused copy of key in RC4.
   6372      [Ben Laurie (CHATS)]
   6374   *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
   6375      [Ben Laurie (CHATS)]
   6377   *) Fix off-by-one error in EGD path.
   6378      [Ben Laurie (CHATS)]
   6380   *) If RANDFILE path is too long, ignore instead of truncating.
   6381      [Ben Laurie (CHATS)]
   6383   *) Eliminate unused and incorrectly sized X.509 structure
   6384      CBCParameter.
   6385      [Ben Laurie (CHATS)]
   6387   *) Eliminate unused and dangerous function knumber().
   6388      [Ben Laurie (CHATS)]
   6390   *) Eliminate unused and dangerous structure, KSSL_ERR.
   6391      [Ben Laurie (CHATS)]
   6393   *) Protect against overlong session ID context length in an encoded
   6394      session object. Since these are local, this does not appear to be
   6395      exploitable.
   6396      [Ben Laurie (CHATS)]
   6398   *) Change from security patch (see 0.9.6e below) that did not affect
   6399      the 0.9.6 release series:
   6401      Remote buffer overflow in SSL3 protocol - an attacker could
   6402      supply an oversized master key in Kerberos-enabled versions.
   6403      (CVE-2002-0657)
   6404      [Ben Laurie (CHATS)]
   6406   *) Change the SSL kerb5 codes to match RFC 2712.
   6407      [Richard Levitte]
   6409   *) Make -nameopt work fully for req and add -reqopt switch.
   6410      [Michael Bell <michael.bell (a] rz.hu-berlin.de>, Steve Henson]
   6412   *) The "block size" for block ciphers in CFB and OFB mode should be 1.
   6413      [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve (a] opera.com>]
   6415   *) Make sure tests can be performed even if the corresponding algorithms
   6416      have been removed entirely.  This was also the last step to make
   6417      OpenSSL compilable with DJGPP under all reasonable conditions.
   6418      [Richard Levitte, Doug Kaufman <dkaufman (a] rahul.net>]
   6420   *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
   6421      to allow version independent disabling of normally unselected ciphers,
   6422      which may be activated as a side-effect of selecting a single cipher.
   6424      (E.g., cipher list string "RSA" enables ciphersuites that are left
   6425      out of "ALL" because they do not provide symmetric encryption.
   6426      "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
   6427      [Lutz Jaenicke, Bodo Moeller]
   6429   *) Add appropriate support for separate platform-dependent build
   6430      directories.  The recommended way to make a platform-dependent
   6431      build directory is the following (tested on Linux), maybe with
   6432      some local tweaks:
   6434 	# Place yourself outside of the OpenSSL source tree.  In
   6435 	# this example, the environment variable OPENSSL_SOURCE
   6436 	# is assumed to contain the absolute OpenSSL source directory.
   6437 	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
   6438 	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
   6439 	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
   6440 		mkdir -p `dirname $F`
   6441 		ln -s $OPENSSL_SOURCE/$F $F
   6442 	done
   6444      To be absolutely sure not to disturb the source tree, a "make clean"
   6445      is a good thing.  If it isn't successful, don't worry about it,
   6446      it probably means the source directory is very clean.
   6447      [Richard Levitte]
   6449   *) Make sure any ENGINE control commands make local copies of string
   6450      pointers passed to them whenever necessary. Otherwise it is possible
   6451      the caller may have overwritten (or deallocated) the original string
   6452      data when a later ENGINE operation tries to use the stored values.
   6453      [Gtz Babin-Ebell <babinebell (a] trustcenter.de>]
   6455   *) Improve diagnostics in file reading and command-line digests.
   6456      [Ben Laurie aided and abetted by Solar Designer <solar (a] openwall.com>]
   6458   *) Add AES modes CFB and OFB to the object database.  Correct an
   6459      error in AES-CFB decryption.
   6460      [Richard Levitte]
   6462   *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
   6463      allows existing EVP_CIPHER_CTX structures to be reused after
   6464      calling EVP_*Final(). This behaviour is used by encryption
   6465      BIOs and some applications. This has the side effect that
   6466      applications must explicitly clean up cipher contexts with
   6467      EVP_CIPHER_CTX_cleanup() or they will leak memory.
   6468      [Steve Henson]
   6470   *) Check the values of dna and dnb in bn_mul_recursive before calling
   6471      bn_mul_comba (a non zero value means the a or b arrays do not contain
   6472      n2 elements) and fallback to bn_mul_normal if either is not zero.
   6473      [Steve Henson]
   6475   *) Fix escaping of non-ASCII characters when using the -subj option
   6476      of the "openssl req" command line tool. (Robert Joop <joop (a] fokus.gmd.de>)
   6477      [Lutz Jaenicke]
   6479   *) Make object definitions compliant to LDAP (RFC2256): SN is the short
   6480      form for "surname", serialNumber has no short form.
   6481      Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
   6482      therefore remove "mail" short name for "internet 7".
   6483      The OID for unique identifiers in X509 certificates is
   6484      x500UniqueIdentifier, not uniqueIdentifier.
   6485      Some more OID additions. (Michael Bell <michael.bell (a] rz.hu-berlin.de>)
   6486      [Lutz Jaenicke]
   6488   *) Add an "init" command to the ENGINE config module and auto initialize
   6489      ENGINEs. Without any "init" command the ENGINE will be initialized 
   6490      after all ctrl commands have been executed on it. If init=1 the 
   6491      ENGINE is initailized at that point (ctrls before that point are run
   6492      on the uninitialized ENGINE and after on the initialized one). If
   6493      init=0 then the ENGINE will not be iniatialized at all.
   6494      [Steve Henson]
   6496   *) Fix the 'app_verify_callback' interface so that the user-defined
   6497      argument is actually passed to the callback: In the
   6498      SSL_CTX_set_cert_verify_callback() prototype, the callback
   6499      declaration has been changed from
   6500           int (*cb)()
   6501      into
   6502           int (*cb)(X509_STORE_CTX *,void *);
   6503      in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
   6504           i=s->ctx->app_verify_callback(&ctx)
   6505      has been changed into
   6506           i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
   6508      To update applications using SSL_CTX_set_cert_verify_callback(),
   6509      a dummy argument can be added to their callback functions.
   6510      [D. K. Smetters <smetters (a] parc.xerox.com>]
   6512   *) Added the '4758cca' ENGINE to support IBM 4758 cards.
   6513      [Maurice Gittens <maurice (a] gittens.nl>, touchups by Geoff Thorpe]
   6515   *) Add and OPENSSL_LOAD_CONF define which will cause
   6516      OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
   6517      This allows older applications to transparently support certain
   6518      OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
   6519      Two new functions OPENSSL_add_all_algorithms_noconf() which will never
   6520      load the config file and OPENSSL_add_all_algorithms_conf() which will
   6521      always load it have also been added.
   6522      [Steve Henson]
   6524   *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
   6525      Adjust NIDs and EVP layer.
   6526      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   6528   *) Config modules support in openssl utility.
   6530      Most commands now load modules from the config file,
   6531      though in a few (such as version) this isn't done 
   6532      because it couldn't be used for anything.
   6534      In the case of ca and req the config file used is
   6535      the same as the utility itself: that is the -config
   6536      command line option can be used to specify an
   6537      alternative file.
   6538      [Steve Henson]
   6540   *) Move default behaviour from OPENSSL_config(). If appname is NULL
   6541      use "openssl_conf" if filename is NULL use default openssl config file.
   6542      [Steve Henson]
   6544   *) Add an argument to OPENSSL_config() to allow the use of an alternative
   6545      config section name. Add a new flag to tolerate a missing config file
   6546      and move code to CONF_modules_load_file().
   6547      [Steve Henson]
   6549   *) Support for crypto accelerator cards from Accelerated Encryption
   6550      Processing, www.aep.ie.  (Use engine 'aep')
   6551      The support was copied from 0.9.6c [engine] and adapted/corrected
   6552      to work with the new engine framework.
   6553      [AEP Inc. and Richard Levitte]
   6555   *) Support for SureWare crypto accelerator cards from Baltimore
   6556      Technologies.  (Use engine 'sureware')
   6557      The support was copied from 0.9.6c [engine] and adapted
   6558      to work with the new engine framework.
   6559      [Richard Levitte]
   6561   *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
   6562      make the newer ENGINE framework commands for the CHIL engine work.
   6563      [Toomas Kiisk <vix (a] cyber.ee> and Richard Levitte]
   6565   *) Make it possible to produce shared libraries on ReliantUNIX.
   6566      [Robert Dahlem <Robert.Dahlem (a] ffm2.siemens.de> via Richard Levitte]
   6568   *) Add the configuration target debug-linux-ppro.
   6569      Make 'openssl rsa' use the general key loading routines
   6570      implemented in apps.c, and make those routines able to
   6571      handle the key format FORMAT_NETSCAPE and the variant
   6572      FORMAT_IISSGC.
   6573      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   6575  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   6576      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   6578   *) Add -keyform to rsautl, and document -engine.
   6579      [Richard Levitte, inspired by Toomas Kiisk <vix (a] cyber.ee>]
   6581   *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
   6582      BIO_R_NO_SUCH_FILE error code rather than the generic
   6583      ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
   6584      [Ben Laurie]
   6586   *) Add new functions
   6587           ERR_peek_last_error
   6588           ERR_peek_last_error_line
   6589           ERR_peek_last_error_line_data.
   6590      These are similar to
   6591           ERR_peek_error
   6592           ERR_peek_error_line
   6593           ERR_peek_error_line_data,
   6594      but report on the latest error recorded rather than the first one
   6595      still in the error queue.
   6596      [Ben Laurie, Bodo Moeller]
   6598   *) default_algorithms option in ENGINE config module. This allows things
   6599      like:
   6600      default_algorithms = ALL
   6601      default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
   6602      [Steve Henson]
   6604   *) Preliminary ENGINE config module.
   6605      [Steve Henson]
   6607   *) New experimental application configuration code.
   6608      [Steve Henson]
   6610   *) Change the AES code to follow the same name structure as all other
   6611      symmetric ciphers, and behave the same way.  Move everything to
   6612      the directory crypto/aes, thereby obsoleting crypto/rijndael.
   6613      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   6615   *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
   6616      [Ben Laurie and Theo de Raadt]
   6618   *) Add option to output public keys in req command.
   6619      [Massimiliano Pala madwolf (a] openca.org]
   6621   *) Use wNAFs in EC_POINTs_mul() for improved efficiency
   6622      (up to about 10% better than before for P-192 and P-224).
   6623      [Bodo Moeller]
   6625   *) New functions/macros
   6627           SSL_CTX_set_msg_callback(ctx, cb)
   6628           SSL_CTX_set_msg_callback_arg(ctx, arg)
   6629           SSL_set_msg_callback(ssl, cb)
   6630           SSL_set_msg_callback_arg(ssl, arg)
   6632      to request calling a callback function
   6634           void cb(int write_p, int version, int content_type,
   6635                   const void *buf, size_t len, SSL *ssl, void *arg)
   6637      whenever a protocol message has been completely received
   6638      (write_p == 0) or sent (write_p == 1).  Here 'version' is the
   6639      protocol version  according to which the SSL library interprets
   6640      the current protocol message (SSL2_VERSION, SSL3_VERSION, or
   6641      TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
   6642      the content type as defined in the SSL 3.0/TLS 1.0 protocol
   6643      specification (change_cipher_spec(20), alert(21), handshake(22)).
   6644      'buf' and 'len' point to the actual message, 'ssl' to the
   6645      SSL object, and 'arg' is the application-defined value set by
   6646      SSL[_CTX]_set_msg_callback_arg().
   6648      'openssl s_client' and 'openssl s_server' have new '-msg' options
   6649      to enable a callback that displays all protocol messages.
   6650      [Bodo Moeller]
   6652   *) Change the shared library support so shared libraries are built as
   6653      soon as the corresponding static library is finished, and thereby get
   6654      openssl and the test programs linked against the shared library.
   6655      This still only happens when the keyword "shard" has been given to
   6656      the configuration scripts.
   6658      NOTE: shared library support is still an experimental thing, and
   6659      backward binary compatibility is still not guaranteed.
   6660      ["Maciej W. Rozycki" <macro (a] ds2.pg.gda.pl> and Richard Levitte]
   6662   *) Add support for Subject Information Access extension.
   6663      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   6665   *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
   6666      additional bytes when new memory had to be allocated, not just
   6667      when reusing an existing buffer.
   6668      [Bodo Moeller]
   6670   *) New command line and configuration option 'utf8' for the req command.
   6671      This allows field values to be specified as UTF8 strings.
   6672      [Steve Henson]
   6674   *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
   6675      runs for the former and machine-readable output for the latter.
