Home | History | Annotate | Line # | Download | only in dist
      2  OpenSSL CHANGES
      3  _______________
      5  Changes between 1.0.2j and 1.0.2k [26 Jan 2017]
      7   *) Truncated packet could crash via OOB read
      9      If one side of an SSL/TLS path is running on a 32-bit host and a specific
     10      cipher is being used, then a truncated packet can cause that host to
     11      perform an out-of-bounds read, usually resulting in a crash.
     13      This issue was reported to OpenSSL by Robert wicki of Google.
     14      (CVE-2017-3731)
     15      [Andy Polyakov]
     17   *) BN_mod_exp may produce incorrect results on x86_64
     19      There is a carry propagating bug in the x86_64 Montgomery squaring
     20      procedure. No EC algorithms are affected. Analysis suggests that attacks
     21      against RSA and DSA as a result of this defect would be very difficult to
     22      perform and are not believed likely. Attacks against DH are considered just
     23      feasible (although very difficult) because most of the work necessary to
     24      deduce information about a private key may be performed offline. The amount
     25      of resources required for such an attack would be very significant and
     26      likely only accessible to a limited number of attackers. An attacker would
     27      additionally need online access to an unpatched system using the target
     28      private key in a scenario with persistent DH parameters and a private
     29      key that is shared between multiple clients. For example this can occur by
     30      default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
     31      similar to CVE-2015-3193 but must be treated as a separate problem.
     33      This issue was reported to OpenSSL by the OSS-Fuzz project.
     34      (CVE-2017-3732)
     35      [Andy Polyakov]
     37   *) Montgomery multiplication may produce incorrect results
     39      There is a carry propagating bug in the Broadwell-specific Montgomery
     40      multiplication procedure that handles input lengths divisible by, but
     41      longer than 256 bits. Analysis suggests that attacks against RSA, DSA
     42      and DH private keys are impossible. This is because the subroutine in
     43      question is not used in operations with the private key itself and an input
     44      of the attacker's direct choice. Otherwise the bug can manifest itself as
     45      transient authentication and key negotiation failures or reproducible
     46      erroneous outcome of public-key operations with specially crafted input.
     47      Among EC algorithms only Brainpool P-512 curves are affected and one
     48      presumably can attack ECDH key negotiation. Impact was not analyzed in
     49      detail, because pre-requisites for attack are considered unlikely. Namely
     50      multiple clients have to choose the curve in question and the server has to
     51      share the private key among them, neither of which is default behaviour.
     52      Even then only clients that chose the curve will be affected.
     54      This issue was publicly reported as transient failures and was not
     55      initially recognized as a security issue. Thanks to Richard Morgan for
     56      providing reproducible case.
     57      (CVE-2016-7055)
     58      [Andy Polyakov]
     60   *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
     61      or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
     62      prevent issues where no progress is being made and the peer continually
     63      sends unrecognised record types, using up resources processing them.
     64      [Matt Caswell]
     66  Changes between 1.0.2i and 1.0.2j [26 Sep 2016]
     68   *) Missing CRL sanity check
     70      A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
     71      but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
     72      CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
     74      This issue only affects the OpenSSL 1.0.2i
     75      (CVE-2016-7052)
     76      [Matt Caswell]
     78  Changes between 1.0.2h and 1.0.2i [22 Sep 2016]
     80   *) OCSP Status Request extension unbounded memory growth
     82      A malicious client can send an excessively large OCSP Status Request
     83      extension. If that client continually requests renegotiation, sending a
     84      large OCSP Status Request extension each time, then there will be unbounded
     85      memory growth on the server. This will eventually lead to a Denial Of
     86      Service attack through memory exhaustion. Servers with a default
     87      configuration are vulnerable even if they do not support OCSP. Builds using
     88      the "no-ocsp" build time option are not affected.
     90      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
     91      (CVE-2016-6304)
     92      [Matt Caswell]
     94   *) In order to mitigate the SWEET32 attack, the DES ciphers were moved from
     95      HIGH to MEDIUM.
     97      This issue was reported to OpenSSL Karthikeyan Bhargavan and Gaetan
     98      Leurent (INRIA)
     99      (CVE-2016-2183)
    100      [Rich Salz]
    102   *) OOB write in MDC2_Update()
    104      An overflow can occur in MDC2_Update() either if called directly or
    105      through the EVP_DigestUpdate() function using MDC2. If an attacker
    106      is able to supply very large amounts of input data after a previous
    107      call to EVP_EncryptUpdate() with a partial block then a length check
    108      can overflow resulting in a heap corruption.
    110      The amount of data needed is comparable to SIZE_MAX which is impractical
    111      on most platforms.
    113      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    114      (CVE-2016-6303)
    115      [Stephen Henson]
    117   *) Malformed SHA512 ticket DoS
    119      If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
    120      DoS attack where a malformed ticket will result in an OOB read which will
    121      ultimately crash.
    123      The use of SHA512 in TLS session tickets is comparatively rare as it requires
    124      a custom server callback and ticket lookup mechanism.
    126      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    127      (CVE-2016-6302)
    128      [Stephen Henson]
    130   *) OOB write in BN_bn2dec()
    132      The function BN_bn2dec() does not check the return value of BN_div_word().
    133      This can cause an OOB write if an application uses this function with an
    134      overly large BIGNUM. This could be a problem if an overly large certificate
    135      or CRL is printed out from an untrusted source. TLS is not affected because
    136      record limits will reject an oversized certificate before it is parsed.
    138      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    139      (CVE-2016-2182)
    140      [Stephen Henson]
    142   *) OOB read in TS_OBJ_print_bio()
    144      The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
    145      the total length the OID text representation would use and not the amount
    146      of data written. This will result in OOB reads when large OIDs are
    147      presented.
    149      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    150      (CVE-2016-2180)
    151      [Stephen Henson]
    153   *) Pointer arithmetic undefined behaviour
    155      Avoid some undefined pointer arithmetic
    157      A common idiom in the codebase is to check limits in the following manner:
    158      "p + len > limit"
    160      Where "p" points to some malloc'd data of SIZE bytes and
    161      limit == p + SIZE
    163      "len" here could be from some externally supplied data (e.g. from a TLS
    164      message).
    166      The rules of C pointer arithmetic are such that "p + len" is only well
    167      defined where len <= SIZE. Therefore the above idiom is actually
    168      undefined behaviour.
    170      For example this could cause problems if some malloc implementation
    171      provides an address for "p" such that "p + len" actually overflows for
    172      values of len that are too big and therefore p + len < limit.
    174      This issue was reported to OpenSSL by Guido Vranken
    175      (CVE-2016-2177)
    176      [Matt Caswell]
    178   *) Constant time flag not preserved in DSA signing
    180      Operations in the DSA signing algorithm should run in constant time in
    181      order to avoid side channel attacks. A flaw in the OpenSSL DSA
    182      implementation means that a non-constant time codepath is followed for
    183      certain operations. This has been demonstrated through a cache-timing
    184      attack to be sufficient for an attacker to recover the private DSA key.
    186      This issue was reported by Csar Pereida (Aalto University), Billy Brumley
    187      (Tampere University of Technology), and Yuval Yarom (The University of
    188      Adelaide and NICTA).
    189      (CVE-2016-2178)
    190      [Csar Pereida]
    192   *) DTLS buffered message DoS
    194      In a DTLS connection where handshake messages are delivered out-of-order
    195      those messages that OpenSSL is not yet ready to process will be buffered
    196      for later use. Under certain circumstances, a flaw in the logic means that
    197      those messages do not get removed from the buffer even though the handshake
    198      has been completed. An attacker could force up to approx. 15 messages to
    199      remain in the buffer when they are no longer required. These messages will
    200      be cleared when the DTLS connection is closed. The default maximum size for
    201      a message is 100k. Therefore the attacker could force an additional 1500k
    202      to be consumed per connection. By opening many simulataneous connections an
    203      attacker could cause a DoS attack through memory exhaustion.
    205      This issue was reported to OpenSSL by Quan Luo.
    206      (CVE-2016-2179)
    207      [Matt Caswell]
    209   *) DTLS replay protection DoS
    211      A flaw in the DTLS replay attack protection mechanism means that records
    212      that arrive for future epochs update the replay protection "window" before
    213      the MAC for the record has been validated. This could be exploited by an
    214      attacker by sending a record for the next epoch (which does not have to
    215      decrypt or have a valid MAC), with a very large sequence number. This means
    216      that all subsequent legitimate packets are dropped causing a denial of
    217      service for a specific DTLS connection.
    219      This issue was reported to OpenSSL by the OCAP audit team.
    220      (CVE-2016-2181)
    221      [Matt Caswell]
    223   *) Certificate message OOB reads
    225      In OpenSSL 1.0.2 and earlier some missing message length checks can result
    226      in OOB reads of up to 2 bytes beyond an allocated buffer. There is a
    227      theoretical DoS risk but this has not been observed in practice on common
    228      platforms.
    230      The messages affected are client certificate, client certificate request
    231      and server certificate. As a result the attack can only be performed
    232      against a client or a server which enables client authentication.
    234      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
    235      (CVE-2016-6306)
    236      [Stephen Henson]
    238  Changes between 1.0.2g and 1.0.2h [3 May 2016]
    240   *) Prevent padding oracle in AES-NI CBC MAC check
    242      A MITM attacker can use a padding oracle attack to decrypt traffic
    243      when the connection uses an AES CBC cipher and the server support
    244      AES-NI.
    246      This issue was introduced as part of the fix for Lucky 13 padding
    247      attack (CVE-2013-0169). The padding check was rewritten to be in
    248      constant time by making sure that always the same bytes are read and
    249      compared against either the MAC or padding bytes. But it no longer
    250      checked that there was enough data to have both the MAC and padding
    251      bytes.
    253      This issue was reported by Juraj Somorovsky using TLS-Attacker.
    254      (CVE-2016-2107)
    255      [Kurt Roeckx]
    257   *) Fix EVP_EncodeUpdate overflow
    259      An overflow can occur in the EVP_EncodeUpdate() function which is used for
    260      Base64 encoding of binary data. If an attacker is able to supply very large
    261      amounts of input data then a length check can overflow resulting in a heap
    262      corruption.
    264      Internally to OpenSSL the EVP_EncodeUpdate() function is primarly used by
    265      the PEM_write_bio* family of functions. These are mainly used within the
    266      OpenSSL command line applications, so any application which processes data
    267      from an untrusted source and outputs it as a PEM file should be considered
    268      vulnerable to this issue. User applications that call these APIs directly
    269      with large amounts of untrusted data may also be vulnerable.
    271      This issue was reported by Guido Vranken.
    272      (CVE-2016-2105)
    273      [Matt Caswell]
    275   *) Fix EVP_EncryptUpdate overflow
    277      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
    278      is able to supply very large amounts of input data after a previous call to
    279      EVP_EncryptUpdate() with a partial block then a length check can overflow
    280      resulting in a heap corruption. Following an analysis of all OpenSSL
    281      internal usage of the EVP_EncryptUpdate() function all usage is one of two
    282      forms. The first form is where the EVP_EncryptUpdate() call is known to be
    283      the first called function after an EVP_EncryptInit(), and therefore that
    284      specific call must be safe. The second form is where the length passed to
    285      EVP_EncryptUpdate() can be seen from the code to be some small value and
    286      therefore there is no possibility of an overflow. Since all instances are
    287      one of these two forms, it is believed that there can be no overflows in
    288      internal code due to this problem. It should be noted that
    289      EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
    290      Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
    291      of these calls have also been analysed too and it is believed there are no
    292      instances in internal usage where an overflow could occur.
    294      This issue was reported by Guido Vranken.
    295      (CVE-2016-2106)
    296      [Matt Caswell]
    298   *) Prevent ASN.1 BIO excessive memory allocation
    300      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
    301      a short invalid encoding can casuse allocation of large amounts of memory
    302      potentially consuming excessive resources or exhausting memory.
    304      Any application parsing untrusted data through d2i BIO functions is
    305      affected. The memory based functions such as d2i_X509() are *not* affected.
    306      Since the memory based functions are used by the TLS library, TLS
    307      applications are not affected.
    309      This issue was reported by Brian Carpenter.
    310      (CVE-2016-2109)
    311      [Stephen Henson]
    313   *) EBCDIC overread
    315      ASN1 Strings that are over 1024 bytes can cause an overread in applications
    316      using the X509_NAME_oneline() function on EBCDIC systems. This could result
    317      in arbitrary stack data being returned in the buffer.
    319      This issue was reported by Guido Vranken.
    320      (CVE-2016-2176)
    321      [Matt Caswell]
    323   *) Modify behavior of ALPN to invoke callback after SNI/servername
    324      callback, such that updates to the SSL_CTX affect ALPN.
    325      [Todd Short]
    327   *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
    328      default.
    329      [Kurt Roeckx]
    331   *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
    332      methods are enabled and ssl2 is disabled the methods return NULL.
    333      [Kurt Roeckx]
    335  Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
    337   * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
    338     Builds that are not configured with "enable-weak-ssl-ciphers" will not
    339     provide any "EXPORT" or "LOW" strength ciphers.
    340     [Viktor Dukhovni]
    342   * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
    343     is by default disabled at build-time.  Builds that are not configured with
    344     "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
    345     users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
    346     will need to explicitly call either of:
    348         SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
    349     or
    350         SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
    352     as appropriate.  Even if either of those is used, or the application
    353     explicitly uses the version-specific SSLv2_method() or its client and
    354     server variants, SSLv2 ciphers vulnerable to exhaustive search key
    355     recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
    356     ciphers, and SSLv2 56-bit DES are no longer available.
    357     (CVE-2016-0800)
    358     [Viktor Dukhovni]
    360   *) Fix a double-free in DSA code
    362      A double free bug was discovered when OpenSSL parses malformed DSA private
    363      keys and could lead to a DoS attack or memory corruption for applications
    364      that receive DSA private keys from untrusted sources.  This scenario is
    365      considered rare.
    367      This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
    368      libFuzzer.
    369      (CVE-2016-0705)
    370      [Stephen Henson]
    372   *) Disable SRP fake user seed to address a server memory leak.
    374      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
    376      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
    377      In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
    378      was changed to ignore the "fake user" SRP seed, even if the seed
    379      is configured.
    381      Users should use SRP_VBASE_get1_by_user instead. Note that in
    382      SRP_VBASE_get1_by_user, caller must free the returned value. Note
    383      also that even though configuring the SRP seed attempts to hide
    384      invalid usernames by continuing the handshake with fake
    385      credentials, this behaviour is not constant time and no strong
    386      guarantees are made that the handshake is indistinguishable from
    387      that of a valid user.
    388      (CVE-2016-0798)
    389      [Emilia Ksper]
    391   *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
    393      In the BN_hex2bn function the number of hex digits is calculated using an
    394      int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
    395      large values of |i| this can result in |bn_expand| not allocating any
    396      memory because |i * 4| is negative. This can leave the internal BIGNUM data
    397      field as NULL leading to a subsequent NULL ptr deref. For very large values
    398      of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
    399      In this case memory is allocated to the internal BIGNUM data field, but it
    400      is insufficiently sized leading to heap corruption. A similar issue exists
    401      in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
    402      is ever called by user applications with very large untrusted hex/dec data.
    403      This is anticipated to be a rare occurrence.
    405      All OpenSSL internal usage of these functions use data that is not expected
    406      to be untrusted, e.g. config file data or application command line
    407      arguments. If user developed applications generate config file data based
    408      on untrusted data then it is possible that this could also lead to security
    409      consequences. This is also anticipated to be rare.
    411      This issue was reported to OpenSSL by Guido Vranken.
    412      (CVE-2016-0797)
    413      [Matt Caswell]
    415   *) Fix memory issues in BIO_*printf functions
    417      The internal |fmtstr| function used in processing a "%s" format string in
    418      the BIO_*printf functions could overflow while calculating the length of a
    419      string and cause an OOB read when printing very long strings.
    421      Additionally the internal |doapr_outch| function can attempt to write to an
    422      OOB memory location (at an offset from the NULL pointer) in the event of a
    423      memory allocation failure. In 1.0.2 and below this could be caused where
    424      the size of a buffer to be allocated is greater than INT_MAX. E.g. this
    425      could be in processing a very long "%s" format string. Memory leaks can
    426      also occur.
    428      The first issue may mask the second issue dependent on compiler behaviour.
    429      These problems could enable attacks where large amounts of untrusted data
    430      is passed to the BIO_*printf functions. If applications use these functions
    431      in this way then they could be vulnerable. OpenSSL itself uses these
    432      functions when printing out human-readable dumps of ASN.1 data. Therefore
    433      applications that print this data could be vulnerable if the data is from
    434      untrusted sources. OpenSSL command line applications could also be
    435      vulnerable where they print out ASN.1 data, or if untrusted data is passed
    436      as command line arguments.
    438      Libssl is not considered directly vulnerable. Additionally certificates etc
    439      received via remote connections via libssl are also unlikely to be able to
    440      trigger these issues because of message size limits enforced within libssl.
    442      This issue was reported to OpenSSL Guido Vranken.
    443      (CVE-2016-0799)
    444      [Matt Caswell]
    446   *) Side channel attack on modular exponentiation
    448      A side-channel attack was found which makes use of cache-bank conflicts on
    449      the Intel Sandy-Bridge microarchitecture which could lead to the recovery
    450      of RSA keys.  The ability to exploit this issue is limited as it relies on
    451      an attacker who has control of code in a thread running on the same
    452      hyper-threaded core as the victim thread which is performing decryptions.
    454      This issue was reported to OpenSSL by Yuval Yarom, The University of
    455      Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
    456      Nadia Heninger, University of Pennsylvania with more information at
    457      http://cachebleed.info.
    458      (CVE-2016-0702)
    459      [Andy Polyakov]
    461   *) Change the req app to generate a 2048-bit RSA/DSA key by default,
    462      if no keysize is specified with default_bits. This fixes an
    463      omission in an earlier change that changed all RSA/DSA key generation
    464      apps to use 2048 bits by default.
    465      [Emilia Ksper]
    467  Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
    469   *) DH small subgroups
    471      Historically OpenSSL only ever generated DH parameters based on "safe"
    472      primes. More recently (in version 1.0.2) support was provided for
    473      generating X9.42 style parameter files such as those required for RFC 5114
    474      support. The primes used in such files may not be "safe". Where an
    475      application is using DH configured with parameters based on primes that are
    476      not "safe" then an attacker could use this fact to find a peer's private
    477      DH exponent. This attack requires that the attacker complete multiple
    478      handshakes in which the peer uses the same private DH exponent. For example
    479      this could be used to discover a TLS server's private DH exponent if it's
    480      reusing the private DH exponent or it's using a static DH ciphersuite.
    482      OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
    483      TLS. It is not on by default. If the option is not set then the server
    484      reuses the same private DH exponent for the life of the server process and
    485      would be vulnerable to this attack. It is believed that many popular
    486      applications do set this option and would therefore not be at risk.
    488      The fix for this issue adds an additional check where a "q" parameter is
    489      available (as is the case in X9.42 based parameters). This detects the
    490      only known attack, and is the only possible defense for static DH
    491      ciphersuites. This could have some performance impact.
    493      Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
    494      default and cannot be disabled. This could have some performance impact.
    496      This issue was reported to OpenSSL by Antonio Sanso (Adobe).
    497      (CVE-2016-0701)
    498      [Matt Caswell]
    500   *) SSLv2 doesn't block disabled ciphers
    502      A malicious client can negotiate SSLv2 ciphers that have been disabled on
    503      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
    504      been disabled, provided that the SSLv2 protocol was not also disabled via
    505      SSL_OP_NO_SSLv2.
    507      This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
    508      and Sebastian Schinzel.
    509      (CVE-2015-3197)
    510      [Viktor Dukhovni]
    512   *) Reject DH handshakes with parameters shorter than 1024 bits.
    513      [Kurt Roeckx]
    515  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
    517   *) BN_mod_exp may produce incorrect results on x86_64
    519      There is a carry propagating bug in the x86_64 Montgomery squaring
    520      procedure. No EC algorithms are affected. Analysis suggests that attacks
    521      against RSA and DSA as a result of this defect would be very difficult to
    522      perform and are not believed likely. Attacks against DH are considered just
    523      feasible (although very difficult) because most of the work necessary to
    524      deduce information about a private key may be performed offline. The amount
    525      of resources required for such an attack would be very significant and
    526      likely only accessible to a limited number of attackers. An attacker would
    527      additionally need online access to an unpatched system using the target
    528      private key in a scenario with persistent DH parameters and a private
    529      key that is shared between multiple clients. For example this can occur by
    530      default in OpenSSL DHE based SSL/TLS ciphersuites.
    532      This issue was reported to OpenSSL by Hanno Bck.
    533      (CVE-2015-3193)
    534      [Andy Polyakov]
    536   *) Certificate verify crash with missing PSS parameter
    538      The signature verification routines will crash with a NULL pointer
    539      dereference if presented with an ASN.1 signature using the RSA PSS
    540      algorithm and absent mask generation function parameter. Since these
    541      routines are used to verify certificate signature algorithms this can be
    542      used to crash any certificate verification operation and exploited in a
    543      DoS attack. Any application which performs certificate verification is
    544      vulnerable including OpenSSL clients and servers which enable client
    545      authentication.
    547      This issue was reported to OpenSSL by Loc Jonas Etienne (Qnective AG).
    548      (CVE-2015-3194)
    549      [Stephen Henson]
    551   *) X509_ATTRIBUTE memory leak
    553      When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
    554      memory. This structure is used by the PKCS#7 and CMS routines so any
    555      application which reads PKCS#7 or CMS data from untrusted sources is
    556      affected. SSL/TLS is not affected.
    558      This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
    559      libFuzzer.
    560      (CVE-2015-3195)
    561      [Stephen Henson]
    563   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
    564      This changes the decoding behaviour for some invalid messages,
    565      though the change is mostly in the more lenient direction, and
    566      legacy behaviour is preserved as much as possible.
    567      [Emilia Ksper]
    569   *) In DSA_generate_parameters_ex, if the provided seed is too short,
    570      use a random seed, as already documented.
    571      [Rich Salz and Ismo Puustinen <ismo.puustinen (a] intel.com>]
    573  Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
    575   *) Alternate chains certificate forgery
    577      During certificate verfification, OpenSSL will attempt to find an
    578      alternative certificate chain if the first attempt to build such a chain
    579      fails. An error in the implementation of this logic can mean that an
    580      attacker could cause certain checks on untrusted certificates to be
    581      bypassed, such as the CA flag, enabling them to use a valid leaf
    582      certificate to act as a CA and "issue" an invalid certificate.
    584      This issue was reported to OpenSSL by Adam Langley/David Benjamin
    585      (Google/BoringSSL).
    586      (CVE-2015-1793)
    587      [Matt Caswell]
    589   *) Race condition handling PSK identify hint
    591      If PSK identity hints are received by a multi-threaded client then
    592      the values are wrongly updated in the parent SSL_CTX structure. This can
    593      result in a race condition potentially leading to a double free of the
    594      identify hint data.
    595      (CVE-2015-3196)
    596      [Stephen Henson]
    598  Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
    600   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
    601      incompatibility in the handling of HMAC. The previous ABI has now been
    602      restored.
    604  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
    606   *) Malformed ECParameters causes infinite loop
    608      When processing an ECParameters structure OpenSSL enters an infinite loop
    609      if the curve specified is over a specially malformed binary polynomial
    610      field.
    612      This can be used to perform denial of service against any
    613      system which processes public keys, certificate requests or
    614      certificates.  This includes TLS clients and TLS servers with
    615      client authentication enabled.
    617      This issue was reported to OpenSSL by Joseph Barr-Pixton.
    618      (CVE-2015-1788)
    619      [Andy Polyakov]
    621   *) Exploitable out-of-bounds read in X509_cmp_time
    623      X509_cmp_time does not properly check the length of the ASN1_TIME
    624      string and can read a few bytes out of bounds. In addition,
    625      X509_cmp_time accepts an arbitrary number of fractional seconds in the
    626      time string.
    628      An attacker can use this to craft malformed certificates and CRLs of
    629      various sizes and potentially cause a segmentation fault, resulting in
    630      a DoS on applications that verify certificates or CRLs. TLS clients
    631      that verify CRLs are affected. TLS clients and servers with client
    632      authentication enabled may be affected if they use custom verification
    633      callbacks.
    635      This issue was reported to OpenSSL by Robert Swiecki (Google), and
    636      independently by Hanno Bck.
    637      (CVE-2015-1789)
    638      [Emilia Ksper]
    640   *) PKCS7 crash with missing EnvelopedContent
    642      The PKCS#7 parsing code does not handle missing inner EncryptedContent
    643      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
    644      with missing content and trigger a NULL pointer dereference on parsing.
    646      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
    647      structures from untrusted sources are affected. OpenSSL clients and
    648      servers are not affected.
    650      This issue was reported to OpenSSL by Michal Zalewski (Google).
    651      (CVE-2015-1790)
    652      [Emilia Ksper]
    654   *) CMS verify infinite loop with unknown hash function
    656      When verifying a signedData message the CMS code can enter an infinite loop
    657      if presented with an unknown hash function OID. This can be used to perform
    658      denial of service against any system which verifies signedData messages using
    659      the CMS code.
    660      This issue was reported to OpenSSL by Johannes Bauer.
    661      (CVE-2015-1792)
    662      [Stephen Henson]
    664   *) Race condition handling NewSessionTicket
    666      If a NewSessionTicket is received by a multi-threaded client when attempting to
    667      reuse a previous ticket then a race condition can occur potentially leading to
    668      a double free of the ticket data.
    669      (CVE-2015-1791)
    670      [Matt Caswell]
    672   *) Removed support for the two export grade static DH ciphersuites
    673      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
    674      were newly added (along with a number of other static DH ciphersuites) to
    675      1.0.2. However the two export ones have *never* worked since they were
    676      introduced. It seems strange in any case to be adding new export
    677      ciphersuites, and given "logjam" it also does not seem correct to fix them.
    678      [Matt Caswell]
    680   *) Only support 256-bit or stronger elliptic curves with the
    681      'ecdh_auto' setting (server) or by default (client). Of supported
    682      curves, prefer P-256 (both).
    683      [Emilia Kasper]
    685   *) Reject DH handshakes with parameters shorter than 768 bits.
    686      [Kurt Roeckx and Emilia Kasper]
    688  Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
    690   *) ClientHello sigalgs DoS fix
    692      If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
    693      invalid signature algorithms extension a NULL pointer dereference will
    694      occur. This can be exploited in a DoS attack against the server.
    696      This issue was was reported to OpenSSL by David Ramos of Stanford
    697      University.
    698      (CVE-2015-0291)
    699      [Stephen Henson and Matt Caswell]
    701   *) Multiblock corrupted pointer fix
    703      OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
    704      feature only applies on 64 bit x86 architecture platforms that support AES
    705      NI instructions. A defect in the implementation of "multiblock" can cause
    706      OpenSSL's internal write buffer to become incorrectly set to NULL when
    707      using non-blocking IO. Typically, when the user application is using a
    708      socket BIO for writing, this will only result in a failed connection.
    709      However if some other BIO is used then it is likely that a segmentation
    710      fault will be triggered, thus enabling a potential DoS attack.
    712      This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
    713      (CVE-2015-0290)
    714      [Matt Caswell]
    716   *) Segmentation fault in DTLSv1_listen fix
    718      The DTLSv1_listen function is intended to be stateless and processes the
    719      initial ClientHello from many peers. It is common for user code to loop
    720      over the call to DTLSv1_listen until a valid ClientHello is received with
    721      an associated cookie. A defect in the implementation of DTLSv1_listen means
    722      that state is preserved in the SSL object from one invocation to the next
    723      that can lead to a segmentation fault. Errors processing the initial
    724      ClientHello can trigger this scenario. An example of such an error could be
    725      that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
    726      server.
    728      This issue was reported to OpenSSL by Per Allansson.
    729      (CVE-2015-0207)
    730      [Matt Caswell]
    732   *) Segmentation fault in ASN1_TYPE_cmp fix
    734      The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
    735      made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
    736      certificate signature algorithm consistency this can be used to crash any
    737      certificate verification operation and exploited in a DoS attack. Any
    738      application which performs certificate verification is vulnerable including
    739      OpenSSL clients and servers which enable client authentication.
    740      (CVE-2015-0286)
    741      [Stephen Henson]
    743   *) Segmentation fault for invalid PSS parameters fix
    745      The signature verification routines will crash with a NULL pointer
    746      dereference if presented with an ASN.1 signature using the RSA PSS
    747      algorithm and invalid parameters. Since these routines are used to verify
    748      certificate signature algorithms this can be used to crash any
    749      certificate verification operation and exploited in a DoS attack. Any
    750      application which performs certificate verification is vulnerable including
    751      OpenSSL clients and servers which enable client authentication.
    753      This issue was was reported to OpenSSL by Brian Carpenter.
    754      (CVE-2015-0208)
    755      [Stephen Henson]
    757   *) ASN.1 structure reuse memory corruption fix
    759      Reusing a structure in ASN.1 parsing may allow an attacker to cause
    760      memory corruption via an invalid write. Such reuse is and has been
    761      strongly discouraged and is believed to be rare.
    763      Applications that parse structures containing CHOICE or ANY DEFINED BY
    764      components may be affected. Certificate parsing (d2i_X509 and related
    765      functions) are however not affected. OpenSSL clients and servers are
    766      not affected.
    767      (CVE-2015-0287)
    768      [Stephen Henson]
    770   *) PKCS7 NULL pointer dereferences fix
    772      The PKCS#7 parsing code does not handle missing outer ContentInfo
    773      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
    774      missing content and trigger a NULL pointer dereference on parsing.
    776      Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
    777      otherwise parse PKCS#7 structures from untrusted sources are
    778      affected. OpenSSL clients and servers are not affected.
    780      This issue was reported to OpenSSL by Michal Zalewski (Google).
    781      (CVE-2015-0289)
    782      [Emilia Ksper]
    784   *) DoS via reachable assert in SSLv2 servers fix
    786      A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
    787      servers that both support SSLv2 and enable export cipher suites by sending
    788      a specially crafted SSLv2 CLIENT-MASTER-KEY message.
    790      This issue was discovered by Sean Burford (Google) and Emilia Ksper
    791      (OpenSSL development team).
    792      (CVE-2015-0293)
    793      [Emilia Ksper]
    795   *) Empty CKE with client auth and DHE fix
    797      If client auth is used then a server can seg fault in the event of a DHE
    798      ciphersuite being selected and a zero length ClientKeyExchange message
    799      being sent by the client. This could be exploited in a DoS attack.
    800      (CVE-2015-1787)
    801      [Matt Caswell]
    803   *) Handshake with unseeded PRNG fix
    805      Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
    806      with an unseeded PRNG. The conditions are:
    807      - The client is on a platform where the PRNG has not been seeded
    808      automatically, and the user has not seeded manually
    809      - A protocol specific client method version has been used (i.e. not
    810      SSL_client_methodv23)
    811      - A ciphersuite is used that does not require additional random data from
    812      the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
    814      If the handshake succeeds then the client random that has been used will
    815      have been generated from a PRNG with insufficient entropy and therefore the
    816      output may be predictable.
    818      For example using the following command with an unseeded openssl will
    819      succeed on an unpatched platform:
    821      openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
    822      (CVE-2015-0285)
    823      [Matt Caswell]
    825   *) Use After Free following d2i_ECPrivatekey error fix
    827      A malformed EC private key file consumed via the d2i_ECPrivateKey function
    828      could cause a use after free condition. This, in turn, could cause a double
    829      free in several private key parsing functions (such as d2i_PrivateKey
    830      or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
    831      for applications that receive EC private keys from untrusted
    832      sources. This scenario is considered rare.
    834      This issue was discovered by the BoringSSL project and fixed in their
    835      commit 517073cd4b.
    836      (CVE-2015-0209)
    837      [Matt Caswell]
    839   *) X509_to_X509_REQ NULL pointer deref fix
    841      The function X509_to_X509_REQ will crash with a NULL pointer dereference if
    842      the certificate key is invalid. This function is rarely used in practice.
    844      This issue was discovered by Brian Carpenter.
    845      (CVE-2015-0288)
    846      [Stephen Henson]
    848   *) Removed the export ciphers from the DEFAULT ciphers
    849      [Kurt Roeckx]
    851  Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
    853   *) Change RSA and DH/DSA key generation apps to generate 2048-bit
    854      keys by default.
    855      [Kurt Roeckx]
    857   *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
    858      ARMv5 through ARMv8, as opposite to "locking" it to single one.
    859      So far those who have to target multiple plaforms would compromise
    860      and argue that binary targeting say ARMv5 would still execute on
    861      ARMv8. "Universal" build resolves this compromise by providing
    862      near-optimal performance even on newer platforms.
    863      [Andy Polyakov]
    865   *) Accelerated NIST P-256 elliptic curve implementation for x86_64
    866      (other platforms pending).
    867      [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
    869   *) Add support for the SignedCertificateTimestampList certificate and
    870      OCSP response extensions from RFC6962.
    871      [Rob Stradling]
    873   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
    874      for corner cases. (Certain input points at infinity could lead to
    875      bogus results, with non-infinity inputs mapped to infinity too.)
    876      [Bodo Moeller]
    878   *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
    879      This covers AES, SHA256/512 and GHASH. "Initial" means that most
    880      common cases are optimized and there still is room for further
    881      improvements. Vector Permutation AES for Altivec is also added.
    882      [Andy Polyakov]
    884   *) Add support for little-endian ppc64 Linux target.
    885      [Marcelo Cerri (IBM)]
    887   *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
    888      SHA1, SHA256 and GHASH. "Initial" means that most common cases
    889      are optimized and there still is room for further improvements.
    890      Both 32- and 64-bit modes are supported.
    891      [Andy Polyakov, Ard Biesheuvel (Linaro)]
    893   *) Improved ARMv7 NEON support.
    894      [Andy Polyakov]
    896   *) Support for SPARC Architecture 2011 crypto extensions, first
    897      implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
    898      SHA256/512, MD5, GHASH and modular exponentiation.
    899      [Andy Polyakov, David Miller]
    901   *) Accelerated modular exponentiation for Intel processors, a.k.a.
    902      RSAZ.
    903      [Shay Gueron & Vlad Krasnov (Intel Corp)]
    905   *) Support for new and upcoming Intel processors, including AVX2,
    906      BMI and SHA ISA extensions. This includes additional "stitched"
    907      implementations, AESNI-SHA256 and GCM, and multi-buffer support
    908      for TLS encrypt.
    910      This work was sponsored by Intel Corp.
    911      [Andy Polyakov]
    913   *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
    914      supports both DTLS 1.2 and 1.0 and should use whatever version the peer
    915      supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
    916      [Steve Henson]
    918   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
    919      this fixes a limiation in previous versions of OpenSSL.
    920      [Steve Henson]
    922   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
    923      MGF1 digest and OAEP label.
    924      [Steve Henson]
    926   *) Add EVP support for key wrapping algorithms, to avoid problems with
    927      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
    928      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
    929      algorithms and include tests cases.
    930      [Steve Henson]
    932   *) Add functions to allocate and set the fields of an ECDSA_METHOD
    933      structure.
    934      [Douglas E. Engert, Steve Henson]
    936   *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
    937      difference in days and seconds between two tm or ASN1_TIME structures.
    938      [Steve Henson]
    940   *) Add -rev test option to s_server to just reverse order of characters
    941      received by client and send back to server. Also prints an abbreviated
    942      summary of the connection parameters.
    943      [Steve Henson]
    945   *) New option -brief for s_client and s_server to print out a brief summary
    946      of connection parameters.
    947      [Steve Henson]
    949   *) Add callbacks for arbitrary TLS extensions.
    950      [Trevor Perrin <trevp (a] trevp.net> and Ben Laurie]
    952   *) New option -crl_download in several openssl utilities to download CRLs
    953      from CRLDP extension in certificates.
    954      [Steve Henson]
    956   *) New options -CRL and -CRLform for s_client and s_server for CRLs.
    957      [Steve Henson]
    959   *) New function X509_CRL_diff to generate a delta CRL from the difference
    960      of two full CRLs. Add support to "crl" utility.
    961      [Steve Henson]
    963   *) New functions to set lookup_crls function and to retrieve
    964      X509_STORE from X509_STORE_CTX.
    965      [Steve Henson]
    967   *) Print out deprecated issuer and subject unique ID fields in
    968      certificates.
    969      [Steve Henson]
    971   *) Extend OCSP I/O functions so they can be used for simple general purpose
    972      HTTP as well as OCSP. New wrapper function which can be used to download
    973      CRLs using the OCSP API.
    974      [Steve Henson]
    976   *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
    977      [Steve Henson]
    979   *) SSL_CONF* functions. These provide a common framework for application
    980      configuration using configuration files or command lines.
    981      [Steve Henson]
    983   *) SSL/TLS tracing code. This parses out SSL/TLS records using the
    984      message callback and prints the results. Needs compile time option
    985      "enable-ssl-trace". New options to s_client and s_server to enable
    986      tracing.
    987      [Steve Henson]
    989   *) New ctrl and macro to retrieve supported points extensions.
    990      Print out extension in s_server and s_client.
    991      [Steve Henson]
    993   *) New functions to retrieve certificate signature and signature
    994      OID NID.
    995      [Steve Henson]
    997   *) Add functions to retrieve and manipulate the raw cipherlist sent by a
    998      client to OpenSSL.
    999      [Steve Henson]
   1001   *) New Suite B modes for TLS code. These use and enforce the requirements
   1002      of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
   1003      only use Suite B curves. The Suite B modes can be set by using the
   1004      strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
   1005      [Steve Henson]
   1007   *) New chain verification flags for Suite B levels of security. Check
   1008      algorithms are acceptable when flags are set in X509_verify_cert.
   1009      [Steve Henson]
   1011   *) Make tls1_check_chain return a set of flags indicating checks passed
   1012      by a certificate chain. Add additional tests to handle client
   1013      certificates: checks for matching certificate type and issuer name
   1014      comparison.
   1015      [Steve Henson]
   1017   *) If an attempt is made to use a signature algorithm not in the peer
   1018      preference list abort the handshake. If client has no suitable
   1019      signature algorithms in response to a certificate request do not
   1020      use the certificate.
   1021      [Steve Henson]
   1023   *) If server EC tmp key is not in client preference list abort handshake.
   1024      [Steve Henson]
   1026   *) Add support for certificate stores in CERT structure. This makes it
   1027      possible to have different stores per SSL structure or one store in
   1028      the parent SSL_CTX. Include distint stores for certificate chain
   1029      verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
   1030      to build and store a certificate chain in CERT structure: returing
   1031      an error if the chain cannot be built: this will allow applications
   1032      to test if a chain is correctly configured.
   1034      Note: if the CERT based stores are not set then the parent SSL_CTX
   1035      store is used to retain compatibility with existing behaviour.
   1037      [Steve Henson]
   1039   *) New function ssl_set_client_disabled to set a ciphersuite disabled
   1040      mask based on the current session, check mask when sending client
   1041      hello and checking the requested ciphersuite.
   1042      [Steve Henson]
   1044   *) New ctrls to retrieve and set certificate types in a certificate
   1045      request message. Print out received values in s_client. If certificate
   1046      types is not set with custom values set sensible values based on
   1047      supported signature algorithms.
   1048      [Steve Henson]
   1050   *) Support for distinct client and server supported signature algorithms.
   1051      [Steve Henson]
   1053   *) Add certificate callback. If set this is called whenever a certificate
   1054      is required by client or server. An application can decide which
   1055      certificate chain to present based on arbitrary criteria: for example
   1056      supported signature algorithms. Add very simple example to s_server.
   1057      This fixes many of the problems and restrictions of the existing client
   1058      certificate callback: for example you can now clear an existing
   1059      certificate and specify the whole chain.
   1060      [Steve Henson]
   1062   *) Add new "valid_flags" field to CERT_PKEY structure which determines what
   1063      the certificate can be used for (if anything). Set valid_flags field 
   1064      in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
   1065      to have similar checks in it.
   1067      Add new "cert_flags" field to CERT structure and include a "strict mode".
   1068      This enforces some TLS certificate requirements (such as only permitting
   1069      certificate signature algorithms contained in the supported algorithms
   1070      extension) which some implementations ignore: this option should be used
   1071      with caution as it could cause interoperability issues.
   1072      [Steve Henson]
   1074   *) Update and tidy signature algorithm extension processing. Work out
   1075      shared signature algorithms based on preferences and peer algorithms
   1076      and print them out in s_client and s_server. Abort handshake if no
   1077      shared signature algorithms.
   1078      [Steve Henson]
   1080   *) Add new functions to allow customised supported signature algorithms
   1081      for SSL and SSL_CTX structures. Add options to s_client and s_server
   1082      to support them.
   1083      [Steve Henson]
   1085   *) New function SSL_certs_clear() to delete all references to certificates
   1086      from an SSL structure. Before this once a certificate had been added
   1087      it couldn't be removed.
   1088      [Steve Henson]
   1090   *) Integrate hostname, email address and IP address checking with certificate
   1091      verification. New verify options supporting checking in opensl utility.
   1092      [Steve Henson]
   1094   *) Fixes and wildcard matching support to hostname and email checking
   1095      functions. Add manual page.
   1096      [Florian Weimer (Red Hat Product Security Team)]
   1098   *) New functions to check a hostname email or IP address against a
   1099      certificate. Add options x509 utility to print results of checks against
   1100      a certificate.
   1101      [Steve Henson]
   1103   *) Fix OCSP checking.
   1104      [Rob Stradling <rob.stradling (a] comodo.com> and Ben Laurie]
   1106   *) Initial experimental support for explicitly trusted non-root CAs. 
   1107      OpenSSL still tries to build a complete chain to a root but if an
   1108      intermediate CA has a trust setting included that is used. The first
   1109      setting is used: whether to trust (e.g., -addtrust option to the x509
   1110      utility) or reject.
   1111      [Steve Henson]
   1113   *) Add -trusted_first option which attempts to find certificates in the
   1114      trusted store even if an untrusted chain is also supplied.
   1115      [Steve Henson]
   1117   *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
   1118      platform support for Linux and Android.
   1119      [Andy Polyakov]
   1121   *) Support for linux-x32, ILP32 environment in x86_64 framework.
   1122      [Andy Polyakov]
   1124   *) Experimental multi-implementation support for FIPS capable OpenSSL.
   1125      When in FIPS mode the approved implementations are used as normal,
   1126      when not in FIPS mode the internal unapproved versions are used instead.
   1127      This means that the FIPS capable OpenSSL isn't forced to use the
   1128      (often lower perfomance) FIPS implementations outside FIPS mode.
   1129      [Steve Henson]
   1131   *) Transparently support X9.42 DH parameters when calling
   1132      PEM_read_bio_DHparameters. This means existing applications can handle
   1133      the new parameter format automatically.
   1134      [Steve Henson]
   1136   *) Initial experimental support for X9.42 DH parameter format: mainly
   1137      to support use of 'q' parameter for RFC5114 parameters.
   1138      [Steve Henson]
   1140   *) Add DH parameters from RFC5114 including test data to dhtest.
   1141      [Steve Henson]
   1143   *) Support for automatic EC temporary key parameter selection. If enabled
   1144      the most preferred EC parameters are automatically used instead of
   1145      hardcoded fixed parameters. Now a server just has to call:
   1146      SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
   1147      support ECDH and use the most appropriate parameters.
   1148      [Steve Henson]
   1150   *) Enhance and tidy EC curve and point format TLS extension code. Use
   1151      static structures instead of allocation if default values are used.
   1152      New ctrls to set curves we wish to support and to retrieve shared curves.
   1153      Print out shared curves in s_server. New options to s_server and s_client
   1154      to set list of supported curves.
   1155      [Steve Henson]
   1157   *) New ctrls to retrieve supported signature algorithms and 
   1158      supported curve values as an array of NIDs. Extend openssl utility
   1159      to print out received values.
   1160      [Steve Henson]
   1162   *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
   1163      between NIDs and the more common NIST names such as "P-256". Enhance
   1164      ecparam utility and ECC method to recognise the NIST names for curves.
   1165      [Steve Henson]
   1167   *) Enhance SSL/TLS certificate chain handling to support different
   1168      chains for each certificate instead of one chain in the parent SSL_CTX.
   1169      [Steve Henson]
   1171   *) Support for fixed DH ciphersuite client authentication: where both
   1172      server and client use DH certificates with common parameters.
   1173      [Steve Henson]
   1175   *) Support for fixed DH ciphersuites: those requiring DH server
   1176      certificates.
   1177      [Steve Henson]
   1179   *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
   1180      the certificate.
   1181      Note: Related 1.0.2-beta specific macros X509_get_cert_info,
   1182      X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
   1183      X509_CINF_get_signature were reverted post internal team review.
   1185  Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
   1187   *) Build fixes for the Windows and OpenVMS platforms
   1188      [Matt Caswell and Richard Levitte]
   1190  Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
   1192   *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
   1193      message can cause a segmentation fault in OpenSSL due to a NULL pointer
   1194      dereference. This could lead to a Denial Of Service attack. Thanks to
   1195      Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
   1196      (CVE-2014-3571)
   1197      [Steve Henson]
   1199   *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
   1200      dtls1_buffer_record function under certain conditions. In particular this
   1201      could occur if an attacker sent repeated DTLS records with the same
   1202      sequence number but for the next epoch. The memory leak could be exploited
   1203      by an attacker in a Denial of Service attack through memory exhaustion.
   1204      Thanks to Chris Mueller for reporting this issue.
   1205      (CVE-2015-0206)
   1206      [Matt Caswell]
   1208   *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
   1209      built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
   1210      method would be set to NULL which could later result in a NULL pointer
   1211      dereference. Thanks to Frank Schmirler for reporting this issue.
   1212      (CVE-2014-3569)
   1213      [Kurt Roeckx]
   1215   *) Abort handshake if server key exchange message is omitted for ephemeral
   1216      ECDH ciphersuites.
   1218      Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
   1219      reporting this issue.
   1220      (CVE-2014-3572)
   1221      [Steve Henson]
   1223   *) Remove non-export ephemeral RSA code on client and server. This code
   1224      violated the TLS standard by allowing the use of temporary RSA keys in
   1225      non-export ciphersuites and could be used by a server to effectively
   1226      downgrade the RSA key length used to a value smaller than the server
   1227      certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
   1228      INRIA or reporting this issue.
   1229      (CVE-2015-0204)
   1230      [Steve Henson]
   1232   *) Fixed issue where DH client certificates are accepted without verification.
   1233      An OpenSSL server will accept a DH certificate for client authentication
   1234      without the certificate verify message. This effectively allows a client to
   1235      authenticate without the use of a private key. This only affects servers
   1236      which trust a client certificate authority which issues certificates
   1237      containing DH keys: these are extremely rare and hardly ever encountered.
   1238      Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
   1239      this issue.
   1240      (CVE-2015-0205)
   1241      [Steve Henson]
   1243   *) Ensure that the session ID context of an SSL is updated when its
   1244      SSL_CTX is updated via SSL_set_SSL_CTX.
   1246      The session ID context is typically set from the parent SSL_CTX,
   1247      and can vary with the CTX.
   1248      [Adam Langley]
   1250   *) Fix various certificate fingerprint issues.
   1252      By using non-DER or invalid encodings outside the signed portion of a
   1253      certificate the fingerprint can be changed without breaking the signature.
   1254      Although no details of the signed portion of the certificate can be changed
   1255      this can cause problems with some applications: e.g. those using the
   1256      certificate fingerprint for blacklists.
   1258      1. Reject signatures with non zero unused bits.
   1260      If the BIT STRING containing the signature has non zero unused bits reject
   1261      the signature. All current signature algorithms require zero unused bits.
   1263      2. Check certificate algorithm consistency.
   1265      Check the AlgorithmIdentifier inside TBS matches the one in the
   1266      certificate signature. NB: this will result in signature failure
   1267      errors for some broken certificates.
   1269      Thanks to Konrad Kraszewski from Google for reporting this issue.
   1271      3. Check DSA/ECDSA signatures use DER.
   1273      Reencode DSA/ECDSA signatures and compare with the original received
   1274      signature. Return an error if there is a mismatch.
   1276      This will reject various cases including garbage after signature
   1277      (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
   1278      program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
   1279      (negative or with leading zeroes).
   1281      Further analysis was conducted and fixes were developed by Stephen Henson
   1282      of the OpenSSL core team.
   1284      (CVE-2014-8275)
   1285      [Steve Henson]
   1287    *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
   1288       results on some platforms, including x86_64. This bug occurs at random
   1289       with a very low probability, and is not known to be exploitable in any
   1290       way, though its exact impact is difficult to determine. Thanks to Pieter
   1291       Wuille (Blockstream) who reported this issue and also suggested an initial
   1292       fix. Further analysis was conducted by the OpenSSL development team and
   1293       Adam Langley of Google. The final fix was developed by Andy Polyakov of
   1294       the OpenSSL core team.
   1295       (CVE-2014-3570)
   1296       [Andy Polyakov]
   1298    *) Do not resume sessions on the server if the negotiated protocol
   1299       version does not match the session's version. Resuming with a different
   1300       version, while not strictly forbidden by the RFC, is of questionable
   1301       sanity and breaks all known clients.
   1302       [David Benjamin, Emilia Ksper]
   1304    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
   1305       early CCS messages during renegotiation. (Note that because
   1306       renegotiation is encrypted, this early CCS was not exploitable.)
   1307       [Emilia Ksper]
   1309    *) Tighten client-side session ticket handling during renegotiation:
   1310       ensure that the client only accepts a session ticket if the server sends
   1311       the extension anew in the ServerHello. Previously, a TLS client would
   1312       reuse the old extension state and thus accept a session ticket if one was
   1313       announced in the initial ServerHello.
   1315       Similarly, ensure that the client requires a session ticket if one
   1316       was advertised in the ServerHello. Previously, a TLS client would
   1317       ignore a missing NewSessionTicket message.
   1318       [Emilia Ksper]
   1320  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
   1322   *) SRTP Memory Leak.
   1324      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
   1325      sends a carefully crafted handshake message, to cause OpenSSL to fail
   1326      to free up to 64k of memory causing a memory leak. This could be
   1327      exploited in a Denial Of Service attack. This issue affects OpenSSL
   1328      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
   1329      whether SRTP is used or configured. Implementations of OpenSSL that
   1330      have been compiled with OPENSSL_NO_SRTP defined are not affected.
   1332      The fix was developed by the OpenSSL team.
   1333      (CVE-2014-3513)
   1334      [OpenSSL team]
   1336   *) Session Ticket Memory Leak.
   1338      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
   1339      integrity of that ticket is first verified. In the event of a session
   1340      ticket integrity check failing, OpenSSL will fail to free memory
   1341      causing a memory leak. By sending a large number of invalid session
   1342      tickets an attacker could exploit this issue in a Denial Of Service
   1343      attack.
   1344      (CVE-2014-3567)
   1345      [Steve Henson]
   1347   *) Build option no-ssl3 is incomplete.
   1349      When OpenSSL is configured with "no-ssl3" as a build option, servers
   1350      could accept and complete a SSL 3.0 handshake, and clients could be
   1351      configured to send them.
   1352      (CVE-2014-3568)
   1353      [Akamai and the OpenSSL team]
   1355   *) Add support for TLS_FALLBACK_SCSV.
   1356      Client applications doing fallback retries should call
   1357      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
   1358      (CVE-2014-3566)
   1359      [Adam Langley, Bodo Moeller]
   1361   *) Add additional DigestInfo checks.
   1363      Reencode DigestInto in DER and check against the original when
   1364      verifying RSA signature: this will reject any improperly encoded
   1365      DigestInfo structures.
   1367      Note: this is a precautionary measure and no attacks are currently known.
   1369      [Steve Henson]
   1371  Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
   1373   *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
   1374      SRP code can be overrun an internal buffer. Add sanity check that
   1375      g, A, B < N to SRP code.
   1377      Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
   1378      Group for discovering this issue.
   1379      (CVE-2014-3512)
   1380      [Steve Henson]
   1382   *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
   1383      TLS 1.0 instead of higher protocol versions when the ClientHello message
   1384      is badly fragmented. This allows a man-in-the-middle attacker to force a
   1385      downgrade to TLS 1.0 even if both the server and the client support a
   1386      higher protocol version, by modifying the client's TLS records.
   1388      Thanks to David Benjamin and Adam Langley (Google) for discovering and
   1389      researching this issue.
   1390      (CVE-2014-3511)
   1391      [David Benjamin]
   1393   *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
   1394      to a denial of service attack. A malicious server can crash the client
   1395      with a null pointer dereference (read) by specifying an anonymous (EC)DH
   1396      ciphersuite and sending carefully crafted handshake messages.
   1398      Thanks to Felix Grbert (Google) for discovering and researching this
   1399      issue.
   1400      (CVE-2014-3510)
   1401      [Emilia Ksper]
   1403   *) By sending carefully crafted DTLS packets an attacker could cause openssl
   1404      to leak memory. This can be exploited through a Denial of Service attack.
   1405      Thanks to Adam Langley for discovering and researching this issue.
   1406      (CVE-2014-3507)
   1407      [Adam Langley]
   1409   *) An attacker can force openssl to consume large amounts of memory whilst
   1410      processing DTLS handshake messages. This can be exploited through a
   1411      Denial of Service attack.
   1412      Thanks to Adam Langley for discovering and researching this issue.
   1413      (CVE-2014-3506)
   1414      [Adam Langley]
   1416   *) An attacker can force an error condition which causes openssl to crash
   1417      whilst processing DTLS packets due to memory being freed twice. This
   1418      can be exploited through a Denial of Service attack.
   1419      Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
   1420      this issue.
   1421      (CVE-2014-3505)
   1422      [Adam Langley]
   1424   *) If a multithreaded client connects to a malicious server using a resumed
   1425      session and the server sends an ec point format extension it could write
   1426      up to 255 bytes to freed memory.
   1428      Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
   1429      issue.
   1430      (CVE-2014-3509)
   1431      [Gabor Tyukasz]
   1433   *) A malicious server can crash an OpenSSL client with a null pointer
   1434      dereference (read) by specifying an SRP ciphersuite even though it was not
   1435      properly negotiated with the client. This can be exploited through a
   1436      Denial of Service attack.
   1438      Thanks to Joonas Kuorilehto and Riku Hietamki (Codenomicon) for
   1439      discovering and researching this issue.
   1440      (CVE-2014-5139)
   1441      [Steve Henson]
   1443   *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
   1444      X509_name_oneline, X509_name_print_ex et al. to leak some information
   1445      from the stack. Applications may be affected if they echo pretty printing
   1446      output to the attacker.
   1448      Thanks to Ivan Fratric (Google) for discovering this issue.
   1449      (CVE-2014-3508)
   1450      [Emilia Ksper, and Steve Henson]
   1452   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
   1453      for corner cases. (Certain input points at infinity could lead to
   1454      bogus results, with non-infinity inputs mapped to infinity too.)
   1455      [Bodo Moeller]
   1457  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
   1459   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
   1460      handshake can force the use of weak keying material in OpenSSL
   1461      SSL/TLS clients and servers.
   1463      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
   1464      researching this issue. (CVE-2014-0224)
   1465      [KIKUCHI Masashi, Steve Henson]
   1467   *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
   1468      OpenSSL DTLS client the code can be made to recurse eventually crashing
   1469      in a DoS attack.
   1471      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
   1472      (CVE-2014-0221)
   1473      [Imre Rad, Steve Henson]
   1475   *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
   1476      be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
   1477      client or server. This is potentially exploitable to run arbitrary
   1478      code on a vulnerable client or server.
   1480      Thanks to Jri Aedla for reporting this issue. (CVE-2014-0195)
   1481      [Jri Aedla, Steve Henson]
   1483   *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
   1484      are subject to a denial of service attack.
   1486      Thanks to Felix Grbert and Ivan Fratric at Google for discovering
   1487      this issue. (CVE-2014-3470)
   1488      [Felix Grbert, Ivan Fratric, Steve Henson]
   1490   *) Harmonize version and its documentation. -f flag is used to display
   1491      compilation flags.
   1492      [mancha <mancha1 (a] zoho.com>]
   1494   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
   1495      in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
   1496      [mancha <mancha1 (a] zoho.com>]
   1498   *) Fix some double frees. These are not thought to be exploitable.
   1499      [mancha <mancha1 (a] zoho.com>]
   1501  Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
   1503   *) A missing bounds check in the handling of the TLS heartbeat extension
   1504      can be used to reveal up to 64k of memory to a connected client or
   1505      server.
   1507      Thanks for Neel Mehta of Google Security for discovering this bug and to
   1508      Adam Langley <agl (a] chromium.org> and Bodo Moeller <bmoeller (a] acm.org> for
   1509      preparing the fix (CVE-2014-0160)
   1510      [Adam Langley, Bodo Moeller]
   1512   *) Fix for the attack described in the paper "Recovering OpenSSL
   1513      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
   1514      by Yuval Yarom and Naomi Benger. Details can be obtained from:
   1515      http://eprint.iacr.org/2014/140
   1517      Thanks to Yuval Yarom and Naomi Benger for discovering this
   1518      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
   1519      [Yuval Yarom and Naomi Benger]
   1521   *) TLS pad extension: draft-agl-tls-padding-03
   1523      Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
   1524      TLS client Hello record length value would otherwise be > 255 and
   1525      less that 512 pad with a dummy extension containing zeroes so it
   1526      is at least 512 bytes long.
   1528      [Adam Langley, Steve Henson]
   1530  Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
   1532   *) Fix for TLS record tampering bug. A carefully crafted invalid 
   1533      handshake could crash OpenSSL with a NULL pointer exception.
   1534      Thanks to Anton Johansson for reporting this issues.
   1535      (CVE-2013-4353)
   1537   *) Keep original DTLS digest and encryption contexts in retransmission
   1538      structures so we can use the previous session parameters if they need
   1539      to be resent. (CVE-2013-6450)
   1540      [Steve Henson]
   1542   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
   1543      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
   1544      Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
   1545      several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
   1546      is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
   1547      10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
   1548      [Rob Stradling, Adam Langley]
   1550  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
   1552   *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
   1553      supporting platforms or when small records were transferred.
   1554      [Andy Polyakov, Steve Henson]
   1556  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
   1558   *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
   1560      This addresses the flaw in CBC record processing discovered by 
   1561      Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
   1562      at: http://www.isg.rhul.ac.uk/tls/     
   1564      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   1565      Security Group at Royal Holloway, University of London
   1566      (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
   1567      Emilia Ksper for the initial patch.
   1568      (CVE-2013-0169)
   1569      [Emilia Ksper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
   1571   *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
   1572      ciphersuites which can be exploited in a denial of service attack.
   1573      Thanks go to and to Adam Langley <agl (a] chromium.org> for discovering
   1574      and detecting this bug and to Wolfgang Ettlinger
   1575      <wolfgang.ettlinger (a] gmail.com> for independently discovering this issue.
   1576      (CVE-2012-2686)
   1577      [Adam Langley]
   1579   *) Return an error when checking OCSP signatures when key is NULL.
   1580      This fixes a DoS attack. (CVE-2013-0166)
   1581      [Steve Henson]
   1583   *) Make openssl verify return errors.
   1584      [Chris Palmer <palmer (a] google.com> and Ben Laurie]
   1586   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
   1587      the right response is stapled. Also change SSL_get_certificate()
   1588      so it returns the certificate actually sent.
   1589      See http://rt.openssl.org/Ticket/Display.html?id=2836.
   1590      [Rob Stradling <rob.stradling (a] comodo.com>]
   1592   *) Fix possible deadlock when decoding public keys.
   1593      [Steve Henson]
   1595   *) Don't use TLS 1.0 record version number in initial client hello
   1596      if renegotiating.
   1597      [Steve Henson]
   1599  Changes between 1.0.1b and 1.0.1c [10 May 2012]
   1601   *) Sanity check record length before skipping explicit IV in TLS
   1602      1.2, 1.1 and DTLS to fix DoS attack.
   1604      Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
   1605      fuzzing as a service testing platform.
   1606      (CVE-2012-2333)
   1607      [Steve Henson]
   1609   *) Initialise tkeylen properly when encrypting CMS messages.
   1610      Thanks to Solar Designer of Openwall for reporting this issue.
   1611      [Steve Henson]
   1613   *) In FIPS mode don't try to use composite ciphers as they are not
   1614      approved.
   1615      [Steve Henson]
   1617  Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
   1619   *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
   1620      1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
   1621      mean any application compiled against OpenSSL 1.0.0 headers setting
   1622      SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
   1623      TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
   1624      0x10000000L Any application which was previously compiled against
   1625      OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
   1626      will need to be recompiled as a result. Letting be results in
   1627      inability to disable specifically TLS 1.1 and in client context,
   1628      in unlike event, limit maximum offered version to TLS 1.0 [see below].
   1629      [Steve Henson]
   1631   *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
   1632      disable just protocol X, but all protocols above X *if* there are
   1633      protocols *below* X still enabled. In more practical terms it means
   1634      that if application wants to disable TLS1.0 in favor of TLS1.1 and
   1635      above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
   1636      SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
   1637      client side.
   1638      [Andy Polyakov]
   1640  Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
   1642   *) Check for potentially exploitable overflows in asn1_d2i_read_bio
   1643      BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
   1644      in CRYPTO_realloc_clean.
   1646      Thanks to Tavis Ormandy, Google Security Team, for discovering this
   1647      issue and to Adam Langley <agl (a] chromium.org> for fixing it.
   1648      (CVE-2012-2110)
   1649      [Adam Langley (Google), Tavis Ormandy, Google Security Team]
   1651   *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
   1652      [Adam Langley]
   1654   *) Workarounds for some broken servers that "hang" if a client hello
   1655      record length exceeds 255 bytes.
   1657      1. Do not use record version number > TLS 1.0 in initial client
   1658         hello: some (but not all) hanging servers will now work.
   1659      2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
   1660 	the number of ciphers sent in the client hello. This should be
   1661         set to an even number, such as 50, for example by passing:
   1662         -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
   1663         Most broken servers should now work.
   1664      3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
   1665 	TLS 1.2 client support entirely.
   1666      [Steve Henson]
   1668   *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
   1669      [Andy Polyakov]
   1671  Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
   1673   *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
   1674      STRING form instead of a DigestInfo.
   1675      [Steve Henson]
   1677   *) The format used for MDC2 RSA signatures is inconsistent between EVP
   1678      and the RSA_sign/RSA_verify functions. This was made more apparent when
   1679      OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
   1680      those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
   1681      the correct format in RSA_verify so both forms transparently work.
   1682      [Steve Henson]
   1684   *) Some servers which support TLS 1.0 can choke if we initially indicate
   1685      support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
   1686      encrypted premaster secret. As a workaround use the maximum pemitted
   1687      client version in client hello, this should keep such servers happy
   1688      and still work with previous versions of OpenSSL.
   1689      [Steve Henson]
   1691   *) Add support for TLS/DTLS heartbeats.
   1692      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   1694   *) Add support for SCTP.
   1695      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   1697   *) Improved PRNG seeding for VOS.
   1698      [Paul Green <Paul.Green (a] stratus.com>]
   1700   *) Extensive assembler packs updates, most notably:
   1702 	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
   1703 	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
   1704 	- x86_64:       bit-sliced AES implementation;
   1705 	- ARM:          NEON support, contemporary platforms optimizations;
   1706 	- s390x:        z196 support;
   1707 	- *:            GHASH and GF(2^m) multiplication implementations;
   1709      [Andy Polyakov]
   1711   *) Make TLS-SRP code conformant with RFC 5054 API cleanup
   1712      (removal of unnecessary code)
   1713      [Peter Sylvester <peter.sylvester (a] edelweb.fr>]
   1715   *) Add TLS key material exporter from RFC 5705.
   1716      [Eric Rescorla]
   1718   *) Add DTLS-SRTP negotiation from RFC 5764.
   1719      [Eric Rescorla]
   1721   *) Add Next Protocol Negotiation,
   1722      http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
   1723      disabled with a no-npn flag to config or Configure. Code donated
   1724      by Google.
   1725      [Adam Langley <agl (a] google.com> and Ben Laurie]
   1727   *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
   1728      NIST-P256, NIST-P521, with constant-time single point multiplication on
   1729      typical inputs. Compiler support for the nonstandard type __uint128_t is
   1730      required to use this (present in gcc 4.4 and later, for 64-bit builds).
   1731      Code made available under Apache License version 2.0.
   1733      Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
   1734      line to include this in your build of OpenSSL, and run "make depend" (or
   1735      "make update"). This enables the following EC_METHODs:
   1737          EC_GFp_nistp224_method()
   1738          EC_GFp_nistp256_method()
   1739          EC_GFp_nistp521_method()
   1741      EC_GROUP_new_by_curve_name() will automatically use these (while
   1742      EC_GROUP_new_curve_GFp() currently prefers the more flexible
   1743      implementations).
   1744      [Emilia Ksper, Adam Langley, Bodo Moeller (Google)]
   1746   *) Use type ossl_ssize_t instad of ssize_t which isn't available on
   1747      all platforms. Move ssize_t definition from e_os.h to the public
   1748      header file e_os2.h as it now appears in public header file cms.h
   1749      [Steve Henson]
   1751   *) New -sigopt option to the ca, req and x509 utilities. Additional
   1752      signature parameters can be passed using this option and in
   1753      particular PSS. 
   1754      [Steve Henson]
   1756   *) Add RSA PSS signing function. This will generate and set the
   1757      appropriate AlgorithmIdentifiers for PSS based on those in the
   1758      corresponding EVP_MD_CTX structure. No application support yet.
   1759      [Steve Henson]
   1761   *) Support for companion algorithm specific ASN1 signing routines.
   1762      New function ASN1_item_sign_ctx() signs a pre-initialised
   1763      EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
   1764      the appropriate parameters.
   1765      [Steve Henson]
   1767   *) Add new algorithm specific ASN1 verification initialisation function
   1768      to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
   1769      handling will be the same no matter what EVP_PKEY_METHOD is used.
   1770      Add a PSS handler to support verification of PSS signatures: checked
   1771      against a number of sample certificates.
   1772      [Steve Henson]
   1774   *) Add signature printing for PSS. Add PSS OIDs.
   1775      [Steve Henson, Martin Kaiser <lists (a] kaiser.cx>]
   1777   *) Add algorithm specific signature printing. An individual ASN1 method
   1778      can now print out signatures instead of the standard hex dump. 
   1780      More complex signatures (e.g. PSS) can print out more meaningful
   1781      information. Include DSA version that prints out the signature
   1782      parameters r, s.
   1783      [Steve Henson]
   1785   *) Password based recipient info support for CMS library: implementing
   1786      RFC3211.
   1787      [Steve Henson]
   1789   *) Split password based encryption into PBES2 and PBKDF2 functions. This
   1790      neatly separates the code into cipher and PBE sections and is required
   1791      for some algorithms that split PBES2 into separate pieces (such as
   1792      password based CMS).
   1793      [Steve Henson]
   1795   *) Session-handling fixes:
   1796      - Fix handling of connections that are resuming with a session ID,
   1797        but also support Session Tickets.
   1798      - Fix a bug that suppressed issuing of a new ticket if the client
   1799        presented a ticket with an expired session.
   1800      - Try to set the ticket lifetime hint to something reasonable.
   1801      - Make tickets shorter by excluding irrelevant information.
   1802      - On the client side, don't ignore renewed tickets.
   1803      [Adam Langley, Bodo Moeller (Google)]
   1805   *) Fix PSK session representation.
   1806      [Bodo Moeller]
   1808   *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
   1810      This work was sponsored by Intel.
   1811      [Andy Polyakov]
   1813   *) Add GCM support to TLS library. Some custom code is needed to split
   1814      the IV between the fixed (from PRF) and explicit (from TLS record)
   1815      portions. This adds all GCM ciphersuites supported by RFC5288 and 
   1816      RFC5289. Generalise some AES* cipherstrings to inlclude GCM and
   1817      add a special AESGCM string for GCM only.
   1818      [Steve Henson]
   1820   *) Expand range of ctrls for AES GCM. Permit setting invocation
   1821      field on decrypt and retrieval of invocation field only on encrypt.
   1822      [Steve Henson]
   1824   *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
   1825      As required by RFC5289 these ciphersuites cannot be used if for
   1826      versions of TLS earlier than 1.2.
   1827      [Steve Henson]
   1829   *) For FIPS capable OpenSSL interpret a NULL default public key method
   1830      as unset and return the appopriate default but do *not* set the default.
   1831      This means we can return the appopriate method in applications that
   1832      swicth between FIPS and non-FIPS modes.
   1833      [Steve Henson]
   1835   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
   1836      ENGINE is used then we cannot handle that in the FIPS module so we
   1837      keep original code iff non-FIPS operations are allowed.
   1838      [Steve Henson]
   1840   *) Add -attime option to openssl utilities.
   1841      [Peter Eckersley <pde (a] eff.org>, Ben Laurie and Steve Henson]
   1843   *) Redirect DSA and DH operations to FIPS module in FIPS mode.
   1844      [Steve Henson]
   1846   *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
   1847      FIPS EC methods unconditionally for now.
   1848      [Steve Henson]
   1850   *) New build option no-ec2m to disable characteristic 2 code.
   1851      [Steve Henson]
   1853   *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
   1854      all cases can be covered as some introduce binary incompatibilities.
   1855      [Steve Henson]
   1857   *) Redirect RSA operations to FIPS module including keygen,
   1858      encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
   1859      [Steve Henson]
   1861   *) Add similar low level API blocking to ciphers.
   1862      [Steve Henson]
   1864   *) Low level digest APIs are not approved in FIPS mode: any attempt
   1865      to use these will cause a fatal error. Applications that *really* want
   1866      to use them can use the private_* version instead.
   1867      [Steve Henson]
   1869   *) Redirect cipher operations to FIPS module for FIPS builds. 
   1870      [Steve Henson]
   1872   *) Redirect digest operations to FIPS module for FIPS builds. 
   1873      [Steve Henson]
   1875   *) Update build system to add "fips" flag which will link in fipscanister.o
   1876      for static and shared library builds embedding a signature if needed.
   1877      [Steve Henson]
   1879   *) Output TLS supported curves in preference order instead of numerical
   1880      order. This is currently hardcoded for the highest order curves first.
   1881      This should be configurable so applications can judge speed vs strength.
   1882      [Steve Henson]
   1884   *) Add TLS v1.2 server support for client authentication. 
   1885      [Steve Henson]
   1887   *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
   1888      and enable MD5.
   1889      [Steve Henson]
   1891   *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
   1892      FIPS modules versions.
   1893      [Steve Henson]
   1895   *) Add TLS v1.2 client side support for client authentication. Keep cache
   1896      of handshake records longer as we don't know the hash algorithm to use
   1897      until after the certificate request message is received.
   1898      [Steve Henson]
   1900   *) Initial TLS v1.2 client support. Add a default signature algorithms
   1901      extension including all the algorithms we support. Parse new signature
   1902      format in client key exchange. Relax some ECC signing restrictions for
   1903      TLS v1.2 as indicated in RFC5246.
   1904      [Steve Henson]
   1906   *) Add server support for TLS v1.2 signature algorithms extension. Switch
   1907      to new signature format when needed using client digest preference.
   1908      All server ciphersuites should now work correctly in TLS v1.2. No client
   1909      support yet and no support for client certificates.
   1910      [Steve Henson]
   1912   *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
   1913      to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
   1914      ciphersuites. At present only RSA key exchange ciphersuites work with
   1915      TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
   1916      SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
   1917      and version checking.
   1918      [Steve Henson]
   1920   *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
   1921      with this defined it will not be affected by any changes to ssl internal
   1922      structures. Add several utility functions to allow openssl application
   1923      to work with OPENSSL_NO_SSL_INTERN defined.
   1924      [Steve Henson]
   1926   *) Add SRP support.
   1927      [Tom Wu <tjw (a] cs.stanford.edu> and Ben Laurie]
   1929   *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
   1930      [Steve Henson]
   1932   *) Permit abbreviated handshakes when renegotiating using the function
   1933      SSL_renegotiate_abbreviated().
   1934      [Robin Seggelmann <seggelmann (a] fh-muenster.de>]
   1936   *) Add call to ENGINE_register_all_complete() to
   1937      ENGINE_load_builtin_engines(), so some implementations get used
   1938      automatically instead of needing explicit application support.
   1939      [Steve Henson]
   1941   *) Add support for TLS key exporter as described in RFC5705.
   1942      [Robin Seggelmann <seggelmann (a] fh-muenster.de>, Steve Henson]
   1944   *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
   1945      a few changes are required:
   1947        Add SSL_OP_NO_TLSv1_1 flag.
   1948        Add TLSv1_1 methods.
   1949        Update version checking logic to handle version 1.1.
   1950        Add explicit IV handling (ported from DTLS code).
   1951        Add command line options to s_client/s_server.
   1952      [Steve Henson]
   1954  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
   1956   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
   1957      in CMS and PKCS7 code. When RSA decryption fails use a random key for
   1958      content decryption and always return the same error. Note: this attack
   1959      needs on average 2^20 messages so it only affects automated senders. The
   1960      old behaviour can be reenabled in the CMS code by setting the
   1961      CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
   1962      an MMA defence is not necessary.
   1963      Thanks to Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering
   1964      this issue. (CVE-2012-0884)
   1965      [Steve Henson]
   1967   *) Fix CVE-2011-4619: make sure we really are receiving a 
   1968      client hello before rejecting multiple SGC restarts. Thanks to
   1969      Ivan Nestlerode <inestlerode (a] us.ibm.com> for discovering this bug.
   1970      [Steve Henson]
   1972  Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
   1974   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
   1975      Thanks to Antonio Martin, Enterprise Secure Access Research and
   1976      Development, Cisco Systems, Inc. for discovering this bug and
   1977      preparing a fix. (CVE-2012-0050)
   1978      [Antonio Martin]
   1980  Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
   1982   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
   1983      of the Vaudenay padding oracle attack on CBC mode encryption
   1984      which enables an efficient plaintext recovery attack against
   1985      the OpenSSL implementation of DTLS. Their attack exploits timing
   1986      differences arising during decryption processing. A research
   1987      paper describing this attack can be found at:
   1988                   http://www.isg.rhul.ac.uk/~kp/dtls.pdf
   1989      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
   1990      Security Group at Royal Holloway, University of London
   1991      (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
   1992      <seggelmann (a] fh-muenster.de> and Michael Tuexen <tuexen (a] fh-muenster.de>
   1993      for preparing the fix. (CVE-2011-4108)
   1994      [Robin Seggelmann, Michael Tuexen]
   1996   *) Clear bytes used for block padding of SSL 3.0 records.
   1997      (CVE-2011-4576)
   1998      [Adam Langley (Google)]
   2000   *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
   2001      Kadianakis <desnacked (a] gmail.com> for discovering this issue and
   2002      Adam Langley for preparing the fix. (CVE-2011-4619)
   2003      [Adam Langley (Google)]
   2005   *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
   2006      [Andrey Kulikov <amdeich (a] gmail.com>]
   2008   *) Prevent malformed RFC3779 data triggering an assertion failure.
   2009      Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
   2010      and Rob Austein <sra (a] hactrn.net> for fixing it. (CVE-2011-4577)
   2011      [Rob Austein <sra (a] hactrn.net>]
   2013   *) Improved PRNG seeding for VOS.
   2014      [Paul Green <Paul.Green (a] stratus.com>]
   2016   *) Fix ssl_ciph.c set-up race.
   2017      [Adam Langley (Google)]
   2019   *) Fix spurious failures in ecdsatest.c.
   2020      [Emilia Ksper (Google)]
   2022   *) Fix the BIO_f_buffer() implementation (which was mixing different
   2023      interpretations of the '..._len' fields).
   2024      [Adam Langley (Google)]
   2026   *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
   2027      BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
   2028      threads won't reuse the same blinding coefficients.
   2030      This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
   2031      lock to call BN_BLINDING_invert_ex, and avoids one use of
   2032      BN_BLINDING_update for each BN_BLINDING structure (previously,
   2033      the last update always remained unused).
   2034      [Emilia Ksper (Google)]
   2036   *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
   2037      [Bob Buckholz (Google)]
   2039  Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
   2041   *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
   2042      by initialising X509_STORE_CTX properly. (CVE-2011-3207)
   2043      [Kaspar Brand <ossl (a] velox.ch>]
   2045   *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
   2046      for multi-threaded use of ECDH. (CVE-2011-3210)
   2047      [Adam Langley (Google)]
   2049   *) Fix x509_name_ex_d2i memory leak on bad inputs.
   2050      [Bodo Moeller]
   2052   *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
   2053      signature public key algorithm by using OID xref utilities instead.
   2054      Before this you could only use some ECC ciphersuites with SHA1 only.
   2055      [Steve Henson]
   2057   *) Add protection against ECDSA timing attacks as mentioned in the paper
   2058      by Billy Bob Brumley and Nicola Tuveri, see:
   2060 	http://eprint.iacr.org/2011/232.pdf
   2062      [Billy Bob Brumley and Nicola Tuveri]
   2064  Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
   2066   *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
   2067      [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
   2069   *) Fix bug in string printing code: if *any* escaping is enabled we must
   2070      escape the escape character (backslash) or the resulting string is
   2071      ambiguous.
   2072      [Steve Henson]
   2074  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
   2076   *) Disable code workaround for ancient and obsolete Netscape browsers
   2077      and servers: an attacker can use it in a ciphersuite downgrade attack.
   2078      Thanks to Martin Rex for discovering this bug. CVE-2010-4180
   2079      [Steve Henson]
   2081   *) Fixed J-PAKE implementation error, originally discovered by
   2082      Sebastien Martini, further info and confirmation from Stefan
   2083      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
   2084      [Ben Laurie]
   2086  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
   2088   *) Fix extension code to avoid race conditions which can result in a buffer
   2089      overrun vulnerability: resumed sessions must not be modified as they can
   2090      be shared by multiple threads. CVE-2010-3864
   2091      [Steve Henson]
   2093   *) Fix WIN32 build system to correctly link an ENGINE directory into
   2094      a DLL. 
   2095      [Steve Henson]
   2097  Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
   2099   *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
   2100      (CVE-2010-1633)
   2101      [Steve Henson, Peter-Michael Hager <hager (a] dortmund.net>]
   2103  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
   2105   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
   2106      context. The operation can be customised via the ctrl mechanism in
   2107      case ENGINEs want to include additional functionality.
   2108      [Steve Henson]
   2110   *) Tolerate yet another broken PKCS#8 key format: private key value negative.
   2111      [Steve Henson]
   2113   *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
   2114      output hashes compatible with older versions of OpenSSL.
   2115      [Willy Weisz <weisz (a] vcpc.univie.ac.at>]
   2117   *) Fix compression algorithm handling: if resuming a session use the
   2118      compression algorithm of the resumed session instead of determining
   2119      it from client hello again. Don't allow server to change algorithm.
   2120      [Steve Henson]
   2122   *) Add load_crls() function to apps tidying load_certs() too. Add option
   2123      to verify utility to allow additional CRLs to be included.
   2124      [Steve Henson]
   2126   *) Update OCSP request code to permit adding custom headers to the request:
   2127      some responders need this.
   2128      [Steve Henson]
   2130   *) The function EVP_PKEY_sign() returns <=0 on error: check return code
   2131      correctly.
   2132      [Julia Lawall <julia (a] diku.dk>]
   2134   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
   2135      needlessly dereferenced structures, used obsolete functions and
   2136      didn't handle all updated verify codes correctly.
   2137      [Steve Henson]
   2139   *) Disable MD2 in the default configuration.
   2140      [Steve Henson]
   2142   *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
   2143      indicate the initial BIO being pushed or popped. This makes it possible
   2144      to determine whether the BIO is the one explicitly called or as a result
   2145      of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
   2146      it handles reference counts correctly and doesn't zero out the I/O bio
   2147      when it is not being explicitly popped. WARNING: applications which
   2148      included workarounds for the old buggy behaviour will need to be modified
   2149      or they could free up already freed BIOs.
   2150      [Steve Henson]
   2152   *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
   2153      renaming to all platforms (within the 0.9.8 branch, this was
   2154      done conditionally on Netware platforms to avoid a name clash).
   2155      [Guenter <lists (a] gknw.net>]
   2157   *) Add ECDHE and PSK support to DTLS.
   2158      [Michael Tuexen <tuexen (a] fh-muenster.de>]
   2160   *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
   2161      be used on C++.
   2162      [Steve Henson]
   2164   *) Add "missing" function EVP_MD_flags() (without this the only way to
   2165      retrieve a digest flags is by accessing the structure directly. Update
   2166      EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
   2167      or cipher is registered as in the "from" argument. Print out all
   2168      registered digests in the dgst usage message instead of manually 
   2169      attempting to work them out.
   2170      [Steve Henson]
   2172   *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
   2173      this allows the use of compression and extensions. Change default cipher
   2174      string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
   2175      by default unless an application cipher string requests it.
   2176      [Steve Henson]
   2178   *) Alter match criteria in PKCS12_parse(). It used to try to use local
   2179      key ids to find matching certificates and keys but some PKCS#12 files
   2180      don't follow the (somewhat unwritten) rules and this strategy fails.
   2181      Now just gather all certificates together and the first private key
   2182      then look for the first certificate that matches the key.
   2183      [Steve Henson]
   2185   *) Support use of registered digest and cipher names for dgst and cipher
   2186      commands instead of having to add each one as a special case. So now
   2187      you can do:
   2189         openssl sha256 foo
   2191      as well as:
   2193         openssl dgst -sha256 foo
   2195      and this works for ENGINE based algorithms too.
   2197      [Steve Henson]
   2199   *) Update Gost ENGINE to support parameter files.
   2200      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   2202   *) Support GeneralizedTime in ca utility. 
   2203      [Oliver Martin <oliver (a] volatilevoid.net>, Steve Henson]
   2205   *) Enhance the hash format used for certificate directory links. The new
   2206      form uses the canonical encoding (meaning equivalent names will work
   2207      even if they aren't identical) and uses SHA1 instead of MD5. This form
   2208      is incompatible with the older format and as a result c_rehash should
   2209      be used to rebuild symbolic links.