   6676      [Ben Laurie]
   6678   *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
   6679      of the e-mail address in the DN (i.e., it will go into a certificate
   6680      extension only).  The new configuration file option 'email_in_dn = no'
   6681      has the same effect.
   6682      [Massimiliano Pala madwolf (a] openca.org]
   6684   *) Change all functions with names starting with des_ to be starting
   6685      with DES_ instead.  Add wrappers that are compatible with libdes,
   6686      but are named _ossl_old_des_*.  Finally, add macros that map the
   6687      des_* symbols to the corresponding _ossl_old_des_* if libdes
   6688      compatibility is desired.  If OpenSSL 0.9.6c compatibility is
   6689      desired, the des_* symbols will be mapped to DES_*, with one
   6690      exception.
   6692      Since we provide two compatibility mappings, the user needs to
   6693      define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
   6694      compatibility is desired.  The default (i.e., when that macro
   6695      isn't defined) is OpenSSL 0.9.6c compatibility.
   6697      There are also macros that enable and disable the support of old
   6698      des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
   6699      and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
   6700      are defined, the default will apply: to support the old des routines.
   6702      In either case, one must include openssl/des.h to get the correct
   6703      definitions.  Do not try to just include openssl/des_old.h, that
   6704      won't work.
   6706      NOTE: This is a major break of an old API into a new one.  Software
   6707      authors are encouraged to switch to the DES_ style functions.  Some
   6708      time in the future, des_old.h and the libdes compatibility functions
   6709      will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
   6710      default), and then completely removed.
   6711      [Richard Levitte]
   6713   *) Test for certificates which contain unsupported critical extensions.
   6714      If such a certificate is found during a verify operation it is 
   6715      rejected by default: this behaviour can be overridden by either
   6716      handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
   6717      by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
   6718      X509_supported_extension() has also been added which returns 1 if a
   6719      particular extension is supported.
   6720      [Steve Henson]
   6722   *) Modify the behaviour of EVP cipher functions in similar way to digests
   6723      to retain compatibility with existing code.
   6724      [Steve Henson]
   6726   *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
   6727      compatibility with existing code. In particular the 'ctx' parameter does
   6728      not have to be to be initialized before the call to EVP_DigestInit() and
   6729      it is tidied up after a call to EVP_DigestFinal(). New function
   6730      EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
   6731      EVP_MD_CTX_copy() changed to not require the destination to be
   6732      initialized valid and new function EVP_MD_CTX_copy_ex() added which
   6733      requires the destination to be valid.
   6735      Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
   6736      EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
   6737      [Steve Henson]
   6739   *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
   6740      so that complete 'Handshake' protocol structures are kept in memory
   6741      instead of overwriting 'msg_type' and 'length' with 'body' data.
   6742      [Bodo Moeller]
   6744   *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
   6745      [Massimo Santin via Richard Levitte]
   6747   *) Major restructuring to the underlying ENGINE code. This includes
   6748      reduction of linker bloat, separation of pure "ENGINE" manipulation
   6749      (initialisation, etc) from functionality dealing with implementations
   6750      of specific crypto iterfaces. This change also introduces integrated
   6751      support for symmetric ciphers and digest implementations - so ENGINEs
   6752      can now accelerate these by providing EVP_CIPHER and EVP_MD
   6753      implementations of their own. This is detailed in crypto/engine/README
   6754      as it couldn't be adequately described here. However, there are a few
   6755      API changes worth noting - some RSA, DSA, DH, and RAND functions that
   6756      were changed in the original introduction of ENGINE code have now
   6757      reverted back - the hooking from this code to ENGINE is now a good
   6758      deal more passive and at run-time, operations deal directly with
   6759      RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
   6760      dereferencing through an ENGINE pointer any more. Also, the ENGINE
   6761      functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
   6762      they were not being used by the framework as there is no concept of a
   6763      BIGNUM_METHOD and they could not be generalised to the new
   6764      'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
   6765      ENGINE_cpy() has been removed as it cannot be consistently defined in
   6766      the new code.
   6767      [Geoff Thorpe]
   6769   *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
   6770      [Steve Henson]
   6772   *) Change mkdef.pl to sort symbols that get the same entry number,
   6773      and make sure the automatically generated functions ERR_load_*
   6774      become part of libeay.num as well.
   6775      [Richard Levitte]
   6777   *) New function SSL_renegotiate_pending().  This returns true once
   6778      renegotiation has been requested (either SSL_renegotiate() call
   6779      or HelloRequest/ClientHello received from the peer) and becomes
   6780      false once a handshake has been completed.
   6781      (For servers, SSL_renegotiate() followed by SSL_do_handshake()
   6782      sends a HelloRequest, but does not ensure that a handshake takes
   6783      place.  SSL_renegotiate_pending() is useful for checking if the
   6784      client has followed the request.)
   6785      [Bodo Moeller]
   6788      By default, clients may request session resumption even during
   6789      renegotiation (if session ID contexts permit); with this option,
   6790      session resumption is possible only in the first handshake.
   6792      SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
   6793      more bits available for options that should not be part of
   6795      [Bodo Moeller]
   6797   *) Add some demos for certificate and certificate request creation.
   6798      [Steve Henson]
   6800   *) Make maximum certificate chain size accepted from the peer application
   6801      settable (SSL*_get/set_max_cert_list()), as proposed by
   6802      "Douglas E. Engert" <deengert (a] anl.gov>.
   6803      [Lutz Jaenicke]
   6805   *) Add support for shared libraries for Unixware-7
   6806      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   6807      [Lutz Jaenicke]
   6809   *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
   6810      be done prior to destruction. Use this to unload error strings from
   6811      ENGINEs that load their own error strings. NB: This adds two new API
   6812      functions to "get" and "set" this destroy handler in an ENGINE.
   6813      [Geoff Thorpe]
   6815   *) Alter all existing ENGINE implementations (except "openssl" and
   6816      "openbsd") to dynamically instantiate their own error strings. This
   6817      makes them more flexible to be built both as statically-linked ENGINEs
   6818      and self-contained shared-libraries loadable via the "dynamic" ENGINE.
   6819      Also, add stub code to each that makes building them as self-contained
   6820      shared-libraries easier (see README.ENGINE).
   6821      [Geoff Thorpe]
   6823   *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
   6824      implementations into applications that are completely implemented in
   6825      self-contained shared-libraries. The "dynamic" ENGINE exposes control
   6826      commands that can be used to configure what shared-library to load and
   6827      to control aspects of the way it is handled. Also, made an update to
   6828      the README.ENGINE file that brings its information up-to-date and
   6829      provides some information and instructions on the "dynamic" ENGINE
   6830      (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
   6831      [Geoff Thorpe]
   6833   *) Make it possible to unload ranges of ERR strings with a new
   6834      "ERR_unload_strings" function.
   6835      [Geoff Thorpe]
   6837   *) Add a copy() function to EVP_MD.
   6838      [Ben Laurie]
   6840   *) Make EVP_MD routines take a context pointer instead of just the
   6841      md_data void pointer.
   6842      [Ben Laurie]
   6844   *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
   6845      that the digest can only process a single chunk of data
   6846      (typically because it is provided by a piece of
   6847      hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
   6848      is only going to provide a single chunk of data, and hence the
   6849      framework needn't accumulate the data for oneshot drivers.
   6850      [Ben Laurie]
   6852   *) As with "ERR", make it possible to replace the underlying "ex_data"
   6853      functions. This change also alters the storage and management of global
   6854      ex_data state - it's now all inside ex_data.c and all "class" code (eg.
   6855      RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
   6856      index counters. The API functions that use this state have been changed
   6857      to take a "class_index" rather than pointers to the class's local STACK
   6858      and counter, and there is now an API function to dynamically create new
   6859      classes. This centralisation allows us to (a) plug a lot of the
   6860      thread-safety problems that existed, and (b) makes it possible to clean
   6861      up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
   6862      such data would previously have always leaked in application code and
   6863      workarounds were in place to make the memory debugging turn a blind eye
   6864      to it. Application code that doesn't use this new function will still
   6865      leak as before, but their memory debugging output will announce it now
   6866      rather than letting it slide.
   6868      Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
   6869      induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
   6870      has a return value to indicate success or failure.
   6871      [Geoff Thorpe]
   6873   *) Make it possible to replace the underlying "ERR" functions such that the
   6874      global state (2 LHASH tables and 2 locks) is only used by the "default"
   6875      implementation. This change also adds two functions to "get" and "set"
   6876      the implementation prior to it being automatically set the first time
   6877      any other ERR function takes place. Ie. an application can call "get",
   6878      pass the return value to a module it has just loaded, and that module
   6879      can call its own "set" function using that value. This means the
   6880      module's "ERR" operations will use (and modify) the error state in the
   6881      application and not in its own statically linked copy of OpenSSL code.
   6882      [Geoff Thorpe]
   6884   *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
   6885      reference counts. This performs normal REF_PRINT/REF_CHECK macros on
   6886      the operation, and provides a more encapsulated way for external code
   6887      (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
   6888      to use these functions rather than manually incrementing the counts.
   6890      Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
   6891      [Geoff Thorpe]
   6893   *) Add EVP test program.
   6894      [Ben Laurie]
   6896   *) Add symmetric cipher support to ENGINE. Expect the API to change!
   6897      [Ben Laurie]
   6899   *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
   6900      X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
   6901      X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
   6902      These allow a CRL to be built without having to access X509_CRL fields
   6903      directly. Modify 'ca' application to use new functions.
   6904      [Steve Henson]
   6906   *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
   6907      bug workarounds. Rollback attack detection is a security feature.
   6908      The problem will only arise on OpenSSL servers when TLSv1 is not
   6909      available (sslv3_server_method() or SSL_OP_NO_TLSv1).
   6910      Software authors not wanting to support TLSv1 will have special reasons
   6911      for their choice and can explicitly enable this option.
   6912      [Bodo Moeller, Lutz Jaenicke]
   6914   *) Rationalise EVP so it can be extended: don't include a union of
   6915      cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
   6916      (similar to those existing for EVP_CIPHER_CTX).
   6917      Usage example:
   6919          EVP_MD_CTX md;
   6921          EVP_MD_CTX_init(&md);             /* new function call */
   6922          EVP_DigestInit(&md, EVP_sha1());
   6923          EVP_DigestUpdate(&md, in, len);
   6924          EVP_DigestFinal(&md, out, NULL);
   6925          EVP_MD_CTX_cleanup(&md);          /* new function call */
   6927      [Ben Laurie]
   6929   *) Make DES key schedule conform to the usual scheme, as well as
   6930      correcting its structure. This means that calls to DES functions
   6931      now have to pass a pointer to a des_key_schedule instead of a
   6932      plain des_key_schedule (which was actually always a pointer
   6933      anyway): E.g.,
   6935          des_key_schedule ks;
   6937 	 des_set_key_checked(..., &ks);
   6938 	 des_ncbc_encrypt(..., &ks, ...);
   6940      (Note that a later change renames 'des_...' into 'DES_...'.)
   6941      [Ben Laurie]
   6943   *) Initial reduction of linker bloat: the use of some functions, such as
   6944      PEM causes large amounts of unused functions to be linked in due to
   6945      poor organisation. For example pem_all.c contains every PEM function
   6946      which has a knock on effect of linking in large amounts of (unused)
   6947      ASN1 code. Grouping together similar functions and splitting unrelated
   6948      functions prevents this.
   6949      [Steve Henson]
   6951   *) Cleanup of EVP macros.
   6952      [Ben Laurie]
   6954   *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
   6955      correct _ecb suffix.
   6956      [Ben Laurie]
   6958   *) Add initial OCSP responder support to ocsp application. The
   6959      revocation information is handled using the text based index
   6960      use by the ca application. The responder can either handle
   6961      requests generated internally, supplied in files (for example
   6962      via a CGI script) or using an internal minimal server.
   6963      [Steve Henson]
   6965   *) Add configuration choices to get zlib compression for TLS.
   6966      [Richard Levitte]
   6968   *) Changes to Kerberos SSL for RFC 2712 compliance:
   6969      1.  Implemented real KerberosWrapper, instead of just using
   6970          KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw (a] sxw.org.uk>]
   6971      2.  Implemented optional authenticator field of KerberosWrapper.
   6973      Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
   6974      and authenticator structs; see crypto/krb5/.
   6976      Generalized Kerberos calls to support multiple Kerberos libraries.
   6977      [Vern Staats <staatsvr (a] asc.hpc.mil>,
   6978       Jeffrey Altman <jaltman (a] columbia.edu>
   6979       via Richard Levitte]
   6981   *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
   6982      already does with RSA. testdsa.h now has 'priv_key/pub_key'
   6983      values for each of the key sizes rather than having just
   6984      parameters (and 'speed' generating keys each time).