   2210      [Steve Henson]
   2212   *) Make PKCS#8 the default write format for private keys, replacing the
   2213      traditional format. This form is standardised, more secure and doesn't
   2214      include an implicit MD5 dependency.
   2215      [Steve Henson]
   2217   *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
   2218      committed to OpenSSL should pass this lot as a minimum.
   2219      [Steve Henson]
   2221   *) Add session ticket override functionality for use by EAP-FAST.
   2222      [Jouni Malinen <j (a] w1.fi>]
   2224   *) Modify HMAC functions to return a value. Since these can be implemented
   2225      in an ENGINE errors can occur.
   2226      [Steve Henson]
   2228   *) Type-checked OBJ_bsearch_ex.
   2229      [Ben Laurie]
   2231   *) Type-checked OBJ_bsearch. Also some constification necessitated
   2232      by type-checking.  Still to come: TXT_DB, bsearch(?),
   2233      OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
   2234      CONF_VALUE.
   2235      [Ben Laurie]
   2237   *) New function OPENSSL_gmtime_adj() to add a specific number of days and
   2238      seconds to a tm structure directly, instead of going through OS
   2239      specific date routines. This avoids any issues with OS routines such
   2240      as the year 2038 bug. New *_adj() functions for ASN1 time structures
   2241      and X509_time_adj_ex() to cover the extended range. The existing
   2242      X509_time_adj() is still usable and will no longer have any date issues.
   2243      [Steve Henson]
   2245   *) Delta CRL support. New use deltas option which will attempt to locate
   2246      and search any appropriate delta CRLs available.
   2248      This work was sponsored by Google.
   2249      [Steve Henson]
   2251   *) Support for CRLs partitioned by reason code. Reorganise CRL processing
   2252      code and add additional score elements. Validate alternate CRL paths
   2253      as part of the CRL checking and indicate a new error "CRL path validation
   2254      error" in this case. Applications wanting additional details can use
   2255      the verify callback and check the new "parent" field. If this is not
   2256      NULL CRL path validation is taking place. Existing applications wont
   2257      see this because it requires extended CRL support which is off by
   2258      default.
   2260      This work was sponsored by Google.
   2261      [Steve Henson]
   2263   *) Support for freshest CRL extension.
   2265      This work was sponsored by Google.
   2266      [Steve Henson]
   2268   *) Initial indirect CRL support. Currently only supported in the CRLs
   2269      passed directly and not via lookup. Process certificate issuer
   2270      CRL entry extension and lookup CRL entries by bother issuer name
   2271      and serial number. Check and process CRL issuer entry in IDP extension.
   2273      This work was sponsored by Google.
   2274      [Steve Henson]
   2276   *) Add support for distinct certificate and CRL paths. The CRL issuer
   2277      certificate is validated separately in this case. Only enabled if
   2278      an extended CRL support flag is set: this flag will enable additional
   2279      CRL functionality in future.
   2281      This work was sponsored by Google.
   2282      [Steve Henson]
   2284   *) Add support for policy mappings extension.
   2286      This work was sponsored by Google.
   2287      [Steve Henson]
   2289   *) Fixes to pathlength constraint, self issued certificate handling,
   2290      policy processing to align with RFC3280 and PKITS tests.
   2292      This work was sponsored by Google.
   2293      [Steve Henson]
   2295   *) Support for name constraints certificate extension. DN, email, DNS
   2296      and URI types are currently supported.
   2298      This work was sponsored by Google.
   2299      [Steve Henson]
   2301   *) To cater for systems that provide a pointer-based thread ID rather
   2302      than numeric, deprecate the current numeric thread ID mechanism and
   2303      replace it with a structure and associated callback type. This
   2304      mechanism allows a numeric "hash" to be extracted from a thread ID in
   2305      either case, and on platforms where pointers are larger than 'long',
   2306      mixing is done to help ensure the numeric 'hash' is usable even if it
   2307      can't be guaranteed unique. The default mechanism is to use "&errno"
   2308      as a pointer-based thread ID to distinguish between threads.
   2310      Applications that want to provide their own thread IDs should now use
   2311      CRYPTO_THREADID_set_callback() to register a callback that will call
   2312      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
   2314      Note that ERR_remove_state() is now deprecated, because it is tied
   2315      to the assumption that thread IDs are numeric.  ERR_remove_state(0)
   2316      to free the current thread's error state should be replaced by
   2317      ERR_remove_thread_state(NULL).
   2319      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
   2320      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
   2321      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
   2322      application was previously providing a numeric thread callback that
   2323      was inappropriate for distinguishing threads, then uniqueness might
   2324      have been obtained with &errno that happened immediately in the
   2325      intermediate development versions of OpenSSL; this is no longer the
   2326      case, the numeric thread callback will now override the automatic use
   2327      of &errno.)
   2328      [Geoff Thorpe, with help from Bodo Moeller]
   2330   *) Initial support for different CRL issuing certificates. This covers a
   2331      simple case where the self issued certificates in the chain exist and
   2332      the real CRL issuer is higher in the existing chain.
   2334      This work was sponsored by Google.
   2335      [Steve Henson]
   2337   *) Removed effectively defunct crypto/store from the build.
   2338      [Ben Laurie]
   2340   *) Revamp of STACK to provide stronger type-checking. Still to come:
   2341      TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
   2342      ASN1_STRING, CONF_VALUE.
   2343      [Ben Laurie]
   2345   *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
   2346      RAM on SSL connections.  This option can save about 34k per idle SSL.
   2347      [Nick Mathewson]
   2349   *) Revamp of LHASH to provide stronger type-checking. Still to come:
   2350      STACK, TXT_DB, bsearch, qsort.
   2351      [Ben Laurie]
   2353   *) Initial support for Cryptographic Message Syntax (aka CMS) based
   2354      on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
   2355      support for data, signedData, compressedData, digestedData and
   2356      encryptedData, envelopedData types included. Scripts to check against
   2357      RFC4134 examples draft and interop and consistency checks of many
   2358      content types and variants.
   2359      [Steve Henson]
   2361   *) Add options to enc utility to support use of zlib compression BIO.
   2362      [Steve Henson]
   2364   *) Extend mk1mf to support importing of options and assembly language
   2365      files from Configure script, currently only included in VC-WIN32.
   2366      The assembly language rules can now optionally generate the source
   2367      files from the associated perl scripts.
   2368      [Steve Henson]
   2370   *) Implement remaining functionality needed to support GOST ciphersuites.
   2371      Interop testing has been performed using CryptoPro implementations.
   2372      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   2374   *) s390x assembler pack.
   2375      [Andy Polyakov]
   2377   *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
   2378      "family."
   2379      [Andy Polyakov]
   2381   *) Implement Opaque PRF Input TLS extension as specified in
   2382      draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
   2383      official specification yet and no extension type assignment by
   2384      IANA exists, this extension (for now) will have to be explicitly
   2385      enabled when building OpenSSL by providing the extension number
   2386      to use.  For example, specify an option
   2388          -DTLSEXT_TYPE_opaque_prf_input=0x9527
   2390      to the "config" or "Configure" script to enable the extension,
   2391      assuming extension number 0x9527 (which is a completely arbitrary
   2392      and unofficial assignment based on the MD5 hash of the Internet
   2393      Draft).  Note that by doing so, you potentially lose
   2394      interoperability with other TLS implementations since these might
   2395      be using the same extension number for other purposes.
   2397      SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
   2398      opaque PRF input value to use in the handshake.  This will create
   2399      an interal copy of the length-'len' string at 'src', and will
   2400      return non-zero for success.
   2402      To get more control and flexibility, provide a callback function
   2403      by using
   2405           SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
   2406           SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
   2408      where
   2410           int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
   2411           void *arg;
   2413      Callback function 'cb' will be called in handshakes, and is
   2414      expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
   2415      Argument 'arg' is for application purposes (the value as given to
   2416      SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
   2417      be provided to the callback function).  The callback function
   2418      has to return non-zero to report success: usually 1 to use opaque
   2419      PRF input just if possible, or 2 to enforce use of the opaque PRF
   2420      input.  In the latter case, the library will abort the handshake
   2421      if opaque PRF input is not successfully negotiated.
   2423      Arguments 'peerinput' and 'len' given to the callback function
   2424      will always be NULL and 0 in the case of a client.  A server will
   2425      see the client's opaque PRF input through these variables if
   2426      available (NULL and 0 otherwise).  Note that if the server
   2427      provides an opaque PRF input, the length must be the same as the
   2428      length of the client's opaque PRF input.
   2430      Note that the callback function will only be called when creating
   2431      a new session (session resumption can resume whatever was
   2432      previously negotiated), and will not be called in SSL 2.0
   2433      handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
   2434      SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
   2435      for applications that need to enforce opaque PRF input.
   2437      [Bodo Moeller]
   2439   *) Update ssl code to support digests other than SHA1+MD5 for handshake
   2440      MAC. 
   2442      [Victor B. Wagner <vitus (a] cryptocom.ru>]
   2444   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   2445      RFC4507bis. The encrypted ticket format is an encrypted encoded
   2446      SSL_SESSION structure, that way new session features are automatically
   2447      supported.
   2449      If a client application caches session in an SSL_SESSION structure
   2450      support is transparent because tickets are now stored in the encoded
   2451      SSL_SESSION.
   2453      The SSL_CTX structure automatically generates keys for ticket
   2454      protection in servers so again support should be possible
   2455      with no application modification.
   2457      If a client or server wishes to disable RFC4507 support then the option
   2458      SSL_OP_NO_TICKET can be set.
   2460      Add a TLS extension debugging callback to allow the contents of any client
   2461      or server extensions to be examined.
   2463      This work was sponsored by Google.
   2464      [Steve Henson]
   2466   *) Final changes to avoid use of pointer pointer casts in OpenSSL.
   2467      OpenSSL should now compile cleanly on gcc 4.2
   2468      [Peter Hartley <pdh (a] utter.chaos.org.uk>, Steve Henson]
   2470   *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
   2471      support including streaming MAC support: this is required for GOST
   2472      ciphersuite support.
   2473      [Victor B. Wagner <vitus (a] cryptocom.ru>, Steve Henson]
   2475   *) Add option -stream to use PKCS#7 streaming in smime utility. New
   2476      function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
   2477      to output in BER and PEM format.
   2478      [Steve Henson]
   2480   *) Experimental support for use of HMAC via EVP_PKEY interface. This
   2481      allows HMAC to be handled via the EVP_DigestSign*() interface. The
   2482      EVP_PKEY "key" in this case is the HMAC key, potentially allowing
   2483      ENGINE support for HMAC keys which are unextractable. New -mac and
   2484      -macopt options to dgst utility.
   2485      [Steve Henson]
   2487   *) New option -sigopt to dgst utility. Update dgst to use
   2488      EVP_Digest{Sign,Verify}*. These two changes make it possible to use
   2489      alternative signing paramaters such as X9.31 or PSS in the dgst 
   2490      utility.
   2491      [Steve Henson]
   2493   *) Change ssl_cipher_apply_rule(), the internal function that does
   2494      the work each time a ciphersuite string requests enabling
   2495      ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
   2496      removing ("!foo+bar") a class of ciphersuites: Now it maintains
   2497      the order of disabled ciphersuites such that those ciphersuites
   2498      that most recently went from enabled to disabled not only stay
   2499      in order with respect to each other, but also have higher priority
   2500      than other disabled ciphersuites the next time ciphersuites are
   2501      enabled again.
   2503      This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
   2504      the same ciphersuites as with "HIGH" alone, but in a specific
   2505      order where the PSK ciphersuites come first (since they are the
   2506      most recently disabled ciphersuites when "HIGH" is parsed).
   2508      Also, change ssl_create_cipher_list() (using this new
   2509      funcionality) such that between otherwise identical
   2510      cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
   2511      the default order.
   2512      [Bodo Moeller]
   2514   *) Change ssl_create_cipher_list() so that it automatically
   2515      arranges the ciphersuites in reasonable order before starting
   2516      to process the rule string.  Thus, the definition for "DEFAULT"
   2517      (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
   2518      remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
   2519      This makes it much easier to arrive at a reasonable default order
   2520      in applications for which anonymous ciphers are OK (meaning
   2521      that you can't actually use DEFAULT).
   2522      [Bodo Moeller; suggested by Victor Duchovni]
   2524   *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
   2525      processing) into multiple integers instead of setting
   2526      "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
   2527      "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
   2528      (These masks as well as the individual bit definitions are hidden
   2529      away into the non-exported interface ssl/ssl_locl.h, so this
   2530      change to the definition of the SSL_CIPHER structure shouldn't
   2531      affect applications.)  This give us more bits for each of these
   2532      categories, so there is no longer a need to coagulate AES128 and
   2533      AES256 into a single algorithm bit, and to coagulate Camellia128
   2534      and Camellia256 into a single algorithm bit, which has led to all
   2535      kinds of kludges.
   2537      Thus, among other things, the kludge introduced in 0.9.7m and
   2538      0.9.8e for masking out AES256 independently of AES128 or masking
   2539      out Camellia256 independently of AES256 is not needed here in 0.9.9.
   2541      With the change, we also introduce new ciphersuite aliases that
   2542      so far were missing: "AES128", "AES256", "CAMELLIA128", and
   2543      "CAMELLIA256".
   2544      [Bodo Moeller]
   2546   *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
   2547      Use the leftmost N bytes of the signature input if the input is
   2548      larger than the prime q (with N being the size in bytes of q).
   2549      [Nils Larsch]
   2551   *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
   2552      it yet and it is largely untested.
   2553      [Steve Henson]
   2555   *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
   2556      [Nils Larsch]
   2558   *) Initial incomplete changes to avoid need for function casts in OpenSSL
   2559      some compilers (gcc 4.2 and later) reject their use. Safestack is
   2560      reimplemented.  Update ASN1 to avoid use of legacy functions. 
   2561      [Steve Henson]
   2563   *) Win32/64 targets are linked with Winsock2.
   2564      [Andy Polyakov]
   2566   *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
   2567      to external functions. This can be used to increase CRL handling 
   2568      efficiency especially when CRLs are very large by (for example) storing
   2569      the CRL revoked certificates in a database.
   2570      [Steve Henson]
   2572   *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
   2573      new CRLs added to a directory can be used. New command line option
   2574      -verify_return_error to s_client and s_server. This causes real errors
   2575      to be returned by the verify callback instead of carrying on no matter
   2576      what. This reflects the way a "real world" verify callback would behave.
   2577      [Steve Henson]
   2579   *) GOST engine, supporting several GOST algorithms and public key formats.
   2580      Kindly donated by Cryptocom.
   2581      [Cryptocom]
   2583   *) Partial support for Issuing Distribution Point CRL extension. CRLs
   2584      partitioned by DP are handled but no indirect CRL or reason partitioning
   2585      (yet). Complete overhaul of CRL handling: now the most suitable CRL is
   2586      selected via a scoring technique which handles IDP and AKID in CRLs.
   2587      [Steve Henson]
   2589   *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
   2590      will ultimately be used for all verify operations: this will remove the
   2591      X509_STORE dependency on certificate verification and allow alternative
   2592      lookup methods.  X509_STORE based implementations of these two callbacks.
   2593      [Steve Henson]
   2595   *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
   2596      Modify get_crl() to find a valid (unexpired) CRL if possible.
   2597      [Steve Henson]
   2599   *) New function X509_CRL_match() to check if two CRLs are identical. Normally
   2600      this would be called X509_CRL_cmp() but that name is already used by
   2601      a function that just compares CRL issuer names. Cache several CRL 
   2602      extensions in X509_CRL structure and cache CRLDP in X509.
   2603      [Steve Henson]
   2605   *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
   2606      this maps equivalent X509_NAME structures into a consistent structure.
   2607      Name comparison can then be performed rapidly using memcmp().
   2608      [Steve Henson]
   2610   *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
   2611      utility.
   2612      [Steve Henson]
   2614   *) Allow digests to supply their own micalg string for S/MIME type using
   2615      the ctrl EVP_MD_CTRL_MICALG.
   2616      [Steve Henson]
   2618   *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
   2619      EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
   2620      ctrl. It can then customise the structure before and/or after signing
   2621      if necessary.
   2622      [Steve Henson]
   2624   *) New function OBJ_add_sigid() to allow application defined signature OIDs
   2625      to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
   2626      to free up any added signature OIDs.
   2627      [Steve Henson]
   2629   *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
   2630      EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
   2631      digest and cipher tables. New options added to openssl utility:
   2632      list-message-digest-algorithms and list-cipher-algorithms.
   2633      [Steve Henson]
   2635   *) Change the array representation of binary polynomials: the list
   2636      of degrees of non-zero coefficients is now terminated with -1.
   2637      Previously it was terminated with 0, which was also part of the
   2638      value; thus, the array representation was not applicable to
   2639      polynomials where t^0 has coefficient zero.  This change makes
   2640      the array representation useful in a more general context.
   2641      [Douglas Stebila]
   2643   *) Various modifications and fixes to SSL/TLS cipher string
   2644      handling.  For ECC, the code now distinguishes between fixed ECDH
   2645      with RSA certificates on the one hand and with ECDSA certificates
   2646      on the other hand, since these are separate ciphersuites.  The
   2647      unused code for Fortezza ciphersuites has been removed.
   2649      For consistency with EDH, ephemeral ECDH is now called "EECDH"
   2650      (not "ECDHE").  For consistency with the code for DH
   2651      certificates, use of ECDH certificates is now considered ECDH
   2652      authentication, not RSA or ECDSA authentication (the latter is
   2653      merely the CA's signing algorithm and not actively used in the
   2654      protocol).
   2656      The temporary ciphersuite alias "ECCdraft" is no longer
   2657      available, and ECC ciphersuites are no longer excluded from "ALL"
   2658      and "DEFAULT".  The following aliases now exist for RFC 4492
   2659      ciphersuites, most of these by analogy with the DH case:
   2661          kECDHr   - ECDH cert, signed with RSA
   2662          kECDHe   - ECDH cert, signed with ECDSA
   2663          kECDH    - ECDH cert (signed with either RSA or ECDSA)
   2664          kEECDH   - ephemeral ECDH
   2665          ECDH     - ECDH cert or ephemeral ECDH
   2667          aECDH    - ECDH cert
   2668          aECDSA   - ECDSA cert
   2669          ECDSA    - ECDSA cert
   2671          AECDH    - anonymous ECDH
   2672          EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
   2674      [Bodo Moeller]
   2676   *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
   2677      Use correct micalg parameters depending on digest(s) in signed message.
   2678      [Steve Henson]
   2680   *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
   2681      an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
   2682      [Steve Henson]
   2684   *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
   2685      an engine to register a method. Add ENGINE lookups for methods and
   2686      functional reference processing.
   2687      [Steve Henson]
   2689   *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
   2690      EVP_{Sign,Verify}* which allow an application to customise the signature
   2691      process.
   2692      [Steve Henson]
   2694   *) New -resign option to smime utility. This adds one or more signers
   2695      to an existing PKCS#7 signedData structure. Also -md option to use an
   2696      alternative message digest algorithm for signing.
   2697      [Steve Henson]
   2699   *) Tidy up PKCS#7 routines and add new functions to make it easier to
   2700      create PKCS7 structures containing multiple signers. Update smime
   2701      application to support multiple signers.
   2702      [Steve Henson]
   2704   *) New -macalg option to pkcs12 utility to allow setting of an alternative
   2705      digest MAC.
   2706      [Steve Henson]
   2708   *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
   2709      Reorganize PBE internals to lookup from a static table using NIDs,
   2710      add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
   2711      EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
   2712      PRF which will be automatically used with PBES2.
   2713      [Steve Henson]
   2715   *) Replace the algorithm specific calls to generate keys in "req" with the
   2716      new API.
   2717      [Steve Henson]
   2719   *) Update PKCS#7 enveloped data routines to use new API. This is now
   2720      supported by any public key method supporting the encrypt operation. A
   2721      ctrl is added to allow the public key algorithm to examine or modify
   2722      the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
   2723      a no op.
   2724      [Steve Henson]
   2726   *) Add a ctrl to asn1 method to allow a public key algorithm to express
   2727      a default digest type to use. In most cases this will be SHA1 but some
   2728      algorithms (such as GOST) need to specify an alternative digest. The
   2729      return value indicates how strong the prefernce is 1 means optional and
   2730      2 is mandatory (that is it is the only supported type). Modify
   2731      ASN1_item_sign() to accept a NULL digest argument to indicate it should
   2732      use the default md. Update openssl utilities to use the default digest
   2733      type for signing if it is not explicitly indicated.
   2734      [Steve Henson]
   2736   *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
   2737      EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
   2738      signing method from the key type. This effectively removes the link
   2739      between digests and public key types.
   2740      [Steve Henson]
   2742   *) Add an OID cross reference table and utility functions. Its purpose is to
   2743      translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
   2744      rsaEncryption. This will allow some of the algorithm specific hackery
   2745      needed to use the correct OID to be removed. 
   2746      [Steve Henson]
   2748   *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
   2749      structures for PKCS7_sign(). They are now set up by the relevant public
   2750      key ASN1 method.
   2751      [Steve Henson]
   2753   *) Add provisional EC pkey method with support for ECDSA and ECDH.
   2754      [Steve Henson]
   2756   *) Add support for key derivation (agreement) in the API, DH method and
   2757      pkeyutl.
   2758      [Steve Henson]
   2760   *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
   2761      public and private key formats. As a side effect these add additional 
   2762      command line functionality not previously available: DSA signatures can be
   2763      generated and verified using pkeyutl and DH key support and generation in
   2764      pkey, genpkey.
   2765      [Steve Henson]
   2767   *) BeOS support.
   2768      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   2770   *) New make target "install_html_docs" installs HTML renditions of the
   2771      manual pages.
   2772      [Oliver Tappe <zooey (a] hirschkaefer.de>]
   2774   *) New utility "genpkey" this is analagous to "genrsa" etc except it can
   2775      generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
   2776      support key and parameter generation and add initial key generation
   2777      functionality for RSA.
   2778      [Steve Henson]
   2780   *) Add functions for main EVP_PKEY_method operations. The undocumented
   2781      functions EVP_PKEY_{encrypt,decrypt} have been renamed to
   2782      EVP_PKEY_{encrypt,decrypt}_old. 
   2783      [Steve Henson]
   2785   *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
   2786      key API, doesn't do much yet.
   2787      [Steve Henson]
   2789   *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
   2790      public key algorithms. New option to openssl utility:
   2791      "list-public-key-algorithms" to print out info.
   2792      [Steve Henson]
   2794   *) Implement the Supported Elliptic Curves Extension for
   2795      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   2796      [Douglas Stebila]
   2798   *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
   2799      EVP_CIPHER structures to avoid later problems in EVP_cleanup().
   2800      [Steve Henson]
   2802   *) New utilities pkey and pkeyparam. These are similar to algorithm specific
   2803      utilities such as rsa, dsa, dsaparam etc except they process any key
   2804      type.
   2805      [Steve Henson]
   2807   *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
   2808      functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
   2809      EVP_PKEY_print_param() to print public key data from an EVP_PKEY
   2810      structure.
   2811      [Steve Henson]
   2813   *) Initial support for pluggable public key ASN1.
   2814      De-spaghettify the public key ASN1 handling. Move public and private
   2815      key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
   2816      algorithm specific handling to a single module within the relevant
   2817      algorithm directory. Add functions to allow (near) opaque processing
   2818      of public and private key structures.
   2819      [Steve Henson]
   2821   *) Implement the Supported Point Formats Extension for
   2822      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
   2823      [Douglas Stebila]
   2825   *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
   2826      for the psk identity [hint] and the psk callback functions to the
   2827      SSL_SESSION, SSL and SSL_CTX structure.
   2829      New ciphersuites:
   2830          PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
   2831          PSK-AES256-CBC-SHA
   2833      New functions:
   2834          SSL_CTX_use_psk_identity_hint
   2835          SSL_get_psk_identity_hint
   2836          SSL_get_psk_identity
   2837          SSL_use_psk_identity_hint
   2839      [Mika Kousa and Pasi Eronen of Nokia Corporation]
   2841   *) Add RFC 3161 compliant time stamp request creation, response generation
   2842      and response verification functionality.
   2843      [Zoltn Glzik <zglozik (a] opentsa.org>, The OpenTSA Project]
   2845   *) Add initial support for TLS extensions, specifically for the server_name
   2846      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   2847      have new members for a host name.  The SSL data structure has an
   2848      additional member SSL_CTX *initial_ctx so that new sessions can be
   2849      stored in that context to allow for session resumption, even after the
   2850      SSL has been switched to a new SSL_CTX in reaction to a client's
   2851      server_name extension.
   2853      New functions (subject to change):
   2855          SSL_get_servername()
   2856          SSL_get_servername_type()
   2857          SSL_set_SSL_CTX()
   2859      New CTRL codes and macros (subject to change):
   2862                                  - SSL_CTX_set_tlsext_servername_callback()
   2864                                       - SSL_CTX_set_tlsext_servername_arg()
   2865          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   2867      openssl s_client has a new '-servername ...' option.
   2869      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   2870      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   2871      testing the HostName extension for a specific single host name ('-cert'
   2872      and '-key' remain fallbacks for handshakes without HostName
   2873      negotiation).  If the unrecogninzed_name alert has to be sent, this by
   2874      default is a warning; it becomes fatal with the '-servername_fatal'
   2875      option.
   2877      [Peter Sylvester,  Remy Allais, Christophe Renou]
   2879   *) Whirlpool hash implementation is added.
   2880      [Andy Polyakov]
   2882   *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
   2883      bn(64,32). Because of instruction set limitations it doesn't have
   2884      any negative impact on performance. This was done mostly in order
   2885      to make it possible to share assembler modules, such as bn_mul_mont
   2886      implementations, between 32- and 64-bit builds without hassle.
   2887      [Andy Polyakov]
   2889   *) Move code previously exiled into file crypto/ec/ec2_smpt.c
   2890      to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
   2891      macro.
   2892      [Bodo Moeller]
   2894   *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
   2895      dedicated Montgomery multiplication procedure, is introduced.
   2896      BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
   2897      "64-bit" performance on certain 32-bit targets.
   2898      [Andy Polyakov]
   2900   *) New option SSL_OP_NO_COMP to disable use of compression selectively
   2901      in SSL structures. New SSL ctrl to set maximum send fragment size. 
   2902      Save memory by seeting the I/O buffer sizes dynamically instead of
   2903      using the maximum available value.
   2904      [Steve Henson]
   2906   *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
   2907      in addition to the text details.
   2908      [Bodo Moeller]
   2910   *) Very, very preliminary EXPERIMENTAL support for printing of general
   2911      ASN1 structures. This currently produces rather ugly output and doesn't
   2912      handle several customised structures at all.
   2913      [Steve Henson]
   2915   *) Integrated support for PVK file format and some related formats such
   2916      as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
   2917      these in the 'rsa' and 'dsa' utilities.
   2918      [Steve Henson]
   2920   *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
   2921      [Steve Henson]
   2923   *) Remove the ancient ASN1_METHOD code. This was only ever used in one
   2924      place for the (very old) "NETSCAPE" format certificates which are now
   2925      handled using new ASN1 code equivalents.
   2926      [Steve Henson]
   2928   *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
   2929      pointer and make the SSL_METHOD parameter in SSL_CTX_new,
   2930      SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
   2931      [Nils Larsch]
   2933   *) Modify CRL distribution points extension code to print out previously
   2934      unsupported fields. Enhance extension setting code to allow setting of
   2935      all fields.
   2936      [Steve Henson]
   2938   *) Add print and set support for Issuing Distribution Point CRL extension.
   2939      [Steve Henson]
   2941   *) Change 'Configure' script to enable Camellia by default.
   2942      [NTT]
   2944  Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
   2946   *) When rejecting SSL/TLS records due to an incorrect version number, never
   2947      update s->server with a new major version number.  As of
   2948      - OpenSSL 0.9.8m if 'short' is a 16-bit type,
   2949      - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
   2950      the previous behavior could result in a read attempt at NULL when
   2951      receiving specific incorrect SSL/TLS records once record payload
   2952      protection is active.  (CVE-2010-0740)
   2953      [Bodo Moeller, Adam Langley <agl (a] chromium.org>]
   2955   *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
   2956      could be crashed if the relevant tables were not present (e.g. chrooted).
   2957      [Tomas Hoger <thoger (a] redhat.com>]
   2959  Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
   2961   *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
   2962      [Martin Olsson, Neel Mehta]
   2964   *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
   2965      accommodate for stack sorting, always a write lock!).
   2966      [Bodo Moeller]
   2968   *) On some versions of WIN32 Heap32Next is very slow. This can cause
   2969      excessive delays in the RAND_poll(): over a minute. As a workaround
   2970      include a time check in the inner Heap32Next loop too.
   2971      [Steve Henson]
   2973   *) The code that handled flushing of data in SSL/TLS originally used the
   2974      BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
   2975      the problem outlined in PR#1949. The fix suggested there however can
   2976      trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
   2977      of Apache). So instead simplify the code to flush unconditionally.
   2978      This should be fine since flushing with no data to flush is a no op.
   2979      [Steve Henson]
   2981   *) Handle TLS versions 2.0 and later properly and correctly use the
   2982      highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
   2983      off ancient servers have a habit of sticking around for a while...
   2984      [Steve Henson]
   2986   *) Modify compression code so it frees up structures without using the
   2987      ex_data callbacks. This works around a problem where some applications
   2988      call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
   2989      restarting) then use compression (e.g. SSL with compression) later.
   2990      This results in significant per-connection memory leaks and
   2991      has caused some security issues including CVE-2008-1678 and
   2992      CVE-2009-4355.
   2993      [Steve Henson]
   2995   *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
   2996      change when encrypting or decrypting.
   2997      [Bodo Moeller]
   2999   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
   3000      connect and renegotiate with servers which do not support RI.
   3001      Until RI is more widely deployed this option is enabled by default.
   3002      [Steve Henson]
   3004   *) Add "missing" ssl ctrls to clear options and mode.
   3005      [Steve Henson]
   3007   *) If client attempts to renegotiate and doesn't support RI respond with
   3008      a no_renegotiation alert as required by RFC5746.  Some renegotiating
   3009      TLS clients will continue a connection gracefully when they receive
   3010      the alert. Unfortunately OpenSSL mishandled this alert and would hang
   3011      waiting for a server hello which it will never receive. Now we treat a
   3012      received no_renegotiation alert as a fatal error. This is because
   3013      applications requesting a renegotiation might well expect it to succeed
   3014      and would have no code in place to handle the server denying it so the
   3015      only safe thing to do is to terminate the connection.
   3016      [Steve Henson]
   3018   *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
   3019      peer supports secure renegotiation and 0 otherwise. Print out peer
   3020      renegotiation support in s_client/s_server.
   3021      [Steve Henson]
   3023   *) Replace the highly broken and deprecated SPKAC certification method with
   3024      the updated NID creation version. This should correctly handle UTF8.
   3025      [Steve Henson]
   3027   *) Implement RFC5746. Re-enable renegotiation but require the extension
   3028      as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
   3029      turns out to be a bad idea. It has been replaced by
   3030      SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
   3031      SSL_CTX_set_options(). This is really not recommended unless you
   3032      know what you are doing.
   3033      [Eric Rescorla <ekr (a] networkresonance.com>, Ben Laurie, Steve Henson]
   3035   *) Fixes to stateless session resumption handling. Use initial_ctx when
   3036      issuing and attempting to decrypt tickets in case it has changed during
   3037      servername handling. Use a non-zero length session ID when attempting
   3038      stateless session resumption: this makes it possible to determine if
   3039      a resumption has occurred immediately after receiving server hello
   3040      (several places in OpenSSL subtly assume this) instead of later in
   3041      the handshake.
   3042      [Steve Henson]
   3044   *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
   3045      CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
   3046      fixes for a few places where the return code is not checked
   3047      correctly.
   3048      [Julia Lawall <julia (a] diku.dk>]
   3050   *) Add --strict-warnings option to Configure script to include devteam
   3051      warnings in other configurations.
   3052      [Steve Henson]
   3054   *) Add support for --libdir option and LIBDIR variable in makefiles. This
   3055      makes it possible to install openssl libraries in locations which
   3056      have names other than "lib", for example "/usr/lib64" which some
   3057      systems need.
   3058      [Steve Henson, based on patch from Jeremy Utley]
   3060   *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
   3061      X690 8.9.12 and can produce some misleading textual output of OIDs.
   3062      [Steve Henson, reported by Dan Kaminsky]
   3064   *) Delete MD2 from algorithm tables. This follows the recommendation in
   3065      several standards that it is not used in new applications due to
   3066      several cryptographic weaknesses. For binary compatibility reasons
   3067      the MD2 API is still compiled in by default.
   3068      [Steve Henson]
   3070   *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
   3071      and restored.
   3072      [Steve Henson]
   3074   *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
   3075      OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
   3076      clash.
   3077      [Guenter <lists (a] gknw.net>]
   3079   *) Fix the server certificate chain building code to use X509_verify_cert(),
   3080      it used to have an ad-hoc builder which was unable to cope with anything
   3081      other than a simple chain.
   3082      [David Woodhouse <dwmw2 (a] infradead.org>, Steve Henson]
   3084   *) Don't check self signed certificate signatures in X509_verify_cert()
   3085      by default (a flag can override this): it just wastes time without
   3086      adding any security. As a useful side effect self signed root CAs
   3087      with non-FIPS digests are now usable in FIPS mode.
   3088      [Steve Henson]
   3090   *) In dtls1_process_out_of_seq_message() the check if the current message
   3091      is already buffered was missing. For every new message was memory
   3092      allocated, allowing an attacker to perform an denial of service attack
   3093      with sending out of seq handshake messages until there is no memory
   3094      left. Additionally every future messege was buffered, even if the
   3095      sequence number made no sense and would be part of another handshake.
   3096      So only messages with sequence numbers less than 10 in advance will be
   3097      buffered.  (CVE-2009-1378)
   3098      [Robin Seggelmann, discovered by Daniel Mentz] 	
   3100   *) Records are buffered if they arrive with a future epoch to be
   3101      processed after finishing the corresponding handshake. There is
   3102      currently no limitation to this buffer allowing an attacker to perform
   3103      a DOS attack with sending records with future epochs until there is no
   3104      memory left. This patch adds the pqueue_size() function to detemine
   3105      the size of a buffer and limits the record buffer to 100 entries.
   3106      (CVE-2009-1377)
   3107      [Robin Seggelmann, discovered by Daniel Mentz] 	
   3109   *) Keep a copy of frag->msg_header.frag_len so it can be used after the
   3110      parent structure is freed.  (CVE-2009-1379)
   3111      [Daniel Mentz] 	
   3113   *) Handle non-blocking I/O properly in SSL_shutdown() call.
   3114      [Darryl Miles <darryl-mailinglists (a] netbauds.net>]
   3116   *) Add 2.5.4.* OIDs
   3117      [Ilya O. <vrghost (a] gmail.com>]
   3119  Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
   3121   *) Disable renegotiation completely - this fixes a severe security
   3122      problem (CVE-2009-3555) at the cost of breaking all
   3123      renegotiation. Renegotiation can be re-enabled by setting
   3125      run-time. This is really not recommended unless you know what
   3126      you're doing.
   3127      [Ben Laurie]
   3129  Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
   3131   *) Don't set val to NULL when freeing up structures, it is freed up by
   3132      underlying code. If sizeof(void *) > sizeof(long) this can result in
   3133      zeroing past the valid field. (CVE-2009-0789)
   3134      [Paolo Ganci <Paolo.Ganci (a] AdNovum.CH>]
   3136   *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
   3137      checked correctly. This would allow some invalid signed attributes to
   3138      appear to verify correctly. (CVE-2009-0591)
   3139      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   3141   *) Reject UniversalString and BMPString types with invalid lengths. This
   3142      prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
   3143      a legal length. (CVE-2009-0590)
   3144      [Steve Henson]
   3146   *) Set S/MIME signing as the default purpose rather than setting it 
   3147      unconditionally. This allows applications to override it at the store
   3148      level.
   3149      [Steve Henson]
   3151   *) Permit restricted recursion of ASN1 strings. This is needed in practice
   3152      to handle some structures.
   3153      [Steve Henson]
   3155   *) Improve efficiency of mem_gets: don't search whole buffer each time
   3156      for a '\n'
   3157      [Jeremy Shapiro <jnshapir (a] us.ibm.com>]
   3159   *) New -hex option for openssl rand.
   3160      [Matthieu Herrb]
   3162   *) Print out UTF8String and NumericString when parsing ASN1.
   3163      [Steve Henson]
   3165   *) Support NumericString type for name components.
   3166      [Steve Henson]
   3168   *) Allow CC in the environment to override the automatically chosen
   3169      compiler. Note that nothing is done to ensure flags work with the
   3170      chosen compiler.
   3171      [Ben Laurie]
   3173  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
   3175   *) Properly check EVP_VerifyFinal() and similar return values
   3176      (CVE-2008-5077).
   3177      [Ben Laurie, Bodo Moeller, Google Security Team]
   3179   *) Enable TLS extensions by default.
   3180      [Ben Laurie]
   3182   *) Allow the CHIL engine to be loaded, whether the application is
   3183      multithreaded or not. (This does not release the developer from the
   3184      obligation to set up the dynamic locking callbacks.)
   3185      [Sander Temme <sander (a] temme.net>]
   3187   *) Use correct exit code if there is an error in dgst command.
   3188      [Steve Henson; problem pointed out by Roland Dirlewanger]
   3190   *) Tweak Configure so that you need to say "experimental-jpake" to enable
   3191      JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
   3192      [Bodo Moeller]
   3194   *) Add experimental JPAKE support, including demo authentication in
   3195      s_client and s_server.
   3196      [Ben Laurie]
   3198   *) Set the comparison function in v3_addr_canonize().
   3199      [Rob Austein <sra (a] hactrn.net>]
   3201   *) Add support for XMPP STARTTLS in s_client.
   3202      [Philip Paeps <philip (a] freebsd.org>]
   3204   *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
   3205      to ensure that even with this option, only ciphersuites in the
   3206      server's preference list will be accepted.  (Note that the option
   3207      applies only when resuming a session, so the earlier behavior was
   3208      just about the algorithm choice for symmetric cryptography.)
   3209      [Bodo Moeller]
   3211  Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
   3213   *) Fix NULL pointer dereference if a DTLS server received
   3214      ChangeCipherSpec as first record (CVE-2009-1386).
   3215      [PR #1679]
   3217   *) Fix a state transitition in s3_srvr.c and d1_srvr.c
   3218      (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
   3219      [Nagendra Modadugu]
   3221   *) The fix in 0.9.8c that supposedly got rid of unsafe
   3222      double-checked locking was incomplete for RSA blinding,
   3223      addressing just one layer of what turns out to have been
   3224      doubly unsafe triple-checked locking.
   3226      So now fix this for real by retiring the MONT_HELPER macro
   3227      in crypto/rsa/rsa_eay.c.
   3229      [Bodo Moeller; problem pointed out by Marius Schilder]
   3231   *) Various precautionary measures:
   3233      - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
   3235      - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
   3236        (NB: This would require knowledge of the secret session ticket key
   3237        to exploit, in which case you'd be SOL either way.)
   3239      - Change bn_nist.c so that it will properly handle input BIGNUMs
   3240        outside the expected range.
   3242      - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
   3243        builds.
   3245      [Neel Mehta, Bodo Moeller]
   3247   *) Allow engines to be "soft loaded" - i.e. optionally don't die if
   3248      the load fails. Useful for distros.
   3249      [Ben Laurie and the FreeBSD team]
   3251   *) Add support for Local Machine Keyset attribute in PKCS#12 files.
   3252      [Steve Henson]
   3254   *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
   3255      [Huang Ying]
   3257   *) Expand ENGINE to support engine supplied SSL client certificate functions.
   3259      This work was sponsored by Logica.
   3260      [Steve Henson]
   3262   *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
   3263      keystores. Support for SSL/TLS client authentication too.
   3264      Not compiled unless enable-capieng specified to Configure.
   3266      This work was sponsored by Logica.
   3267      [Steve Henson]
   3269   *) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
   3270      ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
   3271      attribute creation routines such as certifcate requests and PKCS#12
   3272      files.
   3273      [Steve Henson]
   3275  Changes between 0.9.8g and 0.9.8h  [28 May 2008]
   3277   *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
   3278      handshake which could lead to a cilent crash as found using the
   3279      Codenomicon TLS test suite (CVE-2008-1672) 
   3280      [Steve Henson, Mark Cox]
   3282   *) Fix double free in TLS server name extensions which could lead to
   3283      a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
   3284      [Joe Orton]
   3286   *) Clear error queue in SSL_CTX_use_certificate_chain_file()
   3288      Clear the error queue to ensure that error entries left from
   3289      older function calls do not interfere with the correct operation.
   3290      [Lutz Jaenicke, Erik de Castro Lopo]
   3292   *) Remove root CA certificates of commercial CAs:
   3294      The OpenSSL project does not recommend any specific CA and does not
   3295      have any policy with respect to including or excluding any CA.
   3296      Therefore it does not make any sense to ship an arbitrary selection
   3297      of root CA certificates with the OpenSSL software.