   6985      [Geoff Thorpe]
   6987   *) Speed up EVP routines.
   6988      Before:
   6989 encrypt
   6990 type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
   6991 des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
   6992 des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
   6993 des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
   6994 decrypt
   6995 des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
   6996 des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
   6997 des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
   6998      After:
   6999 encrypt
   7000 des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
   7001 decrypt
   7002 des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   7003      [Ben Laurie]
   7005   *) Added the OS2-EMX target.
   7006      ["Brian Havard" <brianh (a] kheldar.apana.org.au> and Richard Levitte]
   7008   *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
   7009      to support NCONF routines in extension code. New function CONF_set_nconf()
   7010      to allow functions which take an NCONF to also handle the old LHASH
   7011      structure: this means that the old CONF compatible routines can be
   7012      retained (in particular wrt extensions) without having to duplicate the
   7013      code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
   7014      [Steve Henson]
   7016   *) Enhance the general user interface with mechanisms for inner control
   7017      and with possibilities to have yes/no kind of prompts.
   7018      [Richard Levitte]
   7020   *) Change all calls to low level digest routines in the library and
   7021      applications to use EVP. Add missing calls to HMAC_cleanup() and
   7022      don't assume HMAC_CTX can be copied using memcpy().
   7023      [Verdon Walker <VWalker (a] novell.com>, Steve Henson]
   7025   *) Add the possibility to control engines through control names but with
   7026      arbitrary arguments instead of just a string.
   7027      Change the key loaders to take a UI_METHOD instead of a callback
   7028      function pointer.  NOTE: this breaks binary compatibility with earlier
   7029      versions of OpenSSL [engine].
   7030      Adapt the nCipher code for these new conditions and add a card insertion
   7031      callback.
   7032      [Richard Levitte]
   7034   *) Enhance the general user interface with mechanisms to better support
   7035      dialog box interfaces, application-defined prompts, the possibility
   7036      to use defaults (for example default passwords from somewhere else)
   7037      and interrupts/cancellations.
   7038      [Richard Levitte]
   7040   *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
   7041      attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
   7042      [Steve Henson]
   7044   *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
   7045      tidy up some unnecessarily weird code in 'sk_new()').
   7046      [Geoff, reported by Diego Tartara <dtartara (a] novamens.com>]
   7048   *) Change the key loading routines for ENGINEs to use the same kind
   7049      callback (pem_password_cb) as all other routines that need this
   7050      kind of callback.
   7051      [Richard Levitte]
   7053   *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
   7054      256 bit (=32 byte) keys. Of course seeding with more entropy bytes
   7055      than this minimum value is recommended.
   7056      [Lutz Jaenicke]
   7058   *) New random seeder for OpenVMS, using the system process statistics
   7059      that are easily reachable.
   7060      [Richard Levitte]
   7062   *) Windows apparently can't transparently handle global
   7063      variables defined in DLLs. Initialisations such as:
   7065         const ASN1_ITEM *it = &ASN1_INTEGER_it;
   7067      won't compile. This is used by the any applications that need to
   7068      declare their own ASN1 modules. This was fixed by adding the option
   7069      EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
   7070      needed for static libraries under Win32.
   7071      [Steve Henson]
   7073   *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
   7074      setting of purpose and trust fields. New X509_STORE trust and
   7075      purpose functions and tidy up setting in other SSL functions.
   7076      [Steve Henson]
   7078   *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
   7079      structure. These are inherited by X509_STORE_CTX when it is 
   7080      initialised. This allows various defaults to be set in the
   7081      X509_STORE structure (such as flags for CRL checking and custom
   7082      purpose or trust settings) for functions which only use X509_STORE_CTX
   7083      internally such as S/MIME.
   7085      Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
   7086      trust settings if they are not set in X509_STORE. This allows X509_STORE
   7087      purposes and trust (in S/MIME for example) to override any set by default.
   7089      Add command line options for CRL checking to smime, s_client and s_server
   7090      applications.
   7091      [Steve Henson]
   7093   *) Initial CRL based revocation checking. If the CRL checking flag(s)
   7094      are set then the CRL is looked up in the X509_STORE structure and
   7095      its validity and signature checked, then if the certificate is found
   7096      in the CRL the verify fails with a revoked error.
   7098      Various new CRL related callbacks added to X509_STORE_CTX structure.
   7100      Command line options added to 'verify' application to support this.
   7102      This needs some additional work, such as being able to handle multiple
   7103      CRLs with different times, extension based lookup (rather than just
   7104      by subject name) and ultimately more complete V2 CRL extension
   7105      handling.
   7106      [Steve Henson]
   7108   *) Add a general user interface API (crypto/ui/).  This is designed
   7109      to replace things like des_read_password and friends (backward
   7110      compatibility functions using this new API are provided).
   7111      The purpose is to remove prompting functions from the DES code
   7112      section as well as provide for prompting through dialog boxes in
   7113      a window system and the like.
   7114      [Richard Levitte]
   7116   *) Add "ex_data" support to ENGINE so implementations can add state at a
   7117      per-structure level rather than having to store it globally.
   7118      [Geoff]
   7120   *) Make it possible for ENGINE structures to be copied when retrieved by
   7121      ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
   7122      This causes the "original" ENGINE structure to act like a template,
   7123      analogous to the RSA vs. RSA_METHOD type of separation. Because of this
   7124      operational state can be localised to each ENGINE structure, despite the
   7125      fact they all share the same "methods". New ENGINE structures returned in
   7126      this case have no functional references and the return value is the single
   7127      structural reference. This matches the single structural reference returned
   7128      by ENGINE_by_id() normally, when it is incremented on the pre-existing
   7129      ENGINE structure.
   7130      [Geoff]
   7132   *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
   7133      needs to match any other type at all we need to manually clear the
   7134      tag cache.
   7135      [Steve Henson]
   7137   *) Changes to the "openssl engine" utility to include;
   7138      - verbosity levels ('-v', '-vv', and '-vvv') that provide information
   7139        about an ENGINE's available control commands.
   7140      - executing control commands from command line arguments using the
   7141        '-pre' and '-post' switches. '-post' is only used if '-t' is
   7142        specified and the ENGINE is successfully initialised. The syntax for
   7143        the individual commands are colon-separated, for example;
   7144 	 openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
   7145      [Geoff]
   7147   *) New dynamic control command support for ENGINEs. ENGINEs can now
   7148      declare their own commands (numbers), names (strings), descriptions,
   7149      and input types for run-time discovery by calling applications. A
   7150      subset of these commands are implicitly classed as "executable"
   7151      depending on their input type, and only these can be invoked through
   7152      the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
   7153      can be based on user input, config files, etc). The distinction is
   7154      that "executable" commands cannot return anything other than a boolean
   7155      result and can only support numeric or string input, whereas some
   7156      discoverable commands may only be for direct use through
   7157      ENGINE_ctrl(), eg. supporting the exchange of binary data, function
   7158      pointers, or other custom uses. The "executable" commands are to
   7159      support parameterisations of ENGINE behaviour that can be
   7160      unambiguously defined by ENGINEs and used consistently across any
   7161      OpenSSL-based application. Commands have been added to all the
   7162      existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
   7163      control over shared-library paths without source code alterations.
   7164      [Geoff]
   7166   *) Changed all ENGINE implementations to dynamically allocate their
   7167      ENGINEs rather than declaring them statically. Apart from this being
   7168      necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
   7169      this also allows the implementations to compile without using the
   7170      internal engine_int.h header.
   7171      [Geoff]
   7173   *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
   7174      'const' value. Any code that should be able to modify a RAND_METHOD
   7175      should already have non-const pointers to it (ie. they should only
   7176      modify their own ones).
   7177      [Geoff]
   7179   *) Made a variety of little tweaks to the ENGINE code.
   7180      - "atalla" and "ubsec" string definitions were moved from header files
   7181        to C code. "nuron" string definitions were placed in variables
   7182        rather than hard-coded - allowing parameterisation of these values
   7183        later on via ctrl() commands.
   7184      - Removed unused "#if 0"'d code.
   7185      - Fixed engine list iteration code so it uses ENGINE_free() to release
   7186        structural references.
   7187      - Constified the RAND_METHOD element of ENGINE structures.
   7188      - Constified various get/set functions as appropriate and added
   7189        missing functions (including a catch-all ENGINE_cpy that duplicates
   7190        all ENGINE values onto a new ENGINE except reference counts/state).
   7191      - Removed NULL parameter checks in get/set functions. Setting a method
   7192        or function to NULL is a way of cancelling out a previously set
   7193        value.  Passing a NULL ENGINE parameter is just plain stupid anyway
   7194        and doesn't justify the extra error symbols and code.
   7195      - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
   7196        flags from engine_int.h to engine.h.
   7197      - Changed prototypes for ENGINE handler functions (init(), finish(),
   7198        ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
   7199      [Geoff]
   7201   *) Implement binary inversion algorithm for BN_mod_inverse in addition
   7202      to the algorithm using long division.  The binary algorithm can be
   7203      used only if the modulus is odd.  On 32-bit systems, it is faster
   7204      only for relatively small moduli (roughly 20-30% for 128-bit moduli,
   7205      roughly 5-15% for 256-bit moduli), so we use it only for moduli
   7206      up to 450 bits.  In 64-bit environments, the binary algorithm
   7207      appears to be advantageous for much longer moduli; here we use it
   7208      for moduli up to 2048 bits.
   7209      [Bodo Moeller]
   7211   *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
   7212      could not support the combine flag in choice fields.
   7213      [Steve Henson]
   7215   *) Add a 'copy_extensions' option to the 'ca' utility. This copies
   7216      extensions from a certificate request to the certificate.
   7217      [Steve Henson]
   7219   *) Allow multiple 'certopt' and 'nameopt' options to be separated
   7220      by commas. Add 'namopt' and 'certopt' options to the 'ca' config
   7221      file: this allows the display of the certificate about to be
   7222      signed to be customised, to allow certain fields to be included
   7223      or excluded and extension details. The old system didn't display
   7224      multicharacter strings properly, omitted fields not in the policy
   7225      and couldn't display additional details such as extensions.
   7226      [Steve Henson]
   7228   *) Function EC_POINTs_mul for multiple scalar multiplication
   7229      of an arbitrary number of elliptic curve points
   7230           \sum scalars[i]*points[i],
   7231      optionally including the generator defined for the EC_GROUP:
   7232           scalar*generator +  \sum scalars[i]*points[i].
   7234      EC_POINT_mul is a simple wrapper function for the typical case
   7235      that the point list has just one item (besides the optional
   7236      generator).
   7237      [Bodo Moeller]
   7239   *) First EC_METHODs for curves over GF(p):
   7241      EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
   7242      operations and provides various method functions that can also
   7243      operate with faster implementations of modular arithmetic.     
   7245      EC_GFp_mont_method() reuses most functions that are part of
   7246      EC_GFp_simple_method, but uses Montgomery arithmetic.
   7248      [Bodo Moeller; point addition and point doubling
   7249      implementation directly derived from source code provided by
   7250      Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>]
   7252   *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
   7253      crypto/ec/ec_lib.c):
   7255      Curves are EC_GROUP objects (with an optional group generator)
   7256      based on EC_METHODs that are built into the library.
   7258      Points are EC_POINT objects based on EC_GROUP objects.
   7260      Most of the framework would be able to handle curves over arbitrary
   7261      finite fields, but as there are no obvious types for fields other
   7262      than GF(p), some functions are limited to that for now.
   7263      [Bodo Moeller]
   7265   *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
   7266      that the file contains a complete HTTP response.
   7267      [Richard Levitte]
   7269   *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
   7270      change the def and num file printf format specifier from "%-40sXXX"
   7271      to "%-39s XXX". The latter will always guarantee a space after the
   7272      field while the former will cause them to run together if the field
   7273      is 40 of more characters long.
   7274      [Steve Henson]
   7276   *) Constify the cipher and digest 'method' functions and structures
   7277      and modify related functions to take constant EVP_MD and EVP_CIPHER
   7278      pointers.
   7279      [Steve Henson]
   7281   *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
   7282      in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
   7283      [Bodo Moeller]
   7285   *) Modify EVP_Digest*() routines so they now return values. Although the
   7286      internal software routines can never fail additional hardware versions
   7287      might.
   7288      [Steve Henson]
   7290   *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
   7292      Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
   7293      (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
   7295      ASN1 error codes
   7296           ERR_R_NESTED_ASN1_ERROR
   7297           ...
   7298           ERR_R_MISSING_ASN1_EOS
   7299      were 4 .. 9, conflicting with
   7300           ERR_LIB_RSA (= ERR_R_RSA_LIB)
   7301           ...
   7302           ERR_LIB_PEM (= ERR_R_PEM_LIB).
   7303      They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
   7305      Add new error code 'ERR_R_INTERNAL_ERROR'.
   7306      [Bodo Moeller]
   7308   *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
   7309      suffices.
   7310      [Bodo Moeller]
   7312   *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
   7313      sets the subject name for a new request or supersedes the
   7314      subject name in a given request. Formats that can be parsed are
   7315           'CN=Some Name, OU=myOU, C=IT'
   7316      and
   7317           'CN=Some Name/OU=myOU/C=IT'.
   7319      Add options '-batch' and '-verbose' to 'openssl req'.
   7320      [Massimiliano Pala <madwolf (a] hackmasters.net>]
   7322   *) Introduce the possibility to access global variables through
   7323      functions on platform were that's the best way to handle exporting
   7324      global variables in shared libraries.  To enable this functionality,
   7325      one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
   7326      "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
   7327      is normally done by Configure or something similar).
   7329      To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
   7330      in the source file (foo.c) like this:
   7332 	OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
   7333 	OPENSSL_IMPLEMENT_GLOBAL(double,bar);
   7335      To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
   7336      and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
   7338 	OPENSSL_DECLARE_GLOBAL(int,foo);
   7339 	#define foo OPENSSL_GLOBAL_REF(foo)
   7340 	OPENSSL_DECLARE_GLOBAL(double,bar);
   7341 	#define bar OPENSSL_GLOBAL_REF(bar)
   7343      The #defines are very important, and therefore so is including the
   7344      header file everywhere where the defined globals are used.
   7346      The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
   7347      of ASN.1 items, but that structure is a bit different.
   7349      The largest change is in util/mkdef.pl which has been enhanced with
   7350      better and easier to understand logic to choose which symbols should
   7351      go into the Windows .def files as well as a number of fixes and code
   7352      cleanup (among others, algorithm keywords are now sorted
   7353      lexicographically to avoid constant rewrites).
   7354      [Richard Levitte]
   7356   *) In BN_div() keep a copy of the sign of 'num' before writing the
   7357      result to 'rm' because if rm==num the value will be overwritten
   7358      and produce the wrong result if 'num' is negative: this caused
   7359      problems with BN_mod() and BN_nnmod().
   7360      [Steve Henson]
   7362   *) Function OCSP_request_verify(). This checks the signature on an
   7363      OCSP request and verifies the signer certificate. The signer
   7364      certificate is just checked for a generic purpose and OCSP request
   7365      trust settings.
   7366      [Steve Henson]
   7368   *) Add OCSP_check_validity() function to check the validity of OCSP
   7369      responses. OCSP responses are prepared in real time and may only
   7370      be a few seconds old. Simply checking that the current time lies
   7371      between thisUpdate and nextUpdate max reject otherwise valid responses
   7372      caused by either OCSP responder or client clock inaccuracy. Instead
   7373      we allow thisUpdate and nextUpdate to fall within a certain period of
   7374      the current time. The age of the response can also optionally be
   7375      checked. Two new options -validity_period and -status_age added to
   7376      ocsp utility.
   7377      [Steve Henson]
   7379   *) If signature or public key algorithm is unrecognized print out its
   7380      OID rather that just UNKNOWN.
   7381      [Steve Henson]
   7383   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
   7384      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
   7385      ID to be generated from the issuer certificate alone which can then be
   7386      passed to OCSP_id_issuer_cmp().
   7387      [Steve Henson]
   7389   *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
   7390      ASN1 modules to export functions returning ASN1_ITEM pointers
   7391      instead of the ASN1_ITEM structures themselves. This adds several
   7392      new macros which allow the underlying ASN1 function/structure to
   7393      be accessed transparently. As a result code should not use ASN1_ITEM
   7394      references directly (such as &X509_it) but instead use the relevant
   7395      macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
   7396      use of the new ASN1 code on platforms where exporting structures
   7397      is problematical (for example in shared libraries) but exporting
   7398      functions returning pointers to structures is not.
   7399      [Steve Henson]
   7401   *) Add support for overriding the generation of SSL/TLS session IDs.
   7402      These callbacks can be registered either in an SSL_CTX or per SSL.
   7403      The purpose of this is to allow applications to control, if they wish,
   7404      the arbitrary values chosen for use as session IDs, particularly as it
   7405      can be useful for session caching in multiple-server environments. A
   7406      command-line switch for testing this (and any client code that wishes
   7407      to use such a feature) has been added to "s_server".
   7408      [Geoff Thorpe, Lutz Jaenicke]
   7410   *) Modify mkdef.pl to recognise and parse preprocessor conditionals
   7411      of the form '#if defined(...) || defined(...) || ...' and
   7412      '#if !defined(...) && !defined(...) && ...'.  This also avoids
   7413      the growing number of special cases it was previously handling.
   7414      [Richard Levitte]
   7416   *) Make all configuration macros available for application by making
   7417      sure they are available in opensslconf.h, by giving them names starting
   7418      with "OPENSSL_" to avoid conflicts with other packages and by making
   7419      sure e_os2.h will cover all platform-specific cases together with
   7420      opensslconf.h.
   7421      Additionally, it is now possible to define configuration/platform-
   7422      specific names (called "system identities").  In the C code, these
   7423      are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
   7424      macro with the name beginning with "OPENSSL_SYS_", which is determined
   7425      from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
   7426      what is available.
   7427      [Richard Levitte]
   7429   *) New option -set_serial to 'req' and 'x509' this allows the serial
   7430      number to use to be specified on the command line. Previously self
   7431      signed certificates were hard coded with serial number 0 and the 
   7432      CA options of 'x509' had to use a serial number in a file which was
   7433      auto incremented.
   7434      [Steve Henson]
   7436   *) New options to 'ca' utility to support V2 CRL entry extensions.
   7437      Currently CRL reason, invalidity date and hold instruction are
   7438      supported. Add new CRL extensions to V3 code and some new objects.
   7439      [Steve Henson]
   7441   *) New function EVP_CIPHER_CTX_set_padding() this is used to
   7442      disable standard block padding (aka PKCS#5 padding) in the EVP
   7443      API, which was previously mandatory. This means that the data is
   7444      not padded in any way and so the total length much be a multiple
   7445      of the block size, otherwise an error occurs.
   7446      [Steve Henson]
   7448   *) Initial (incomplete) OCSP SSL support.
   7449      [Steve Henson]
   7451   *) New function OCSP_parse_url(). This splits up a URL into its host,
   7452      port and path components: primarily to parse OCSP URLs. New -url
   7453      option to ocsp utility.
   7454      [Steve Henson]
   7456   *) New nonce behavior. The return value of OCSP_check_nonce() now 
   7457      reflects the various checks performed. Applications can decide
   7458      whether to tolerate certain situations such as an absent nonce
   7459      in a response when one was present in a request: the ocsp application
   7460      just prints out a warning. New function OCSP_add1_basic_nonce()
   7461      this is to allow responders to include a nonce in a response even if
   7462      the request is nonce-less.
   7463      [Steve Henson]
   7465   *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
   7466      skipped when using openssl x509 multiple times on a single input file,
   7467      e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
   7468      [Bodo Moeller]
   7470   *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
   7471      set string type: to handle setting ASN1_TIME structures. Fix ca
   7472      utility to correctly initialize revocation date of CRLs.
   7473      [Steve Henson]
   7475   *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
   7476      the clients preferred ciphersuites and rather use its own preferences.
   7477      Should help to work around M$ SGC (Server Gated Cryptography) bug in
   7478      Internet Explorer by ensuring unchanged hash method during stepup.
   7479      (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
   7480      [Lutz Jaenicke]
   7482   *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
   7483      to aes and add a new 'exist' option to print out symbols that don't
   7484      appear to exist.
   7485      [Steve Henson]
   7487   *) Additional options to ocsp utility to allow flags to be set and
   7488      additional certificates supplied.
   7489      [Steve Henson]
   7491   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
   7492      OCSP client a number of certificate to only verify the response
   7493      signature against.
   7494      [Richard Levitte]
   7496   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
   7497      handle the new API. Currently only ECB, CBC modes supported. Add new
   7498      AES OIDs.
   7500      Add TLS AES ciphersuites as described in RFC3268, "Advanced
   7501      Encryption Standard (AES) Ciphersuites for Transport Layer
   7502      Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
   7503      not enabled by default and were not part of the "ALL" ciphersuite
   7504      alias because they were not yet official; they could be
   7505      explicitly requested by specifying the "AESdraft" ciphersuite
   7506      group alias.  In the final release of OpenSSL 0.9.7, the group
   7507      alias is called "AES" and is part of "ALL".)
   7508      [Ben Laurie, Steve  Henson, Bodo Moeller]
   7510   *) New function OCSP_copy_nonce() to copy nonce value (if present) from
   7511      request to response.
   7512      [Steve Henson]
   7514   *) Functions for OCSP responders. OCSP_request_onereq_count(),
   7515      OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
   7516      extract information from a certificate request. OCSP_response_create()
   7517      creates a response and optionally adds a basic response structure.
   7518      OCSP_basic_add1_status() adds a complete single response to a basic
   7519      response and returns the OCSP_SINGLERESP structure just added (to allow
   7520      extensions to be included for example). OCSP_basic_add1_cert() adds a
   7521      certificate to a basic response and OCSP_basic_sign() signs a basic
   7522      response with various flags. New helper functions ASN1_TIME_check()
   7523      (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
   7524      (converts ASN1_TIME to GeneralizedTime).
   7525      [Steve Henson]
   7527   *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
   7528      in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
   7529      structure from a certificate. X509_pubkey_digest() digests the public_key
   7530      contents: this is used in various key identifiers. 
   7531      [Steve Henson]
   7533   *) Make sk_sort() tolerate a NULL argument.
   7534      [Steve Henson reported by Massimiliano Pala <madwolf (a] comune.modena.it>]
   7536   *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
   7537      passed by the function are trusted implicitly. If any of them signed the
   7538      response then it is assumed to be valid and is not verified.
   7539      [Steve Henson]
   7541   *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
   7542      to data. This was previously part of the PKCS7 ASN1 code. This
   7543      was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
   7544      [Steve Henson, reported by Kenneth R. Robinette
   7545 				<support (a] securenetterm.com>]
   7547   *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
   7548      routines: without these tracing memory leaks is very painful.
   7549      Fix leaks in PKCS12 and PKCS7 routines.
   7550      [Steve Henson]
   7552   *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
   7553      Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
   7554      effectively meant GeneralizedTime would never be used. Now it
   7555      is initialised to -1 but X509_time_adj() now has to check the value
   7556      and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
   7557      V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
   7558      [Steve Henson, reported by Kenneth R. Robinette
   7559 				<support (a] securenetterm.com>]
   7561   *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
   7562      result in a zero length in the ASN1_INTEGER structure which was
   7563      not consistent with the structure when d2i_ASN1_INTEGER() was used
   7564      and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
   7565      to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
   7566      where it did not print out a minus for negative ASN1_INTEGER.
   7567      [Steve Henson]
   7569   *) Add summary printout to ocsp utility. The various functions which
   7570      convert status values to strings have been renamed to:
   7571      OCSP_response_status_str(), OCSP_cert_status_str() and
   7572      OCSP_crl_reason_str() and are no longer static. New options
   7573      to verify nonce values and to disable verification. OCSP response
   7574      printout format cleaned up.
   7575      [Steve Henson]
   7577   *) Add additional OCSP certificate checks. These are those specified
   7578      in RFC2560. This consists of two separate checks: the CA of the
   7579      certificate being checked must either be the OCSP signer certificate
   7580      or the issuer of the OCSP signer certificate. In the latter case the
   7581      OCSP signer certificate must contain the OCSP signing extended key
   7582      usage. This check is performed by attempting to match the OCSP
   7583      signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
   7584      in the OCSP_CERTID structures of the response.
   7585      [Steve Henson]
   7587   *) Initial OCSP certificate verification added to OCSP_basic_verify()
   7588      and related routines. This uses the standard OpenSSL certificate
   7589      verify routines to perform initial checks (just CA validity) and
   7590      to obtain the certificate chain. Then additional checks will be
   7591      performed on the chain. Currently the root CA is checked to see
   7592      if it is explicitly trusted for OCSP signing. This is used to set
   7593      a root CA as a global signing root: that is any certificate that
   7594      chains to that CA is an acceptable OCSP signing certificate.
   7595      [Steve Henson]
   7597   *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
   7598      extensions from a separate configuration file.
   7599      As when reading extensions from the main configuration file,
   7600      the '-extensions ...' option may be used for specifying the
   7601      section to use.