   3298      [Lutz Jaenicke]
   3300   *) RSA OAEP patches to fix two separate invalid memory reads.
   3301      The first one involves inputs when 'lzero' is greater than
   3302      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
   3303      before the beginning of from). The second one involves inputs where
   3304      the 'db' section contains nothing but zeroes (there is a one-byte
   3305      invalid read after the end of 'db').
   3306      [Ivan Nestlerode <inestlerode (a] us.ibm.com>]
   3308   *) Partial backport from 0.9.9-dev:
   3310      Introduce bn_mul_mont (dedicated Montgomery multiplication
   3311      procedure) as a candidate for BIGNUM assembler implementation.
   3312      While 0.9.9-dev uses assembler for various architectures, only
   3313      x86_64 is available by default here in the 0.9.8 branch, and
   3314      32-bit x86 is available through a compile-time setting.
   3316      To try the 32-bit x86 assembler implementation, use Configure
   3317      option "enable-montasm" (which exists only for this backport).
   3319      As "enable-montasm" for 32-bit x86 disclaims code stability
   3320      anyway, in this constellation we activate additional code
   3321      backported from 0.9.9-dev for further performance improvements,
   3322      namely BN_from_montgomery_word.  (To enable this otherwise,
   3323      e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
   3325      [Andy Polyakov (backport partially by Bodo Moeller)]
   3327   *) Add TLS session ticket callback. This allows an application to set
   3328      TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
   3329      values. This is useful for key rollover for example where several key
   3330      sets may exist with different names.
   3331      [Steve Henson]
   3333   *) Reverse ENGINE-internal logic for caching default ENGINE handles.
   3334      This was broken until now in 0.9.8 releases, such that the only way
   3335      a registered ENGINE could be used (assuming it initialises
   3336      successfully on the host) was to explicitly set it as the default
   3337      for the relevant algorithms. This is in contradiction with 0.9.7
   3338      behaviour and the documentation. With this fix, when an ENGINE is
   3339      registered into a given algorithm's table of implementations, the
   3340      'uptodate' flag is reset so that auto-discovery will be used next
   3341      time a new context for that algorithm attempts to select an
   3342      implementation.
   3343      [Ian Lister (tweaked by Geoff Thorpe)]
   3345   *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
   3346      implemention in the following ways:
   3348      Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
   3349      hard coded.
   3351      Lack of BER streaming support means one pass streaming processing is
   3352      only supported if data is detached: setting the streaming flag is
   3353      ignored for embedded content.
   3355      CMS support is disabled by default and must be explicitly enabled
   3356      with the enable-cms configuration option.
   3357      [Steve Henson]
   3359   *) Update the GMP engine glue to do direct copies between BIGNUM and
   3360      mpz_t when openssl and GMP use the same limb size. Otherwise the
   3361      existing "conversion via a text string export" trick is still used.
   3362      [Paul Sheer <paulsheer (a] gmail.com>]
   3364   *) Zlib compression BIO. This is a filter BIO which compressed and
   3365      uncompresses any data passed through it.
   3366      [Steve Henson]
   3368   *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
   3369      RFC3394 compatible AES key wrapping.
   3370      [Steve Henson]
   3372   *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
   3373      sets string data without copying. X509_ALGOR_set0() and
   3374      X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
   3375      data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
   3376      from an X509_ATTRIBUTE structure optionally checking it occurs only
   3377      once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
   3378      data.
   3379      [Steve Henson]
   3381   *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
   3382      to get the expected BN_FLG_CONSTTIME behavior.
   3383      [Bodo Moeller (Google)]
   3385   *) Netware support:
   3387      - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
   3388      - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
   3389      - added some more tests to do_tests.pl
   3390      - fixed RunningProcess usage so that it works with newer LIBC NDKs too
   3391      - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
   3392      - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
   3393        netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
   3394      - various changes to netware.pl to enable gcc-cross builds on Win32
   3395        platform
   3396      - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
   3397      - various changes to fix missing prototype warnings
   3398      - fixed x86nasm.pl to create correct asm files for NASM COFF output
   3399      - added AES, WHIRLPOOL and CPUID assembler code to build files
   3400      - added missing AES assembler make rules to mk1mf.pl
   3401      - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
   3402      [Guenter Knauf <eflash (a] gmx.net>]
   3404   *) Implement certificate status request TLS extension defined in RFC3546.
   3405      A client can set the appropriate parameters and receive the encoded
   3406      OCSP response via a callback. A server can query the supplied parameters
   3407      and set the encoded OCSP response in the callback. Add simplified examples
   3408      to s_client and s_server.
   3409      [Steve Henson]
   3411  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
   3413   *) Fix various bugs:
   3414      + Binary incompatibility of ssl_ctx_st structure
   3415      + DTLS interoperation with non-compliant servers
   3416      + Don't call get_session_cb() without proposed session
   3417      + Fix ia64 assembler code
   3418      [Andy Polyakov, Steve Henson]
   3420  Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
   3422   *) DTLS Handshake overhaul. There were longstanding issues with
   3423      OpenSSL DTLS implementation, which were making it impossible for
   3424      RFC 4347 compliant client to communicate with OpenSSL server.
   3425      Unfortunately just fixing these incompatibilities would "cut off"
   3426      pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
   3427      server keeps tolerating non RFC compliant syntax. The opposite is
   3428      not true, 0.9.8f client can not communicate with earlier server.
   3429      This update even addresses CVE-2007-4995.
   3430      [Andy Polyakov]
   3432   *) Changes to avoid need for function casts in OpenSSL: some compilers
   3433      (gcc 4.2 and later) reject their use.
   3434      [Kurt Roeckx <kurt (a] roeckx.be>, Peter Hartley <pdh (a] utter.chaos.org.uk>,
   3435       Steve Henson]
   3437   *) Add RFC4507 support to OpenSSL. This includes the corrections in
   3438      RFC4507bis. The encrypted ticket format is an encrypted encoded
   3439      SSL_SESSION structure, that way new session features are automatically
   3440      supported.
   3442      If a client application caches session in an SSL_SESSION structure
   3443      support is transparent because tickets are now stored in the encoded
   3444      SSL_SESSION.
   3446      The SSL_CTX structure automatically generates keys for ticket
   3447      protection in servers so again support should be possible
   3448      with no application modification.
   3450      If a client or server wishes to disable RFC4507 support then the option
   3451      SSL_OP_NO_TICKET can be set.
   3453      Add a TLS extension debugging callback to allow the contents of any client
   3454      or server extensions to be examined.
   3456      This work was sponsored by Google.
   3457      [Steve Henson]
   3459   *) Add initial support for TLS extensions, specifically for the server_name
   3460      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
   3461      have new members for a host name.  The SSL data structure has an
   3462      additional member SSL_CTX *initial_ctx so that new sessions can be
   3463      stored in that context to allow for session resumption, even after the
   3464      SSL has been switched to a new SSL_CTX in reaction to a client's
   3465      server_name extension.
   3467      New functions (subject to change):
   3469          SSL_get_servername()
   3470          SSL_get_servername_type()
   3471          SSL_set_SSL_CTX()
   3473      New CTRL codes and macros (subject to change):
   3476                                  - SSL_CTX_set_tlsext_servername_callback()
   3478                                       - SSL_CTX_set_tlsext_servername_arg()
   3479          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
   3481      openssl s_client has a new '-servername ...' option.
   3483      openssl s_server has new options '-servername_host ...', '-cert2 ...',
   3484      '-key2 ...', '-servername_fatal' (subject to change).  This allows
   3485      testing the HostName extension for a specific single host name ('-cert'
   3486      and '-key' remain fallbacks for handshakes without HostName
   3487      negotiation).  If the unrecogninzed_name alert has to be sent, this by
   3488      default is a warning; it becomes fatal with the '-servername_fatal'
   3489      option.
   3491      [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
   3493   *) Add AES and SSE2 assembly language support to VC++ build.
   3494      [Steve Henson]
   3496   *) Mitigate attack on final subtraction in Montgomery reduction.
   3497      [Andy Polyakov]
   3499   *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
   3500      (which previously caused an internal error).
   3501      [Bodo Moeller]
   3503   *) Squeeze another 10% out of IGE mode when in != out.
   3504      [Ben Laurie]
   3506   *) AES IGE mode speedup.
   3507      [Dean Gaudet (Google)]
   3509   *) Add the Korean symmetric 128-bit cipher SEED (see
   3510      http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
   3511      add SEED ciphersuites from RFC 4162:
   3513         TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
   3516         TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
   3518      To minimize changes between patchlevels in the OpenSSL 0.9.8
   3519      series, SEED remains excluded from compilation unless OpenSSL
   3520      is configured with 'enable-seed'.
   3521      [KISA, Bodo Moeller]
   3523   *) Mitigate branch prediction attacks, which can be practical if a
   3524      single processor is shared, allowing a spy process to extract
   3525      information.  For detailed background information, see
   3526      http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
   3527      J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
   3528      and Necessary Software Countermeasures").  The core of the change
   3529      are new versions BN_div_no_branch() and
   3530      BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
   3531      respectively, which are slower, but avoid the security-relevant
   3532      conditional branches.  These are automatically called by BN_div()
   3533      and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
   3534      of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
   3535      remove a conditional branch.
   3537      BN_FLG_CONSTTIME is the new name for the previous
   3538      BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
   3539      modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
   3540      in the exponent causes BN_mod_exp_mont() to use the alternative
   3541      implementation in BN_mod_exp_mont_consttime().)  The old name
   3542      remains as a deprecated alias.
   3544      Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
   3545      RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
   3546      constant-time implementations for more than just exponentiation.
   3547      Here too the old name is kept as a deprecated alias.
   3549      BN_BLINDING_new() will now use BN_dup() for the modulus so that
   3550      the BN_BLINDING structure gets an independent copy of the
   3551      modulus.  This means that the previous "BIGNUM *m" argument to
   3552      BN_BLINDING_new() and to BN_BLINDING_create_param() now
   3553      essentially becomes "const BIGNUM *m", although we can't actually
   3554      change this in the header file before 0.9.9.  It allows
   3555      RSA_setup_blinding() to use BN_with_flags() on the modulus to
   3556      enable BN_FLG_CONSTTIME.
   3558      [Matthew D Wood (Intel Corp)]
   3560   *) In the SSL/TLS server implementation, be strict about session ID
   3561      context matching (which matters if an application uses a single
   3562      external cache for different purposes).  Previously,
   3563      out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
   3564      set.  This did ensure strict client verification, but meant that,
   3565      with applications using a single external cache for quite
   3566      different requirements, clients could circumvent ciphersuite
   3567      restrictions for a given session ID context by starting a session
   3568      in a different context.
   3569      [Bodo Moeller]
   3571   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   3572      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   3573      authentication-only ciphersuites.
   3574      [Bodo Moeller]
   3576   *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
   3577      not complete and could lead to a possible single byte overflow
   3578      (CVE-2007-5135) [Ben Laurie]
   3580  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
   3582   *) Since AES128 and AES256 (and similarly Camellia128 and
   3583      Camellia256) share a single mask bit in the logic of
   3584      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   3585      kludge to work properly if AES128 is available and AES256 isn't
   3586      (or if Camellia128 is available and Camellia256 isn't).
   3587      [Victor Duchovni]
   3589   *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
   3590      (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
   3591      When a point or a seed is encoded in a BIT STRING, we need to
   3592      prevent the removal of trailing zero bits to get the proper DER
   3593      encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
   3594      of a NamedBitList, for which trailing 0 bits need to be removed.)
   3595      [Bodo Moeller]
   3597   *) Have SSL/TLS server implementation tolerate "mismatched" record
   3598      protocol version while receiving ClientHello even if the
   3599      ClientHello is fragmented.  (The server can't insist on the
   3600      particular protocol version it has chosen before the ServerHello
   3601      message has informed the client about his choice.)
   3602      [Bodo Moeller]
   3604   *) Add RFC 3779 support.
   3605      [Rob Austein for ARIN, Ben Laurie]
   3607   *) Load error codes if they are not already present instead of using a
   3608      static variable. This allows them to be cleanly unloaded and reloaded.
   3609      Improve header file function name parsing.
   3610      [Steve Henson]
   3612   *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
   3613      or CAPABILITY handshake as required by RFCs.
   3614      [Goetz Babin-Ebell]
   3616  Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
   3618   *) Introduce limits to prevent malicious keys being able to
   3619      cause a denial of service.  (CVE-2006-2940)
   3620      [Steve Henson, Bodo Moeller]
   3622   *) Fix ASN.1 parsing of certain invalid structures that can result
   3623      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   3625   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   3626      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   3628   *) Fix SSL client code which could crash if connecting to a
   3629      malicious SSLv2 server.  (CVE-2006-4343)
   3630      [Tavis Ormandy and Will Drewry, Google Security Team]
   3632   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
   3633      match only those.  Before that, "AES256-SHA" would be interpreted
   3634      as a pattern and match "AES128-SHA" too (since AES128-SHA got
   3635      the same strength classification in 0.9.7h) as we currently only
   3636      have a single AES bit in the ciphersuite description bitmap.
   3637      That change, however, also applied to ciphersuite strings such as
   3638      "RC4-MD5" that intentionally matched multiple ciphersuites --
   3639      namely, SSL 2.0 ciphersuites in addition to the more common ones
   3640      from SSL 3.0/TLS 1.0.
   3642      So we change the selection algorithm again: Naming an explicit
   3643      ciphersuite selects this one ciphersuite, and any other similar
   3644      ciphersuite (same bitmap) from *other* protocol versions.
   3645      Thus, "RC4-MD5" again will properly select both the SSL 2.0
   3646      ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
   3648      Since SSL 2.0 does not have any ciphersuites for which the
   3649      128/256 bit distinction would be relevant, this works for now.
   3650      The proper fix will be to use different bits for AES128 and
   3651      AES256, which would have avoided the problems from the beginning;
   3652      however, bits are scarce, so we can only do this in a new release
   3653      (not just a patchlevel) when we can change the SSL_CIPHER
   3654      definition to split the single 'unsigned long mask' bitmap into
   3655      multiple values to extend the available space.
   3657      [Bodo Moeller]
   3659  Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
   3661   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   3662      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   3664   *) Add AES IGE and biIGE modes.
   3665      [Ben Laurie]
   3667   *) Change the Unix randomness entropy gathering to use poll() when
   3668      possible instead of select(), since the latter has some
   3669      undesirable limitations.
   3670      [Darryl Miles via Richard Levitte and Bodo Moeller]
   3672   *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
   3673      treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
   3674      cannot be implicitly activated as part of, e.g., the "AES" alias.
   3675      However, please upgrade to OpenSSL 0.9.9[-dev] for
   3676      non-experimental use of the ECC ciphersuites to get TLS extension
   3677      support, which is required for curve and point format negotiation
   3678      to avoid potential handshake problems.
   3679      [Bodo Moeller]
   3681   *) Disable rogue ciphersuites:
   3683       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   3684       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   3685       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   3687      The latter two were purportedly from
   3688      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   3689      appear there.
   3691      Also deactivate the remaining ciphersuites from
   3692      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   3693      unofficial, and the ID has long expired.
   3694      [Bodo Moeller]
   3696   *) Fix RSA blinding Heisenbug (problems sometimes occured on
   3697      dual-core machines) and other potential thread-safety issues.
   3698      [Bodo Moeller]
   3700   *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
   3701      versions), which is now available for royalty-free use
   3702      (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
   3703      Also, add Camellia TLS ciphersuites from RFC 4132.
   3705      To minimize changes between patchlevels in the OpenSSL 0.9.8
   3706      series, Camellia remains excluded from compilation unless OpenSSL
   3707      is configured with 'enable-camellia'.
   3708      [NTT]
   3710   *) Disable the padding bug check when compression is in use. The padding
   3711      bug check assumes the first packet is of even length, this is not
   3712      necessarily true if compresssion is enabled and can result in false
   3713      positives causing handshake failure. The actual bug test is ancient
   3714      code so it is hoped that implementations will either have fixed it by
   3715      now or any which still have the bug do not support compression.
   3716      [Steve Henson]
   3718  Changes between 0.9.8a and 0.9.8b  [04 May 2006]
   3720   *) When applying a cipher rule check to see if string match is an explicit
   3721      cipher suite and only match that one cipher suite if it is.
   3722      [Steve Henson]
   3724   *) Link in manifests for VC++ if needed.
   3725      [Austin Ziegler <halostatue (a] gmail.com>]
   3727   *) Update support for ECC-based TLS ciphersuites according to
   3728      draft-ietf-tls-ecc-12.txt with proposed changes (but without
   3729      TLS extensions, which are supported starting with the 0.9.9
   3730      branch, not in the OpenSSL 0.9.8 branch).
   3731      [Douglas Stebila]
   3733   *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
   3734      opaque EVP_CIPHER_CTX handling.
   3735      [Steve Henson]
   3737   *) Fixes and enhancements to zlib compression code. We now only use
   3738      "zlib1.dll" and use the default __cdecl calling convention on Win32
   3739      to conform with the standards mentioned here:
   3740            http://www.zlib.net/DLL_FAQ.txt
   3741      Static zlib linking now works on Windows and the new --with-zlib-include
   3742      --with-zlib-lib options to Configure can be used to supply the location
   3743      of the headers and library. Gracefully handle case where zlib library
   3744      can't be loaded.
   3745      [Steve Henson]
   3747   *) Several fixes and enhancements to the OID generation code. The old code
   3748      sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
   3749      handle numbers larger than ULONG_MAX, truncated printing and had a
   3750      non standard OBJ_obj2txt() behaviour.
   3751      [Steve Henson]
   3753   *) Add support for building of engines under engine/ as shared libraries
   3754      under VC++ build system.
   3755      [Steve Henson]
   3757   *) Corrected the numerous bugs in the Win32 path splitter in DSO.
   3758      Hopefully, we will not see any false combination of paths any more.
   3759      [Richard Levitte]
   3761  Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
   3763   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   3764      (part of SSL_OP_ALL).  This option used to disable the
   3765      countermeasure against man-in-the-middle protocol-version
   3766      rollback in the SSL 2.0 server implementation, which is a bad
   3767      idea.  (CVE-2005-2969)
   3769      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   3770      for Information Security, National Institute of Advanced Industrial
   3771      Science and Technology [AIST], Japan)]
   3773   *) Add two function to clear and return the verify parameter flags.
   3774      [Steve Henson]
   3776   *) Keep cipherlists sorted in the source instead of sorting them at
   3777      runtime, thus removing the need for a lock.
   3778      [Nils Larsch]
   3780   *) Avoid some small subgroup attacks in Diffie-Hellman.
   3781      [Nick Mathewson and Ben Laurie]
   3783   *) Add functions for well-known primes.
   3784      [Nick Mathewson]
   3786   *) Extended Windows CE support.
   3787      [Satoshi Nakamura and Andy Polyakov]
   3789   *) Initialize SSL_METHOD structures at compile time instead of during
   3790      runtime, thus removing the need for a lock.
   3791      [Steve Henson]
   3793   *) Make PKCS7_decrypt() work even if no certificate is supplied by
   3794      attempting to decrypt each encrypted key in turn. Add support to
   3795      smime utility.
   3796      [Steve Henson]
   3798  Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
   3800   [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
   3801   OpenSSL 0.9.8.]
   3803   *) Add libcrypto.pc and libssl.pc for those who feel they need them.
   3804      [Richard Levitte]
   3806   *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
   3807      key into the same file any more.
   3808      [Richard Levitte]
   3810   *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
   3811      [Andy Polyakov]
   3813   *) Add -utf8 command line and config file option to 'ca'.
   3814      [Stefan <stf (a] udoma.org]
   3816   *) Removed the macro des_crypt(), as it seems to conflict with some
   3817      libraries.  Use DES_crypt().
   3818      [Richard Levitte]
   3820   *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
   3821      involves renaming the source and generated shared-libs for
   3822      both. The engines will accept the corrected or legacy ids
   3823      ('ncipher' and '4758_cca' respectively) when binding. NB,
   3824      this only applies when building 'shared'.
   3825      [Corinna Vinschen <vinschen (a] redhat.com> and Geoff Thorpe]
   3827   *) Add attribute functions to EVP_PKEY structure. Modify
   3828      PKCS12_create() to recognize a CSP name attribute and
   3829      use it. Make -CSP option work again in pkcs12 utility.
   3830      [Steve Henson]
   3832   *) Add new functionality to the bn blinding code:
   3833      - automatic re-creation of the BN_BLINDING parameters after
   3834        a fixed number of uses (currently 32)
   3835      - add new function for parameter creation
   3836      - introduce flags to control the update behaviour of the
   3837        BN_BLINDING parameters
   3838      - hide BN_BLINDING structure
   3839      Add a second BN_BLINDING slot to the RSA structure to improve
   3840      performance when a single RSA object is shared among several
   3841      threads.
   3842      [Nils Larsch]
   3844   *) Add support for DTLS.
   3845      [Nagendra Modadugu <nagendra (a] cs.stanford.edu> and Ben Laurie]
   3847   *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
   3848      to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
   3849      [Walter Goulet]
   3851   *) Remove buggy and incompletet DH cert support from
   3852      ssl/ssl_rsa.c and ssl/s3_both.c
   3853      [Nils Larsch]
   3855   *) Use SHA-1 instead of MD5 as the default digest algorithm for
   3856      the apps/openssl applications.
   3857      [Nils Larsch]
   3859   *) Compile clean with "-Wall -Wmissing-prototypes
   3860      -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
   3861      DEBUG_SAFESTACK must also be set.
   3862      [Ben Laurie]
   3864   *) Change ./Configure so that certain algorithms can be disabled by default.
   3865      The new counterpiece to "no-xxx" is "enable-xxx".
   3867      The patented RC5 and MDC2 algorithms will now be disabled unless
   3868      "enable-rc5" and "enable-mdc2", respectively, are specified.
   3870      (IDEA remains enabled despite being patented.  This is because IDEA
   3871      is frequently required for interoperability, and there is no license
   3872      fee for non-commercial use.  As before, "no-idea" can be used to
   3873      avoid this algorithm.)
   3875      [Bodo Moeller]
   3877   *) Add processing of proxy certificates (see RFC 3820).  This work was
   3878      sponsored by KTH (The Royal Institute of Technology in Stockholm) and
   3879      EGEE (Enabling Grids for E-science in Europe).
   3880      [Richard Levitte]
   3882   *) RC4 performance overhaul on modern architectures/implementations, such
   3883      as Intel P4, IA-64 and AMD64.
   3884      [Andy Polyakov]
   3886   *) New utility extract-section.pl. This can be used specify an alternative
   3887      section number in a pod file instead of having to treat each file as
   3888      a separate case in Makefile. This can be done by adding two lines to the
   3889      pod file:
   3891      =for comment openssl_section:XXX
   3893      The blank line is mandatory.
   3895      [Steve Henson]
   3897   *) New arguments -certform, -keyform and -pass for s_client and s_server
   3898      to allow alternative format key and certificate files and passphrase
   3899      sources.
   3900      [Steve Henson]
   3902   *) New structure X509_VERIFY_PARAM which combines current verify parameters,
   3903      update associated structures and add various utility functions.
   3905      Add new policy related verify parameters, include policy checking in 
   3906      standard verify code. Enhance 'smime' application with extra parameters
   3907      to support policy checking and print out.
   3908      [Steve Henson]
   3910   *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
   3911      Nehemiah processors. These extensions support AES encryption in hardware
   3912      as well as RNG (though RNG support is currently disabled).
   3913      [Michal Ludvig <michal (a] logix.cz>, with help from Andy Polyakov]
   3915   *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
   3916      [Geoff Thorpe]
   3918   *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
   3919      [Andy Polyakov and a number of other people]
   3921   *) Improved PowerPC platform support. Most notably BIGNUM assembler
   3922      implementation contributed by IBM.
   3923      [Suresh Chari, Peter Waltenberg, Andy Polyakov]
   3925   *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
   3926      exponent rather than 'unsigned long'. There is a corresponding change to
   3927      the new 'rsa_keygen' element of the RSA_METHOD structure.
   3928      [Jelte Jansen, Geoff Thorpe]
   3930   *) Functionality for creating the initial serial number file is now
   3931      moved from CA.pl to the 'ca' utility with a new option -create_serial.
   3933      (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
   3934      number file to 1, which is bound to cause problems.  To avoid
   3935      the problems while respecting compatibility between different 0.9.7
   3936      patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
   3937      CA.pl for serial number initialization.  With the new release 0.9.8,
   3938      we can fix the problem directly in the 'ca' utility.)
   3939      [Steve Henson]
   3941   *) Reduced header interdepencies by declaring more opaque objects in
   3942      ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
   3943      give fewer recursive includes, which could break lazy source code - so
   3944      this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
   3945      developers should define this symbol when building and using openssl to
   3946      ensure they track the recommended behaviour, interfaces, [etc], but
   3947      backwards-compatible behaviour prevails when this isn't defined.
   3948      [Geoff Thorpe]
   3950   *) New function X509_POLICY_NODE_print() which prints out policy nodes.
   3951      [Steve Henson]
   3953   *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
   3954      This will generate a random key of the appropriate length based on the 
   3955      cipher context. The EVP_CIPHER can provide its own random key generation
   3956      routine to support keys of a specific form. This is used in the des and 
   3957      3des routines to generate a key of the correct parity. Update S/MIME
   3958      code to use new functions and hence generate correct parity DES keys.
   3959      Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
   3960      valid (weak or incorrect parity).
   3961      [Steve Henson]
   3963   *) Add a local set of CRLs that can be used by X509_verify_cert() as well
   3964      as looking them up. This is useful when the verified structure may contain
   3965      CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
   3966      present unless the new PKCS7_NO_CRL flag is asserted.
   3967      [Steve Henson]
   3969   *) Extend ASN1 oid configuration module. It now additionally accepts the
   3970      syntax:
   3972      shortName = some long name,
   3973      [Steve Henson]
   3975   *) Reimplemented the BN_CTX implementation. There is now no more static
   3976      limitation on the number of variables it can handle nor the depth of the
   3977      "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
   3978      information can now expand as required, and rather than having a single
   3979      static array of bignums, BN_CTX now uses a linked-list of such arrays
   3980      allowing it to expand on demand whilst maintaining the usefulness of
   3981      BN_CTX's "bundling".
   3982      [Geoff Thorpe]
   3984   *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
   3985      to allow all RSA operations to function using a single BN_CTX.
   3986      [Geoff Thorpe]
   3988   *) Preliminary support for certificate policy evaluation and checking. This
   3989      is initially intended to pass the tests outlined in "Conformance Testing
   3990      of Relying Party Client Certificate Path Processing Logic" v1.07.
   3991      [Steve Henson]
   3993   *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
   3994      remained unused and not that useful. A variety of other little bignum
   3995      tweaks and fixes have also been made continuing on from the audit (see
   3996      below).
   3997      [Geoff Thorpe]
   3999   *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
   4000      associated ASN1, EVP and SSL functions and old ASN1 macros.
   4001      [Richard Levitte]
   4003   *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
   4004      and this should never fail. So the return value from the use of
   4005      BN_set_word() (which can fail due to needless expansion) is now deprecated;
   4006      if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
   4007      [Geoff Thorpe]
   4009   *) BN_CTX_get() should return zero-valued bignums, providing the same
   4010      initialised value as BN_new().
   4011      [Geoff Thorpe, suggested by Ulf Mller]
   4013   *) Support for inhibitAnyPolicy certificate extension.
   4014      [Steve Henson]
   4016   *) An audit of the BIGNUM code is underway, for which debugging code is
   4017      enabled when BN_DEBUG is defined. This makes stricter enforcements on what
   4018      is considered valid when processing BIGNUMs, and causes execution to
   4019      assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
   4020      further steps are taken to deliberately pollute unused data in BIGNUM
   4021      structures to try and expose faulty code further on. For now, openssl will
   4022      (in its default mode of operation) continue to tolerate the inconsistent
   4023      forms that it has tolerated in the past, but authors and packagers should
   4024      consider trying openssl and their own applications when compiled with
   4025      these debugging symbols defined. It will help highlight potential bugs in
   4026      their own code, and will improve the test coverage for OpenSSL itself. At
   4027      some point, these tighter rules will become openssl's default to improve
   4028      maintainability, though the assert()s and other overheads will remain only
   4029      in debugging configurations. See bn.h for more details.
   4030      [Geoff Thorpe, Nils Larsch, Ulf Mller]
   4032   *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
   4033      that can only be obtained through BN_CTX_new() (which implicitly
   4034      initialises it). The presence of this function only made it possible
   4035      to overwrite an existing structure (and cause memory leaks).
   4036      [Geoff Thorpe]
   4038   *) Because of the callback-based approach for implementing LHASH as a
   4039      template type, lh_insert() adds opaque objects to hash-tables and
   4040      lh_doall() or lh_doall_arg() are typically used with a destructor callback
   4041      to clean up those corresponding objects before destroying the hash table
   4042      (and losing the object pointers). So some over-zealous constifications in
   4043      LHASH have been relaxed so that lh_insert() does not take (nor store) the
   4044      objects as "const" and the lh_doall[_arg] callback wrappers are not
   4045      prototyped to have "const" restrictions on the object pointers they are
   4046      given (and so aren't required to cast them away any more).
   4047      [Geoff Thorpe]
   4049   *) The tmdiff.h API was so ugly and minimal that our own timing utility
   4050      (speed) prefers to use its own implementation. The two implementations
   4051      haven't been consolidated as yet (volunteers?) but the tmdiff API has had
   4052      its object type properly exposed (MS_TM) instead of casting to/from "char
   4053      *". This may still change yet if someone realises MS_TM and "ms_time_***"
   4054      aren't necessarily the greatest nomenclatures - but this is what was used
   4055      internally to the implementation so I've used that for now.
   4056      [Geoff Thorpe]
   4058   *) Ensure that deprecated functions do not get compiled when
   4059      OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
   4060      the self-tests were still using deprecated key-generation functions so
   4061      these have been updated also.
   4062      [Geoff Thorpe]
   4064   *) Reorganise PKCS#7 code to separate the digest location functionality
   4065      into PKCS7_find_digest(), digest addtion into PKCS7_bio_add_digest().
   4066      New function PKCS7_set_digest() to set the digest type for PKCS#7
   4067      digestedData type. Add additional code to correctly generate the
   4068      digestedData type and add support for this type in PKCS7 initialization
   4069      functions.
   4070      [Steve Henson]
   4072   *) New function PKCS7_set0_type_other() this initializes a PKCS7 
   4073      structure of type "other".
   4074      [Steve Henson]
   4076   *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
   4077      sure the loop does correctly stop and breaking ("division by zero")
   4078      modulus operations are not performed. The (pre-generated) prime
   4079      table crypto/bn/bn_prime.h was already correct, but it could not be
   4080      re-generated on some platforms because of the "division by zero"
   4081      situation in the script.
   4082      [Ralf S. Engelschall]
   4084   *) Update support for ECC-based TLS ciphersuites according to
   4085      draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
   4086      SHA-1 now is only used for "small" curves (where the
   4087      representation of a field element takes up to 24 bytes); for
   4088      larger curves, the field element resulting from ECDH is directly
   4089      used as premaster secret.
   4090      [Douglas Stebila (Sun Microsystems Laboratories)]
   4092   *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
   4093      curve secp160r1 to the tests.
   4094      [Douglas Stebila (Sun Microsystems Laboratories)]
   4096   *) Add the possibility to load symbols globally with DSO.
   4097      [Gtz Babin-Ebell <babin-ebell (a] trustcenter.de> via Richard Levitte]
   4099   *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
   4100      control of the error stack.
   4101      [Richard Levitte]
   4103   *) Add support for STORE in ENGINE.
   4104      [Richard Levitte]
   4106   *) Add the STORE type.  The intention is to provide a common interface
   4107      to certificate and key stores, be they simple file-based stores, or
   4108      HSM-type store, or LDAP stores, or...
   4109      NOTE: The code is currently UNTESTED and isn't really used anywhere.
   4110      [Richard Levitte]
   4112   *) Add a generic structure called OPENSSL_ITEM.  This can be used to
   4113      pass a list of arguments to any function as well as provide a way
   4114      for a function to pass data back to the caller.
   4115      [Richard Levitte]
   4117   *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
   4118      works like BUF_strdup() but can be used to duplicate a portion of
   4119      a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
   4120      a memory area.
   4121      [Richard Levitte]
   4123   *) Add the function sk_find_ex() which works like sk_find(), but will
   4124      return an index to an element even if an exact match couldn't be
   4125      found.  The index is guaranteed to point at the element where the
   4126      searched-for key would be inserted to preserve sorting order.
   4127      [Richard Levitte]
   4129   *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
   4130      takes an extra flags argument for optional functionality.  Currently,
   4131      the following flags are defined:
   4134 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   4135 	element where the comparing function returns a negative or zero
   4136 	number.
   4139 	This one gets OBJ_bsearch_ex() to return a pointer to the first
   4140 	element where the comparing function returns zero.  This is useful
   4141 	if there are more than one element where the comparing function
   4142 	returns zero.
   4143      [Richard Levitte]
   4145   *) Make it possible to create self-signed certificates with 'openssl ca'
   4146      in such a way that the self-signed certificate becomes part of the
   4147      CA database and uses the same mechanisms for serial number generation
   4148      as all other certificate signing.  The new flag '-selfsign' enables
   4149      this functionality.  Adapt CA.sh and CA.pl.in.
   4150      [Richard Levitte]
   4152   *) Add functionality to check the public key of a certificate request
   4153      against a given private.  This is useful to check that a certificate
   4154      request can be signed by that key (self-signing).
   4155      [Richard Levitte]
   4157   *) Make it possible to have multiple active certificates with the same
   4158      subject in the CA index file.  This is done only if the keyword
   4159      'unique_subject' is set to 'no' in the main CA section (default
   4160      if 'CA_default') of the configuration file.  The value is saved
   4161      with the database itself in a separate index attribute file,
   4162      named like the index file with '.attr' appended to the name.
   4163      [Richard Levitte]
   4165   *) Generate muti valued AVAs using '+' notation in config files for
   4166      req and dirName.
   4167      [Steve Henson]
   4169   *) Support for nameConstraints certificate extension.
   4170      [Steve Henson]
   4172   *) Support for policyConstraints certificate extension.
   4173      [Steve Henson]
   4175   *) Support for policyMappings certificate extension.
   4176      [Steve Henson]
   4178   *) Make sure the default DSA_METHOD implementation only uses its
   4179      dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
   4180      and change its own handlers to be NULL so as to remove unnecessary
   4181      indirection. This lets alternative implementations fallback to the
   4182      default implementation more easily.
   4183      [Geoff Thorpe]
   4185   *) Support for directoryName in GeneralName related extensions
   4186      in config files.
   4187      [Steve Henson]
   4189   *) Make it possible to link applications using Makefile.shared.
   4190      Make that possible even when linking against static libraries!
   4191      [Richard Levitte]
   4193   *) Support for single pass processing for S/MIME signing. This now
   4194      means that S/MIME signing can be done from a pipe, in addition
   4195      cleartext signing (multipart/signed type) is effectively streaming
   4196      and the signed data does not need to be all held in memory.
   4198      This is done with a new flag PKCS7_STREAM. When this flag is set
   4199      PKCS7_sign() only initializes the PKCS7 structure and the actual signing
   4200      is done after the data is output (and digests calculated) in
   4201      SMIME_write_PKCS7().
   4202      [Steve Henson]
   4204   *) Add full support for -rpath/-R, both in shared libraries and
   4205      applications, at least on the platforms where it's known how
   4206      to do it.
   4207      [Richard Levitte]
   4209   *) In crypto/ec/ec_mult.c, implement fast point multiplication with
   4210      precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
   4211      will now compute a table of multiples of the generator that
   4212      makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
   4213      faster (notably in the case of a single point multiplication,
   4214      scalar * generator).
   4215      [Nils Larsch, Bodo Moeller]
   4217   *) IPv6 support for certificate extensions. The various extensions
   4218      which use the IP:a.b.c.d can now take IPv6 addresses using the
   4219      formats of RFC1884 2.2 . IPv6 addresses are now also displayed
   4220      correctly.
   4221      [Steve Henson]
   4223   *) Added an ENGINE that implements RSA by performing private key
   4224      exponentiations with the GMP library. The conversions to and from
   4225      GMP's mpz_t format aren't optimised nor are any montgomery forms
   4226      cached, and on x86 it appears OpenSSL's own performance has caught up.
   4227      However there are likely to be other architectures where GMP could
   4228      provide a boost. This ENGINE is not built in by default, but it can be
   4229      specified at Configure time and should be accompanied by the necessary
   4230      linker additions, eg;
   4231          ./config -DOPENSSL_USE_GMP -lgmp
   4232      [Geoff Thorpe]
   4234   *) "openssl engine" will not display ENGINE/DSO load failure errors when
   4235      testing availability of engines with "-t" - the old behaviour is
   4236      produced by increasing the feature's verbosity with "-tt".
   4237      [Geoff Thorpe]
   4239   *) ECDSA routines: under certain error conditions uninitialized BN objects
   4240      could be freed. Solution: make sure initialization is performed early
   4241      enough. (Reported and fix supplied by Nils Larsch <nla (a] trustcenter.de>
   4242      via PR#459)
   4243      [Lutz Jaenicke]
   4245   *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
   4246      and DH_METHOD (eg. by ENGINE implementations) to override the normal
   4247      software implementations. For DSA and DH, parameter generation can
   4248      also be overriden by providing the appropriate method callbacks.
   4249      [Geoff Thorpe]
   4251   *) Change the "progress" mechanism used in key-generation and
   4252      primality testing to functions that take a new BN_GENCB pointer in
   4253      place of callback/argument pairs. The new API functions have "_ex"
   4254      postfixes and the older functions are reimplemented as wrappers for
   4255      the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
   4256      declarations of the old functions to help (graceful) attempts to
   4257      migrate to the new functions. Also, the new key-generation API
   4258      functions operate on a caller-supplied key-structure and return
   4259      success/failure rather than returning a key or NULL - this is to
   4260      help make "keygen" another member function of RSA_METHOD etc.
   4262      Example for using the new callback interface:
   4264           int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
   4265           void *my_arg = ...;
   4266           BN_GENCB my_cb;
   4268           BN_GENCB_set(&my_cb, my_callback, my_arg);
   4270           return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
   4271           /* For the meaning of a, b in calls to my_callback(), see the
   4272            * documentation of the function that calls the callback.
   4273            * cb will point to my_cb; my_arg can be retrieved as cb->arg.
   4274            * my_callback should return 1 if it wants BN_is_prime_ex()
   4275            * to continue, or 0 to stop.
   4276            */
   4278      [Geoff Thorpe]
   4280   *) Change the ZLIB compression method to be stateful, and make it
   4281      available to TLS with the number defined in 
   4282      draft-ietf-tls-compression-04.txt.
   4283      [Richard Levitte]
   4285   *) Add the ASN.1 structures and functions for CertificatePair, which
   4286      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
   4288      CertificatePair ::= SEQUENCE {
   4289         forward		[0]	Certificate OPTIONAL,
   4290         reverse		[1]	Certificate OPTIONAL,
   4291         -- at least one of the pair shall be present -- }
   4293      Also implement the PEM functions to read and write certificate
   4294      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
   4296      This needed to be defined, mostly for the sake of the LDAP
   4297      attribute crossCertificatePair, but may prove useful elsewhere as
   4298      well.
   4299      [Richard Levitte]
   4301   *) Make it possible to inhibit symlinking of shared libraries in
   4302      Makefile.shared, for Cygwin's sake.
   4303      [Richard Levitte]
   4305   *) Extend the BIGNUM API by creating a function 
   4306           void BN_set_negative(BIGNUM *a, int neg);
   4307      and a macro that behave like
   4308           int  BN_is_negative(const BIGNUM *a);
   4310      to avoid the need to access 'a->neg' directly in applications.
   4311      [Nils Larsch]
   4313   *) Implement fast modular reduction for pseudo-Mersenne primes
   4314      used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
   4315      EC_GROUP_new_curve_GFp() will now automatically use this
   4316      if applicable.
   4317      [Nils Larsch <nla (a] trustcenter.de>]
   4319   *) Add new lock type (CRYPTO_LOCK_BN).
   4320      [Bodo Moeller]
   4322   *) Change the ENGINE framework to automatically load engines
   4323      dynamically from specific directories unless they could be
   4324      found to already be built in or loaded.  Move all the
   4325      current engines except for the cryptodev one to a new
   4326      directory engines/.
   4327      The engines in engines/ are built as shared libraries if
   4328      the "shared" options was given to ./Configure or ./config.
   4329      Otherwise, they are inserted in libcrypto.a.
   4330      /usr/local/ssl/engines is the default directory for dynamic
   4331      engines, but that can be overriden at configure time through
   4332      the usual use of --prefix and/or --openssldir, and at run
   4333      time with the environment variable OPENSSL_ENGINES.
   4334      [Geoff Thorpe and Richard Levitte]
   4336   *) Add Makefile.shared, a helper makefile to build shared
   4337      libraries.  Addapt Makefile.org.
   4338      [Richard Levitte]
   4340   *) Add version info to Win32 DLLs.