   7602      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   7604   *) New OCSP utility. Allows OCSP requests to be generated or
   7605      read. The request can be sent to a responder and the output
   7606      parsed, outputed or printed in text form. Not complete yet:
   7607      still needs to check the OCSP response validity.
   7608      [Steve Henson]
   7610   *) New subcommands for 'openssl ca':
   7611      'openssl ca -status <serial>' prints the status of the cert with
   7612      the given serial number (according to the index file).
   7613      'openssl ca -updatedb' updates the expiry status of certificates
   7614      in the index file.
   7615      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   7617   *) New '-newreq-nodes' command option to CA.pl.  This is like
   7618      '-newreq', but calls 'openssl req' with the '-nodes' option
   7619      so that the resulting key is not encrypted.
   7620      [Damien Miller <djm (a] mindrot.org>]
   7622   *) New configuration for the GNU Hurd.
   7623      [Jonathan Bartlett <johnnyb (a] wolfram.com> via Richard Levitte]
   7625   *) Initial code to implement OCSP basic response verify. This
   7626      is currently incomplete. Currently just finds the signer's
   7627      certificate and verifies the signature on the response.
   7628      [Steve Henson]
   7630   *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
   7631      value of OPENSSLDIR.  This is available via the new '-d' option
   7632      to 'openssl version', and is also included in 'openssl version -a'.
   7633      [Bodo Moeller]
   7635   *) Allowing defining memory allocation callbacks that will be given
   7636      file name and line number information in additional arguments
   7637      (a const char* and an int).  The basic functionality remains, as
   7638      well as the original possibility to just replace malloc(),
   7639      realloc() and free() by functions that do not know about these
   7640      additional arguments.  To register and find out the current
   7641      settings for extended allocation functions, the following
   7642      functions are provided:
   7644 	CRYPTO_set_mem_ex_functions
   7645 	CRYPTO_set_locked_mem_ex_functions
   7646 	CRYPTO_get_mem_ex_functions
   7647 	CRYPTO_get_locked_mem_ex_functions
   7649      These work the same way as CRYPTO_set_mem_functions and friends.
   7650      CRYPTO_get_[locked_]mem_functions now writes 0 where such an
   7651      extended allocation function is enabled.
   7652      Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
   7653      a conventional allocation function is enabled.
   7654      [Richard Levitte, Bodo Moeller]
   7656   *) Finish off removing the remaining LHASH function pointer casts.
   7657      There should no longer be any prototype-casting required when using
   7658      the LHASH abstraction, and any casts that remain are "bugs". See
   7659      the callback types and macros at the head of lhash.h for details
   7660      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
   7661      [Geoff Thorpe]
   7663   *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
   7664      If /dev/[u]random devices are not available or do not return enough
   7665      entropy, EGD style sockets (served by EGD or PRNGD) will automatically
   7666      be queried.
   7667      The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
   7668      /etc/entropy will be queried once each in this sequence, querying stops
   7669      when enough entropy was collected without querying more sockets.
   7670      [Lutz Jaenicke]
   7672   *) Change the Unix RAND_poll() variant to be able to poll several
   7673      random devices, as specified by DEVRANDOM, until a sufficient amount
   7674      of data has been collected.   We spend at most 10 ms on each file
   7675      (select timeout) and read in non-blocking mode.  DEVRANDOM now
   7676      defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
   7677      (previously it was just the string "/dev/urandom"), so on typical
   7678      platforms the 10 ms delay will never occur.
   7679      Also separate out the Unix variant to its own file, rand_unix.c.
   7680      For VMS, there's a currently-empty rand_vms.c.
   7681      [Richard Levitte]
   7683   *) Move OCSP client related routines to ocsp_cl.c. These
   7684      provide utility functions which an application needing
   7685      to issue a request to an OCSP responder and analyse the
   7686      response will typically need: as opposed to those which an
   7687      OCSP responder itself would need which will be added later.
   7689      OCSP_request_sign() signs an OCSP request with an API similar
   7690      to PKCS7_sign(). OCSP_response_status() returns status of OCSP
   7691      response. OCSP_response_get1_basic() extracts basic response
   7692      from response. OCSP_resp_find_status(): finds and extracts status
   7693      information from an OCSP_CERTID structure (which will be created
   7694      when the request structure is built). These are built from lower
   7695      level functions which work on OCSP_SINGLERESP structures but
   7696      won't normally be used unless the application wishes to examine
   7697      extensions in the OCSP response for example.
   7699      Replace nonce routines with a pair of functions.
   7700      OCSP_request_add1_nonce() adds a nonce value and optionally
   7701      generates a random value. OCSP_check_nonce() checks the
   7702      validity of the nonce in an OCSP response.
   7703      [Steve Henson]
   7705   *) Change function OCSP_request_add() to OCSP_request_add0_id().
   7706      This doesn't copy the supplied OCSP_CERTID and avoids the
   7707      need to free up the newly created id. Change return type
   7708      to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
   7709      This can then be used to add extensions to the request.
   7710      Deleted OCSP_request_new(), since most of its functionality
   7711      is now in OCSP_REQUEST_new() (and the case insensitive name
   7712      clash) apart from the ability to set the request name which
   7713      will be added elsewhere.
   7714      [Steve Henson]
   7716   *) Update OCSP API. Remove obsolete extensions argument from
   7717      various functions. Extensions are now handled using the new
   7718      OCSP extension code. New simple OCSP HTTP function which 
   7719      can be used to send requests and parse the response.
   7720      [Steve Henson]
   7722   *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
   7723      ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
   7724      uses the special reorder version of SET OF to sort the attributes
   7725      and reorder them to match the encoded order. This resolves a long
   7726      standing problem: a verify on a PKCS7 structure just after signing
   7727      it used to fail because the attribute order did not match the
   7728      encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
   7729      it uses the received order. This is necessary to tolerate some broken
   7730      software that does not order SET OF. This is handled by encoding
   7731      as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
   7732      to produce the required SET OF.
   7733      [Steve Henson]
   7735   *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
   7736      OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
   7737      files to get correct declarations of the ASN.1 item variables.
   7738      [Richard Levitte]
   7740   *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
   7741      PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
   7742      asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
   7743      NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
   7744      New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
   7745      ASN1_ITEM and no wrapper functions.
   7746      [Steve Henson]
   7748   *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
   7749      replace the old function pointer based I/O routines. Change most of
   7750      the *_d2i_bio() and *_d2i_fp() functions to use these.
   7751      [Steve Henson]
   7753   *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
   7754      lines, recognice more "algorithms" that can be deselected, and make
   7755      it complain about algorithm deselection that isn't recognised.
   7756      [Richard Levitte]
   7758   *) New ASN1 functions to handle dup, sign, verify, digest, pack and
   7759      unpack operations in terms of ASN1_ITEM. Modify existing wrappers
   7760      to use new functions. Add NO_ASN1_OLD which can be set to remove
   7761      some old style ASN1 functions: this can be used to determine if old
   7762      code will still work when these eventually go away.
   7763      [Steve Henson]
   7765   *) New extension functions for OCSP structures, these follow the
   7766      same conventions as certificates and CRLs.
   7767      [Steve Henson]
   7769   *) New function X509V3_add1_i2d(). This automatically encodes and
   7770      adds an extension. Its behaviour can be customised with various
   7771      flags to append, replace or delete. Various wrappers added for
   7772      certificates and CRLs.
   7773      [Steve Henson]
   7775   *) Fix to avoid calling the underlying ASN1 print routine when
   7776      an extension cannot be parsed. Correct a typo in the
   7777      OCSP_SERVICELOC extension. Tidy up print OCSP format.
   7778      [Steve Henson]
   7780   *) Make mkdef.pl parse some of the ASN1 macros and add appropriate
   7781      entries for variables.
   7782      [Steve Henson]
   7784   *) Add functionality to apps/openssl.c for detecting locking
   7785      problems: As the program is single-threaded, all we have
   7786      to do is register a locking callback using an array for
   7787      storing which locks are currently held by the program.
   7788      [Bodo Moeller]
   7790   *) Use a lock around the call to CRYPTO_get_ex_new_index() in
   7791      SSL_get_ex_data_X509_STORE_idx(), which is used in
   7792      ssl_verify_cert_chain() and thus can be called at any time
   7793      during TLS/SSL handshakes so that thread-safety is essential.
   7794      Unfortunately, the ex_data design is not at all suited
   7795      for multi-threaded use, so it probably should be abolished.
   7796      [Bodo Moeller]
   7798   *) Added Broadcom "ubsec" ENGINE to OpenSSL.
   7799      [Broadcom, tweaked and integrated by Geoff Thorpe]
   7801   *) Move common extension printing code to new function
   7802      X509V3_print_extensions(). Reorganise OCSP print routines and
   7803      implement some needed OCSP ASN1 functions. Add OCSP extensions.
   7804      [Steve Henson]
   7806   *) New function X509_signature_print() to remove duplication in some
   7807      print routines.
   7808      [Steve Henson]
   7810   *) Add a special meaning when SET OF and SEQUENCE OF flags are both
   7811      set (this was treated exactly the same as SET OF previously). This
   7812      is used to reorder the STACK representing the structure to match the
   7813      encoding. This will be used to get round a problem where a PKCS7
   7814      structure which was signed could not be verified because the STACK
   7815      order did not reflect the encoded order.
   7816      [Steve Henson]
   7818   *) Reimplement the OCSP ASN1 module using the new code.
   7819      [Steve Henson]
   7821   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
   7822      for its ASN1 operations. The old style function pointers still exist
   7823      for now but they will eventually go away.
   7824      [Steve Henson]
   7826   *) Merge in replacement ASN1 code from the ASN1 branch. This almost
   7827      completely replaces the old ASN1 functionality with a table driven
   7828      encoder and decoder which interprets an ASN1_ITEM structure describing
   7829      the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
   7830      largely maintained. Almost all of the old asn1_mac.h macro based ASN1
   7831      has also been converted to the new form.
   7832      [Steve Henson]
   7834   *) Change BN_mod_exp_recp so that negative moduli are tolerated
   7835      (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
   7836      so that BN_mod_exp_mont and BN_mod_exp_mont_word work
   7837      for negative moduli.
   7838      [Bodo Moeller]
   7840   *) Fix BN_uadd and BN_usub: Always return non-negative results instead
   7841      of not touching the result's sign bit.
   7842      [Bodo Moeller]
   7844   *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
   7845      set.
   7846      [Bodo Moeller]
   7848   *) Changed the LHASH code to use prototypes for callbacks, and created
   7849      macros to declare and implement thin (optionally static) functions
   7850      that provide type-safety and avoid function pointer casting for the
   7851      type-specific callbacks.
   7852      [Geoff Thorpe]
   7854   *) Added Kerberos Cipher Suites to be used with TLS, as written in
   7855      RFC 2712.
   7856      [Veers Staats <staatsvr (a] asc.hpc.mil>,
   7857       Jeffrey Altman <jaltman (a] columbia.edu>, via Richard Levitte]
   7859   *) Reformat the FAQ so the different questions and answers can be divided
   7860      in sections depending on the subject.
   7861      [Richard Levitte]
   7863   *) Have the zlib compression code load ZLIB.DLL dynamically under
   7864      Windows.
   7865      [Richard Levitte]
   7867   *) New function BN_mod_sqrt for computing square roots modulo a prime
   7868      (using the probabilistic Tonelli-Shanks algorithm unless
   7869      p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
   7870      be handled deterministically).
   7871      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   7873   *) Make BN_mod_inverse faster by explicitly handling small quotients
   7874      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
   7875      512 bits], about 30% for larger ones [1024 or 2048 bits].)
   7876      [Bodo Moeller]
   7878   *) New function BN_kronecker.
   7879      [Bodo Moeller]
   7881   *) Fix BN_gcd so that it works on negative inputs; the result is
   7882      positive unless both parameters are zero.
   7883      Previously something reasonably close to an infinite loop was
   7884      possible because numbers could be growing instead of shrinking
   7885      in the implementation of Euclid's algorithm.
   7886      [Bodo Moeller]
   7888   *) Fix BN_is_word() and BN_is_one() macros to take into account the
   7889      sign of the number in question.
   7891      Fix BN_is_word(a,w) to work correctly for w == 0.
   7893      The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
   7894      because its test if the absolute value of 'a' equals 'w'.
   7895      Note that BN_abs_is_word does *not* handle w == 0 reliably;
   7896      it exists mostly for use in the implementations of BN_is_zero(),
   7897      BN_is_one(), and BN_is_word().
   7898      [Bodo Moeller]
   7900   *) New function BN_swap.
   7901      [Bodo Moeller]
   7903   *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
   7904      the exponentiation functions are more likely to produce reasonable
   7905      results on negative inputs.