   4341      [Peter 'Luna' Runestig" <peter (a] runestig.com>]
   4343   *) Add new 'medium level' PKCS#12 API. Certificates and keys
   4344      can be added using this API to created arbitrary PKCS#12
   4345      files while avoiding the low level API.
   4347      New options to PKCS12_create(), key or cert can be NULL and
   4348      will then be omitted from the output file. The encryption
   4349      algorithm NIDs can be set to -1 for no encryption, the mac
   4350      iteration count can be set to 0 to omit the mac.
   4352      Enhance pkcs12 utility by making the -nokeys and -nocerts
   4353      options work when creating a PKCS#12 file. New option -nomac
   4354      to omit the mac, NONE can be set for an encryption algorithm.
   4355      New code is modified to use the enhanced PKCS12_create()
   4356      instead of the low level API.
   4357      [Steve Henson]
   4359   *) Extend ASN1 encoder to support indefinite length constructed
   4360      encoding. This can output sequences tags and octet strings in
   4361      this form. Modify pk7_asn1.c to support indefinite length
   4362      encoding. This is experimental and needs additional code to
   4363      be useful, such as an ASN1 bio and some enhanced streaming
   4364      PKCS#7 code.
   4366      Extend template encode functionality so that tagging is passed
   4367      down to the template encoder.
   4368      [Steve Henson]
   4370   *) Let 'openssl req' fail if an argument to '-newkey' is not
   4371      recognized instead of using RSA as a default.
   4372      [Bodo Moeller]
   4374   *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
   4375      As these are not official, they are not included in "ALL";
   4376      the "ECCdraft" ciphersuite group alias can be used to select them.
   4377      [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
   4379   *) Add ECDH engine support.
   4380      [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
   4382   *) Add ECDH in new directory crypto/ecdh/.
   4383      [Douglas Stebila (Sun Microsystems Laboratories)]
   4385   *) Let BN_rand_range() abort with an error after 100 iterations
   4386      without success (which indicates a broken PRNG).
   4387      [Bodo Moeller]
   4389   *) Change BN_mod_sqrt() so that it verifies that the input value
   4390      is really the square of the return value.  (Previously,
   4391      BN_mod_sqrt would show GIGO behaviour.)
   4392      [Bodo Moeller]
   4394   *) Add named elliptic curves over binary fields from X9.62, SECG,
   4395      and WAP/WTLS; add OIDs that were still missing.
   4397      [Sheueling Chang Shantz and Douglas Stebila
   4398      (Sun Microsystems Laboratories)]
   4400   *) Extend the EC library for elliptic curves over binary fields
   4401      (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
   4402      New EC_METHOD:
   4404           EC_GF2m_simple_method
   4406      New API functions:
   4408           EC_GROUP_new_curve_GF2m
   4409           EC_GROUP_set_curve_GF2m
   4410           EC_GROUP_get_curve_GF2m
   4411           EC_POINT_set_affine_coordinates_GF2m
   4412           EC_POINT_get_affine_coordinates_GF2m
   4413           EC_POINT_set_compressed_coordinates_GF2m
   4415      Point compression for binary fields is disabled by default for
   4416      patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
   4417      enable it).
   4419      As binary polynomials are represented as BIGNUMs, various members
   4420      of the EC_GROUP and EC_POINT data structures can be shared
   4421      between the implementations for prime fields and binary fields;
   4422      the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
   4423      are essentially identical to their ..._GFp counterparts.
   4424      (For simplicity, the '..._GFp' prefix has been dropped from
   4425      various internal method names.)
   4427      An internal 'field_div' method (similar to 'field_mul' and
   4428      'field_sqr') has been added; this is used only for binary fields.
   4430      [Sheueling Chang Shantz and Douglas Stebila
   4431      (Sun Microsystems Laboratories)]
   4433   *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
   4434      through methods ('mul', 'precompute_mult').
   4436      The generic implementations (now internally called 'ec_wNAF_mul'
   4437      and 'ec_wNAF_precomputed_mult') remain the default if these
   4438      methods are undefined.
   4440      [Sheueling Chang Shantz and Douglas Stebila
   4441      (Sun Microsystems Laboratories)]
   4443   *) New function EC_GROUP_get_degree, which is defined through
   4444      EC_METHOD.  For curves over prime fields, this returns the bit
   4445      length of the modulus.
   4447      [Sheueling Chang Shantz and Douglas Stebila
   4448      (Sun Microsystems Laboratories)]
   4450   *) New functions EC_GROUP_dup, EC_POINT_dup.
   4451      (These simply call ..._new  and ..._copy).
   4453      [Sheueling Chang Shantz and Douglas Stebila
   4454      (Sun Microsystems Laboratories)]
   4456   *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
   4457      Polynomials are represented as BIGNUMs (where the sign bit is not
   4458      used) in the following functions [macros]:  
   4460           BN_GF2m_add
   4461           BN_GF2m_sub             [= BN_GF2m_add]
   4462           BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
   4463           BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
   4464           BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
   4465           BN_GF2m_mod_inv
   4466           BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
   4467           BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
   4468           BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
   4469           BN_GF2m_cmp             [= BN_ucmp]
   4471      (Note that only the 'mod' functions are actually for fields GF(2^m).
   4472      BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
   4474      For some functions, an the irreducible polynomial defining a
   4475      field can be given as an 'unsigned int[]' with strictly
   4476      decreasing elements giving the indices of those bits that are set;
   4477      i.e., p[] represents the polynomial
   4478           f(t) = t^p[0] + t^p[1] + ... + t^p[k]
   4479      where
   4480           p[0] > p[1] > ... > p[k] = 0.
   4481      This applies to the following functions:
   4483           BN_GF2m_mod_arr
   4484           BN_GF2m_mod_mul_arr
   4485           BN_GF2m_mod_sqr_arr
   4486           BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
   4487           BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
   4488           BN_GF2m_mod_exp_arr
   4489           BN_GF2m_mod_sqrt_arr
   4490           BN_GF2m_mod_solve_quad_arr
   4491           BN_GF2m_poly2arr
   4492           BN_GF2m_arr2poly
   4494      Conversion can be performed by the following functions:
   4496           BN_GF2m_poly2arr
   4497           BN_GF2m_arr2poly
   4499      bntest.c has additional tests for binary polynomial arithmetic.
   4501      Two implementations for BN_GF2m_mod_div() are available.
   4502      The default algorithm simply uses BN_GF2m_mod_inv() and
   4503      BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
   4504      if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
   4505      copyright notice in crypto/bn/bn_gf2m.c before enabling it).
   4507      [Sheueling Chang Shantz and Douglas Stebila
   4508      (Sun Microsystems Laboratories)]
   4510   *) Add new error code 'ERR_R_DISABLED' that can be used when some
   4511      functionality is disabled at compile-time.
   4512      [Douglas Stebila <douglas.stebila (a] sun.com>]
   4514   *) Change default behaviour of 'openssl asn1parse' so that more
   4515      information is visible when viewing, e.g., a certificate:
   4517      Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
   4518      mode the content of non-printable OCTET STRINGs is output in a
   4519      style similar to INTEGERs, but with '[HEX DUMP]' prepended to
   4520      avoid the appearance of a printable string.
   4521      [Nils Larsch <nla (a] trustcenter.de>]
   4523   *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
   4524      functions
   4525           EC_GROUP_set_asn1_flag()
   4526           EC_GROUP_get_asn1_flag()
   4527           EC_GROUP_set_point_conversion_form()
   4528           EC_GROUP_get_point_conversion_form()
   4529      These control ASN1 encoding details:
   4530      - Curves (i.e., groups) are encoded explicitly unless asn1_flag
   4531        has been set to OPENSSL_EC_NAMED_CURVE.
   4532      - Points are encoded in uncompressed form by default; options for
   4533        asn1_for are as for point2oct, namely
   4538      Also add 'seed' and 'seed_len' members to EC_GROUP with access
   4539      functions
   4540           EC_GROUP_set_seed()
   4541           EC_GROUP_get0_seed()
   4542           EC_GROUP_get_seed_len()
   4543      This is used only for ASN1 purposes (so far).
   4544      [Nils Larsch <nla (a] trustcenter.de>]
   4546   *) Add 'field_type' member to EC_METHOD, which holds the NID
   4547      of the appropriate field type OID.  The new function
   4548      EC_METHOD_get_field_type() returns this value.
   4549      [Nils Larsch <nla (a] trustcenter.de>]
   4551   *) Add functions 
   4552           EC_POINT_point2bn()
   4553           EC_POINT_bn2point()
   4554           EC_POINT_point2hex()
   4555           EC_POINT_hex2point()
   4556      providing useful interfaces to EC_POINT_point2oct() and
   4557      EC_POINT_oct2point().
   4558      [Nils Larsch <nla (a] trustcenter.de>]
   4560   *) Change internals of the EC library so that the functions
   4561           EC_GROUP_set_generator()
   4562           EC_GROUP_get_generator()
   4563           EC_GROUP_get_order()
   4564           EC_GROUP_get_cofactor()
   4565      are implemented directly in crypto/ec/ec_lib.c and not dispatched
   4566      to methods, which would lead to unnecessary code duplication when
   4567      adding different types of curves.
   4568      [Nils Larsch <nla (a] trustcenter.de> with input by Bodo Moeller]
   4570   *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
   4571      arithmetic, and such that modified wNAFs are generated
   4572      (which avoid length expansion in many cases).
   4573      [Bodo Moeller]
   4575   *) Add a function EC_GROUP_check_discriminant() (defined via
   4576      EC_METHOD) that verifies that the curve discriminant is non-zero.
   4578      Add a function EC_GROUP_check() that makes some sanity tests
   4579      on a EC_GROUP, its generator and order.  This includes
   4580      EC_GROUP_check_discriminant().
   4581      [Nils Larsch <nla (a] trustcenter.de>]
   4583   *) Add ECDSA in new directory crypto/ecdsa/.
   4585      Add applications 'openssl ecparam' and 'openssl ecdsa'
   4586      (these are based on 'openssl dsaparam' and 'openssl dsa').
   4588      ECDSA support is also included in various other files across the
   4589      library.  Most notably,
   4590      - 'openssl req' now has a '-newkey ecdsa:file' option;
   4591      - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
   4592      - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
   4593        d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
   4594        them suitable for ECDSA where domain parameters must be
   4595        extracted before the specific public key;
   4596      - ECDSA engine support has been added.
   4597      [Nils Larsch <nla (a] trustcenter.de>]
   4599   *) Include some named elliptic curves, and add OIDs from X9.62,
   4600      SECG, and WAP/WTLS.  Each curve can be obtained from the new
   4601      function
   4602           EC_GROUP_new_by_curve_name(),
   4603      and the list of available named curves can be obtained with
   4604           EC_get_builtin_curves().
   4605      Also add a 'curve_name' member to EC_GROUP objects, which can be
   4606      accessed via
   4607          EC_GROUP_set_curve_name()
   4608          EC_GROUP_get_curve_name()
   4609      [Nils Larsch <larsch (a] trustcenter.de, Bodo Moeller]
   4611   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   4612      was actually never needed) and in BN_mul().  The removal in BN_mul()
   4613      required a small change in bn_mul_part_recursive() and the addition
   4614      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   4615      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   4616      bn_sub_words() and bn_add_words() except they take arrays with
   4617      differing sizes.
   4618      [Richard Levitte]
   4620  Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
   4622   *) Cleanse PEM buffers before freeing them since they may contain 
   4623      sensitive data.
   4624      [Benjamin Bennett <ben (a] psc.edu>]
   4626   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
   4627      a ciphersuite string such as "DEFAULT:RSA" cannot enable
   4628      authentication-only ciphersuites.
   4629      [Bodo Moeller]
   4631   *) Since AES128 and AES256 share a single mask bit in the logic of
   4632      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
   4633      kludge to work properly if AES128 is available and AES256 isn't.
   4634      [Victor Duchovni]
   4636   *) Expand security boundary to match 1.1.1 module.
   4637      [Steve Henson]
   4639   *) Remove redundant features: hash file source, editing of test vectors
   4640      modify fipsld to use external fips_premain.c signature.
   4641      [Steve Henson]
   4643   *) New perl script mkfipsscr.pl to create shell scripts or batch files to
   4644      run algorithm test programs.
   4645      [Steve Henson]
   4647   *) Make algorithm test programs more tolerant of whitespace.
   4648      [Steve Henson]
   4650   *) Have SSL/TLS server implementation tolerate "mismatched" record
   4651      protocol version while receiving ClientHello even if the
   4652      ClientHello is fragmented.  (The server can't insist on the
   4653      particular protocol version it has chosen before the ServerHello
   4654      message has informed the client about his choice.)
   4655      [Bodo Moeller]
   4657   *) Load error codes if they are not already present instead of using a
   4658      static variable. This allows them to be cleanly unloaded and reloaded.
   4659      [Steve Henson]
   4661  Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
   4663   *) Introduce limits to prevent malicious keys being able to
   4664      cause a denial of service.  (CVE-2006-2940)
   4665      [Steve Henson, Bodo Moeller]
   4667   *) Fix ASN.1 parsing of certain invalid structures that can result
   4668      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
   4670   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
   4671      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
   4673   *) Fix SSL client code which could crash if connecting to a
   4674      malicious SSLv2 server.  (CVE-2006-4343)
   4675      [Tavis Ormandy and Will Drewry, Google Security Team]
   4677   *) Change ciphersuite string processing so that an explicit
   4678      ciphersuite selects this one ciphersuite (so that "AES256-SHA"
   4679      will no longer include "AES128-SHA"), and any other similar
   4680      ciphersuite (same bitmap) from *other* protocol versions (so that
   4681      "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
   4682      SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
   4683      changes from 0.9.8b and 0.9.8d.
   4684      [Bodo Moeller]
   4686  Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
   4688   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
   4689      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
   4691   *) Change the Unix randomness entropy gathering to use poll() when
   4692      possible instead of select(), since the latter has some
   4693      undesirable limitations.
   4694      [Darryl Miles via Richard Levitte and Bodo Moeller]
   4696   *) Disable rogue ciphersuites:
   4698       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
   4699       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
   4700       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
   4702      The latter two were purportedly from
   4703      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
   4704      appear there.
   4706      Also deactive the remaining ciphersuites from
   4707      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
   4708      unofficial, and the ID has long expired.
   4709      [Bodo Moeller]
   4711   *) Fix RSA blinding Heisenbug (problems sometimes occured on
   4712      dual-core machines) and other potential thread-safety issues.
   4713      [Bodo Moeller]
   4715  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
   4717   *) Adapt fipsld and the build system to link against the validated FIPS
   4718      module in FIPS mode.
   4719      [Steve Henson]
   4721   *) Fixes for VC++ 2005 build under Windows.
   4722      [Steve Henson]
   4724   *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
   4725      from a Windows bash shell such as MSYS. It is autodetected from the
   4726      "config" script when run from a VC++ environment. Modify standard VC++
   4727      build to use fipscanister.o from the GNU make build. 
   4728      [Steve Henson]
   4730  Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
   4732   *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
   4733      The value now differs depending on if you build for FIPS or not.
   4734      BEWARE!  A program linked with a shared FIPSed libcrypto can't be
   4735      safely run with a non-FIPSed libcrypto, as it may crash because of
   4736      the difference induced by this change.
   4737      [Andy Polyakov]
   4739  Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
   4741   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
   4742      (part of SSL_OP_ALL).  This option used to disable the
   4743      countermeasure against man-in-the-middle protocol-version
   4744      rollback in the SSL 2.0 server implementation, which is a bad
   4745      idea.  (CVE-2005-2969)
   4747      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
   4748      for Information Security, National Institute of Advanced Industrial
   4749      Science and Technology [AIST], Japan)]
   4751   *) Minimal support for X9.31 signatures and PSS padding modes. This is
   4752      mainly for FIPS compliance and not fully integrated at this stage.
   4753      [Steve Henson]
   4755   *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
   4756      the exponentiation using a fixed-length exponent.  (Otherwise,
   4757      the information leaked through timing could expose the secret key
   4758      after many signatures; cf. Bleichenbacher's attack on DSA with
   4759      biased k.)
   4760      [Bodo Moeller]
   4762   *) Make a new fixed-window mod_exp implementation the default for
   4763      RSA, DSA, and DH private-key operations so that the sequence of
   4764      squares and multiplies and the memory access pattern are
   4765      independent of the particular secret key.  This will mitigate
   4766      cache-timing and potential related attacks.
   4768      BN_mod_exp_mont_consttime() is the new exponentiation implementation,
   4769      and this is automatically used by BN_mod_exp_mont() if the new flag
   4770      BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
   4771      will use this BN flag for private exponents unless the flag
   4773      DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
   4775      [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
   4777   *) Change the client implementation for SSLv23_method() and
   4778      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
   4779      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
   4780      (Previously, the SSL 2.0 backwards compatible Client Hello
   4781      message format would be used even with SSL_OP_NO_SSLv2.)
   4782      [Bodo Moeller]
   4784   *) Add support for smime-type MIME parameter in S/MIME messages which some
   4785      clients need.
   4786      [Steve Henson]
   4788   *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
   4789      a threadsafe manner. Modify rsa code to use new function and add calls
   4790      to dsa and dh code (which had race conditions before).
   4791      [Steve Henson]
   4793   *) Include the fixed error library code in the C error file definitions
   4794      instead of fixing them up at runtime. This keeps the error code
   4795      structures constant.
   4796      [Steve Henson]
   4798  Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
   4800   [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
   4801   OpenSSL 0.9.8.]
   4803   *) Fixes for newer kerberos headers. NB: the casts are needed because
   4804      the 'length' field is signed on one version and unsigned on another
   4805      with no (?) obvious way to tell the difference, without these VC++
   4806      complains. Also the "definition" of FAR (blank) is no longer included
   4807      nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
   4808      some needed definitions.
   4809      [Steve Henson]
   4811   *) Undo Cygwin change.
   4812      [Ulf Mller]
   4814   *) Added support for proxy certificates according to RFC 3820.
   4815      Because they may be a security thread to unaware applications,
   4816      they must be explicitely allowed in run-time.  See
   4817      docs/HOWTO/proxy_certificates.txt for further information.
   4818      [Richard Levitte]
   4820  Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
   4822   *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
   4823      server and client random values. Previously
   4824      (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
   4825      less random data when sizeof(time_t) > 4 (some 64 bit platforms).
   4827      This change has negligible security impact because:
   4829      1. Server and client random values still have 24 bytes of pseudo random
   4830         data.
   4832      2. Server and client random values are sent in the clear in the initial
   4833         handshake.
   4835      3. The master secret is derived using the premaster secret (48 bytes in
   4836         size for static RSA ciphersuites) as well as client server and random
   4837         values.
   4839      The OpenSSL team would like to thank the UK NISCC for bringing this issue
   4840      to our attention. 
   4842      [Stephen Henson, reported by UK NISCC]
   4844   *) Use Windows randomness collection on Cygwin.
   4845      [Ulf Mller]
   4847   *) Fix hang in EGD/PRNGD query when communication socket is closed
   4848      prematurely by EGD/PRNGD.
   4849      [Darren Tucker <dtucker (a] zip.com.au> via Lutz Jnicke, resolves #1014]
   4851   *) Prompt for pass phrases when appropriate for PKCS12 input format.
   4852      [Steve Henson]
   4854   *) Back-port of selected performance improvements from development
   4855      branch, as well as improved support for PowerPC platforms.
   4856      [Andy Polyakov]
   4858   *) Add lots of checks for memory allocation failure, error codes to indicate
   4859      failure and freeing up memory if a failure occurs.
   4860      [Nauticus Networks SSL Team <openssl (a] nauticusnet.com>, Steve Henson]
   4862   *) Add new -passin argument to dgst.
   4863      [Steve Henson]
   4865   *) Perform some character comparisons of different types in X509_NAME_cmp:
   4866      this is needed for some certificates that reencode DNs into UTF8Strings
   4867      (in violation of RFC3280) and can't or wont issue name rollover
   4868      certificates.
   4869      [Steve Henson]
   4871   *) Make an explicit check during certificate validation to see that
   4872      the CA setting in each certificate on the chain is correct.  As a
   4873      side effect always do the following basic checks on extensions,
   4874      not just when there's an associated purpose to the check:
   4876       - if there is an unhandled critical extension (unless the user
   4877         has chosen to ignore this fault)
   4878       - if the path length has been exceeded (if one is set at all)
   4879       - that certain extensions fit the associated purpose (if one has
   4880         been given)
   4881      [Richard Levitte]
   4883  Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
   4885   *) Avoid a race condition when CRLs are checked in a multi threaded 
   4886      environment. This would happen due to the reordering of the revoked
   4887      entries during signature checking and serial number lookup. Now the
   4888      encoding is cached and the serial number sort performed under a lock.
   4889      Add new STACK function sk_is_sorted().
   4890      [Steve Henson]
   4892   *) Add Delta CRL to the extension code.
   4893      [Steve Henson]
   4895   *) Various fixes to s3_pkt.c so alerts are sent properly.
   4896      [David Holmes <d.holmes (a] f5.com>]
   4898   *) Reduce the chances of duplicate issuer name and serial numbers (in
   4899      violation of RFC3280) using the OpenSSL certificate creation utilities.
   4900      This is done by creating a random 64 bit value for the initial serial
   4901      number when a serial number file is created or when a self signed
   4902      certificate is created using 'openssl req -x509'. The initial serial
   4903      number file is created using 'openssl x509 -next_serial' in CA.pl
   4904      rather than being initialized to 1.
   4905      [Steve Henson]
   4907  Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
   4909   *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
   4910      by using the Codenomicon TLS Test Tool (CVE-2004-0079)                    
   4911      [Joe Orton, Steve Henson]   
   4913   *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
   4914      (CVE-2004-0112)
   4915      [Joe Orton, Steve Henson]   
   4917   *) Make it possible to have multiple active certificates with the same
   4918      subject in the CA index file.  This is done only if the keyword
   4919      'unique_subject' is set to 'no' in the main CA section (default
   4920      if 'CA_default') of the configuration file.  The value is saved
   4921      with the database itself in a separate index attribute file,
   4922      named like the index file with '.attr' appended to the name.
   4923      [Richard Levitte]
   4925   *) X509 verify fixes. Disable broken certificate workarounds when 
   4926      X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
   4927      keyUsage extension present. Don't accept CRLs with unhandled critical
   4928      extensions: since verify currently doesn't process CRL extensions this
   4929      rejects a CRL with *any* critical extensions. Add new verify error codes
   4930      for these cases.
   4931      [Steve Henson]
   4933   *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
   4934      A clarification of RFC2560 will require the use of OCTET STRINGs and 
   4935      some implementations cannot handle the current raw format. Since OpenSSL
   4936      copies and compares OCSP nonces as opaque blobs without any attempt at
   4937      parsing them this should not create any compatibility issues.
   4938      [Steve Henson]
   4940   *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
   4941      calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
   4942      this HMAC (and other) operations are several times slower than OpenSSL
   4943      < 0.9.7.
   4944      [Steve Henson]
   4946   *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
   4947      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   4949   *) Use the correct content when signing type "other".
   4950      [Steve Henson]
   4952  Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
   4954   *) Fix various bugs revealed by running the NISCC test suite:
   4956      Stop out of bounds reads in the ASN1 code when presented with
   4957      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   4959      Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
   4961      If verify callback ignores invalid public key errors don't try to check
   4962      certificate signature with the NULL public key.
   4964      [Steve Henson]
   4966   *) New -ignore_err option in ocsp application to stop the server
   4967      exiting on the first error in a request.
   4968      [Steve Henson]
   4970   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   4971      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   4972      specifications.
   4973      [Steve Henson]
   4975   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   4976      extra data after the compression methods not only for TLS 1.0
   4977      but also for SSL 3.0 (as required by the specification).
   4978      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   4980   *) Change X509_certificate_type() to mark the key as exported/exportable
   4981      when it's 512 *bits* long, not 512 bytes.
   4982      [Richard Levitte]
   4984   *) Change AES_cbc_encrypt() so it outputs exact multiple of
   4985      blocks during encryption.
   4986      [Richard Levitte]
   4988   *) Various fixes to base64 BIO and non blocking I/O. On write 
   4989      flushes were not handled properly if the BIO retried. On read
   4990      data was not being buffered properly and had various logic bugs.
   4991      This also affects blocking I/O when the data being decoded is a
   4992      certain size.
   4993      [Steve Henson]
   4995   *) Various S/MIME bugfixes and compatibility changes:
   4996      output correct application/pkcs7 MIME type if
   4997      PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
   4998      Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
   4999      of files as .eml work). Correctly handle very long lines in MIME
   5000      parser.
   5001      [Steve Henson]
   5003  Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
   5005   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   5006      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   5007      a protocol version number mismatch like a decryption error
   5008      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   5009      [Bodo Moeller]
   5011   *) Turn on RSA blinding by default in the default implementation
   5012      to avoid a timing attack. Applications that don't want it can call
   5013      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   5014      They would be ill-advised to do so in most cases.
   5015      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   5017   *) Change RSA blinding code so that it works when the PRNG is not
   5018      seeded (in this case, the secret RSA exponent is abused as
   5019      an unpredictable seed -- if it is not unpredictable, there
   5020      is no point in blinding anyway).  Make RSA blinding thread-safe
   5021      by remembering the creator's thread ID in rsa->blinding and
   5022      having all other threads use local one-time blinding factors
   5023      (this requires more computation than sharing rsa->blinding, but
   5024      avoids excessive locking; and if an RSA object is not shared
   5025      between threads, blinding will still be very fast).
   5026      [Bodo Moeller]
   5028   *) Fixed a typo bug that would cause ENGINE_set_default() to set an
   5029      ENGINE as defaults for all supported algorithms irrespective of
   5030      the 'flags' parameter. 'flags' is now honoured, so applications
   5031      should make sure they are passing it correctly.
   5032      [Geoff Thorpe]
   5034   *) Target "mingw" now allows native Windows code to be generated in
   5035      the Cygwin environment as well as with the MinGW compiler.
   5036      [Ulf Moeller] 
   5038  Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
   5040   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   5041      via timing by performing a MAC computation even if incorrrect
   5042      block cipher padding has been found.  This is a countermeasure
   5043      against active attacks where the attacker has to distinguish
   5044      between bad padding and a MAC verification error. (CVE-2003-0078)
   5046      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   5047      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   5048      Martin Vuagnoux (EPFL, Ilion)]
   5050   *) Make the no-err option work as intended.  The intention with no-err
   5051      is not to have the whole error stack handling routines removed from
   5052      libcrypto, it's only intended to remove all the function name and
   5053      reason texts, thereby removing some of the footprint that may not
   5054      be interesting if those errors aren't displayed anyway.
   5056      NOTE: it's still possible for any application or module to have it's
   5057      own set of error texts inserted.  The routines are there, just not
   5058      used by default when no-err is given.
   5059      [Richard Levitte]
   5061   *) Add support for FreeBSD on IA64.
   5062      [dirk.meyer (a] dinoex.sub.org via Richard Levitte, resolves #454]
   5064   *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
   5065      Kerberos function mit_des_cbc_cksum().  Before this change,
   5066      the value returned by DES_cbc_cksum() was like the one from
   5067      mit_des_cbc_cksum(), except the bytes were swapped.
   5068      [Kevin Greaney <Kevin.Greaney (a] hp.com> and Richard Levitte]
   5070   *) Allow an application to disable the automatic SSL chain building.
   5071      Before this a rather primitive chain build was always performed in
   5072      ssl3_output_cert_chain(): an application had no way to send the 
   5073      correct chain if the automatic operation produced an incorrect result.
   5075      Now the chain builder is disabled if either:
   5077      1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
   5079      2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
   5081      The reasoning behind this is that an application would not want the
   5082      auto chain building to take place if extra chain certificates are
   5083      present and it might also want a means of sending no additional
   5084      certificates (for example the chain has two certificates and the
   5085      root is omitted).
   5086      [Steve Henson]
   5088   *) Add the possibility to build without the ENGINE framework.
   5089      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   5091   *) Under Win32 gmtime() can return NULL: check return value in
   5092      OPENSSL_gmtime(). Add error code for case where gmtime() fails.
   5093      [Steve Henson]
   5095   *) DSA routines: under certain error conditions uninitialized BN objects
   5096      could be freed. Solution: make sure initialization is performed early
   5097      enough. (Reported and fix supplied by Ivan D Nestlerode <nestler (a] MIT.EDU>,
   5098      Nils Larsch <nla (a] trustcenter.de> via PR#459)
   5099      [Lutz Jaenicke]
   5101   *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
   5102      checked on reconnect on the client side, therefore session resumption
   5103      could still fail with a "ssl session id is different" error. This
   5104      behaviour is masked when SSL_OP_ALL is used due to
   5105      SSL_OP_MICROSOFT_SESS_ID_BUG being set.
   5106      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   5107      followup to PR #377.
   5108      [Lutz Jaenicke]
   5110   *) IA-32 assembler support enhancements: unified ELF targets, support
   5111      for SCO/Caldera platforms, fix for Cygwin shared build.
   5112      [Andy Polyakov]
   5114   *) Add support for FreeBSD on sparc64.  As a consequence, support for
   5115      FreeBSD on non-x86 processors is separate from x86 processors on
   5116      the config script, much like the NetBSD support.
   5117      [Richard Levitte & Kris Kennaway <kris (a] obsecurity.org>]
   5119  Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
   5121   [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
   5122   OpenSSL 0.9.7.]
   5124   *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
   5125      code (06) was taken as the first octet of the session ID and the last
   5126      octet was ignored consequently. As a result SSLv2 client side session
   5127      caching could not have worked due to the session ID mismatch between
   5128      client and server.
   5129      Behaviour observed by Crispin Flowerday <crispin (a] flowerday.cx> as
   5130      PR #377.
   5131      [Lutz Jaenicke]
   5133   *) Change the declaration of needed Kerberos libraries to use EX_LIBS
   5134      instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
   5135      removed entirely.
   5136      [Richard Levitte]
   5138   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
   5139      seems that in spite of existing for more than a year, many application
   5140      author have done nothing to provide the necessary callbacks, which
   5141      means that this particular engine will not work properly anywhere.
   5142      This is a very unfortunate situation which forces us, in the name
   5143      of usability, to give the hw_ncipher.c a static lock, which is part
   5144      of libcrypto.
   5145      NOTE: This is for the 0.9.7 series ONLY.  This hack will never
   5146      appear in 0.9.8 or later.  We EXPECT application authors to have
   5147      dealt properly with this when 0.9.8 is released (unless we actually
   5148      make such changes in the libcrypto locking code that changes will
   5149      have to be made anyway).
   5150      [Richard Levitte]
   5152   *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
   5153      octets have been read, EOF or an error occurs. Without this change
   5154      some truncated ASN1 structures will not produce an error.
   5155      [Steve Henson]
   5157   *) Disable Heimdal support, since it hasn't been fully implemented.
   5158      Still give the possibility to force the use of Heimdal, but with
   5159      warnings and a request that patches get sent to openssl-dev.
   5160      [Richard Levitte]
   5162   *) Add the VC-CE target, introduce the WINCE sysname, and add
   5163      INSTALL.WCE and appropriate conditionals to make it build.
   5164      [Steven Reddie <smr (a] essemer.com.au> via Richard Levitte]
   5166   *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
   5167      cygssl-x.y.z.dll, where x, y and z are the major, minor and
   5168      edit numbers of the version.
   5169      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   5171   *) Introduce safe string copy and catenation functions
   5172      (BUF_strlcpy() and BUF_strlcat()).
   5173      [Ben Laurie (CHATS) and Richard Levitte]
   5175   *) Avoid using fixed-size buffers for one-line DNs.
   5176      [Ben Laurie (CHATS)]
   5178   *) Add BUF_MEM_grow_clean() to avoid information leakage when
   5179      resizing buffers containing secrets, and use where appropriate.
   5180      [Ben Laurie (CHATS)]
   5182   *) Avoid using fixed size buffers for configuration file location.
   5183      [Ben Laurie (CHATS)]
   5185   *) Avoid filename truncation for various CA files.
   5186      [Ben Laurie (CHATS)]
   5188   *) Use sizeof in preference to magic numbers.
   5189      [Ben Laurie (CHATS)]
   5191   *) Avoid filename truncation in cert requests.
   5192      [Ben Laurie (CHATS)]
   5194   *) Add assertions to check for (supposedly impossible) buffer
   5195      overflows.
   5196      [Ben Laurie (CHATS)]
   5198   *) Don't cache truncated DNS entries in the local cache (this could
   5199      potentially lead to a spoofing attack).
   5200      [Ben Laurie (CHATS)]
   5202   *) Fix various buffers to be large enough for hex/decimal
   5203      representations in a platform independent manner.
   5204      [Ben Laurie (CHATS)]
   5206   *) Add CRYPTO_realloc_clean() to avoid information leakage when
   5207      resizing buffers containing secrets, and use where appropriate.
   5208      [Ben Laurie (CHATS)]
   5210   *) Add BIO_indent() to avoid much slightly worrying code to do
   5211      indents.
   5212      [Ben Laurie (CHATS)]
   5214   *) Convert sprintf()/BIO_puts() to BIO_printf().
   5215      [Ben Laurie (CHATS)]
   5217   *) buffer_gets() could terminate with the buffer only half
   5218      full. Fixed.
   5219      [Ben Laurie (CHATS)]
   5221   *) Add assertions to prevent user-supplied crypto functions from
   5222      overflowing internal buffers by having large block sizes, etc.
   5223      [Ben Laurie (CHATS)]
   5225   *) New OPENSSL_assert() macro (similar to assert(), but enabled
   5226      unconditionally).
   5227      [Ben Laurie (CHATS)]
   5229   *) Eliminate unused copy of key in RC4.
   5230      [Ben Laurie (CHATS)]
   5232   *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
   5233      [Ben Laurie (CHATS)]
   5235   *) Fix off-by-one error in EGD path.
   5236      [Ben Laurie (CHATS)]
   5238   *) If RANDFILE path is too long, ignore instead of truncating.
   5239      [Ben Laurie (CHATS)]
   5241   *) Eliminate unused and incorrectly sized X.509 structure
   5242      CBCParameter.
   5243      [Ben Laurie (CHATS)]
   5245   *) Eliminate unused and dangerous function knumber().
   5246      [Ben Laurie (CHATS)]
   5248   *) Eliminate unused and dangerous structure, KSSL_ERR.
   5249      [Ben Laurie (CHATS)]
   5251   *) Protect against overlong session ID context length in an encoded
   5252      session object. Since these are local, this does not appear to be
   5253      exploitable.
   5254      [Ben Laurie (CHATS)]
   5256   *) Change from security patch (see 0.9.6e below) that did not affect
   5257      the 0.9.6 release series:
   5259      Remote buffer overflow in SSL3 protocol - an attacker could
   5260      supply an oversized master key in Kerberos-enabled versions.
   5261      (CVE-2002-0657)
   5262      [Ben Laurie (CHATS)]
   5264   *) Change the SSL kerb5 codes to match RFC 2712.
   5265      [Richard Levitte]
   5267   *) Make -nameopt work fully for req and add -reqopt switch.
   5268      [Michael Bell <michael.bell (a] rz.hu-berlin.de>, Steve Henson]
   5270   *) The "block size" for block ciphers in CFB and OFB mode should be 1.
   5271      [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve (a] opera.com>]
   5273   *) Make sure tests can be performed even if the corresponding algorithms
   5274      have been removed entirely.  This was also the last step to make
   5275      OpenSSL compilable with DJGPP under all reasonable conditions.
   5276      [Richard Levitte, Doug Kaufman <dkaufman (a] rahul.net>]
   5278   *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
   5279      to allow version independent disabling of normally unselected ciphers,
   5280      which may be activated as a side-effect of selecting a single cipher.
   5282      (E.g., cipher list string "RSA" enables ciphersuites that are left
   5283      out of "ALL" because they do not provide symmetric encryption.
   5284      "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
   5285      [Lutz Jaenicke, Bodo Moeller]
   5287   *) Add appropriate support for separate platform-dependent build
   5288      directories.  The recommended way to make a platform-dependent
   5289      build directory is the following (tested on Linux), maybe with
   5290      some local tweaks:
   5292 	# Place yourself outside of the OpenSSL source tree.  In
   5293 	# this example, the environment variable OPENSSL_SOURCE
   5294 	# is assumed to contain the absolute OpenSSL source directory.
   5295 	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
   5296 	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
   5297 	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
   5298 		mkdir -p `dirname $F`
   5299 		ln -s $OPENSSL_SOURCE/$F $F
   5300 	done
   5302      To be absolutely sure not to disturb the source tree, a "make clean"
   5303      is a good thing.  If it isn't successfull, don't worry about it,
   5304      it probably means the source directory is very clean.
   5305      [Richard Levitte]
   5307   *) Make sure any ENGINE control commands make local copies of string
   5308      pointers passed to them whenever necessary. Otherwise it is possible
   5309      the caller may have overwritten (or deallocated) the original string
   5310      data when a later ENGINE operation tries to use the stored values.
   5311      [Gtz Babin-Ebell <babinebell (a] trustcenter.de>]
   5313   *) Improve diagnostics in file reading and command-line digests.
   5314      [Ben Laurie aided and abetted by Solar Designer <solar (a] openwall.com>]
   5316   *) Add AES modes CFB and OFB to the object database.  Correct an
   5317      error in AES-CFB decryption.
   5318      [Richard Levitte]
   5320   *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
   5321      allows existing EVP_CIPHER_CTX structures to be reused after
   5322      calling EVP_*Final(). This behaviour is used by encryption
   5323      BIOs and some applications. This has the side effect that
   5324      applications must explicitly clean up cipher contexts with
   5325      EVP_CIPHER_CTX_cleanup() or they will leak memory.
   5326      [Steve Henson]
   5328   *) Check the values of dna and dnb in bn_mul_recursive before calling
   5329      bn_mul_comba (a non zero value means the a or b arrays do not contain
   5330      n2 elements) and fallback to bn_mul_normal if either is not zero.
   5331      [Steve Henson]
   5333   *) Fix escaping of non-ASCII characters when using the -subj option
   5334      of the "openssl req" command line tool. (Robert Joop <joop (a] fokus.gmd.de>)
   5335      [Lutz Jaenicke]
   5337   *) Make object definitions compliant to LDAP (RFC2256): SN is the short
   5338      form for "surname", serialNumber has no short form.
   5339      Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
   5340      therefore remove "mail" short name for "internet 7".
   5341      The OID for unique identifiers in X509 certificates is
   5342      x500UniqueIdentifier, not uniqueIdentifier.
   5343      Some more OID additions. (Michael Bell <michael.bell (a] rz.hu-berlin.de>)
   5344      [Lutz Jaenicke]
   5346   *) Add an "init" command to the ENGINE config module and auto initialize
   5347      ENGINEs. Without any "init" command the ENGINE will be initialized 
   5348      after all ctrl commands have been executed on it. If init=1 the 
   5349      ENGINE is initailized at that point (ctrls before that point are run
   5350      on the uninitialized ENGINE and after on the initialized one). If
   5351      init=0 then the ENGINE will not be iniatialized at all.
   5352      [Steve Henson]
   5354   *) Fix the 'app_verify_callback' interface so that the user-defined
   5355      argument is actually passed to the callback: In the
   5356      SSL_CTX_set_cert_verify_callback() prototype, the callback
   5357      declaration has been changed from
   5358           int (*cb)()
   5359      into
   5360           int (*cb)(X509_STORE_CTX *,void *);
   5361      in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
   5362           i=s->ctx->app_verify_callback(&ctx)
   5363      has been changed into
   5364           i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
   5366      To update applications using SSL_CTX_set_cert_verify_callback(),
   5367      a dummy argument can be added to their callback functions.
   5368      [D. K. Smetters <smetters (a] parc.xerox.com>]
   5370   *) Added the '4758cca' ENGINE to support IBM 4758 cards.
   5371      [Maurice Gittens <maurice (a] gittens.nl>, touchups by Geoff Thorpe]
   5373   *) Add and OPENSSL_LOAD_CONF define which will cause
   5374      OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
   5375      This allows older applications to transparently support certain
   5376      OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
   5377      Two new functions OPENSSL_add_all_algorithms_noconf() which will never
   5378      load the config file and OPENSSL_add_all_algorithms_conf() which will
   5379      always load it have also been added.
   5380      [Steve Henson]
   5382   *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
   5383      Adjust NIDs and EVP layer.
   5384      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   5386   *) Config modules support in openssl utility.
   5388      Most commands now load modules from the config file,
   5389      though in a few (such as version) this isn't done 
   5390      because it couldn't be used for anything.
   5392      In the case of ca and req the config file used is
   5393      the same as the utility itself: that is the -config
   5394      command line option can be used to specify an
   5395      alternative file.
   5396      [Steve Henson]
   5398   *) Move default behaviour from OPENSSL_config(). If appname is NULL
   5399      use "openssl_conf" if filename is NULL use default openssl config file.
   5400      [Steve Henson]
   5402   *) Add an argument to OPENSSL_config() to allow the use of an alternative
   5403      config section name. Add a new flag to tolerate a missing config file
   5404      and move code to CONF_modules_load_file().
   5405      [Steve Henson]
   5407   *) Support for crypto accelerator cards from Accelerated Encryption
   5408      Processing, www.aep.ie.  (Use engine 'aep')
   5409      The support was copied from 0.9.6c [engine] and adapted/corrected
   5410      to work with the new engine framework.
   5411      [AEP Inc. and Richard Levitte]
   5413   *) Support for SureWare crypto accelerator cards from Baltimore
   5414      Technologies.  (Use engine 'sureware')
   5415      The support was copied from 0.9.6c [engine] and adapted
   5416      to work with the new engine framework.
   5417      [Richard Levitte]
   5419   *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
   5420      make the newer ENGINE framework commands for the CHIL engine work.
   5421      [Toomas Kiisk <vix (a] cyber.ee> and Richard Levitte]
   5423   *) Make it possible to produce shared libraries on ReliantUNIX.
   5424      [Robert Dahlem <Robert.Dahlem (a] ffm2.siemens.de> via Richard Levitte]
   5426   *) Add the configuration target debug-linux-ppro.
   5427      Make 'openssl rsa' use the general key loading routines
   5428      implemented in apps.c, and make those routines able to
   5429      handle the key format FORMAT_NETSCAPE and the variant
   5430      FORMAT_IISSGC.
   5431      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   5433  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   5434      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   5436   *) Add -keyform to rsautl, and document -engine.
   5437      [Richard Levitte, inspired by Toomas Kiisk <vix (a] cyber.ee>]
   5439   *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
   5440      BIO_R_NO_SUCH_FILE error code rather than the generic
   5441      ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
   5442      [Ben Laurie]
   5444   *) Add new functions
   5445           ERR_peek_last_error
   5446           ERR_peek_last_error_line
   5447           ERR_peek_last_error_line_data.
   5448      These are similar to
   5449           ERR_peek_error
   5450           ERR_peek_error_line
   5451           ERR_peek_error_line_data,
   5452      but report on the latest error recorded rather than the first one
   5453      still in the error queue.
   5454      [Ben Laurie, Bodo Moeller]
   5456   *) default_algorithms option in ENGINE config module. This allows things
   5457      like:
   5458      default_algorithms = ALL
   5459      default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
   5460      [Steve Henson]
   5462   *) Prelminary ENGINE config module.
   5463      [Steve Henson]
   5465   *) New experimental application configuration code.
   5466      [Steve Henson]
   5468   *) Change the AES code to follow the same name structure as all other
   5469      symmetric ciphers, and behave the same way.  Move everything to
   5470      the directory crypto/aes, thereby obsoleting crypto/rijndael.
   5471      [Stephen Sprunk <stephen (a] sprunk.org> and Richard Levitte]
   5473   *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
   5474      [Ben Laurie and Theo de Raadt]
   5476   *) Add option to output public keys in req command.
   5477      [Massimiliano Pala madwolf (a] openca.org]
   5479   *) Use wNAFs in EC_POINTs_mul() for improved efficiency
   5480      (up to about 10% better than before for P-192 and P-224).
   5481      [Bodo Moeller]
   5483   *) New functions/macros
   5485           SSL_CTX_set_msg_callback(ctx, cb)
   5486           SSL_CTX_set_msg_callback_arg(ctx, arg)
   5487           SSL_set_msg_callback(ssl, cb)
   5488           SSL_set_msg_callback_arg(ssl, arg)
   5490      to request calling a callback function
   5492           void cb(int write_p, int version, int content_type,
   5493                   const void *buf, size_t len, SSL *ssl, void *arg)
   5495      whenever a protocol message has been completely received
   5496      (write_p == 0) or sent (write_p == 1).  Here 'version' is the
   5497      protocol version  according to which the SSL library interprets
   5498      the current protocol message (SSL2_VERSION, SSL3_VERSION, or
   5499      TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
   5500      the content type as defined in the SSL 3.0/TLS 1.0 protocol
   5501      specification (change_cipher_spec(20), alert(21), handshake(22)).
   5502      'buf' and 'len' point to the actual message, 'ssl' to the
   5503      SSL object, and 'arg' is the application-defined value set by
   5504      SSL[_CTX]_set_msg_callback_arg().
   5506      'openssl s_client' and 'openssl s_server' have new '-msg' options
   5507      to enable a callback that displays all protocol messages.
   5508      [Bodo Moeller]
   5510   *) Change the shared library support so shared libraries are built as
   5511      soon as the corresponding static library is finished, and thereby get
   5512      openssl and the test programs linked against the shared library.
   5513      This still only happens when the keyword "shard" has been given to
   5514      the configuration scripts.
   5516      NOTE: shared library support is still an experimental thing, and
   5517      backward binary compatibility is still not guaranteed.
   5518      ["Maciej W. Rozycki" <macro (a] ds2.pg.gda.pl> and Richard Levitte]
   5520   *) Add support for Subject Information Access extension.
   5521      [Peter Sylvester <Peter.Sylvester (a] EdelWeb.fr>]
   5523   *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
   5524      additional bytes when new memory had to be allocated, not just
   5525      when reusing an existing buffer.
   5526      [Bodo Moeller]
   5528   *) New command line and configuration option 'utf8' for the req command.
   5529      This allows field values to be specified as UTF8 strings.
   5530      [Steve Henson]
   5532   *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
   5533      runs for the former and machine-readable output for the latter.
   5534      [Ben Laurie]
   5536   *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
   5537      of the e-mail address in the DN (i.e., it will go into a certificate
   5538      extension only).  The new configuration file option 'email_in_dn = no'
   5539      has the same effect.
   5540      [Massimiliano Pala madwolf (a] openca.org]
   5542   *) Change all functions with names starting with des_ to be starting
   5543      with DES_ instead.  Add wrappers that are compatible with libdes,
   5544      but are named _ossl_old_des_*.  Finally, add macros that map the
   5545      des_* symbols to the corresponding _ossl_old_des_* if libdes
   5546      compatibility is desired.  If OpenSSL 0.9.6c compatibility is
   5547      desired, the des_* symbols will be mapped to DES_*, with one
   5548      exception.
   5550      Since we provide two compatibility mappings, the user needs to
   5551      define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
   5552      compatibility is desired.  The default (i.e., when that macro
   5553      isn't defined) is OpenSSL 0.9.6c compatibility.
   5555      There are also macros that enable and disable the support of old
   5556      des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
   5557      and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
   5558      are defined, the default will apply: to support the old des routines.
   5560      In either case, one must include openssl/des.h to get the correct
   5561      definitions.  Do not try to just include openssl/des_old.h, that
   5562      won't work.
   5564      NOTE: This is a major break of an old API into a new one.  Software
   5565      authors are encouraged to switch to the DES_ style functions.  Some
   5566      time in the future, des_old.h and the libdes compatibility functions
   5567      will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
   5568      default), and then completely removed.
   5569      [Richard Levitte]
   5571   *) Test for certificates which contain unsupported critical extensions.
   5572      If such a certificate is found during a verify operation it is 
   5573      rejected by default: this behaviour can be overridden by either
   5574      handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
   5575      by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
   5576      X509_supported_extension() has also been added which returns 1 if a
   5577      particular extension is supported.
   5578      [Steve Henson]
   5580   *) Modify the behaviour of EVP cipher functions in similar way to digests
   5581      to retain compatibility with existing code.
   5582      [Steve Henson]
   5584   *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
   5585      compatibility with existing code. In particular the 'ctx' parameter does
   5586      not have to be to be initialized before the call to EVP_DigestInit() and
   5587      it is tidied up after a call to EVP_DigestFinal(). New function
   5588      EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
   5589      EVP_MD_CTX_copy() changed to not require the destination to be
   5590      initialized valid and new function EVP_MD_CTX_copy_ex() added which
   5591      requires the destination to be valid.
   5593      Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
   5594      EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
   5595      [Steve Henson]
   5597   *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
   5598      so that complete 'Handshake' protocol structures are kept in memory
   5599      instead of overwriting 'msg_type' and 'length' with 'body' data.
   5600      [Bodo Moeller]
   5602   *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
   5603      [Massimo Santin via Richard Levitte]
   5605   *) Major restructuring to the underlying ENGINE code. This includes
   5606      reduction of linker bloat, separation of pure "ENGINE" manipulation
   5607      (initialisation, etc) from functionality dealing with implementations
   5608      of specific crypto iterfaces. This change also introduces integrated
   5609      support for symmetric ciphers and digest implementations - so ENGINEs
   5610      can now accelerate these by providing EVP_CIPHER and EVP_MD
   5611      implementations of their own. This is detailed in crypto/engine/README
   5612      as it couldn't be adequately described here. However, there are a few
   5613      API changes worth noting - some RSA, DSA, DH, and RAND functions that
   5614      were changed in the original introduction of ENGINE code have now
   5615      reverted back - the hooking from this code to ENGINE is now a good
   5616      deal more passive and at run-time, operations deal directly with
   5617      RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
   5618      dereferencing through an ENGINE pointer any more. Also, the ENGINE
   5619      functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
   5620      they were not being used by the framework as there is no concept of a
   5621      BIGNUM_METHOD and they could not be generalised to the new
   5622      'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
   5623      ENGINE_cpy() has been removed as it cannot be consistently defined in
   5624      the new code.
   5625      [Geoff Thorpe]
   5627   *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
   5628      [Steve Henson]
   5630   *) Change mkdef.pl to sort symbols that get the same entry number,
   5631      and make sure the automatically generated functions ERR_load_*
   5632      become part of libeay.num as well.
   5633      [Richard Levitte]
   5635   *) New function SSL_renegotiate_pending().  This returns true once
   5636      renegotiation has been requested (either SSL_renegotiate() call
   5637      or HelloRequest/ClientHello receveived from the peer) and becomes
   5638      false once a handshake has been completed.
   5639      (For servers, SSL_renegotiate() followed by SSL_do_handshake()
   5640      sends a HelloRequest, but does not ensure that a handshake takes
   5641      place.  SSL_renegotiate_pending() is useful for checking if the
   5642      client has followed the request.)
   5643      [Bodo Moeller]
   5646      By default, clients may request session resumption even during
   5647      renegotiation (if session ID contexts permit); with this option,
   5648      session resumption is possible only in the first handshake.
   5650      SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
   5651      more bits available for options that should not be part of
   5653      [Bodo Moeller]
   5655   *) Add some demos for certificate and certificate request creation.
   5656      [Steve Henson]
   5658   *) Make maximum certificate chain size accepted from the peer application
   5659      settable (SSL*_get/set_max_cert_list()), as proposed by
   5660      "Douglas E. Engert" <deengert (a] anl.gov>.
   5661      [Lutz Jaenicke]
   5663   *) Add support for shared libraries for Unixware-7
   5664      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   5665      [Lutz Jaenicke]
   5667   *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
   5668      be done prior to destruction. Use this to unload error strings from
   5669      ENGINEs that load their own error strings. NB: This adds two new API
   5670      functions to "get" and "set" this destroy handler in an ENGINE.
   5671      [Geoff Thorpe]
   5673   *) Alter all existing ENGINE implementations (except "openssl" and
   5674      "openbsd") to dynamically instantiate their own error strings. This
   5675      makes them more flexible to be built both as statically-linked ENGINEs
   5676      and self-contained shared-libraries loadable via the "dynamic" ENGINE.
   5677      Also, add stub code to each that makes building them as self-contained
   5678      shared-libraries easier (see README.ENGINE).
   5679      [Geoff Thorpe]
   5681   *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
   5682      implementations into applications that are completely implemented in
   5683      self-contained shared-libraries. The "dynamic" ENGINE exposes control
   5684      commands that can be used to configure what shared-library to load and
   5685      to control aspects of the way it is handled. Also, made an update to
   5686      the README.ENGINE file that brings its information up-to-date and
   5687      provides some information and instructions on the "dynamic" ENGINE
   5688      (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
   5689      [Geoff Thorpe]
   5691   *) Make it possible to unload ranges of ERR strings with a new
   5692      "ERR_unload_strings" function.
   5693      [Geoff Thorpe]
   5695   *) Add a copy() function to EVP_MD.
   5696      [Ben Laurie]
   5698   *) Make EVP_MD routines take a context pointer instead of just the
   5699      md_data void pointer.
   5700      [Ben Laurie]
   5702   *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
   5703      that the digest can only process a single chunk of data
   5704      (typically because it is provided by a piece of
   5705      hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
   5706      is only going to provide a single chunk of data, and hence the
   5707      framework needn't accumulate the data for oneshot drivers.
   5708      [Ben Laurie]
   5710   *) As with "ERR", make it possible to replace the underlying "ex_data"
   5711      functions. This change also alters the storage and management of global
   5712      ex_data state - it's now all inside ex_data.c and all "class" code (eg.
   5713      RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
   5714      index counters. The API functions that use this state have been changed
   5715      to take a "class_index" rather than pointers to the class's local STACK
   5716      and counter, and there is now an API function to dynamically create new
   5717      classes. This centralisation allows us to (a) plug a lot of the
   5718      thread-safety problems that existed, and (b) makes it possible to clean
   5719      up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
   5720      such data would previously have always leaked in application code and
   5721      workarounds were in place to make the memory debugging turn a blind eye
   5722      to it. Application code that doesn't use this new function will still
   5723      leak as before, but their memory debugging output will announce it now
   5724      rather than letting it slide.
   5726      Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
   5727      induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
   5728      has a return value to indicate success or failure.
   5729      [Geoff Thorpe]
   5731   *) Make it possible to replace the underlying "ERR" functions such that the
   5732      global state (2 LHASH tables and 2 locks) is only used by the "default"
   5733      implementation. This change also adds two functions to "get" and "set"
   5734      the implementation prior to it being automatically set the first time
   5735      any other ERR function takes place. Ie. an application can call "get",
   5736      pass the return value to a module it has just loaded, and that module
   5737      can call its own "set" function using that value. This means the
   5738      module's "ERR" operations will use (and modify) the error state in the
   5739      application and not in its own statically linked copy of OpenSSL code.
   5740      [Geoff Thorpe]
   5742   *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
   5743      reference counts. This performs normal REF_PRINT/REF_CHECK macros on
   5744      the operation, and provides a more encapsulated way for external code
   5745      (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
   5746      to use these functions rather than manually incrementing the counts.
   5748      Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
   5749      [Geoff Thorpe]
   5751   *) Add EVP test program.
   5752      [Ben Laurie]
   5754   *) Add symmetric cipher support to ENGINE. Expect the API to change!
   5755      [Ben Laurie]
   5757   *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
   5758      X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
   5759      X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
   5760      These allow a CRL to be built without having to access X509_CRL fields
   5761      directly. Modify 'ca' application to use new functions.
   5762      [Steve Henson]
   5764   *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
   5765      bug workarounds. Rollback attack detection is a security feature.
   5766      The problem will only arise on OpenSSL servers when TLSv1 is not
   5767      available (sslv3_server_method() or SSL_OP_NO_TLSv1).
   5768      Software authors not wanting to support TLSv1 will have special reasons
   5769      for their choice and can explicitly enable this option.
   5770      [Bodo Moeller, Lutz Jaenicke]
   5772   *) Rationalise EVP so it can be extended: don't include a union of
   5773      cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
   5774      (similar to those existing for EVP_CIPHER_CTX).
   5775      Usage example:
   5777          EVP_MD_CTX md;
   5779          EVP_MD_CTX_init(&md);             /* new function call */
   5780          EVP_DigestInit(&md, EVP_sha1());
   5781          EVP_DigestUpdate(&md, in, len);
   5782          EVP_DigestFinal(&md, out, NULL);
   5783          EVP_MD_CTX_cleanup(&md);          /* new function call */
   5785      [Ben Laurie]
   5787   *) Make DES key schedule conform to the usual scheme, as well as
   5788      correcting its structure. This means that calls to DES functions
   5789      now have to pass a pointer to a des_key_schedule instead of a
   5790      plain des_key_schedule (which was actually always a pointer
   5791      anyway): E.g.,
   5793          des_key_schedule ks;
   5795 	 des_set_key_checked(..., &ks);
   5796 	 des_ncbc_encrypt(..., &ks, ...);
   5798      (Note that a later change renames 'des_...' into 'DES_...'.)
   5799      [Ben Laurie]
   5801   *) Initial reduction of linker bloat: the use of some functions, such as
   5802      PEM causes large amounts of unused functions to be linked in due to
   5803      poor organisation. For example pem_all.c contains every PEM function
   5804      which has a knock on effect of linking in large amounts of (unused)
   5805      ASN1 code. Grouping together similar functions and splitting unrelated
   5806      functions prevents this.
   5807      [Steve Henson]
   5809   *) Cleanup of EVP macros.
   5810      [Ben Laurie]
   5812   *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
   5813      correct _ecb suffix.
   5814      [Ben Laurie]
   5816   *) Add initial OCSP responder support to ocsp application. The
   5817      revocation information is handled using the text based index
   5818      use by the ca application. The responder can either handle
   5819      requests generated internally, supplied in files (for example
   5820      via a CGI script) or using an internal minimal server.
   5821      [Steve Henson]
   5823   *) Add configuration choices to get zlib compression for TLS.
   5824      [Richard Levitte]
   5826   *) Changes to Kerberos SSL for RFC 2712 compliance:
   5827      1.  Implemented real KerberosWrapper, instead of just using
   5828          KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw (a] sxw.org.uk>]
   5829      2.  Implemented optional authenticator field of KerberosWrapper.
   5831      Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
   5832      and authenticator structs; see crypto/krb5/.
   5834      Generalized Kerberos calls to support multiple Kerberos libraries.
   5835      [Vern Staats <staatsvr (a] asc.hpc.mil>,
   5836       Jeffrey Altman <jaltman (a] columbia.edu>
   5837       via Richard Levitte]
   5839   *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
   5840      already does with RSA. testdsa.h now has 'priv_key/pub_key'
   5841      values for each of the key sizes rather than having just
   5842      parameters (and 'speed' generating keys each time).
   5843      [Geoff Thorpe]
   5845   *) Speed up EVP routines.
   5846      Before:
   5847 encrypt
   5848 type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
   5849 des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
   5850 des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
   5851 des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
   5852 decrypt
   5853 des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
   5854 des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
   5855 des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
   5856      After:
   5857 encrypt
   5858 des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
   5859 decrypt
   5860 des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   5861      [Ben Laurie]
   5863   *) Added the OS2-EMX target.
   5864      ["Brian Havard" <brianh (a] kheldar.apana.org.au> and Richard Levitte]
   5866   *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
   5867      to support NCONF routines in extension code. New function CONF_set_nconf()
   5868      to allow functions which take an NCONF to also handle the old LHASH
   5869      structure: this means that the old CONF compatible routines can be
   5870      retained (in particular wrt extensions) without having to duplicate the
   5871      code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
   5872      [Steve Henson]
   5874   *) Enhance the general user interface with mechanisms for inner control
   5875      and with possibilities to have yes/no kind of prompts.
   5876      [Richard Levitte]
   5878   *) Change all calls to low level digest routines in the library and
   5879      applications to use EVP. Add missing calls to HMAC_cleanup() and
   5880      don't assume HMAC_CTX can be copied using memcpy().
   5881      [Verdon Walker <VWalker (a] novell.com>, Steve Henson]
   5883   *) Add the possibility to control engines through control names but with
   5884      arbitrary arguments instead of just a string.
   5885      Change the key loaders to take a UI_METHOD instead of a callback
   5886      function pointer.  NOTE: this breaks binary compatibility with earlier
   5887      versions of OpenSSL [engine].
   5888      Adapt the nCipher code for these new conditions and add a card insertion
   5889      callback.
   5890      [Richard Levitte]
   5892   *) Enhance the general user interface with mechanisms to better support
   5893      dialog box interfaces, application-defined prompts, the possibility
   5894      to use defaults (for example default passwords from somewhere else)
   5895      and interrupts/cancellations.
   5896      [Richard Levitte]
   5898   *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
   5899      attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
   5900      [Steve Henson]
   5902   *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
   5903      tidy up some unnecessarily weird code in 'sk_new()').
   5904      [Geoff, reported by Diego Tartara <dtartara (a] novamens.com>]
   5906   *) Change the key loading routines for ENGINEs to use the same kind
   5907      callback (pem_password_cb) as all other routines that need this
   5908      kind of callback.
   5909      [Richard Levitte]
   5911   *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
   5912      256 bit (=32 byte) keys. Of course seeding with more entropy bytes
   5913      than this minimum value is recommended.
   5914      [Lutz Jaenicke]
   5916   *) New random seeder for OpenVMS, using the system process statistics
   5917      that are easily reachable.
   5918      [Richard Levitte]
   5920   *) Windows apparently can't transparently handle global
   5921      variables defined in DLLs. Initialisations such as:
   5923         const ASN1_ITEM *it = &ASN1_INTEGER_it;
   5925      wont compile. This is used by the any applications that need to
   5926      declare their own ASN1 modules. This was fixed by adding the option
   5927      EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
   5928      needed for static libraries under Win32.
   5929      [Steve Henson]
   5931   *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
   5932      setting of purpose and trust fields. New X509_STORE trust and
   5933      purpose functions and tidy up setting in other SSL functions.
   5934      [Steve Henson]
   5936   *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
   5937      structure. These are inherited by X509_STORE_CTX when it is 
   5938      initialised. This allows various defaults to be set in the
   5939      X509_STORE structure (such as flags for CRL checking and custom
   5940      purpose or trust settings) for functions which only use X509_STORE_CTX
   5941      internally such as S/MIME.
   5943      Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
   5944      trust settings if they are not set in X509_STORE. This allows X509_STORE
   5945      purposes and trust (in S/MIME for example) to override any set by default.
   5947      Add command line options for CRL checking to smime, s_client and s_server
   5948      applications.
   5949      [Steve Henson]
   5951   *) Initial CRL based revocation checking. If the CRL checking flag(s)
   5952      are set then the CRL is looked up in the X509_STORE structure and
   5953      its validity and signature checked, then if the certificate is found
   5954      in the CRL the verify fails with a revoked error.
   5956      Various new CRL related callbacks added to X509_STORE_CTX structure.
   5958      Command line options added to 'verify' application to support this.
   5960      This needs some additional work, such as being able to handle multiple
   5961      CRLs with different times, extension based lookup (rather than just
   5962      by subject name) and ultimately more complete V2 CRL extension
   5963      handling.
   5964      [Steve Henson]
   5966   *) Add a general user interface API (crypto/ui/).  This is designed
   5967      to replace things like des_read_password and friends (backward
   5968      compatibility functions using this new API are provided).
   5969      The purpose is to remove prompting functions from the DES code
   5970      section as well as provide for prompting through dialog boxes in
   5971      a window system and the like.
   5972      [Richard Levitte]
   5974   *) Add "ex_data" support to ENGINE so implementations can add state at a
   5975      per-structure level rather than having to store it globally.
   5976      [Geoff]
   5978   *) Make it possible for ENGINE structures to be copied when retrieved by
   5979      ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
   5980      This causes the "original" ENGINE structure to act like a template,
   5981      analogous to the RSA vs. RSA_METHOD type of separation. Because of this
   5982      operational state can be localised to each ENGINE structure, despite the
   5983      fact they all share the same "methods". New ENGINE structures returned in
   5984      this case have no functional references and the return value is the single
   5985      structural reference. This matches the single structural reference returned
   5986      by ENGINE_by_id() normally, when it is incremented on the pre-existing
   5987      ENGINE structure.
   5988      [Geoff]
   5990   *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
   5991      needs to match any other type at all we need to manually clear the
   5992      tag cache.
   5993      [Steve Henson]
   5995   *) Changes to the "openssl engine" utility to include;
   5996      - verbosity levels ('-v', '-vv', and '-vvv') that provide information
   5997        about an ENGINE's available control commands.
   5998      - executing control commands from command line arguments using the
   5999        '-pre' and '-post' switches. '-post' is only used if '-t' is
   6000        specified and the ENGINE is successfully initialised. The syntax for
   6001        the individual commands are colon-separated, for example;
   6002 	 openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
   6003      [Geoff]
   6005   *) New dynamic control command support for ENGINEs. ENGINEs can now
   6006      declare their own commands (numbers), names (strings), descriptions,
   6007      and input types for run-time discovery by calling applications. A
   6008      subset of these commands are implicitly classed as "executable"
   6009      depending on their input type, and only these can be invoked through
   6010      the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
   6011      can be based on user input, config files, etc). The distinction is
   6012      that "executable" commands cannot return anything other than a boolean
   6013      result and can only support numeric or string input, whereas some
   6014      discoverable commands may only be for direct use through
   6015      ENGINE_ctrl(), eg. supporting the exchange of binary data, function
   6016      pointers, or other custom uses. The "executable" commands are to
   6017      support parameterisations of ENGINE behaviour that can be
   6018      unambiguously defined by ENGINEs and used consistently across any
   6019      OpenSSL-based application. Commands have been added to all the
   6020      existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
   6021      control over shared-library paths without source code alterations.
   6022      [Geoff]
   6024   *) Changed all ENGINE implementations to dynamically allocate their
   6025      ENGINEs rather than declaring them statically. Apart from this being
   6026      necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
   6027      this also allows the implementations to compile without using the
   6028      internal engine_int.h header.
   6029      [Geoff]
   6031   *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
   6032      'const' value. Any code that should be able to modify a RAND_METHOD
   6033      should already have non-const pointers to it (ie. they should only
   6034      modify their own ones).
   6035      [Geoff]
   6037   *) Made a variety of little tweaks to the ENGINE code.
   6038      - "atalla" and "ubsec" string definitions were moved from header files
   6039        to C code. "nuron" string definitions were placed in variables
   6040        rather than hard-coded - allowing parameterisation of these values
   6041        later on via ctrl() commands.
   6042      - Removed unused "#if 0"'d code.
   6043      - Fixed engine list iteration code so it uses ENGINE_free() to release
   6044        structural references.
   6045      - Constified the RAND_METHOD element of ENGINE structures.
   6046      - Constified various get/set functions as appropriate and added
   6047        missing functions (including a catch-all ENGINE_cpy that duplicates
   6048        all ENGINE values onto a new ENGINE except reference counts/state).
   6049      - Removed NULL parameter checks in get/set functions. Setting a method
   6050        or function to NULL is a way of cancelling out a previously set
   6051        value.  Passing a NULL ENGINE parameter is just plain stupid anyway
   6052        and doesn't justify the extra error symbols and code.
   6053      - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
   6054        flags from engine_int.h to engine.h.
   6055      - Changed prototypes for ENGINE handler functions (init(), finish(),
   6056        ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
   6057      [Geoff]
   6059   *) Implement binary inversion algorithm for BN_mod_inverse in addition
   6060      to the algorithm using long division.  The binary algorithm can be
   6061      used only if the modulus is odd.  On 32-bit systems, it is faster
   6062      only for relatively small moduli (roughly 20-30% for 128-bit moduli,
   6063      roughly 5-15% for 256-bit moduli), so we use it only for moduli
   6064      up to 450 bits.  In 64-bit environments, the binary algorithm
   6065      appears to be advantageous for much longer moduli; here we use it
   6066      for moduli up to 2048 bits.
   6067      [Bodo Moeller]
   6069   *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
   6070      could not support the combine flag in choice fields.
   6071      [Steve Henson]
   6073   *) Add a 'copy_extensions' option to the 'ca' utility. This copies
   6074      extensions from a certificate request to the certificate.
   6075      [Steve Henson]
   6077   *) Allow multiple 'certopt' and 'nameopt' options to be separated
   6078      by commas. Add 'namopt' and 'certopt' options to the 'ca' config
   6079      file: this allows the display of the certificate about to be
   6080      signed to be customised, to allow certain fields to be included
   6081      or excluded and extension details. The old system didn't display
   6082      multicharacter strings properly, omitted fields not in the policy
   6083      and couldn't display additional details such as extensions.
   6084      [Steve Henson]
   6086   *) Function EC_POINTs_mul for multiple scalar multiplication
   6087      of an arbitrary number of elliptic curve points
   6088           \sum scalars[i]*points[i],
   6089      optionally including the generator defined for the EC_GROUP:
   6090           scalar*generator +  \sum scalars[i]*points[i].
   6092      EC_POINT_mul is a simple wrapper function for the typical case
   6093      that the point list has just one item (besides the optional
   6094      generator).
   6095      [Bodo Moeller]
   6097   *) First EC_METHODs for curves over GF(p):
   6099      EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
   6100      operations and provides various method functions that can also
   6101      operate with faster implementations of modular arithmetic.     
   6103      EC_GFp_mont_method() reuses most functions that are part of
   6104      EC_GFp_simple_method, but uses Montgomery arithmetic.
   6106      [Bodo Moeller; point addition and point doubling
   6107      implementation directly derived from source code provided by
   6108      Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>]
   6110   *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
   6111      crypto/ec/ec_lib.c):
   6113      Curves are EC_GROUP objects (with an optional group generator)
   6114      based on EC_METHODs that are built into the library.
   6116      Points are EC_POINT objects based on EC_GROUP objects.
   6118      Most of the framework would be able to handle curves over arbitrary
   6119      finite fields, but as there are no obvious types for fields other
   6120      than GF(p), some functions are limited to that for now.
   6121      [Bodo Moeller]
   6123   *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
   6124      that the file contains a complete HTTP response.
   6125      [Richard Levitte]
   6127   *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
   6128      change the def and num file printf format specifier from "%-40sXXX"
   6129      to "%-39s XXX". The latter will always guarantee a space after the
   6130      field while the former will cause them to run together if the field
   6131      is 40 of more characters long.
   6132      [Steve Henson]
   6134   *) Constify the cipher and digest 'method' functions and structures
   6135      and modify related functions to take constant EVP_MD and EVP_CIPHER
   6136      pointers.
   6137      [Steve Henson]
   6139   *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
   6140      in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
   6141      [Bodo Moeller]
   6143   *) Modify EVP_Digest*() routines so they now return values. Although the
   6144      internal software routines can never fail additional hardware versions
   6145      might.
   6146      [Steve Henson]
   6148   *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
   6150      Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
   6151      (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
   6153      ASN1 error codes
   6154           ERR_R_NESTED_ASN1_ERROR
   6155           ...
   6156           ERR_R_MISSING_ASN1_EOS
   6157      were 4 .. 9, conflicting with
   6158           ERR_LIB_RSA (= ERR_R_RSA_LIB)
   6159           ...
   6160           ERR_LIB_PEM (= ERR_R_PEM_LIB).
   6161      They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
   6163      Add new error code 'ERR_R_INTERNAL_ERROR'.
   6164      [Bodo Moeller]
   6166   *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
   6167      suffices.
   6168      [Bodo Moeller]
   6170   *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
   6171      sets the subject name for a new request or supersedes the
   6172      subject name in a given request. Formats that can be parsed are
   6173           'CN=Some Name, OU=myOU, C=IT'
   6174      and
   6175           'CN=Some Name/OU=myOU/C=IT'.
   6177      Add options '-batch' and '-verbose' to 'openssl req'.
   6178      [Massimiliano Pala <madwolf (a] hackmasters.net>]
   6180   *) Introduce the possibility to access global variables through
   6181      functions on platform were that's the best way to handle exporting
   6182      global variables in shared libraries.  To enable this functionality,
   6183      one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
   6184      "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
   6185      is normally done by Configure or something similar).
   6187      To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
   6188      in the source file (foo.c) like this:
   6190 	OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
   6191 	OPENSSL_IMPLEMENT_GLOBAL(double,bar);
   6193      To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
   6194      and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
   6196 	OPENSSL_DECLARE_GLOBAL(int,foo);
   6197 	#define foo OPENSSL_GLOBAL_REF(foo)
   6198 	OPENSSL_DECLARE_GLOBAL(double,bar);
   6199 	#define bar OPENSSL_GLOBAL_REF(bar)
   6201      The #defines are very important, and therefore so is including the
   6202      header file everywhere where the defined globals are used.
   6204      The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
   6205      of ASN.1 items, but that structure is a bit different.
   6207      The largest change is in util/mkdef.pl which has been enhanced with
   6208      better and easier to understand logic to choose which symbols should
   6209      go into the Windows .def files as well as a number of fixes and code
   6210      cleanup (among others, algorithm keywords are now sorted
   6211      lexicographically to avoid constant rewrites).
   6212      [Richard Levitte]
   6214   *) In BN_div() keep a copy of the sign of 'num' before writing the
   6215      result to 'rm' because if rm==num the value will be overwritten
   6216      and produce the wrong result if 'num' is negative: this caused
   6217      problems with BN_mod() and BN_nnmod().
   6218      [Steve Henson]
   6220   *) Function OCSP_request_verify(). This checks the signature on an
   6221      OCSP request and verifies the signer certificate. The signer
   6222      certificate is just checked for a generic purpose and OCSP request
   6223      trust settings.
   6224      [Steve Henson]
   6226   *) Add OCSP_check_validity() function to check the validity of OCSP
   6227      responses. OCSP responses are prepared in real time and may only
   6228      be a few seconds old. Simply checking that the current time lies
   6229      between thisUpdate and nextUpdate max reject otherwise valid responses
   6230      caused by either OCSP responder or client clock inaccuracy. Instead
   6231      we allow thisUpdate and nextUpdate to fall within a certain period of
   6232      the current time. The age of the response can also optionally be
   6233      checked. Two new options -validity_period and -status_age added to
   6234      ocsp utility.
   6235      [Steve Henson]
   6237   *) If signature or public key algorithm is unrecognized print out its
   6238      OID rather that just UNKNOWN.
   6239      [Steve Henson]
   6241   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
   6242      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
   6243      ID to be generated from the issuer certificate alone which can then be
   6244      passed to OCSP_id_issuer_cmp().
   6245      [Steve Henson]
   6247   *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
   6248      ASN1 modules to export functions returning ASN1_ITEM pointers
   6249      instead of the ASN1_ITEM structures themselves. This adds several
   6250      new macros which allow the underlying ASN1 function/structure to
   6251      be accessed transparently. As a result code should not use ASN1_ITEM
   6252      references directly (such as &X509_it) but instead use the relevant
   6253      macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
   6254      use of the new ASN1 code on platforms where exporting structures
   6255      is problematical (for example in shared libraries) but exporting
   6256      functions returning pointers to structures is not.
   6257      [Steve Henson]
   6259   *) Add support for overriding the generation of SSL/TLS session IDs.
   6260      These callbacks can be registered either in an SSL_CTX or per SSL.
   6261      The purpose of this is to allow applications to control, if they wish,
   6262      the arbitrary values chosen for use as session IDs, particularly as it
   6263      can be useful for session caching in multiple-server environments. A
   6264      command-line switch for testing this (and any client code that wishes
   6265      to use such a feature) has been added to "s_server".
   6266      [Geoff Thorpe, Lutz Jaenicke]
   6268   *) Modify mkdef.pl to recognise and parse preprocessor conditionals
   6269      of the form '#if defined(...) || defined(...) || ...' and
   6270      '#if !defined(...) && !defined(...) && ...'.  This also avoids
   6271      the growing number of special cases it was previously handling.
   6272      [Richard Levitte]
   6274   *) Make all configuration macros available for application by making
   6275      sure they are available in opensslconf.h, by giving them names starting
   6276      with "OPENSSL_" to avoid conflicts with other packages and by making
   6277      sure e_os2.h will cover all platform-specific cases together with
   6278      opensslconf.h.
   6279      Additionally, it is now possible to define configuration/platform-
   6280      specific names (called "system identities").  In the C code, these
   6281      are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
   6282      macro with the name beginning with "OPENSSL_SYS_", which is determined
   6283      from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
   6284      what is available.
   6285      [Richard Levitte]
   6287   *) New option -set_serial to 'req' and 'x509' this allows the serial
   6288      number to use to be specified on the command line. Previously self
   6289      signed certificates were hard coded with serial number 0 and the 
   6290      CA options of 'x509' had to use a serial number in a file which was
   6291      auto incremented.
   6292      [Steve Henson]
   6294   *) New options to 'ca' utility to support V2 CRL entry extensions.
   6295      Currently CRL reason, invalidity date and hold instruction are
   6296      supported. Add new CRL extensions to V3 code and some new objects.
   6297      [Steve Henson]
   6299   *) New function EVP_CIPHER_CTX_set_padding() this is used to
   6300      disable standard block padding (aka PKCS#5 padding) in the EVP
   6301      API, which was previously mandatory. This means that the data is
   6302      not padded in any way and so the total length much be a multiple
   6303      of the block size, otherwise an error occurs.
   6304      [Steve Henson]
   6306   *) Initial (incomplete) OCSP SSL support.
   6307      [Steve Henson]
   6309   *) New function OCSP_parse_url(). This splits up a URL into its host,
   6310      port and path components: primarily to parse OCSP URLs. New -url
   6311      option to ocsp utility.
   6312      [Steve Henson]
   6314   *) New nonce behavior. The return value of OCSP_check_nonce() now 
   6315      reflects the various checks performed. Applications can decide
   6316      whether to tolerate certain situations such as an absent nonce
   6317      in a response when one was present in a request: the ocsp application
   6318      just prints out a warning. New function OCSP_add1_basic_nonce()
   6319      this is to allow responders to include a nonce in a response even if
   6320      the request is nonce-less.
   6321      [Steve Henson]
   6323   *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
   6324      skipped when using openssl x509 multiple times on a single input file,
   6325      e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
   6326      [Bodo Moeller]
   6328   *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
   6329      set string type: to handle setting ASN1_TIME structures. Fix ca
   6330      utility to correctly initialize revocation date of CRLs.
   6331      [Steve Henson]
   6333   *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
   6334      the clients preferred ciphersuites and rather use its own preferences.
   6335      Should help to work around M$ SGC (Server Gated Cryptography) bug in
   6336      Internet Explorer by ensuring unchanged hash method during stepup.
   6337      (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
   6338      [Lutz Jaenicke]
   6340   *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
   6341      to aes and add a new 'exist' option to print out symbols that don't
   6342      appear to exist.
   6343      [Steve Henson]
   6345   *) Additional options to ocsp utility to allow flags to be set and
   6346      additional certificates supplied.
   6347      [Steve Henson]
   6349   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
   6350      OCSP client a number of certificate to only verify the response
   6351      signature against.
   6352      [Richard Levitte]
   6354   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
   6355      handle the new API. Currently only ECB, CBC modes supported. Add new
   6356      AES OIDs.
   6358      Add TLS AES ciphersuites as described in RFC3268, "Advanced
   6359      Encryption Standard (AES) Ciphersuites for Transport Layer
   6360      Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
   6361      not enabled by default and were not part of the "ALL" ciphersuite
   6362      alias because they were not yet official; they could be
   6363      explicitly requested by specifying the "AESdraft" ciphersuite
   6364      group alias.  In the final release of OpenSSL 0.9.7, the group
   6365      alias is called "AES" and is part of "ALL".)
   6366      [Ben Laurie, Steve  Henson, Bodo Moeller]
   6368   *) New function OCSP_copy_nonce() to copy nonce value (if present) from
   6369      request to response.
   6370      [Steve Henson]
   6372   *) Functions for OCSP responders. OCSP_request_onereq_count(),
   6373      OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
   6374      extract information from a certificate request. OCSP_response_create()
   6375      creates a response and optionally adds a basic response structure.
   6376      OCSP_basic_add1_status() adds a complete single response to a basic
   6377      response and returns the OCSP_SINGLERESP structure just added (to allow
   6378      extensions to be included for example). OCSP_basic_add1_cert() adds a
   6379      certificate to a basic response and OCSP_basic_sign() signs a basic
   6380      response with various flags. New helper functions ASN1_TIME_check()
   6381      (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
   6382      (converts ASN1_TIME to GeneralizedTime).
   6383      [Steve Henson]
   6385   *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
   6386      in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
   6387      structure from a certificate. X509_pubkey_digest() digests the public_key
   6388      contents: this is used in various key identifiers. 
   6389      [Steve Henson]
   6391   *) Make sk_sort() tolerate a NULL argument.
   6392      [Steve Henson reported by Massimiliano Pala <madwolf (a] comune.modena.it>]
   6394   *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
   6395      passed by the function are trusted implicitly. If any of them signed the
   6396      response then it is assumed to be valid and is not verified.
   6397      [Steve Henson]
   6399   *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
   6400      to data. This was previously part of the PKCS7 ASN1 code. This
   6401      was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
   6402      [Steve Henson, reported by Kenneth R. Robinette
   6403 				<support (a] securenetterm.com>]
   6405   *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
   6406      routines: without these tracing memory leaks is very painful.
   6407      Fix leaks in PKCS12 and PKCS7 routines.
   6408      [Steve Henson]
   6410   *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
   6411      Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
   6412      effectively meant GeneralizedTime would never be used. Now it
   6413      is initialised to -1 but X509_time_adj() now has to check the value
   6414      and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
   6415      V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
   6416      [Steve Henson, reported by Kenneth R. Robinette
   6417 				<support (a] securenetterm.com>]
   6419   *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
   6420      result in a zero length in the ASN1_INTEGER structure which was
   6421      not consistent with the structure when d2i_ASN1_INTEGER() was used
   6422      and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
   6423      to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
   6424      where it did not print out a minus for negative ASN1_INTEGER.