   7906      [Bodo Moeller]
   7908   *) Change BN_mod_mul so that the result is always non-negative.
   7909      Previously, it could be negative if one of the factors was negative;
   7910      I don't think anyone really wanted that behaviour.
   7911      [Bodo Moeller]
   7913   *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
   7914      (except for exponentiation, which stays in crypto/bn/bn_exp.c,
   7915      and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
   7916      and add new functions:
   7918           BN_nnmod
   7919           BN_mod_sqr
   7920           BN_mod_add
   7921           BN_mod_add_quick
   7922           BN_mod_sub
   7923           BN_mod_sub_quick
   7924           BN_mod_lshift1
   7925           BN_mod_lshift1_quick
   7926           BN_mod_lshift
   7927           BN_mod_lshift_quick
   7929      These functions always generate non-negative results.
   7931      BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
   7932      such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
   7934      BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
   7935      BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
   7936      be reduced modulo  m.
   7937      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   7939 #if 0
   7940      The following entry accidentally appeared in the CHANGES file
   7941      distributed with OpenSSL 0.9.7.  The modifications described in
   7942      it do *not* apply to OpenSSL 0.9.7.
   7944   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   7945      was actually never needed) and in BN_mul().  The removal in BN_mul()
   7946      required a small change in bn_mul_part_recursive() and the addition
   7947      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   7948      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   7949      bn_sub_words() and bn_add_words() except they take arrays with
   7950      differing sizes.
   7951      [Richard Levitte]
   7952 #endif
   7954   *) In 'openssl passwd', verify passwords read from the terminal
   7955      unless the '-salt' option is used (which usually means that
   7956      verification would just waste user's time since the resulting
   7957      hash is going to be compared with some given password hash)
   7958      or the new '-noverify' option is used.
   7960      This is an incompatible change, but it does not affect
   7961      non-interactive use of 'openssl passwd' (passwords on the command
   7962      line, '-stdin' option, '-in ...' option) and thus should not
   7963      cause any problems.
   7964      [Bodo Moeller]
   7966   *) Remove all references to RSAref, since there's no more need for it.
   7967      [Richard Levitte]
   7969   *) Make DSO load along a path given through an environment variable
   7970      (SHLIB_PATH) with shl_load().
   7971      [Richard Levitte]
   7973   *) Constify the ENGINE code as a result of BIGNUM constification.
   7974      Also constify the RSA code and most things related to it.  In a
   7975      few places, most notable in the depth of the ASN.1 code, ugly
   7976      casts back to non-const were required (to be solved at a later
   7977      time)
   7978      [Richard Levitte]
   7980   *) Make it so the openssl application has all engines loaded by default.
   7981      [Richard Levitte]
   7983   *) Constify the BIGNUM routines a little more.
   7984      [Richard Levitte]
   7986   *) Add the following functions:
   7988 	ENGINE_load_cswift()
   7989 	ENGINE_load_chil()
   7990 	ENGINE_load_atalla()
   7991 	ENGINE_load_nuron()
   7992 	ENGINE_load_builtin_engines()
   7994      That way, an application can itself choose if external engines that
   7995      are built-in in OpenSSL shall ever be used or not.  The benefit is
   7996      that applications won't have to be linked with libdl or other dso
   7997      libraries unless it's really needed.
   7999      Changed 'openssl engine' to load all engines on demand.
   8000      Changed the engine header files to avoid the duplication of some
   8001      declarations (they differed!).
   8002      [Richard Levitte]
   8004   *) 'openssl engine' can now list capabilities.
   8005      [Richard Levitte]
   8007   *) Better error reporting in 'openssl engine'.
   8008      [Richard Levitte]
   8010   *) Never call load_dh_param(NULL) in s_server.
   8011      [Bodo Moeller]
   8013   *) Add engine application.  It can currently list engines by name and
   8014      identity, and test if they are actually available.
   8015      [Richard Levitte]
   8017   *) Improve RPM specification file by forcing symbolic linking and making
   8018      sure the installed documentation is also owned by root.root.
   8019      [Damien Miller <djm (a] mindrot.org>]
   8021   *) Give the OpenSSL applications more possibilities to make use of
   8022      keys (public as well as private) handled by engines.
   8023      [Richard Levitte]
   8025   *) Add OCSP code that comes from CertCo.
   8026      [Richard Levitte]
   8028   *) Add VMS support for the Rijndael code.
   8029      [Richard Levitte]
   8031   *) Added untested support for Nuron crypto accelerator.
   8032      [Ben Laurie]
   8034   *) Add support for external cryptographic devices.  This code was
   8035      previously distributed separately as the "engine" branch.
   8036      [Geoff Thorpe, Richard Levitte]
   8038   *) Rework the filename-translation in the DSO code. It is now possible to
   8039      have far greater control over how a "name" is turned into a filename
   8040      depending on the operating environment and any oddities about the
   8041      different shared library filenames on each system.
   8042      [Geoff Thorpe]
   8044   *) Support threads on FreeBSD-elf in Configure.
   8045      [Richard Levitte]
   8047   *) Fix for SHA1 assembly problem with MASM: it produces
   8048      warnings about corrupt line number information when assembling
   8049      with debugging information. This is caused by the overlapping
   8050      of two sections.
   8051      [Bernd Matthes <mainbug (a] celocom.de>, Steve Henson]
   8053   *) NCONF changes.
   8054      NCONF_get_number() has no error checking at all.  As a replacement,
   8055      NCONF_get_number_e() is defined (_e for "error checking") and is
   8056      promoted strongly.  The old NCONF_get_number is kept around for
   8057      binary backward compatibility.
   8058      Make it possible for methods to load from something other than a BIO,
   8059      by providing a function pointer that is given a name instead of a BIO.
   8060      For example, this could be used to load configuration data from an
   8061      LDAP server.
   8062      [Richard Levitte]
   8064   *) Fix for non blocking accept BIOs. Added new I/O special reason
   8065      BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
   8066      with non blocking I/O was not possible because no retry code was
   8067      implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
   8068      this case.
   8069      [Steve Henson]
   8071   *) Added the beginnings of Rijndael support.
   8072      [Ben Laurie]
   8074   *) Fix for bug in DirectoryString mask setting. Add support for
   8075      X509_NAME_print_ex() in 'req' and X509_print_ex() function
   8076      to allow certificate printing to more controllable, additional
   8077      'certopt' option to 'x509' to allow new printing options to be
   8078      set.
   8079      [Steve Henson]
   8081   *) Clean old EAY MD5 hack from e_os.h.
   8082      [Richard Levitte]
   8084  Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
   8086   *) Fix null-pointer assignment in do_change_cipher_spec() revealed
   8087      by using the Codenomicon TLS Test Tool (CVE-2004-0079)
   8088      [Joe Orton, Steve Henson]
   8090  Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
   8092   *) Fix additional bug revealed by the NISCC test suite:
   8094      Stop bug triggering large recursion when presented with
   8095      certain ASN.1 tags (CVE-2003-0851)
   8096      [Steve Henson]
   8098  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
   8100   *) Fix various bugs revealed by running the NISCC test suite:
   8102      Stop out of bounds reads in the ASN1 code when presented with
   8103      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   8105      If verify callback ignores invalid public key errors don't try to check
   8106      certificate signature with the NULL public key.
   8108      [Steve Henson]
   8110   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   8111      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   8112      specifications.
   8113      [Steve Henson]
   8115   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   8116      extra data after the compression methods not only for TLS 1.0
   8117      but also for SSL 3.0 (as required by the specification).
   8118      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   8120   *) Change X509_certificate_type() to mark the key as exported/exportable
   8121      when it's 512 *bits* long, not 512 bytes.
   8122      [Richard Levitte]
   8124  Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
   8126   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   8127      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   8128      a protocol version number mismatch like a decryption error
   8129      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   8130      [Bodo Moeller]
   8132   *) Turn on RSA blinding by default in the default implementation
   8133      to avoid a timing attack. Applications that don't want it can call
   8134      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   8135      They would be ill-advised to do so in most cases.
   8136      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   8138   *) Change RSA blinding code so that it works when the PRNG is not
   8139      seeded (in this case, the secret RSA exponent is abused as
   8140      an unpredictable seed -- if it is not unpredictable, there
   8141      is no point in blinding anyway).  Make RSA blinding thread-safe
   8142      by remembering the creator's thread ID in rsa->blinding and
   8143      having all other threads use local one-time blinding factors
   8144      (this requires more computation than sharing rsa->blinding, but
   8145      avoids excessive locking; and if an RSA object is not shared
   8146      between threads, blinding will still be very fast).
   8147      [Bodo Moeller]
   8149  Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
   8151   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   8152      via timing by performing a MAC computation even if incorrrect
   8153      block cipher padding has been found.  This is a countermeasure
   8154      against active attacks where the attacker has to distinguish
   8155      between bad padding and a MAC verification error. (CVE-2003-0078)
   8157      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   8158      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   8159      Martin Vuagnoux (EPFL, Ilion)]
   8161  Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
   8163   *) New function OPENSSL_cleanse(), which is used to cleanse a section of
   8164      memory from it's contents.  This is done with a counter that will
   8165      place alternating values in each byte.  This can be used to solve
   8166      two issues: 1) the removal of calls to memset() by highly optimizing
   8167      compilers, and 2) cleansing with other values than 0, since those can
   8168      be read through on certain media, for example a swap space on disk.
   8169      [Geoff Thorpe]
   8171   *) Bugfix: client side session caching did not work with external caching,
   8172      because the session->cipher setting was not restored when reloading
   8173      from the external cache. This problem was masked, when
   8174      SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
   8175      (Found by Steve Haslam <steve (a] araqnid.ddts.net>.)
   8176      [Lutz Jaenicke]
   8178   *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
   8179      length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
   8180      [Zeev Lieber <zeev-l (a] yahoo.com>]
   8182   *) Undo an undocumented change introduced in 0.9.6e which caused
   8183      repeated calls to OpenSSL_add_all_ciphers() and 
   8184      OpenSSL_add_all_digests() to be ignored, even after calling
   8185      EVP_cleanup().
   8186      [Richard Levitte]
   8188   *) Change the default configuration reader to deal with last line not
   8189      being properly terminated.
   8190      [Richard Levitte]
   8192   *) Change X509_NAME_cmp() so it applies the special rules on handling
   8193      DN values that are of type PrintableString, as well as RDNs of type
   8194      emailAddress where the value has the type ia5String.
   8195      [stefank (a] valicert.com via Richard Levitte]
   8197   *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
   8198      the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
   8199      doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
   8200      the bitwise-OR of the two for use by the majority of applications
   8201      wanting this behaviour, and update the docs. The documented
   8202      behaviour and actual behaviour were inconsistent and had been
   8203      changing anyway, so this is more a bug-fix than a behavioural
   8204      change.
   8205      [Geoff Thorpe, diagnosed by Nadav Har'El]
   8207   *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
   8208      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
   8209      [Bodo Moeller]
   8211   *) Fix initialization code race conditions in
   8212         SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
   8213         SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
   8214         SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
   8215         TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
   8216         ssl2_get_cipher_by_char(),
   8217         ssl3_get_cipher_by_char().
   8218      [Patrick McCormick <patrick (a] tellme.com>, Bodo Moeller]
   8220   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
   8221      the cached sessions are flushed, as the remove_cb() might use ex_data
   8222      contents. Bug found by Sam Varshavchik <mrsam (a] courier-mta.com>
   8223      (see [openssl.org #212]).
   8224      [Geoff Thorpe, Lutz Jaenicke]
   8226   *) Fix typo in OBJ_txt2obj which incorrectly passed the content
   8227      length, instead of the encoding length to d2i_ASN1_OBJECT.
   8228      [Steve Henson]
   8230  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
   8232   *) [In 0.9.6g-engine release:]
   8233      Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
   8234      [Lynn Gazis <lgazis (a] rainbow.com>]
   8236  Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
   8238   *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
   8239      and get fix the header length calculation.
   8240      [Florian Weimer <Weimer (a] CERT.Uni-Stuttgart.DE>,
   8241 	Alon Kantor <alonk (a] checkpoint.com> (and others),
   8242 	Steve Henson]
   8244   *) Use proper error handling instead of 'assertions' in buffer
   8245      overflow checks added in 0.9.6e.  This prevents DoS (the
   8246      assertions could call abort()).
   8247      [Arne Ansper <arne (a] ats.cyber.ee>, Bodo Moeller]
   8249  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
   8251   *) Add various sanity checks to asn1_get_length() to reject
   8252      the ASN1 length bytes if they exceed sizeof(long), will appear
   8253      negative or the content length exceeds the length of the
   8254      supplied buffer.