   6425      [Steve Henson]
   6427   *) Add summary printout to ocsp utility. The various functions which
   6428      convert status values to strings have been renamed to:
   6429      OCSP_response_status_str(), OCSP_cert_status_str() and
   6430      OCSP_crl_reason_str() and are no longer static. New options
   6431      to verify nonce values and to disable verification. OCSP response
   6432      printout format cleaned up.
   6433      [Steve Henson]
   6435   *) Add additional OCSP certificate checks. These are those specified
   6436      in RFC2560. This consists of two separate checks: the CA of the
   6437      certificate being checked must either be the OCSP signer certificate
   6438      or the issuer of the OCSP signer certificate. In the latter case the
   6439      OCSP signer certificate must contain the OCSP signing extended key
   6440      usage. This check is performed by attempting to match the OCSP
   6441      signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
   6442      in the OCSP_CERTID structures of the response.
   6443      [Steve Henson]
   6445   *) Initial OCSP certificate verification added to OCSP_basic_verify()
   6446      and related routines. This uses the standard OpenSSL certificate
   6447      verify routines to perform initial checks (just CA validity) and
   6448      to obtain the certificate chain. Then additional checks will be
   6449      performed on the chain. Currently the root CA is checked to see
   6450      if it is explicitly trusted for OCSP signing. This is used to set
   6451      a root CA as a global signing root: that is any certificate that
   6452      chains to that CA is an acceptable OCSP signing certificate.
   6453      [Steve Henson]
   6455   *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
   6456      extensions from a separate configuration file.
   6457      As when reading extensions from the main configuration file,
   6458      the '-extensions ...' option may be used for specifying the
   6459      section to use.
   6460      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   6462   *) New OCSP utility. Allows OCSP requests to be generated or
   6463      read. The request can be sent to a responder and the output
   6464      parsed, outputed or printed in text form. Not complete yet:
   6465      still needs to check the OCSP response validity.
   6466      [Steve Henson]
   6468   *) New subcommands for 'openssl ca':
   6469      'openssl ca -status <serial>' prints the status of the cert with
   6470      the given serial number (according to the index file).
   6471      'openssl ca -updatedb' updates the expiry status of certificates
   6472      in the index file.
   6473      [Massimiliano Pala <madwolf (a] comune.modena.it>]
   6475   *) New '-newreq-nodes' command option to CA.pl.  This is like
   6476      '-newreq', but calls 'openssl req' with the '-nodes' option
   6477      so that the resulting key is not encrypted.
   6478      [Damien Miller <djm (a] mindrot.org>]
   6480   *) New configuration for the GNU Hurd.
   6481      [Jonathan Bartlett <johnnyb (a] wolfram.com> via Richard Levitte]
   6483   *) Initial code to implement OCSP basic response verify. This
   6484      is currently incomplete. Currently just finds the signer's
   6485      certificate and verifies the signature on the response.
   6486      [Steve Henson]
   6488   *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
   6489      value of OPENSSLDIR.  This is available via the new '-d' option
   6490      to 'openssl version', and is also included in 'openssl version -a'.
   6491      [Bodo Moeller]
   6493   *) Allowing defining memory allocation callbacks that will be given
   6494      file name and line number information in additional arguments
   6495      (a const char* and an int).  The basic functionality remains, as
   6496      well as the original possibility to just replace malloc(),
   6497      realloc() and free() by functions that do not know about these
   6498      additional arguments.  To register and find out the current
   6499      settings for extended allocation functions, the following
   6500      functions are provided:
   6502 	CRYPTO_set_mem_ex_functions
   6503 	CRYPTO_set_locked_mem_ex_functions
   6504 	CRYPTO_get_mem_ex_functions
   6505 	CRYPTO_get_locked_mem_ex_functions
   6507      These work the same way as CRYPTO_set_mem_functions and friends.
   6508      CRYPTO_get_[locked_]mem_functions now writes 0 where such an
   6509      extended allocation function is enabled.
   6510      Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
   6511      a conventional allocation function is enabled.
   6512      [Richard Levitte, Bodo Moeller]
   6514   *) Finish off removing the remaining LHASH function pointer casts.
   6515      There should no longer be any prototype-casting required when using
   6516      the LHASH abstraction, and any casts that remain are "bugs". See
   6517      the callback types and macros at the head of lhash.h for details
   6518      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
   6519      [Geoff Thorpe]
   6521   *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
   6522      If /dev/[u]random devices are not available or do not return enough
   6523      entropy, EGD style sockets (served by EGD or PRNGD) will automatically
   6524      be queried.
   6525      The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
   6526      /etc/entropy will be queried once each in this sequence, quering stops
   6527      when enough entropy was collected without querying more sockets.
   6528      [Lutz Jaenicke]
   6530   *) Change the Unix RAND_poll() variant to be able to poll several
   6531      random devices, as specified by DEVRANDOM, until a sufficient amount
   6532      of data has been collected.   We spend at most 10 ms on each file
   6533      (select timeout) and read in non-blocking mode.  DEVRANDOM now
   6534      defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
   6535      (previously it was just the string "/dev/urandom"), so on typical
   6536      platforms the 10 ms delay will never occur.
   6537      Also separate out the Unix variant to its own file, rand_unix.c.
   6538      For VMS, there's a currently-empty rand_vms.c.
   6539      [Richard Levitte]
   6541   *) Move OCSP client related routines to ocsp_cl.c. These
   6542      provide utility functions which an application needing
   6543      to issue a request to an OCSP responder and analyse the
   6544      response will typically need: as opposed to those which an
   6545      OCSP responder itself would need which will be added later.
   6547      OCSP_request_sign() signs an OCSP request with an API similar
   6548      to PKCS7_sign(). OCSP_response_status() returns status of OCSP
   6549      response. OCSP_response_get1_basic() extracts basic response
   6550      from response. OCSP_resp_find_status(): finds and extracts status
   6551      information from an OCSP_CERTID structure (which will be created
   6552      when the request structure is built). These are built from lower
   6553      level functions which work on OCSP_SINGLERESP structures but
   6554      wont normally be used unless the application wishes to examine
   6555      extensions in the OCSP response for example.
   6557      Replace nonce routines with a pair of functions.
   6558      OCSP_request_add1_nonce() adds a nonce value and optionally
   6559      generates a random value. OCSP_check_nonce() checks the
   6560      validity of the nonce in an OCSP response.
   6561      [Steve Henson]
   6563   *) Change function OCSP_request_add() to OCSP_request_add0_id().
   6564      This doesn't copy the supplied OCSP_CERTID and avoids the
   6565      need to free up the newly created id. Change return type
   6566      to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
   6567      This can then be used to add extensions to the request.
   6568      Deleted OCSP_request_new(), since most of its functionality
   6569      is now in OCSP_REQUEST_new() (and the case insensitive name
   6570      clash) apart from the ability to set the request name which
   6571      will be added elsewhere.
   6572      [Steve Henson]
   6574   *) Update OCSP API. Remove obsolete extensions argument from
   6575      various functions. Extensions are now handled using the new
   6576      OCSP extension code. New simple OCSP HTTP function which 
   6577      can be used to send requests and parse the response.
   6578      [Steve Henson]
   6580   *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
   6581      ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
   6582      uses the special reorder version of SET OF to sort the attributes
   6583      and reorder them to match the encoded order. This resolves a long
   6584      standing problem: a verify on a PKCS7 structure just after signing
   6585      it used to fail because the attribute order did not match the
   6586      encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
   6587      it uses the received order. This is necessary to tolerate some broken
   6588      software that does not order SET OF. This is handled by encoding
   6589      as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
   6590      to produce the required SET OF.
   6591      [Steve Henson]
   6593   *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
   6594      OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
   6595      files to get correct declarations of the ASN.1 item variables.
   6596      [Richard Levitte]
   6598   *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
   6599      PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
   6600      asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
   6601      NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
   6602      New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
   6603      ASN1_ITEM and no wrapper functions.
   6604      [Steve Henson]
   6606   *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
   6607      replace the old function pointer based I/O routines. Change most of
   6608      the *_d2i_bio() and *_d2i_fp() functions to use these.
   6609      [Steve Henson]
   6611   *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
   6612      lines, recognice more "algorithms" that can be deselected, and make
   6613      it complain about algorithm deselection that isn't recognised.
   6614      [Richard Levitte]
   6616   *) New ASN1 functions to handle dup, sign, verify, digest, pack and
   6617      unpack operations in terms of ASN1_ITEM. Modify existing wrappers
   6618      to use new functions. Add NO_ASN1_OLD which can be set to remove
   6619      some old style ASN1 functions: this can be used to determine if old
   6620      code will still work when these eventually go away.
   6621      [Steve Henson]
   6623   *) New extension functions for OCSP structures, these follow the
   6624      same conventions as certificates and CRLs.
   6625      [Steve Henson]
   6627   *) New function X509V3_add1_i2d(). This automatically encodes and
   6628      adds an extension. Its behaviour can be customised with various
   6629      flags to append, replace or delete. Various wrappers added for
   6630      certifcates and CRLs.
   6631      [Steve Henson]
   6633   *) Fix to avoid calling the underlying ASN1 print routine when
   6634      an extension cannot be parsed. Correct a typo in the
   6635      OCSP_SERVICELOC extension. Tidy up print OCSP format.
   6636      [Steve Henson]
   6638   *) Make mkdef.pl parse some of the ASN1 macros and add apropriate
   6639      entries for variables.
   6640      [Steve Henson]
   6642   *) Add functionality to apps/openssl.c for detecting locking
   6643      problems: As the program is single-threaded, all we have
   6644      to do is register a locking callback using an array for
   6645      storing which locks are currently held by the program.
   6646      [Bodo Moeller]
   6648   *) Use a lock around the call to CRYPTO_get_ex_new_index() in
   6649      SSL_get_ex_data_X509_STORE_idx(), which is used in
   6650      ssl_verify_cert_chain() and thus can be called at any time
   6651      during TLS/SSL handshakes so that thread-safety is essential.
   6652      Unfortunately, the ex_data design is not at all suited
   6653      for multi-threaded use, so it probably should be abolished.
   6654      [Bodo Moeller]
   6656   *) Added Broadcom "ubsec" ENGINE to OpenSSL.
   6657      [Broadcom, tweaked and integrated by Geoff Thorpe]
   6659   *) Move common extension printing code to new function
   6660      X509V3_print_extensions(). Reorganise OCSP print routines and
   6661      implement some needed OCSP ASN1 functions. Add OCSP extensions.
   6662      [Steve Henson]
   6664   *) New function X509_signature_print() to remove duplication in some
   6665      print routines.
   6666      [Steve Henson]
   6668   *) Add a special meaning when SET OF and SEQUENCE OF flags are both
   6669      set (this was treated exactly the same as SET OF previously). This
   6670      is used to reorder the STACK representing the structure to match the
   6671      encoding. This will be used to get round a problem where a PKCS7
   6672      structure which was signed could not be verified because the STACK
   6673      order did not reflect the encoded order.
   6674      [Steve Henson]
   6676   *) Reimplement the OCSP ASN1 module using the new code.
   6677      [Steve Henson]
   6679   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
   6680      for its ASN1 operations. The old style function pointers still exist
   6681      for now but they will eventually go away.
   6682      [Steve Henson]
   6684   *) Merge in replacement ASN1 code from the ASN1 branch. This almost
   6685      completely replaces the old ASN1 functionality with a table driven
   6686      encoder and decoder which interprets an ASN1_ITEM structure describing
   6687      the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
   6688      largely maintained. Almost all of the old asn1_mac.h macro based ASN1
   6689      has also been converted to the new form.
   6690      [Steve Henson]
   6692   *) Change BN_mod_exp_recp so that negative moduli are tolerated
   6693      (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
   6694      so that BN_mod_exp_mont and BN_mod_exp_mont_word work
   6695      for negative moduli.
   6696      [Bodo Moeller]
   6698   *) Fix BN_uadd and BN_usub: Always return non-negative results instead
   6699      of not touching the result's sign bit.
   6700      [Bodo Moeller]
   6702   *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
   6703      set.
   6704      [Bodo Moeller]
   6706   *) Changed the LHASH code to use prototypes for callbacks, and created
   6707      macros to declare and implement thin (optionally static) functions
   6708      that provide type-safety and avoid function pointer casting for the
   6709      type-specific callbacks.
   6710      [Geoff Thorpe]
   6712   *) Added Kerberos Cipher Suites to be used with TLS, as written in
   6713      RFC 2712.
   6714      [Veers Staats <staatsvr (a] asc.hpc.mil>,
   6715       Jeffrey Altman <jaltman (a] columbia.edu>, via Richard Levitte]
   6717   *) Reformat the FAQ so the different questions and answers can be divided
   6718      in sections depending on the subject.
   6719      [Richard Levitte]
   6721   *) Have the zlib compression code load ZLIB.DLL dynamically under
   6722      Windows.
   6723      [Richard Levitte]
   6725   *) New function BN_mod_sqrt for computing square roots modulo a prime
   6726      (using the probabilistic Tonelli-Shanks algorithm unless
   6727      p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
   6728      be handled deterministically).
   6729      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   6731   *) Make BN_mod_inverse faster by explicitly handling small quotients
   6732      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
   6733      512 bits], about 30% for larger ones [1024 or 2048 bits].)
   6734      [Bodo Moeller]
   6736   *) New function BN_kronecker.
   6737      [Bodo Moeller]
   6739   *) Fix BN_gcd so that it works on negative inputs; the result is
   6740      positive unless both parameters are zero.
   6741      Previously something reasonably close to an infinite loop was
   6742      possible because numbers could be growing instead of shrinking
   6743      in the implementation of Euclid's algorithm.
   6744      [Bodo Moeller]
   6746   *) Fix BN_is_word() and BN_is_one() macros to take into account the
   6747      sign of the number in question.
   6749      Fix BN_is_word(a,w) to work correctly for w == 0.
   6751      The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
   6752      because its test if the absolute value of 'a' equals 'w'.
   6753      Note that BN_abs_is_word does *not* handle w == 0 reliably;
   6754      it exists mostly for use in the implementations of BN_is_zero(),
   6755      BN_is_one(), and BN_is_word().
   6756      [Bodo Moeller]
   6758   *) New function BN_swap.
   6759      [Bodo Moeller]
   6761   *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
   6762      the exponentiation functions are more likely to produce reasonable
   6763      results on negative inputs.
   6764      [Bodo Moeller]
   6766   *) Change BN_mod_mul so that the result is always non-negative.
   6767      Previously, it could be negative if one of the factors was negative;
   6768      I don't think anyone really wanted that behaviour.
   6769      [Bodo Moeller]
   6771   *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
   6772      (except for exponentiation, which stays in crypto/bn/bn_exp.c,
   6773      and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
   6774      and add new functions:
   6776           BN_nnmod
   6777           BN_mod_sqr
   6778           BN_mod_add
   6779           BN_mod_add_quick
   6780           BN_mod_sub
   6781           BN_mod_sub_quick
   6782           BN_mod_lshift1
   6783           BN_mod_lshift1_quick
   6784           BN_mod_lshift
   6785           BN_mod_lshift_quick
   6787      These functions always generate non-negative results.
   6789      BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
   6790      such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
   6792      BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
   6793      BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
   6794      be reduced modulo  m.
   6795      [Lenka Fibikova <fibikova (a] exp-math.uni-essen.de>, Bodo Moeller]
   6797 #if 0
   6798      The following entry accidentily appeared in the CHANGES file
   6799      distributed with OpenSSL 0.9.7.  The modifications described in
   6800      it do *not* apply to OpenSSL 0.9.7.
   6802   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
   6803      was actually never needed) and in BN_mul().  The removal in BN_mul()
   6804      required a small change in bn_mul_part_recursive() and the addition
   6805      of the functions bn_cmp_part_words(), bn_sub_part_words() and
   6806      bn_add_part_words(), which do the same thing as bn_cmp_words(),
   6807      bn_sub_words() and bn_add_words() except they take arrays with
   6808      differing sizes.
   6809      [Richard Levitte]
   6810 #endif
   6812   *) In 'openssl passwd', verify passwords read from the terminal
   6813      unless the '-salt' option is used (which usually means that
   6814      verification would just waste user's time since the resulting
   6815      hash is going to be compared with some given password hash)
   6816      or the new '-noverify' option is used.
   6818      This is an incompatible change, but it does not affect
   6819      non-interactive use of 'openssl passwd' (passwords on the command
   6820      line, '-stdin' option, '-in ...' option) and thus should not
   6821      cause any problems.
   6822      [Bodo Moeller]
   6824   *) Remove all references to RSAref, since there's no more need for it.
   6825      [Richard Levitte]
   6827   *) Make DSO load along a path given through an environment variable
   6828      (SHLIB_PATH) with shl_load().
   6829      [Richard Levitte]
   6831   *) Constify the ENGINE code as a result of BIGNUM constification.
   6832      Also constify the RSA code and most things related to it.  In a
   6833      few places, most notable in the depth of the ASN.1 code, ugly
   6834      casts back to non-const were required (to be solved at a later
   6835      time)
   6836      [Richard Levitte]
   6838   *) Make it so the openssl application has all engines loaded by default.
   6839      [Richard Levitte]
   6841   *) Constify the BIGNUM routines a little more.
   6842      [Richard Levitte]
   6844   *) Add the following functions:
   6846 	ENGINE_load_cswift()
   6847 	ENGINE_load_chil()
   6848 	ENGINE_load_atalla()
   6849 	ENGINE_load_nuron()
   6850 	ENGINE_load_builtin_engines()
   6852      That way, an application can itself choose if external engines that
   6853      are built-in in OpenSSL shall ever be used or not.  The benefit is
   6854      that applications won't have to be linked with libdl or other dso
   6855      libraries unless it's really needed.
   6857      Changed 'openssl engine' to load all engines on demand.
   6858      Changed the engine header files to avoid the duplication of some
   6859      declarations (they differed!).
   6860      [Richard Levitte]
   6862   *) 'openssl engine' can now list capabilities.
   6863      [Richard Levitte]
   6865   *) Better error reporting in 'openssl engine'.
   6866      [Richard Levitte]
   6868   *) Never call load_dh_param(NULL) in s_server.
   6869      [Bodo Moeller]
   6871   *) Add engine application.  It can currently list engines by name and
   6872      identity, and test if they are actually available.
   6873      [Richard Levitte]
   6875   *) Improve RPM specification file by forcing symbolic linking and making
   6876      sure the installed documentation is also owned by root.root.
   6877      [Damien Miller <djm (a] mindrot.org>]
   6879   *) Give the OpenSSL applications more possibilities to make use of
   6880      keys (public as well as private) handled by engines.
   6881      [Richard Levitte]
   6883   *) Add OCSP code that comes from CertCo.
   6884      [Richard Levitte]
   6886   *) Add VMS support for the Rijndael code.
   6887      [Richard Levitte]
   6889   *) Added untested support for Nuron crypto accelerator.
   6890      [Ben Laurie]
   6892   *) Add support for external cryptographic devices.  This code was
   6893      previously distributed separately as the "engine" branch.
   6894      [Geoff Thorpe, Richard Levitte]
   6896   *) Rework the filename-translation in the DSO code. It is now possible to
   6897      have far greater control over how a "name" is turned into a filename
   6898      depending on the operating environment and any oddities about the
   6899      different shared library filenames on each system.
   6900      [Geoff Thorpe]
   6902   *) Support threads on FreeBSD-elf in Configure.
   6903      [Richard Levitte]
   6905   *) Fix for SHA1 assembly problem with MASM: it produces
   6906      warnings about corrupt line number information when assembling
   6907      with debugging information. This is caused by the overlapping
   6908      of two sections.
   6909      [Bernd Matthes <mainbug (a] celocom.de>, Steve Henson]
   6911   *) NCONF changes.
   6912      NCONF_get_number() has no error checking at all.  As a replacement,
   6913      NCONF_get_number_e() is defined (_e for "error checking") and is
   6914      promoted strongly.  The old NCONF_get_number is kept around for
   6915      binary backward compatibility.
   6916      Make it possible for methods to load from something other than a BIO,
   6917      by providing a function pointer that is given a name instead of a BIO.
   6918      For example, this could be used to load configuration data from an
   6919      LDAP server.
   6920      [Richard Levitte]
   6922   *) Fix for non blocking accept BIOs. Added new I/O special reason
   6923      BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
   6924      with non blocking I/O was not possible because no retry code was
   6925      implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
   6926      this case.
   6927      [Steve Henson]
   6929   *) Added the beginnings of Rijndael support.
   6930      [Ben Laurie]
   6932   *) Fix for bug in DirectoryString mask setting. Add support for
   6933      X509_NAME_print_ex() in 'req' and X509_print_ex() function
   6934      to allow certificate printing to more controllable, additional
   6935      'certopt' option to 'x509' to allow new printing options to be
   6936      set.
   6937      [Steve Henson]
   6939   *) Clean old EAY MD5 hack from e_os.h.
   6940      [Richard Levitte]
   6942  Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
   6944   *) Fix null-pointer assignment in do_change_cipher_spec() revealed
   6945      by using the Codenomicon TLS Test Tool (CVE-2004-0079)
   6946      [Joe Orton, Steve Henson]
   6948  Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
   6950   *) Fix additional bug revealed by the NISCC test suite:
   6952      Stop bug triggering large recursion when presented with
   6953      certain ASN.1 tags (CVE-2003-0851)
   6954      [Steve Henson]
   6956  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
   6958   *) Fix various bugs revealed by running the NISCC test suite:
   6960      Stop out of bounds reads in the ASN1 code when presented with
   6961      invalid tags (CVE-2003-0543 and CVE-2003-0544).
   6963      If verify callback ignores invalid public key errors don't try to check
   6964      certificate signature with the NULL public key.
   6966      [Steve Henson]
   6968   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
   6969      if the server requested one: as stated in TLS 1.0 and SSL 3.0
   6970      specifications.
   6971      [Steve Henson]
   6973   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
   6974      extra data after the compression methods not only for TLS 1.0
   6975      but also for SSL 3.0 (as required by the specification).
   6976      [Bodo Moeller; problem pointed out by Matthias Loepfe]
   6978   *) Change X509_certificate_type() to mark the key as exported/exportable
   6979      when it's 512 *bits* long, not 512 bytes.
   6980      [Richard Levitte]
   6982  Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
   6984   *) Countermeasure against the Klima-Pokorny-Rosa extension of
   6985      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
   6986      a protocol version number mismatch like a decryption error
   6987      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
   6988      [Bodo Moeller]
   6990   *) Turn on RSA blinding by default in the default implementation
   6991      to avoid a timing attack. Applications that don't want it can call
   6992      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
   6993      They would be ill-advised to do so in most cases.
   6994      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
   6996   *) Change RSA blinding code so that it works when the PRNG is not
   6997      seeded (in this case, the secret RSA exponent is abused as
   6998      an unpredictable seed -- if it is not unpredictable, there
   6999      is no point in blinding anyway).  Make RSA blinding thread-safe
   7000      by remembering the creator's thread ID in rsa->blinding and
   7001      having all other threads use local one-time blinding factors
   7002      (this requires more computation than sharing rsa->blinding, but
   7003      avoids excessive locking; and if an RSA object is not shared
   7004      between threads, blinding will still be very fast).
   7005      [Bodo Moeller]
   7007  Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
   7009   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
   7010      via timing by performing a MAC computation even if incorrrect
   7011      block cipher padding has been found.  This is a countermeasure
   7012      against active attacks where the attacker has to distinguish
   7013      between bad padding and a MAC verification error. (CVE-2003-0078)
   7015      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
   7016      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
   7017      Martin Vuagnoux (EPFL, Ilion)]
   7019  Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
   7021   *) New function OPENSSL_cleanse(), which is used to cleanse a section of
   7022      memory from it's contents.  This is done with a counter that will
   7023      place alternating values in each byte.  This can be used to solve
   7024      two issues: 1) the removal of calls to memset() by highly optimizing
   7025      compilers, and 2) cleansing with other values than 0, since those can
   7026      be read through on certain media, for example a swap space on disk.
   7027      [Geoff Thorpe]
   7029   *) Bugfix: client side session caching did not work with external caching,
   7030      because the session->cipher setting was not restored when reloading
   7031      from the external cache. This problem was masked, when
   7032      SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
   7033      (Found by Steve Haslam <steve (a] araqnid.ddts.net>.)
   7034      [Lutz Jaenicke]
   7036   *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
   7037      length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
   7038      [Zeev Lieber <zeev-l (a] yahoo.com>]
   7040   *) Undo an undocumented change introduced in 0.9.6e which caused
   7041      repeated calls to OpenSSL_add_all_ciphers() and 
   7042      OpenSSL_add_all_digests() to be ignored, even after calling
   7043      EVP_cleanup().
   7044      [Richard Levitte]
   7046   *) Change the default configuration reader to deal with last line not
   7047      being properly terminated.
   7048      [Richard Levitte]
   7050   *) Change X509_NAME_cmp() so it applies the special rules on handling
   7051      DN values that are of type PrintableString, as well as RDNs of type
   7052      emailAddress where the value has the type ia5String.
   7053      [stefank (a] valicert.com via Richard Levitte]
   7055   *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
   7056      the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
   7057      doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
   7058      the bitwise-OR of the two for use by the majority of applications
   7059      wanting this behaviour, and update the docs. The documented
   7060      behaviour and actual behaviour were inconsistent and had been
   7061      changing anyway, so this is more a bug-fix than a behavioural
   7062      change.
   7063      [Geoff Thorpe, diagnosed by Nadav Har'El]
   7065   *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
   7066      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
   7067      [Bodo Moeller]
   7069   *) Fix initialization code race conditions in
   7070         SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
   7071         SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
   7072         SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
   7073         TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
   7074         ssl2_get_cipher_by_char(),
   7075         ssl3_get_cipher_by_char().
   7076      [Patrick McCormick <patrick (a] tellme.com>, Bodo Moeller]
   7078   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
   7079      the cached sessions are flushed, as the remove_cb() might use ex_data
   7080      contents. Bug found by Sam Varshavchik <mrsam (a] courier-mta.com>
   7081      (see [openssl.org #212]).
   7082      [Geoff Thorpe, Lutz Jaenicke]
   7084   *) Fix typo in OBJ_txt2obj which incorrectly passed the content
   7085      length, instead of the encoding length to d2i_ASN1_OBJECT.
   7086      [Steve Henson]
   7088  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
   7090   *) [In 0.9.6g-engine release:]
   7091      Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
   7092      [Lynn Gazis <lgazis (a] rainbow.com>]
   7094  Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
   7096   *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
   7097      and get fix the header length calculation.
   7098      [Florian Weimer <Weimer (a] CERT.Uni-Stuttgart.DE>,
   7099 	Alon Kantor <alonk (a] checkpoint.com> (and others),
   7100 	Steve Henson]
   7102   *) Use proper error handling instead of 'assertions' in buffer
   7103      overflow checks added in 0.9.6e.  This prevents DoS (the
   7104      assertions could call abort()).
   7105      [Arne Ansper <arne (a] ats.cyber.ee>, Bodo Moeller]
   7107  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
   7109   *) Add various sanity checks to asn1_get_length() to reject
   7110      the ASN1 length bytes if they exceed sizeof(long), will appear
   7111      negative or the content length exceeds the length of the
   7112      supplied buffer.
   7113      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   7115   *) Fix cipher selection routines: ciphers without encryption had no flags
   7116      for the cipher strength set and where therefore not handled correctly
   7117      by the selection routines (PR #130).
   7118      [Lutz Jaenicke]
   7120   *) Fix EVP_dsa_sha macro.
   7121      [Nils Larsch]
   7123   *) New option
   7125      for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
   7126      that was added in OpenSSL 0.9.6d.
   7128      As the countermeasure turned out to be incompatible with some
   7129      broken SSL implementations, the new option is part of SSL_OP_ALL.
   7130      SSL_OP_ALL is usually employed when compatibility with weird SSL
   7131      implementations is desired (e.g. '-bugs' option to 's_client' and
   7132      's_server'), so the new option is automatically set in many
   7133      applications.
   7134      [Bodo Moeller]
   7136   *) Changes in security patch:
   7138      Changes marked "(CHATS)" were sponsored by the Defense Advanced
   7139      Research Projects Agency (DARPA) and Air Force Research Laboratory,
   7140      Air Force Materiel Command, USAF, under agreement number
   7141      F30602-01-2-0537.
   7143   *) Add various sanity checks to asn1_get_length() to reject
   7144      the ASN1 length bytes if they exceed sizeof(long), will appear
   7145      negative or the content length exceeds the length of the
   7146      supplied buffer. (CVE-2002-0659)
   7147      [Steve Henson, Adi Stav <stav (a] mercury.co.il>, James Yonan <jim (a] ntlp.com>]
   7149   *) Assertions for various potential buffer overflows, not known to
   7150      happen in practice.
   7151      [Ben Laurie (CHATS)]
   7153   *) Various temporary buffers to hold ASCII versions of integers were
   7154      too small for 64 bit platforms. (CVE-2002-0655)
   7155      [Matthew Byng-Maddick <mbm (a] aldigital.co.uk> and Ben Laurie (CHATS)>
   7157   *) Remote buffer overflow in SSL3 protocol - an attacker could
   7158      supply an oversized session ID to a client. (CVE-2002-0656)
   7159      [Ben Laurie (CHATS)]
   7161   *) Remote buffer overflow in SSL2 protocol - an attacker could
   7162      supply an oversized client master key. (CVE-2002-0656)
   7163      [Ben Laurie (CHATS)]
   7165  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
   7167   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
   7168      encoded as NULL) with id-dsa-with-sha1.
   7169      [Nils Larsch <nla (a] trustcenter.de>; problem pointed out by Bodo Moeller]
   7171   *) Check various X509_...() return values in apps/req.c.
   7172      [Nils Larsch <nla (a] trustcenter.de>]
   7174   *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
   7175      an end-of-file condition would erronously be flagged, when the CRLF
   7176      was just at the end of a processed block. The bug was discovered when
   7177      processing data through a buffering memory BIO handing the data to a
   7178      BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
   7179      <ptsekov (a] syntrex.com> and Nedelcho Stanev.
   7180      [Lutz Jaenicke]
   7182   *) Implement a countermeasure against a vulnerability recently found
   7183      in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
   7184      before application data chunks to avoid the use of known IVs
   7185      with data potentially chosen by the attacker.
   7186      [Bodo Moeller]
   7188   *) Fix length checks in ssl3_get_client_hello().
   7189      [Bodo Moeller]
   7191   *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
   7192      to prevent ssl3_read_internal() from incorrectly assuming that
   7193      ssl3_read_bytes() found application data while handshake
   7194      processing was enabled when in fact s->s3->in_read_app_data was
   7195      merely automatically cleared during the initial handshake.
   7196      [Bodo Moeller; problem pointed out by Arne Ansper <arne (a] ats.cyber.ee>]
   7198   *) Fix object definitions for Private and Enterprise: they were not
   7199      recognized in their shortname (=lowercase) representation. Extend
   7200      obj_dat.pl to issue an error when using undefined keywords instead
   7201      of silently ignoring the problem (Svenning Sorensen
   7202      <sss (a] sss.dnsalias.net>).
   7203      [Lutz Jaenicke]
   7205   *) Fix DH_generate_parameters() so that it works for 'non-standard'
   7206      generators, i.e. generators other than 2 and 5.  (Previously, the
   7207      code did not properly initialise the 'add' and 'rem' values to
   7208      BN_generate_prime().)
   7210      In the new general case, we do not insist that 'generator' is
   7211      actually a primitive root: This requirement is rather pointless;
   7212      a generator of the order-q subgroup is just as good, if not
   7213      better.
   7214      [Bodo Moeller]
   7216   *) Map new X509 verification errors to alerts. Discovered and submitted by
   7217      Tom Wu <tom (a] arcot.com>.
   7218      [Lutz Jaenicke]
   7220   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
   7221      returning non-zero before the data has been completely received
   7222      when using non-blocking I/O.
   7223      [Bodo Moeller; problem pointed out by John Hughes]
   7225   *) Some of the ciphers missed the strength entry (SSL_LOW etc).
   7226      [Ben Laurie, Lutz Jaenicke]
   7228   *) Fix bug in SSL_clear(): bad sessions were not removed (found by
   7229      Yoram Zahavi <YoramZ (a] gilian.com>).
   7230      [Lutz Jaenicke]
   7232   *) Add information about CygWin 1.3 and on, and preserve proper
   7233      configuration for the versions before that.
   7234      [Corinna Vinschen <vinschen (a] redhat.com> and Richard Levitte]
   7236   *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
   7237      check whether we deal with a copy of a session and do not delete from
   7238      the cache in this case. Problem reported by "Izhar Shoshani Levi"
   7239      <izhar (a] checkpoint.com>.
   7240      [Lutz Jaenicke]
   7242   *) Do not store session data into the internal session cache, if it
   7243      is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
   7244      flag is set). Proposed by Aslam <aslam (a] funk.com>.
   7245      [Lutz Jaenicke]
   7247   *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
   7248      value is 0.
   7249      [Richard Levitte]
   7251   *) [In 0.9.6d-engine release:]
   7252      Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
   7253      [Toomas Kiisk <vix (a] cyber.ee> via Richard Levitte]
   7255   *) Add the configuration target linux-s390x.
   7256      [Neale Ferguson <Neale.Ferguson (a] SoftwareAG-USA.com> via Richard Levitte]
   7258   *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
   7259      ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
   7260      variable as an indication that a ClientHello message has been
   7261      received.  As the flag value will be lost between multiple
   7262      invocations of ssl3_accept when using non-blocking I/O, the
   7263      function may not be aware that a handshake has actually taken
   7264      place, thus preventing a new session from being added to the
   7265      session cache.
   7267      To avoid this problem, we now set s->new_session to 2 instead of
   7268      using a local variable.
   7269      [Lutz Jaenicke, Bodo Moeller]
   7271   *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
   7272      if the SSL_R_LENGTH_MISMATCH error is detected.
   7273      [Geoff Thorpe, Bodo Moeller]
   7275   *) New 'shared_ldflag' column in Configure platform table.
   7276      [Richard Levitte]
   7278   *) Fix EVP_CIPHER_mode macro.
   7279      ["Dan S. Camper" <dan (a] bti.net>]
   7281   *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
   7282      type, we must throw them away by setting rr->length to 0.
   7283      [D P Chang <dpc (a] qualys.com>]
   7285  Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
   7287   *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
   7288      <Dominikus.Scherkl (a] biodata.com>.  (The previous implementation
   7289      worked incorrectly for those cases where  range = 10..._2  and
   7290      3*range  is two bits longer than  range.)
   7291      [Bodo Moeller]
   7293   *) Only add signing time to PKCS7 structures if it is not already
   7294      present.
   7295      [Steve Henson]
   7297   *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
   7298      OBJ_ld_ce should be OBJ_id_ce.
   7299      Also some ip-pda OIDs in crypto/objects/objects.txt were
   7300      incorrect (cf. RFC 3039).
   7301      [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
   7303   *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
   7304      returns early because it has nothing to do.
   7305      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   7307   *) [In 0.9.6c-engine release:]
   7308      Fix mutex callback return values in crypto/engine/hw_ncipher.c.
   7309      [Andy Schneider <andy.schneider (a] bjss.co.uk>]
   7311   *) [In 0.9.6c-engine release:]
   7312      Add support for Cryptographic Appliance's keyserver technology.
   7313      (Use engine 'keyclient')
   7314      [Cryptographic Appliances and Geoff Thorpe]
   7316   *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
   7317      is called via tools/c89.sh because arguments have to be
   7318      rearranged (all '-L' options must appear before the first object
   7319      modules).
   7320      [Richard Shapiro <rshapiro (a] abinitio.com>]
   7322   *) [In 0.9.6c-engine release:]
   7323      Add support for Broadcom crypto accelerator cards, backported
   7324      from 0.9.7.
   7325      [Broadcom, Nalin Dahyabhai <nalin (a] redhat.com>, Mark Cox]
   7327   *) [In 0.9.6c-engine release:]
   7328      Add support for SureWare crypto accelerator cards from 
   7329      Baltimore Technologies.  (Use engine 'sureware')
   7330      [Baltimore Technologies and Mark Cox]
   7332   *) [In 0.9.6c-engine release:]
   7333      Add support for crypto accelerator cards from Accelerated
   7334      Encryption Processing, www.aep.ie.  (Use engine 'aep')
   7335      [AEP Inc. and Mark Cox]
   7337   *) Add a configuration entry for gcc on UnixWare.
   7338      [Gary Benson <gbenson (a] redhat.com>]
   7340   *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
   7341      messages are stored in a single piece (fixed-length part and
   7342      variable-length part combined) and fix various bugs found on the way.
   7343      [Bodo Moeller]
   7345   *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
   7346      instead.  BIO_gethostbyname() does not know what timeouts are
   7347      appropriate, so entries would stay in cache even when they have
   7348      become invalid.
   7349      [Bodo Moeller; problem pointed out by Rich Salz <rsalz (a] zolera.com>
   7351   *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
   7352      faced with a pathologically small ClientHello fragment that does
   7353      not contain client_version: Instead of aborting with an error,
   7354      simply choose the highest available protocol version (i.e.,
   7355      TLS 1.0 unless it is disabled).  In practice, ClientHello
   7356      messages are never sent like this, but this change gives us
   7357      strictly correct behaviour at least for TLS.
   7358      [Bodo Moeller]
   7360   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
   7361      never resets s->method to s->ctx->method when called from within
   7362      one of the SSL handshake functions.
   7363      [Bodo Moeller; problem pointed out by Niko Baric]
   7365   *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
   7366      (sent using the client's version number) if client_version is
   7367      smaller than the protocol version in use.  Also change
   7368      ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
   7369      the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
   7370      the client will at least see that alert.
   7371      [Bodo Moeller]
   7373   *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
   7374      correctly.
   7375      [Bodo Moeller]
   7377   *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
   7378      client receives HelloRequest while in a handshake.
   7379      [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider (a] bjss.co.uk>]
   7381   *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
   7382      should end in 'break', not 'goto end' which circuments various
   7383      cleanups done in state SSL_ST_OK.   But session related stuff
   7384      must be disabled for SSL_ST_OK in the case that we just sent a
   7385      HelloRequest.
   7387      Also avoid some overhead by not calling ssl_init_wbio_buffer()
   7388      before just sending a HelloRequest.
   7389      [Bodo Moeller, Eric Rescorla <ekr (a] rtfm.com>]
   7391   *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
   7392      reveal whether illegal block cipher padding was found or a MAC
   7393      verification error occured.  (Neither SSLerr() codes nor alerts
   7394      are directly visible to potential attackers, but the information
   7395      may leak via logfiles.)
   7397      Similar changes are not required for the SSL 2.0 implementation
   7398      because the number of padding bytes is sent in clear for SSL 2.0,
   7399      and the extra bytes are just ignored.  However ssl/s2_pkt.c
   7400      failed to verify that the purported number of padding bytes is in
   7401      the legal range.
   7402      [Bodo Moeller]
   7404   *) Add OpenUNIX-8 support including shared libraries
   7405      (Boyd Lynn Gerber <gerberb (a] zenez.com>).
   7406      [Lutz Jaenicke]
   7408   *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
   7409      'wristwatch attack' using huge encoding parameters (cf.
   7410      James H. Manger's CRYPTO 2001 paper).  Note that the
   7411      RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
   7412      encoding parameters and hence was not vulnerable.
   7413      [Bodo Moeller]
   7415   *) BN_sqr() bug fix.
   7416      [Ulf Mller, reported by Jim Ellis <jim.ellis (a] cavium.com>]
   7418   *) Rabin-Miller test analyses assume uniformly distributed witnesses,
   7419      so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
   7420      followed by modular reduction.
   7421      [Bodo Moeller; pointed out by Adam Young <AYoung1 (a] NCSUS.JNJ.COM>]
   7423   *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
   7424      equivalent based on BN_pseudo_rand() instead of BN_rand().
   7425      [Bodo Moeller]
   7427   *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
   7428      This function was broken, as the check for a new client hello message
   7429      to handle SGC did not allow these large messages.
   7430      (Tracked down by "Douglas E. Engert" <deengert (a] anl.gov>.)
   7431      [Lutz Jaenicke]
   7433   *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
   7434      [Lutz Jaenicke]
   7436   *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
   7437      for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton (a] netopia.com>).
   7438      [Lutz Jaenicke]
   7440   *) Rework the configuration and shared library support for Tru64 Unix.
   7441      The configuration part makes use of modern compiler features and
   7442      still retains old compiler behavior for those that run older versions
   7443      of the OS.  The shared library support part includes a variant that
   7444      uses the RPATH feature, and is available through the special
   7445      configuration target "alpha-cc-rpath", which will never be selected
   7446      automatically.
   7447      [Tim Mooney <mooney (a] dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
   7449   *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
   7450      with the same message size as in ssl3_get_certificate_request().
   7451      Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
   7452      messages might inadvertently be reject as too long.
   7453      [Petr Lampa <lampa (a] fee.vutbr.cz>]
   7455   *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
   7456      [Andy Polyakov]
   7458   *) Modified SSL library such that the verify_callback that has been set
   7459      specificly for an SSL object with SSL_set_verify() is actually being
   7460      used. Before the change, a verify_callback set with this function was
   7461      ignored and the verify_callback() set in the SSL_CTX at the time of
   7462      the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
   7463      to allow the necessary settings.