   8255      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   8257   *) Fix cipher selection routines: ciphers without encryption had no flags
   8258      for the cipher strength set and where therefore not handled correctly
   8259      by the selection routines (PR #130).
   8260      [Lutz Jaenicke]
   8262   *) Fix EVP_dsa_sha macro.
   8263      [Nils Larsch]
   8265   *) New option
   8267      for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
   8268      that was added in OpenSSL 0.9.6d.
   8270      As the countermeasure turned out to be incompatible with some
   8271      broken SSL implementations, the new option is part of SSL_OP_ALL.
   8272      SSL_OP_ALL is usually employed when compatibility with weird SSL
   8273      implementations is desired (e.g. '-bugs' option to 's_client' and
   8274      's_server'), so the new option is automatically set in many
   8275      applications.
   8276      [Bodo Moeller]
   8278   *) Changes in security patch:
   8280      Changes marked "(CHATS)" were sponsored by the Defense Advanced
   8281      Research Projects Agency (DARPA) and Air Force Research Laboratory,
   8282      Air Force Materiel Command, USAF, under agreement number
   8283      F30602-01-2-0537.
   8285   *) Add various sanity checks to asn1_get_length() to reject
   8286      the ASN1 length bytes if they exceed sizeof(long), will appear
   8287      negative or the content length exceeds the length of the
   8288      supplied buffer. (CVE-2002-0659)
   8289      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   8291   *) Assertions for various potential buffer overflows, not known to
   8292      happen in practice.
   8293      [Ben Laurie (CHATS)]
   8295   *) Various temporary buffers to hold ASCII versions of integers were
   8296      too small for 64 bit platforms. (CVE-2002-0655)
   8297      [Matthew Byng-Maddick <mbm (a] aldigital.co.uk> and Ben Laurie (CHATS)>
   8299   *) Remote buffer overflow in SSL3 protocol - an attacker could
   8300      supply an oversized session ID to a client. (CVE-2002-0656)
   8301      [Ben Laurie (CHATS)]
   8303   *) Remote buffer overflow in SSL2 protocol - an attacker could
   8304      supply an oversized client master key. (CVE-2002-0656)
   8305      [Ben Laurie (CHATS)]
   8307  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
   8309   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
   8310      encoded as NULL) with id-dsa-with-sha1.
   8311      [Nils Larsch <nla (a] trustcenter.de>; problem pointed out by Bodo Moeller]
   8313   *) Check various X509_...() return values in apps/req.c.
   8314      [Nils Larsch <nla (a] trustcenter.de>]
   8316   *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
   8317      an end-of-file condition would erroneously be flagged, when the CRLF
   8318      was just at the end of a processed block. The bug was discovered when
   8319      processing data through a buffering memory BIO handing the data to a
   8320      BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
   8321      <ptsekov (a] syntrex.com> and Nedelcho Stanev.
   8322      [Lutz Jaenicke]
   8324   *) Implement a countermeasure against a vulnerability recently found
   8325      in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
   8326      before application data chunks to avoid the use of known IVs
   8327      with data potentially chosen by the attacker.
   8328      [Bodo Moeller]
   8330   *) Fix length checks in ssl3_get_client_hello().
   8331      [Bodo Moeller]
   8333   *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
   8334      to prevent ssl3_read_internal() from incorrectly assuming that
   8335      ssl3_read_bytes() found application data while handshake
   8336      processing was enabled when in fact s->s3->in_read_app_data was
   8337      merely automatically cleared during the initial handshake.
   8338      [Bodo Moeller; problem pointed out by Arne Ansper <arne (a] ats.cyber.ee>]
   8340   *) Fix object definitions for Private and Enterprise: they were not
   8341      recognized in their shortname (=lowercase) representation. Extend
   8342      obj_dat.pl to issue an error when using undefined keywords instead
   8343      of silently ignoring the problem (Svenning Sorensen
   8344      <sss (a] sss.dnsalias.net>).
   8345      [Lutz Jaenicke]
   8347   *) Fix DH_generate_parameters() so that it works for 'non-standard'
   8348      generators, i.e. generators other than 2 and 5.  (Previously, the
   8349      code did not properly initialise the 'add' and 'rem' values to
   8350      BN_generate_prime().)
   8352      In the new general case, we do not insist that 'generator' is
   8353      actually a primitive root: This requirement is rather pointless;
   8354      a generator of the order-q subgroup is just as good, if not
   8355      better.
   8356      [Bodo Moeller]
   8358   *) Map new X509 verification errors to alerts. Discovered and submitted by
   8359      Tom Wu <tom (a] arcot.com>.
   8360      [Lutz Jaenicke]
   8362   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
   8363      returning non-zero before the data has been completely received
   8364      when using non-blocking I/O.
   8365      [Bodo Moeller; problem pointed out by John Hughes]
   8367   *) Some of the ciphers missed the strength entry (SSL_LOW etc).
   8368      [Ben Laurie, Lutz Jaenicke]
   8370   *) Fix bug in SSL_clear(): bad sessions were not removed (found by
   8371      Yoram Zahavi <YoramZ (a] gilian.com>).
   8372      [Lutz Jaenicke]
   8374   *) Add information about CygWin 1.3 and on, and preserve proper
   8375      configuration for the versions before that.
   8376      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   8378   *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
   8379      check whether we deal with a copy of a session and do not delete from
   8380      the cache in this case. Problem reported by "Izhar Shoshani Levi"
   8381      <izhar (a] checkpoint.com>.
   8382      [Lutz Jaenicke]
   8384   *) Do not store session data into the internal session cache, if it
   8385      is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
   8386      flag is set). Proposed by Aslam <aslam (a] funk.com>.
   8387      [Lutz Jaenicke]
   8389   *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
   8390      value is 0.
   8391      [Richard Levitte]
   8393   *) [In 0.9.6d-engine release:]
   8394      Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   8395      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   8397   *) Add the configuration target linux-s390x.
   8398      [Neale Ferguson <Neale.Ferguson (a] SoftwareAG-USA.com> via Richard Levitte]
   8400   *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
   8401      ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
   8402      variable as an indication that a ClientHello message has been
   8403      received.  As the flag value will be lost between multiple
   8404      invocations of ssl3_accept when using non-blocking I/O, the
   8405      function may not be aware that a handshake has actually taken
   8406      place, thus preventing a new session from being added to the
   8407      session cache.
   8409      To avoid this problem, we now set s->new_session to 2 instead of
   8410      using a local variable.
   8411      [Lutz Jaenicke, Bodo Moeller]
   8413   *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
   8414      if the SSL_R_LENGTH_MISMATCH error is detected.
   8415      [Geoff Thorpe, Bodo Moeller]
   8417   *) New 'shared_ldflag' column in Configure platform table.
   8418      [Richard Levitte]
   8420   *) Fix EVP_CIPHER_mode macro.
   8421      ["Dan S. Camper" <dan (a] bti.net>]
   8423   *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
   8424      type, we must throw them away by setting rr->length to 0.
   8425      [D P Chang <dpc (a] qualys.com>]
   8427  Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
   8429   *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
   8430      <Dominikus.Scherkl (a] biodata.com>.  (The previous implementation
   8431      worked incorrectly for those cases where  range = 10..._2  and
   8432      3*range  is two bits longer than  range.)
   8433      [Bodo Moeller]
   8435   *) Only add signing time to PKCS7 structures if it is not already
   8436      present.
   8437      [Steve Henson]
   8439   *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
   8440      OBJ_ld_ce should be OBJ_id_ce.
   8441      Also some ip-pda OIDs in crypto/objects/objects.txt were
   8442      incorrect (cf. RFC 3039).
   8443      [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
   8445   *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
   8446      returns early because it has nothing to do.
   8447      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   8449   *) [In 0.9.6c-engine release:]
   8450      Fix mutex callback return values in crypto/engine/hw_ncipher.c.
   8451      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   8453   *) [In 0.9.6c-engine release:]
   8454      Add support for Cryptographic Appliance's keyserver technology.
   8455      (Use engine 'keyclient')
   8456      [Cryptographic Appliances and Geoff Thorpe]
   8458   *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
   8459      is called via tools/c89.sh because arguments have to be
   8460      rearranged (all '-L' options must appear before the first object
   8461      modules).
   8462      [Richard Shapiro <rshapiro (a] abinitio.com>]
   8464   *) [In 0.9.6c-engine release:]
   8465      Add support for Broadcom crypto accelerator cards, backported
   8466      from 0.9.7.
   8467      [Broadcom, Nalin Dahyabhai <nalin (a] redhat.com>, Mark Cox]
   8469   *) [In 0.9.6c-engine release:]
   8470      Add support for SureWare crypto accelerator cards from 
   8471      Baltimore Technologies.  (Use engine 'sureware')
   8472      [Baltimore Technologies and Mark Cox]
   8474   *) [In 0.9.6c-engine release:]
   8475      Add support for crypto accelerator cards from Accelerated
   8476      Encryption Processing, www.aep.ie.  (Use engine 'aep')
   8477      [AEP Inc. and Mark Cox]
   8479   *) Add a configuration entry for gcc on UnixWare.
   8480      [Gary Benson <gbenson (a] redhat.com>]
   8482   *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
   8483      messages are stored in a single piece (fixed-length part and
   8484      variable-length part combined) and fix various bugs found on the way.
   8485      [Bodo Moeller]
   8487   *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
   8488      instead.  BIO_gethostbyname() does not know what timeouts are
   8489      appropriate, so entries would stay in cache even when they have
   8490      become invalid.
   8491      [Bodo Moeller; problem pointed out by Rich Salz <rsalz (a] zolera.com>
   8493   *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
   8494      faced with a pathologically small ClientHello fragment that does
   8495      not contain client_version: Instead of aborting with an error,
   8496      simply choose the highest available protocol version (i.e.,
   8497      TLS 1.0 unless it is disabled).  In practice, ClientHello
   8498      messages are never sent like this, but this change gives us
   8499      strictly correct behaviour at least for TLS.
   8500      [Bodo Moeller]
   8502   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
   8503      never resets s->method to s->ctx->method when called from within
   8504      one of the SSL handshake functions.
   8505      [Bodo Moeller; problem pointed out by Niko Baric]
   8507   *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
   8508      (sent using the client's version number) if client_version is
   8509      smaller than the protocol version in use.  Also change
   8510      ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
   8511      the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
   8512      the client will at least see that alert.
   8513      [Bodo Moeller]
   8515   *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
   8516      correctly.
   8517      [Bodo Moeller]
   8519   *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
   8520      client receives HelloRequest while in a handshake.
   8521      [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider (a] bjss.co.uk>]
   8523   *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
   8524      should end in 'break', not 'goto end' which circumvents various
   8525      cleanups done in state SSL_ST_OK.   But session related stuff
   8526      must be disabled for SSL_ST_OK in the case that we just sent a
   8527      HelloRequest.
   8529      Also avoid some overhead by not calling ssl_init_wbio_buffer()
   8530      before just sending a HelloRequest.
   8531      [Bodo Moeller, Eric Rescorla <ekr (a] rtfm.com>]
   8533   *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
   8534      reveal whether illegal block cipher padding was found or a MAC
   8535      verification error occurred.  (Neither SSLerr() codes nor alerts
   8536      are directly visible to potential attackers, but the information
   8537      may leak via logfiles.)
   8539      Similar changes are not required for the SSL 2.0 implementation
   8540      because the number of padding bytes is sent in clear for SSL 2.0,
   8541      and the extra bytes are just ignored.  However ssl/s2_pkt.c
   8542      failed to verify that the purported number of padding bytes is in
   8543      the legal range.
   8544      [Bodo Moeller]
   8546   *) Add OpenUNIX-8 support including shared libraries
   8547      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   8548      [Lutz Jaenicke]
   8550   *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
   8551      'wristwatch attack' using huge encoding parameters (cf.
   8552      James H. Manger's CRYPTO 2001 paper).  Note that the
   8553      RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
   8554      encoding parameters and hence was not vulnerable.
   8555      [Bodo Moeller]
   8557   *) BN_sqr() bug fix.
   8558      [Ulf Mller, reported by Jim Ellis <jim.ellis (a] cavium.com>]
   8560   *) Rabin-Miller test analyses assume uniformly distributed witnesses,
   8561      so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
   8562      followed by modular reduction.
   8563      [Bodo Moeller; pointed out by Adam Young <AYoung1 (a] NCSUS.JNJ.COM>]
   8565   *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
   8566      equivalent based on BN_pseudo_rand() instead of BN_rand().
   8567      [Bodo Moeller]
   8569   *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
   8570      This function was broken, as the check for a new client hello message
   8571      to handle SGC did not allow these large messages.
   8572      (Tracked down by "Douglas E. Engert" <deengert (a] anl.gov>.)
   8573      [Lutz Jaenicke]
   8575   *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
   8576      [Lutz Jaenicke]
   8578   *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
   8579      for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton (a] netopia.com>).
   8580      [Lutz Jaenicke]
   8582   *) Rework the configuration and shared library support for Tru64 Unix.
   8583      The configuration part makes use of modern compiler features and
   8584      still retains old compiler behavior for those that run older versions
   8585      of the OS.  The shared library support part includes a variant that
   8586      uses the RPATH feature, and is available through the special
   8587      configuration target "alpha-cc-rpath", which will never be selected
   8588      automatically.
   8589      [Tim Mooney <mooney (a] dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
   8591   *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
   8592      with the same message size as in ssl3_get_certificate_request().
   8593      Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
   8594      messages might inadvertently be reject as too long.
   8595      [Petr Lampa <lampa (a] fee.vutbr.cz>]
   8597   *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
   8598      [Andy Polyakov]
   8600   *) Modified SSL library such that the verify_callback that has been set
   8601      specificly for an SSL object with SSL_set_verify() is actually being
   8602      used. Before the change, a verify_callback set with this function was
   8603      ignored and the verify_callback() set in the SSL_CTX at the time of
   8604      the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
   8605      to allow the necessary settings.
   8606      [Lutz Jaenicke]
   8608   *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
   8609      explicitly to NULL, as at least on Solaris 8 this seems not always to be
   8610      done automatically (in contradiction to the requirements of the C
   8611      standard). This made problems when used from OpenSSH.
   8612      [Lutz Jaenicke]
   8614   *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
   8615      dh->length and always used
   8617           BN_rand_range(priv_key, dh->p).
   8619      BN_rand_range() is not necessary for Diffie-Hellman, and this
   8620      specific range makes Diffie-Hellman unnecessarily inefficient if
   8621      dh->length (recommended exponent length) is much smaller than the
   8622      length of dh->p.  We could use BN_rand_range() if the order of
   8623      the subgroup was stored in the DH structure, but we only have
   8624      dh->length.
   8626      So switch back to
   8628           BN_rand(priv_key, l, ...)
   8630      where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
   8631      otherwise.
   8632      [Bodo Moeller]
   8634   *) In
   8636           RSA_eay_public_encrypt
   8637           RSA_eay_private_decrypt
   8638           RSA_eay_private_encrypt (signing)
   8639           RSA_eay_public_decrypt (signature verification)
   8641      (default implementations for RSA_public_encrypt,
   8642      RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
   8643      always reject numbers >= n.
   8644      [Bodo Moeller]
   8646   *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
   8647      to synchronize access to 'locking_thread'.  This is necessary on
   8648      systems where access to 'locking_thread' (an 'unsigned long'
   8649      variable) is not atomic.
   8650      [Bodo Moeller]
   8652   *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
   8653      *before* setting the 'crypto_lock_rand' flag.  The previous code had
   8654      a race condition if 0 is a valid thread ID.
   8655      [Travis Vitek <vitek (a] roguewave.com>]
   8657   *) Add support for shared libraries under Irix.
   8658      [Albert Chin-A-Young <china (a] thewrittenword.com>]
   8660   *) Add configuration option to build on Linux on both big-endian and
   8661      little-endian MIPS.
   8662      [Ralf Baechle <ralf (a] uni-koblenz.de>]
   8664   *) Add the possibility to create shared libraries on HP-UX.
   8665      [Richard Levitte]
   8667  Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
   8669   *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
   8670      to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
   8671      Markku-Juhani O. Saarinen <markku-juhani.saarinen (a] nokia.com>:
   8672      PRNG state recovery was possible based on the output of
   8673      one PRNG request appropriately sized to gain knowledge on
   8674      'md' followed by enough consecutive 1-byte PRNG requests
   8675      to traverse all of 'state'.
   8677      1. When updating 'md_local' (the current thread's copy of 'md')
   8678         during PRNG output generation, hash all of the previous
   8679         'md_local' value, not just the half used for PRNG output.
   8681      2. Make the number of bytes from 'state' included into the hash
   8682         independent from the number of PRNG bytes requested.
   8684      The first measure alone would be sufficient to avoid
   8685      Markku-Juhani's attack.  (Actually it had never occurred
   8686      to me that the half of 'md_local' used for chaining was the
   8687      half from which PRNG output bytes were taken -- I had always
   8688      assumed that the secret half would be used.)  The second
   8689      measure makes sure that additional data from 'state' is never
   8690      mixed into 'md_local' in small portions; this heuristically
   8691      further strengthens the PRNG.
   8692      [Bodo Moeller]
   8694   *) Fix crypto/bn/asm/mips3.s.
   8695      [Andy Polyakov]
   8697   *) When only the key is given to "enc", the IV is undefined. Print out
   8698      an error message in this case.
   8699      [Lutz Jaenicke]
   8701   *) Handle special case when X509_NAME is empty in X509 printing routines.
   8702      [Steve Henson]
   8704   *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
   8705      positive and less than q.
   8706      [Bodo Moeller]
   8708   *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
   8709      used: it isn't thread safe and the add_lock_callback should handle
   8710      that itself.
   8711      [Paul Rose <Paul.Rose (a] bridge.com>]
   8713   *) Verify that incoming data obeys the block size in
   8714      ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
   8715      [Bodo Moeller]
   8717   *) Fix OAEP check.
   8718      [Ulf Mller, Bodo Mller]
   8720   *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
   8721      RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
   8722      when fixing the server behaviour for backwards-compatible 'client
   8723      hello' messages.  (Note that the attack is impractical against
   8724      SSL 3.0 and TLS 1.0 anyway because length and version checking
   8725      means that the probability of guessing a valid ciphertext is
   8726      around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
   8727      paper.)
   8729      Before 0.9.5, the countermeasure (hide the error by generating a
   8730      random 'decryption result') did not work properly because
   8731      ERR_clear_error() was missing, meaning that SSL_get_error() would
   8732      detect the supposedly ignored error.
   8734      Both problems are now fixed.
   8735      [Bodo Moeller]
   8737   *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
   8738      (previously it was 1024).
   8739      [Bodo Moeller]
   8741   *) Fix for compatibility mode trust settings: ignore trust settings
   8742      unless some valid trust or reject settings are present.
   8743      [Steve Henson]
   8745   *) Fix for blowfish EVP: its a variable length cipher.
   8746      [Steve Henson]
   8748   *) Fix various bugs related to DSA S/MIME verification. Handle missing
   8749      parameters in DSA public key structures and return an error in the
   8750      DSA routines if parameters are absent.
   8751      [Steve Henson]
   8753   *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
   8754      in the current directory if neither $RANDFILE nor $HOME was set.
   8755      RAND_file_name() in 0.9.6a returned NULL in this case.  This has
   8756      caused some confusion to Windows users who haven't defined $HOME.
   8757      Thus RAND_file_name() is changed again: e_os.h can define a
   8758      DEFAULT_HOME, which will be used if $HOME is not set.
   8759      For Windows, we use "C:"; on other platforms, we still require
   8760      environment variables.
   8762   *) Move 'if (!initialized) RAND_poll()' into regions protected by
   8763      CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
   8764      having multiple threads call RAND_poll() concurrently.
   8765      [Bodo Moeller]
   8767   *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
   8768      combination of a flag and a thread ID variable.
   8769      Otherwise while one thread is in ssleay_rand_bytes (which sets the
   8770      flag), *other* threads can enter ssleay_add_bytes without obeying
   8771      the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
   8772      that they do not hold after the first thread unsets add_do_not_lock).
   8773      [Bodo Moeller]
   8775   *) Change bctest again: '-x' expressions are not available in all
   8776      versions of 'test'.
   8777      [Bodo Moeller]
   8779  Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
   8781   *) Fix a couple of memory leaks in PKCS7_dataDecode()
   8782      [Steve Henson, reported by Heyun Zheng <hzheng (a] atdsprint.com>]
   8784   *) Change Configure and Makefiles to provide EXE_EXT, which will contain
   8785      the default extension for executables, if any.  Also, make the perl
   8786      scripts that use symlink() to test if it really exists and use "cp"
   8787      if it doesn't.  All this made OpenSSL compilable and installable in
   8788      CygWin.
   8789      [Richard Levitte]
   8791   *) Fix for asn1_GetSequence() for indefinite length constructed data.
   8792      If SEQUENCE is length is indefinite just set c->slen to the total
   8793      amount of data available.
   8794      [Steve Henson, reported by shige (a] FreeBSD.org]
   8795      [This change does not apply to 0.9.7.]
   8797   *) Change bctest to avoid here-documents inside command substitution
   8798      (workaround for FreeBSD /bin/sh bug).
   8799      For compatibility with Ultrix, avoid shell functions (introduced
   8800      in the bctest version that searches along $PATH).
   8801      [Bodo Moeller]
   8803   *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
   8804      with des_encrypt() defined on some operating systems, like Solaris
   8805      and UnixWare.
   8806      [Richard Levitte]
   8808   *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
   8809      On the Importance of Eliminating Errors in Cryptographic
   8810      Computations, J. Cryptology 14 (2001) 2, 101-119,
   8811      http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
   8812      [Ulf Moeller]
   8814   *) MIPS assembler BIGNUM division bug fix. 
   8815      [Andy Polyakov]
   8817   *) Disabled incorrect Alpha assembler code.
   8818      [Richard Levitte]
   8820   *) Fix PKCS#7 decode routines so they correctly update the length
   8821      after reading an EOC for the EXPLICIT tag.
   8822      [Steve Henson]
   8823      [This change does not apply to 0.9.7.]
   8825   *) Fix bug in PKCS#12 key generation routines. This was triggered
   8826      if a 3DES key was generated with a 0 initial byte. Include
   8827      PKCS12_BROKEN_KEYGEN compilation option to retain the old
   8828      (but broken) behaviour.
   8829      [Steve Henson]
   8831   *) Enhance bctest to search for a working bc along $PATH and print
   8832      it when found.
   8833      [Tim Rice <tim (a] multitalents.net> via Richard Levitte]
   8835   *) Fix memory leaks in err.c: free err_data string if necessary;
   8836      don't write to the wrong index in ERR_set_error_data.
   8837      [Bodo Moeller]
   8839   *) Implement ssl23_peek (analogous to ssl23_read), which previously
   8840      did not exist.
   8841      [Bodo Moeller]
   8843   *) Replace rdtsc with _emit statements for VC++ version 5.
   8844      [Jeremy Cooper <jeremy (a] baymoo.org>]
   8846   *) Make it possible to reuse SSLv2 sessions.
   8847      [Richard Levitte]
   8849   *) In copy_email() check for >= 0 as a return value for
   8850      X509_NAME_get_index_by_NID() since 0 is a valid index.
   8851      [Steve Henson reported by Massimiliano Pala <madwolf (a] opensca.org>]
   8853   *) Avoid coredump with unsupported or invalid public keys by checking if
   8854      X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
   8855      PKCS7_verify() fails with non detached data.
   8856      [Steve Henson]
   8858   *) Don't use getenv in library functions when run as setuid/setgid.
   8859      New function OPENSSL_issetugid().
   8860      [Ulf Moeller]
   8862   *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
   8863      due to incorrect handling of multi-threading:
   8865      1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
   8867      2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
   8869      3. Count how many times MemCheck_off() has been called so that
   8870         nested use can be treated correctly.  This also avoids 
   8871         inband-signalling in the previous code (which relied on the
   8872         assumption that thread ID 0 is impossible).
   8873      [Bodo Moeller]
   8875   *) Add "-rand" option also to s_client and s_server.
   8876      [Lutz Jaenicke]
   8878   *) Fix CPU detection on Irix 6.x.
   8879      [Kurt Hockenbury <khockenb (a] stevens-tech.edu> and
   8880       "Bruce W. Forsberg" <bruce.forsberg (a] baesystems.com>]
   8882   *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
   8883      was empty.
   8884      [Steve Henson]
   8885      [This change does not apply to 0.9.7.]
   8887   *) Use the cached encoding of an X509_NAME structure rather than
   8888      copying it. This is apparently the reason for the libsafe "errors"
   8889      but the code is actually correct.
   8890      [Steve Henson]
   8892   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
   8893      Bleichenbacher's DSA attack.
   8894      Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
   8895      to be set and top=0 forces the highest bit to be set; top=-1 is new
   8896      and leaves the highest bit random.
   8897      [Ulf Moeller, Bodo Moeller]
   8899   *) In the NCONF_...-based implementations for CONF_... queries
   8900      (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
   8901      a temporary CONF structure with the data component set to NULL
   8902      (which gives segmentation faults in lh_retrieve).