   7464      [Lutz Jaenicke]
   7466   *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
   7467      explicitly to NULL, as at least on Solaris 8 this seems not always to be
   7468      done automatically (in contradiction to the requirements of the C
   7469      standard). This made problems when used from OpenSSH.
   7470      [Lutz Jaenicke]
   7472   *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
   7473      dh->length and always used
   7475           BN_rand_range(priv_key, dh->p).
   7477      BN_rand_range() is not necessary for Diffie-Hellman, and this
   7478      specific range makes Diffie-Hellman unnecessarily inefficient if
   7479      dh->length (recommended exponent length) is much smaller than the
   7480      length of dh->p.  We could use BN_rand_range() if the order of
   7481      the subgroup was stored in the DH structure, but we only have
   7482      dh->length.
   7484      So switch back to
   7486           BN_rand(priv_key, l, ...)
   7488      where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
   7489      otherwise.
   7490      [Bodo Moeller]
   7492   *) In
   7494           RSA_eay_public_encrypt
   7495           RSA_eay_private_decrypt
   7496           RSA_eay_private_encrypt (signing)
   7497           RSA_eay_public_decrypt (signature verification)
   7499      (default implementations for RSA_public_encrypt,
   7500      RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
   7501      always reject numbers >= n.
   7502      [Bodo Moeller]
   7504   *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
   7505      to synchronize access to 'locking_thread'.  This is necessary on
   7506      systems where access to 'locking_thread' (an 'unsigned long'
   7507      variable) is not atomic.
   7508      [Bodo Moeller]
   7510   *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
   7511      *before* setting the 'crypto_lock_rand' flag.  The previous code had
   7512      a race condition if 0 is a valid thread ID.
   7513      [Travis Vitek <vitek (a] roguewave.com>]
   7515   *) Add support for shared libraries under Irix.
   7516      [Albert Chin-A-Young <china (a] thewrittenword.com>]
   7518   *) Add configuration option to build on Linux on both big-endian and
   7519      little-endian MIPS.
   7520      [Ralf Baechle <ralf (a] uni-koblenz.de>]
   7522   *) Add the possibility to create shared libraries on HP-UX.
   7523      [Richard Levitte]
   7525  Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
   7527   *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
   7528      to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
   7529      Markku-Juhani O. Saarinen <markku-juhani.saarinen (a] nokia.com>:
   7530      PRNG state recovery was possible based on the output of
   7531      one PRNG request appropriately sized to gain knowledge on
   7532      'md' followed by enough consecutive 1-byte PRNG requests
   7533      to traverse all of 'state'.
   7535      1. When updating 'md_local' (the current thread's copy of 'md')
   7536         during PRNG output generation, hash all of the previous
   7537         'md_local' value, not just the half used for PRNG output.
   7539      2. Make the number of bytes from 'state' included into the hash
   7540         independent from the number of PRNG bytes requested.
   7542      The first measure alone would be sufficient to avoid
   7543      Markku-Juhani's attack.  (Actually it had never occurred
   7544      to me that the half of 'md_local' used for chaining was the
   7545      half from which PRNG output bytes were taken -- I had always
   7546      assumed that the secret half would be used.)  The second
   7547      measure makes sure that additional data from 'state' is never
   7548      mixed into 'md_local' in small portions; this heuristically
   7549      further strengthens the PRNG.
   7550      [Bodo Moeller]
   7552   *) Fix crypto/bn/asm/mips3.s.
   7553      [Andy Polyakov]
   7555   *) When only the key is given to "enc", the IV is undefined. Print out
   7556      an error message in this case.
   7557      [Lutz Jaenicke]
   7559   *) Handle special case when X509_NAME is empty in X509 printing routines.
   7560      [Steve Henson]
   7562   *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
   7563      positive and less than q.
   7564      [Bodo Moeller]
   7566   *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
   7567      used: it isn't thread safe and the add_lock_callback should handle
   7568      that itself.
   7569      [Paul Rose <Paul.Rose (a] bridge.com>]
   7571   *) Verify that incoming data obeys the block size in
   7572      ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
   7573      [Bodo Moeller]
   7575   *) Fix OAEP check.
   7576      [Ulf Mller, Bodo Mller]
   7578   *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
   7579      RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
   7580      when fixing the server behaviour for backwards-compatible 'client
   7581      hello' messages.  (Note that the attack is impractical against
   7582      SSL 3.0 and TLS 1.0 anyway because length and version checking
   7583      means that the probability of guessing a valid ciphertext is
   7584      around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
   7585      paper.)
   7587      Before 0.9.5, the countermeasure (hide the error by generating a
   7588      random 'decryption result') did not work properly because
   7589      ERR_clear_error() was missing, meaning that SSL_get_error() would
   7590      detect the supposedly ignored error.
   7592      Both problems are now fixed.
   7593      [Bodo Moeller]
   7595   *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
   7596      (previously it was 1024).
   7597      [Bodo Moeller]
   7599   *) Fix for compatibility mode trust settings: ignore trust settings
   7600      unless some valid trust or reject settings are present.
   7601      [Steve Henson]
   7603   *) Fix for blowfish EVP: its a variable length cipher.
   7604      [Steve Henson]
   7606   *) Fix various bugs related to DSA S/MIME verification. Handle missing
   7607      parameters in DSA public key structures and return an error in the
   7608      DSA routines if parameters are absent.
   7609      [Steve Henson]
   7611   *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
   7612      in the current directory if neither $RANDFILE nor $HOME was set.
   7613      RAND_file_name() in 0.9.6a returned NULL in this case.  This has
   7614      caused some confusion to Windows users who haven't defined $HOME.
   7615      Thus RAND_file_name() is changed again: e_os.h can define a
   7616      DEFAULT_HOME, which will be used if $HOME is not set.
   7617      For Windows, we use "C:"; on other platforms, we still require
   7618      environment variables.
   7620   *) Move 'if (!initialized) RAND_poll()' into regions protected by
   7621      CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
   7622      having multiple threads call RAND_poll() concurrently.
   7623      [Bodo Moeller]
   7625   *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
   7626      combination of a flag and a thread ID variable.
   7627      Otherwise while one thread is in ssleay_rand_bytes (which sets the
   7628      flag), *other* threads can enter ssleay_add_bytes without obeying
   7629      the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
   7630      that they do not hold after the first thread unsets add_do_not_lock).
   7631      [Bodo Moeller]
   7633   *) Change bctest again: '-x' expressions are not available in all
   7634      versions of 'test'.
   7635      [Bodo Moeller]
   7637  Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
   7639   *) Fix a couple of memory leaks in PKCS7_dataDecode()
   7640      [Steve Henson, reported by Heyun Zheng <hzheng (a] atdsprint.com>]
   7642   *) Change Configure and Makefiles to provide EXE_EXT, which will contain
   7643      the default extension for executables, if any.  Also, make the perl
   7644      scripts that use symlink() to test if it really exists and use "cp"
   7645      if it doesn't.  All this made OpenSSL compilable and installable in
   7646      CygWin.
   7647      [Richard Levitte]
   7649   *) Fix for asn1_GetSequence() for indefinite length constructed data.
   7650      If SEQUENCE is length is indefinite just set c->slen to the total
   7651      amount of data available.
   7652      [Steve Henson, reported by shige (a] FreeBSD.org]
   7653      [This change does not apply to 0.9.7.]
   7655   *) Change bctest to avoid here-documents inside command substitution
   7656      (workaround for FreeBSD /bin/sh bug).
   7657      For compatibility with Ultrix, avoid shell functions (introduced
   7658      in the bctest version that searches along $PATH).
   7659      [Bodo Moeller]
   7661   *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
   7662      with des_encrypt() defined on some operating systems, like Solaris
   7663      and UnixWare.
   7664      [Richard Levitte]
   7666   *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
   7667      On the Importance of Eliminating Errors in Cryptographic
   7668      Computations, J. Cryptology 14 (2001) 2, 101-119,
   7669      http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
   7670      [Ulf Moeller]
   7672   *) MIPS assembler BIGNUM division bug fix. 
   7673      [Andy Polyakov]
   7675   *) Disabled incorrect Alpha assembler code.
   7676      [Richard Levitte]
   7678   *) Fix PKCS#7 decode routines so they correctly update the length
   7679      after reading an EOC for the EXPLICIT tag.
   7680      [Steve Henson]
   7681      [This change does not apply to 0.9.7.]
   7683   *) Fix bug in PKCS#12 key generation routines. This was triggered
   7684      if a 3DES key was generated with a 0 initial byte. Include
   7685      PKCS12_BROKEN_KEYGEN compilation option to retain the old
   7686      (but broken) behaviour.
   7687      [Steve Henson]
   7689   *) Enhance bctest to search for a working bc along $PATH and print
   7690      it when found.
   7691      [Tim Rice <tim (a] multitalents.net> via Richard Levitte]
   7693   *) Fix memory leaks in err.c: free err_data string if necessary;
   7694      don't write to the wrong index in ERR_set_error_data.
   7695      [Bodo Moeller]
   7697   *) Implement ssl23_peek (analogous to ssl23_read), which previously
   7698      did not exist.
   7699      [Bodo Moeller]
   7701   *) Replace rdtsc with _emit statements for VC++ version 5.
   7702      [Jeremy Cooper <jeremy (a] baymoo.org>]
   7704   *) Make it possible to reuse SSLv2 sessions.
   7705      [Richard Levitte]
   7707   *) In copy_email() check for >= 0 as a return value for
   7708      X509_NAME_get_index_by_NID() since 0 is a valid index.
   7709      [Steve Henson reported by Massimiliano Pala <madwolf (a] opensca.org>]
   7711   *) Avoid coredump with unsupported or invalid public keys by checking if
   7712      X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
   7713      PKCS7_verify() fails with non detached data.
   7714      [Steve Henson]
   7716   *) Don't use getenv in library functions when run as setuid/setgid.
   7717      New function OPENSSL_issetugid().
   7718      [Ulf Moeller]
   7720   *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
   7721      due to incorrect handling of multi-threading:
   7723      1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
   7725      2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
   7727      3. Count how many times MemCheck_off() has been called so that
   7728         nested use can be treated correctly.  This also avoids 
   7729         inband-signalling in the previous code (which relied on the
   7730         assumption that thread ID 0 is impossible).
   7731      [Bodo Moeller]
   7733   *) Add "-rand" option also to s_client and s_server.
   7734      [Lutz Jaenicke]
   7736   *) Fix CPU detection on Irix 6.x.
   7737      [Kurt Hockenbury <khockenb (a] stevens-tech.edu> and
   7738       "Bruce W. Forsberg" <bruce.forsberg (a] baesystems.com>]
   7740   *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
   7741      was empty.
   7742      [Steve Henson]
   7743      [This change does not apply to 0.9.7.]
   7745   *) Use the cached encoding of an X509_NAME structure rather than
   7746      copying it. This is apparently the reason for the libsafe "errors"
   7747      but the code is actually correct.
   7748      [Steve Henson]
   7750   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
   7751      Bleichenbacher's DSA attack.
   7752      Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
   7753      to be set and top=0 forces the highest bit to be set; top=-1 is new
   7754      and leaves the highest bit random.
   7755      [Ulf Moeller, Bodo Moeller]
   7757   *) In the NCONF_...-based implementations for CONF_... queries
   7758      (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
   7759      a temporary CONF structure with the data component set to NULL
   7760      (which gives segmentation faults in lh_retrieve).
   7761      Instead, use NULL for the CONF pointer in CONF_get_string and
   7762      CONF_get_number (which may use environment variables) and directly
   7763      return NULL from CONF_get_section.
   7764      [Bodo Moeller]
   7766   *) Fix potential buffer overrun for EBCDIC.
   7767      [Ulf Moeller]
   7769   *) Tolerate nonRepudiation as being valid for S/MIME signing and certSign
   7770      keyUsage if basicConstraints absent for a CA.
   7771      [Steve Henson]
   7773   *) Make SMIME_write_PKCS7() write mail header values with a format that
   7774      is more generally accepted (no spaces before the semicolon), since
   7775      some programs can't parse those values properly otherwise.  Also make
   7776      sure BIO's that break lines after each write do not create invalid
   7777      headers.
   7778      [Richard Levitte]
   7780   *) Make the CRL encoding routines work with empty SEQUENCE OF. The
   7781      macros previously used would not encode an empty SEQUENCE OF
   7782      and break the signature.
   7783      [Steve Henson]
   7784      [This change does not apply to 0.9.7.]
   7786   *) Zero the premaster secret after deriving the master secret in
   7787      DH ciphersuites.
   7788      [Steve Henson]
   7790   *) Add some EVP_add_digest_alias registrations (as found in
   7791      OpenSSL_add_all_digests()) to SSL_library_init()
   7792      aka OpenSSL_add_ssl_algorithms().  This provides improved
   7793      compatibility with peers using X.509 certificates
   7794      with unconventional AlgorithmIdentifier OIDs.
   7795      [Bodo Moeller]
   7797   *) Fix for Irix with NO_ASM.
   7798      ["Bruce W. Forsberg" <bruce.forsberg (a] baesystems.com>]
   7800   *) ./config script fixes.
   7801      [Ulf Moeller, Richard Levitte]
   7803   *) Fix 'openssl passwd -1'.
   7804      [Bodo Moeller]
   7806   *) Change PKCS12_key_gen_asc() so it can cope with non null
   7807      terminated strings whose length is passed in the passlen
   7808      parameter, for example from PEM callbacks. This was done
   7809      by adding an extra length parameter to asc2uni().
   7810      [Steve Henson, reported by <oddissey (a] samsung.co.kr>]
   7812   *) Fix C code generated by 'openssl dsaparam -C': If a BN_bin2bn
   7813      call failed, free the DSA structure.
   7814      [Bodo Moeller]
   7816   *) Fix to uni2asc() to cope with zero length Unicode strings.
   7817      These are present in some PKCS#12 files.
   7818      [Steve Henson]
   7820   *) Increase s2->wbuf allocation by one byte in ssl2_new (ssl/s2_lib.c).
   7821      Otherwise do_ssl_write (ssl/s2_pkt.c) will write beyond buffer limits
   7822      when writing a 32767 byte record.
   7823      [Bodo Moeller; problem reported by Eric Day <eday (a] concentric.net>]
   7825   *) In RSA_eay_public_{en,ed}crypt and RSA_eay_mod_exp (rsa_eay.c),
   7826      obtain lock CRYPTO_LOCK_RSA before setting rsa->_method_mod_{n,p,q}.
   7828      (RSA objects have a reference count access to which is protected
   7829      by CRYPTO_LOCK_RSA [see rsa_lib.c, s3_srvr.c, ssl_cert.c, ssl_rsa.c],
   7830      so they are meant to be shared between threads.)
   7831      [Bodo Moeller, Geoff Thorpe; original patch submitted by
   7832      "Reddie, Steven" <Steven.Reddie (a] ca.com>]
   7834   *) Fix a deadlock in CRYPTO_mem_leaks().
   7835      [Bodo Moeller]
   7837   *) Use better test patterns in bntest.
   7838      [Ulf Mller]
   7840   *) rand_win.c fix for Borland C.
   7841      [Ulf Mller]
   7843   *) BN_rshift bugfix for n == 0.
   7844      [Bodo Moeller]
   7846   *) Add a 'bctest' script that checks for some known 'bc' bugs
   7847      so that 'make test' does not abort just because 'bc' is broken.
   7848      [Bodo Moeller]
   7850   *) Store verify_result within SSL_SESSION also for client side to
   7851      avoid potential security hole. (Re-used sessions on the client side
   7852      always resulted in verify_result==X509_V_OK, not using the original
   7853      result of the server certificate verification.)
   7854      [Lutz Jaenicke]
   7856   *) Fix ssl3_pending: If the record in s->s3->rrec is not of type
   7857      SSL3_RT_APPLICATION_DATA, return 0.
   7858      Similarly, change ssl2_pending to return 0 if SSL_in_init(s) is true.
   7859      [Bodo Moeller]
   7861   *) Fix SSL_peek:
   7862      Both ssl2_peek and ssl3_peek, which were totally broken in earlier
   7863      releases, have been re-implemented by renaming the previous
   7864      implementations of ssl2_read and ssl3_read to ssl2_read_internal
   7865      and ssl3_read_internal, respectively, and adding 'peek' parameters
   7866      to them.  The new ssl[23]_{read,peek} functions are calls to
   7867      ssl[23]_read_internal with the 'peek' flag set appropriately.
   7868      A 'peek' parameter has also been added to ssl3_read_bytes, which
   7869      does the actual work for ssl3_read_internal.
   7870      [Bodo Moeller]
   7872   *) Initialise "ex_data" member of RSA/DSA/DH structures prior to calling
   7873      the method-specific "init()" handler. Also clean up ex_data after
   7874      calling the method-specific "finish()" handler. Previously, this was
   7875      happening the other way round.
   7876      [Geoff Thorpe]
   7878   *) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
   7879      The previous value, 12, was not always sufficient for BN_mod_exp().
   7880      [Bodo Moeller]
   7882   *) Make sure that shared libraries get the internal name engine with
   7883      the full version number and not just 0.  This should mark the
   7884      shared libraries as not backward compatible.  Of course, this should
   7885      be changed again when we can guarantee backward binary compatibility.
   7886      [Richard Levitte]
   7888   *) Fix typo in get_cert_by_subject() in by_dir.c
   7889      [Jean-Marc Desperrier <jean-marc.desperrier (a] certplus.com>]
   7891   *) Rework the system to generate shared libraries:
   7893      - Make note of the expected extension for the shared libraries and
   7894        if there is a need for symbolic links from for example libcrypto.so.0
   7895        to libcrypto.so.0.9.7.  There is extended info in Configure for
   7896        that.
   7898      - Make as few rebuilds of the shared libraries as possible.
   7900      - Still avoid linking the OpenSSL programs with the shared libraries.
   7902      - When installing, install the shared libraries separately from the
   7903        static ones.
   7904      [Richard Levitte]
   7906   *) Fix SSL_CTX_set_read_ahead macro to actually use its argument.
   7908      Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
   7909      and not in SSL_clear because the latter is also used by the
   7910      accept/connect functions; previously, the settings made by
   7911      SSL_set_read_ahead would be lost during the handshake.
   7912      [Bodo Moeller; problems reported by Anders Gertz <gertz (a] epact.se>]     
   7914   *) Correct util/mkdef.pl to be selective about disabled algorithms.
   7915      Previously, it would create entries for disableed algorithms no
   7916      matter what.
   7917      [Richard Levitte]
   7919   *) Added several new manual pages for SSL_* function.
   7920      [Lutz Jaenicke]
   7922  Changes between 0.9.5a and 0.9.6  [24 Sep 2000]
   7924   *) In ssl23_get_client_hello, generate an error message when faced
   7925      with an initial SSL 3.0/TLS record that is too small to contain the
   7926      first two bytes of the ClientHello message, i.e. client_version.
   7927      (Note that this is a pathologic case that probably has never happened
   7928      in real life.)  The previous approach was to use the version number
   7929      from the record header as a substitute; but our protocol choice
   7930      should not depend on that one because it is not authenticated
   7931      by the Finished messages.
   7932      [Bodo Moeller]
   7934   *) More robust randomness gathering functions for Windows.
   7935      [Jeffrey Altman <jaltman (a] columbia.edu>]
   7937   *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
   7938      not set then we don't setup the error code for issuer check errors
   7939      to avoid possibly overwriting other errors which the callback does
   7940      handle. If an application does set the flag then we assume it knows
   7941      what it is doing and can handle the new informational codes
   7942      appropriately.
   7943      [Steve Henson]
   7945   *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
   7946      a general "ANY" type, as such it should be able to decode anything
   7947      including tagged types. However it didn't check the class so it would
   7948      wrongly interpret tagged types in the same way as their universal
   7949      counterpart and unknown types were just rejected. Changed so that the
   7950      tagged and unknown types are handled in the same way as a SEQUENCE:
   7951      that is the encoding is stored intact. There is also a new type
   7952      "V_ASN1_OTHER" which is used when the class is not universal, in this
   7953      case we have no idea what the actual type is so we just lump them all
   7954      together.
   7955      [Steve Henson]
   7957   *) On VMS, stdout may very well lead to a file that is written to
   7958      in a record-oriented fashion.  That means that every write() will
   7959      write a separate record, which will be read separately by the
   7960      programs trying to read from it.  This can be very confusing.
   7962      The solution is to put a BIO filter in the way that will buffer
   7963      text until a linefeed is reached, and then write everything a
   7964      line at a time, so every record written will be an actual line,
   7965      not chunks of lines and not (usually doesn't happen, but I've
   7966      seen it once) several lines in one record.  BIO_f_linebuffer() is
   7967      the answer.
   7969      Currently, it's a VMS-only method, because that's where it has
   7970      been tested well enough.
   7971      [Richard Levitte]
   7973   *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
   7974      it can return incorrect results.
   7975      (Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
   7976      but it was in 0.9.6-beta[12].)
   7977      [Bodo Moeller]
   7979   *) Disable the check for content being present when verifying detached
   7980      signatures in pk7_smime.c. Some versions of Netscape (wrongly)
   7981      include zero length content when signing messages.
   7982      [Steve Henson]
   7984   *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
   7985      BIO_ctrl (for BIO pairs).
   7986      [Bodo Mller]
   7988   *) Add DSO method for VMS.
   7989      [Richard Levitte]
   7991   *) Bug fix: Montgomery multiplication could produce results with the
   7992      wrong sign.
   7993      [Ulf Mller]
   7995   *) Add RPM specification openssl.spec and modify it to build three
   7996      packages.  The default package contains applications, application
   7997      documentation and run-time libraries.  The devel package contains
   7998      include files, static libraries and function documentation.  The
   7999      doc package contains the contents of the doc directory.  The original
   8000      openssl.spec was provided by Damien Miller <djm (a] mindrot.org>.
   8001      [Richard Levitte]
   8003   *) Add a large number of documentation files for many SSL routines.
   8004      [Lutz Jaenicke <Lutz.Jaenicke (a] aet.TU-Cottbus.DE>]
   8006   *) Add a configuration entry for Sony News 4.
   8007      [NAKAJI Hiroyuki <nakaji (a] tutrp.tut.ac.jp>]
   8009   *) Don't set the two most significant bits to one when generating a
   8010      random number < q in the DSA library.
   8011      [Ulf Mller]
   8013   *) New SSL API mode 'SSL_MODE_AUTO_RETRY'.  This disables the default
   8014      behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if
   8015      the underlying transport is blocking) if a handshake took place.
   8016      (The default behaviour is needed by applications such as s_client
   8017      and s_server that use select() to determine when to use SSL_read;
   8018      but for applications that know in advance when to expect data, it
   8019      just makes things more complicated.)
   8020      [Bodo Moeller]
   8022   *) Add RAND_egd_bytes(), which gives control over the number of bytes read
   8023      from EGD.
   8024      [Ben Laurie]
   8026   *) Add a few more EBCDIC conditionals that make `req' and `x509'
   8027      work better on such systems.
   8028      [Martin Kraemer <Martin.Kraemer (a] MchP.Siemens.De>]
   8030   *) Add two demo programs for PKCS12_parse() and PKCS12_create().
   8031      Update PKCS12_parse() so it copies the friendlyName and the
   8032      keyid to the certificates aux info.
   8033      [Steve Henson]
   8035   *) Fix bug in PKCS7_verify() which caused an infinite loop
   8036      if there was more than one signature.
   8037      [Sven Uszpelkat <su (a] celocom.de>]
   8039   *) Major change in util/mkdef.pl to include extra information
   8040      about each symbol, as well as presentig variables as well
   8041      as functions.  This change means that there's n more need
   8042      to rebuild the .num files when some algorithms are excluded.
   8043      [Richard Levitte]
   8045   *) Allow the verify time to be set by an application,
   8046      rather than always using the current time.
   8047      [Steve Henson]
   8049   *) Phase 2 verify code reorganisation. The certificate
   8050      verify code now looks up an issuer certificate by a
   8051      number of criteria: subject name, authority key id
   8052      and key usage. It also verifies self signed certificates
   8053      by the same criteria. The main comparison function is
   8054      X509_check_issued() which performs these checks.
   8056      Lot of changes were necessary in order to support this
   8057      without completely rewriting the lookup code.
   8059      Authority and subject key identifier are now cached.
   8061      The LHASH 'certs' is X509_STORE has now been replaced
   8062      by a STACK_OF(X509_OBJECT). This is mainly because an
   8063      LHASH can't store or retrieve multiple objects with
   8064      the same hash value.
   8066      As a result various functions (which were all internal
   8067      use only) have changed to handle the new X509_STORE
   8068      structure. This will break anything that messed round
   8069      with X509_STORE internally.
   8071      The functions X509_STORE_add_cert() now checks for an
   8072      exact match, rather than just subject name.
   8074      The X509_STORE API doesn't directly support the retrieval
   8075      of multiple certificates matching a given criteria, however
   8076      this can be worked round by performing a lookup first
   8077      (which will fill the cache with candidate certificates)
   8078      and then examining the cache for matches. This is probably
   8079      the best we can do without throwing out X509_LOOKUP
   8080      entirely (maybe later...).
   8082      The X509_VERIFY_CTX structure has been enhanced considerably.
   8084      All certificate lookup operations now go via a get_issuer()
   8085      callback. Although this currently uses an X509_STORE it
   8086      can be replaced by custom lookups. This is a simple way
   8087      to bypass the X509_STORE hackery necessary to make this
   8088      work and makes it possible to use more efficient techniques
   8089      in future. A very simple version which uses a simple
   8090      STACK for its trusted certificate store is also provided
   8091      using X509_STORE_CTX_trusted_stack().
   8093      The verify_cb() and verify() callbacks now have equivalents
   8094      in the X509_STORE_CTX structure.
   8096      X509_STORE_CTX also has a 'flags' field which can be used
   8097      to customise the verify behaviour.
   8098      [Steve Henson]
   8100   *) Add new PKCS#7 signing option PKCS7_NOSMIMECAP which 
   8101      excludes S/MIME capabilities.
   8102      [Steve Henson]
   8104   *) When a certificate request is read in keep a copy of the
   8105      original encoding of the signed data and use it when outputing
   8106      again. Signatures then use the original encoding rather than
   8107      a decoded, encoded version which may cause problems if the
   8108      request is improperly encoded.
   8109      [Steve Henson]
   8111   *) For consistency with other BIO_puts implementations, call
   8112      buffer_write(b, ...) directly in buffer_puts instead of calling
   8113      BIO_write(b, ...).
   8115      In BIO_puts, increment b->num_write as in BIO_write.
   8116      [Peter.Sylvester (a] EdelWeb.fr]
   8118   *) Fix BN_mul_word for the case where the word is 0. (We have to use
   8119      BN_zero, we may not return a BIGNUM with an array consisting of
   8120      words set to zero.)
   8121      [Bodo Moeller]
   8123   *) Avoid calling abort() from within the library when problems are
   8124      detected, except if preprocessor symbols have been defined
   8125      (such as REF_CHECK, BN_DEBUG etc.).
   8126      [Bodo Moeller]
   8128   *) New openssl application 'rsautl'. This utility can be
   8129      used for low level RSA operations. DER public key
   8130      BIO/fp routines also added.
   8131      [Steve Henson]
   8133   *) New Configure entry and patches for compiling on QNX 4.
   8134      [Andreas Schneider <andreas (a] ds3.etech.fh-hamburg.de>]
   8136   *) A demo state-machine implementation was sponsored by
   8137      Nuron (http://www.nuron.com/) and is now available in
   8138      demos/state_machine.
   8139      [Ben Laurie]
   8141   *) New options added to the 'dgst' utility for signature
   8142      generation and verification.
   8143      [Steve Henson]
   8145   *) Unrecognized PKCS#7 content types are now handled via a
   8146      catch all ASN1_TYPE structure. This allows unsupported
   8147      types to be stored as a "blob" and an application can
   8148      encode and decode it manually.
   8149      [Steve Henson]
   8151   *) Fix various signed/unsigned issues to make a_strex.c
   8152      compile under VC++.
   8153      [Oscar Jacobsson <oscar.jacobsson (a] celocom.com>]
   8155   *) ASN1 fixes. i2d_ASN1_OBJECT was not returning the correct
   8156      length if passed a buffer. ASN1_INTEGER_to_BN failed
   8157      if passed a NULL BN and its argument was negative.
   8158      [Steve Henson, pointed out by Sven Heiberg <sven (a] tartu.cyber.ee>]
   8160   *) Modification to PKCS#7 encoding routines to output definite
   8161      length encoding. Since currently the whole structures are in
   8162      memory there's not real point in using indefinite length 
   8163      constructed encoding. However if OpenSSL is compiled with
   8164      the flag PKCS7_INDEFINITE_ENCODING the old form is used.
   8165      [Steve Henson]
   8167   *) Added BIO_vprintf() and BIO_vsnprintf().
   8168      [Richard Levitte]
   8170   *) Added more prefixes to parse for in the the strings written
   8171      through a logging bio, to cover all the levels that are available
   8172      through syslog.  The prefixes are now:
   8175 	ALERT, ALR		=>	LOG_ALERT
   8176 	CRIT, CRI		=>	LOG_CRIT
   8177 	ERROR, ERR		=>	LOG_ERR
   8180 	INFO, INF		=>	LOG_INFO
   8181 	DEBUG, DBG		=>	LOG_DEBUG
   8183      and as before, if none of those prefixes are present at the
   8184      beginning of the string, LOG_ERR is chosen.
   8186      On Win32, the LOG_* levels are mapped according to this:
   8192      [Richard Levitte]
   8194   *) Made it possible to reconfigure with just the configuration
   8195      argument "reconf" or "reconfigure".  The command line arguments
   8196      are stored in Makefile.ssl in the variable CONFIGURE_ARGS,
   8197      and are retrieved from there when reconfiguring.
   8198      [Richard Levitte]
   8200   *) MD4 implemented.
   8201      [Assar Westerlund <assar (a] sics.se>, Richard Levitte]
   8203   *) Add the arguments -CAfile and -CApath to the pkcs12 utility.
   8204      [Richard Levitte]
   8206   *) The obj_dat.pl script was messing up the sorting of object
   8207      names. The reason was that it compared the quoted version
   8208      of strings as a result "OCSP" > "OCSP Signing" because
   8209      " > SPACE. Changed script to store unquoted versions of
   8210      names and add quotes on output. It was also omitting some
   8211      names from the lookup table if they were given a default
   8212      value (that is if SN is missing it is given the same
   8213      value as LN and vice versa), these are now added on the
   8214      grounds that if an object has a name we should be able to
   8215      look it up. Finally added warning output when duplicate
   8216      short or long names are found.
   8217      [Steve Henson]
   8219   *) Changes needed for Tandem NSK.
   8220      [Scott Uroff <scott (a] xypro.com>]
   8222   *) Fix SSL 2.0 rollback checking: Due to an off-by-one error in
   8223      RSA_padding_check_SSLv23(), special padding was never detected
   8224      and thus the SSL 3.0/TLS 1.0 countermeasure against protocol
   8225      version rollback attacks was not effective.
   8227      In s23_clnt.c, don't use special rollback-attack detection padding
   8228      (RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the
   8229      client; similarly, in s23_srvr.c, don't do the rollback check if
   8230      SSL 2.0 is the only protocol enabled in the server.
   8231      [Bodo Moeller]
   8233   *) Make it possible to get hexdumps of unprintable data with 'openssl
   8234      asn1parse'.  By implication, the functions ASN1_parse_dump() and
   8235      BIO_dump_indent() are added.
   8236      [Richard Levitte]
   8238   *) New functions ASN1_STRING_print_ex() and X509_NAME_print_ex()
   8239      these print out strings and name structures based on various
   8240      flags including RFC2253 support and proper handling of
   8241      multibyte characters. Added options to the 'x509' utility 
   8242      to allow the various flags to be set.
   8243      [Steve Henson]
   8245   *) Various fixes to use ASN1_TIME instead of ASN1_UTCTIME.
   8246      Also change the functions X509_cmp_current_time() and
   8247      X509_gmtime_adj() work with an ASN1_TIME structure,
   8248      this will enable certificates using GeneralizedTime in validity
   8249      dates to be checked.
   8250      [Steve Henson]
   8252   *) Make the NEG_PUBKEY_BUG code (which tolerates invalid
   8253      negative public key encodings) on by default,
   8254      NO_NEG_PUBKEY_BUG can be set to disable it.
   8255      [Steve Henson]
   8257   *) New function c2i_ASN1_OBJECT() which acts on ASN1_OBJECT
   8258      content octets. An i2c_ASN1_OBJECT is unnecessary because
   8259      the encoding can be trivially obtained from the structure.
   8260      [Steve Henson]
   8262   *) crypto/err.c locking bugfix: Use write locks (CRYPTO_w_[un]lock),
   8263      not read locks (CRYPTO_r_[un]lock).
   8264      [Bodo Moeller]
   8266   *) A first attempt at creating official support for shared
   8267      libraries through configuration.  I've kept it so the
   8268      default is static libraries only, and the OpenSSL programs
   8269      are always statically linked for now, but there are
   8270      preparations for dynamic linking in place.
   8271      This has been tested on Linux and Tru64.
   8272      [Richard Levitte]
   8274   *) Randomness polling function for Win9x, as described in:
   8275      Peter Gutmann, Software Generation of Practically Strong
   8276      Random Numbers.
   8277      [Ulf Mller]
   8279   *) Fix so PRNG is seeded in req if using an already existing
   8280      DSA key.
   8281      [Steve Henson]
   8283   *) New options to smime application. -inform and -outform
   8284      allow alternative formats for the S/MIME message including
   8285      PEM and DER. The -content option allows the content to be
   8286      specified separately. This should allow things like Netscape
   8287      form signing output easier to verify.
   8288      [Steve Henson]
   8290   *) Fix the ASN1 encoding of tags using the 'long form'.
   8291      [Steve Henson]
   8293   *) New ASN1 functions, i2c_* and c2i_* for INTEGER and BIT
   8294      STRING types. These convert content octets to and from the
   8295      underlying type. The actual tag and length octets are
   8296      already assumed to have been read in and checked. These
   8297      are needed because all other string types have virtually
   8298      identical handling apart from the tag. By having versions
   8299      of the ASN1 functions that just operate on content octets
   8300      IMPLICIT tagging can be handled properly. It also allows
   8301      the ASN1_ENUMERATED code to be cut down because ASN1_ENUMERATED
   8302      and ASN1_INTEGER are identical apart from the tag.
   8303      [Steve Henson]
   8305   *) Change the handling of OID objects as follows:
   8307      - New object identifiers are inserted in objects.txt, following
   8308        the syntax given in objects.README.
   8309      - objects.pl is used to process obj_mac.num and create a new
   8310        obj_mac.h.
   8311      - obj_dat.pl is used to create a new obj_dat.h, using the data in
   8312        obj_mac.h.
   8314      This is currently kind of a hack, and the perl code in objects.pl
   8315      isn't very elegant, but it works as I intended.  The simplest way
   8316      to check that it worked correctly is to look in obj_dat.h and
   8317      check the array nid_objs and make sure the objects haven't moved
   8318      around (this is important!).  Additions are OK, as well as
   8319      consistent name changes. 
   8320      [Richard Levitte]
   8322   *) Add BSD-style MD5-based passwords to 'openssl passwd' (option '-1').
   8323      [Bodo Moeller]
   8325   *) Addition of the command line parameter '-rand file' to 'openssl req'.
   8326      The given file adds to whatever has already been seeded into the
   8327      random pool through the RANDFILE configuration file option or
   8328      environment variable, or the default random state file.
   8329      [Richard Levitte]
   8331   *) mkstack.pl now sorts each macro group into lexical order.
   8332      Previously the output order depended on the order the files
   8333      appeared in the directory, resulting in needless rewriting
   8334      of safestack.h .
   8335      [Steve Henson]
   8337   *) Patches to make OpenSSL compile under Win32 again. Mostly
   8338      work arounds for the VC++ problem that it treats func() as
   8339      func(void). Also stripped out the parts of mkdef.pl that
   8340      added extra typesafe functions: these no longer exist.
   8341      [Steve Henson]
   8343   *) Reorganisation of the stack code. The macros are now all 
   8344      collected in safestack.h . Each macro is defined in terms of
   8345      a "stack macro" of the form SKM_<name>(type, a, b). The 
   8346      DEBUG_SAFESTACK is now handled in terms of function casts,
   8347      this has the advantage of retaining type safety without the
   8348      use of additional functions. If DEBUG_SAFESTACK is not defined
   8349      then the non typesafe macros are used instead. Also modified the
   8350      mkstack.pl script to handle the new form. Needs testing to see
   8351      if which (if any) compilers it chokes and maybe make DEBUG_SAFESTACK
   8352      the default if no major problems. Similar behaviour for ASN1_SET_OF
   8353      and PKCS12_STACK_OF.
   8354      [Steve Henson]
   8356   *) When some versions of IIS use the 'NET' form of private key the
   8357      key derivation algorithm is different. Normally MD5(password) is
   8358      used as a 128 bit RC4 key. In the modified case
   8359      MD5(MD5(password) + "SGCKEYSALT")  is used insted. Added some
   8360      new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same
   8361      as the old Netscape_RSA functions except they have an additional
   8362      'sgckey' parameter which uses the modified algorithm. Also added
   8363      an -sgckey command line option to the rsa utility. Thanks to 
   8364      Adrian Peck <bertie (a] ncipher.com> for posting details of the modified
   8365      algorithm to openssl-dev.
   8366      [Steve Henson]
   8368   *) The evp_local.h macros were using 'c.##kname' which resulted in
   8369      invalid expansion on some systems (SCO 5.0.5 for example).
   8370      Corrected to 'c.kname'.
   8371      [Phillip Porch <root (a] theporch.com>]
   8373   *) New X509_get1_email() and X509_REQ_get1_email() functions that return
   8374      a STACK of email addresses from a certificate or request, these look
   8375      in the subject name and the subject alternative name extensions and 
   8376      omit any duplicate addresses.
   8377      [Steve Henson]
   8379   *) Re-implement BN_mod_exp2_mont using independent (and larger) windows.
   8380      This makes DSA verification about 2 % faster.
   8381      [Bodo Moeller]
   8383   *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5
   8384      (meaning that now 2^5 values will be precomputed, which is only 4 KB
   8385      plus overhead for 1024 bit moduli).
   8386      This makes exponentiations about 0.5 % faster for 1024 bit
   8387      exponents (as measured by "openssl speed rsa2048").
   8388      [Bodo Moeller]
   8390   *) Rename memory handling macros to avoid conflicts with other
   8391      software:
   8392           Malloc         =>  OPENSSL_malloc
   8393           Malloc_locked  =>  OPENSSL_malloc_locked
   8394           Realloc        =>  OPENSSL_realloc
   8395           Free           =>  OPENSSL_free
   8396      [Richard Levitte]
   8398   *) New function BN_mod_exp_mont_word for small bases (roughly 15%
   8399      faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange).
   8400      [Bodo Moeller]
   8402   *) CygWin32 support.
   8403      [John Jarvie <jjarvie (a] newsguy.com>]
   8405   *) The type-safe stack code has been rejigged. It is now only compiled
   8406      in when OpenSSL is configured with the DEBUG_SAFESTACK option and
   8407      by default all type-specific stack functions are "#define"d back to
   8408      standard stack functions. This results in more streamlined output
   8409      but retains the type-safety checking possibilities of the original
   8410      approach.
   8411      [Geoff Thorpe]
   8413   *) The STACK code has been cleaned up, and certain type declarations
   8414      that didn't make a lot of sense have been brought in line. This has
   8415      also involved a cleanup of sorts in safestack.h to more correctly
   8416      map type-safe stack functions onto their plain stack counterparts.
   8417      This work has also resulted in a variety of "const"ifications of
   8418      lots of the code, especially "_cmp" operations which should normally
   8419      be prototyped with "const" parameters anyway.
   8420      [Geoff Thorpe]
   8422   *) When generating bytes for the first time in md_rand.c, 'stir the pool'
   8423      by seeding with STATE_SIZE dummy bytes (with zero entropy count).
   8424      (The PRNG state consists of two parts, the large pool 'state' and 'md',
   8425      where all of 'md' is used each time the PRNG is used, but 'state'
   8426      is used only indexed by a cyclic counter. As entropy may not be
   8427      well distributed from the beginning, 'md' is important as a
   8428      chaining variable. However, the output function chains only half
   8429      of 'md', i.e. 80 bits.  ssleay_rand_add, on the other hand, chains
   8430      all of 'md', and seeding with STATE_SIZE dummy bytes will result
   8431      in all of 'state' being rewritten, with the new values depending
   8432      on virtually all of 'md'.  This overcomes the 80 bit limitation.)
   8433      [Bodo Moeller]
   8435   *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when
   8436      the handshake is continued after ssl_verify_cert_chain();
   8437      otherwise, if SSL_VERIFY_NONE is set, remaining error codes
   8438      can lead to 'unexplainable' connection aborts later.
   8439      [Bodo Moeller; problem tracked down by Lutz Jaenicke]
   8441   *) Major EVP API cipher revision.
   8442      Add hooks for extra EVP features. This allows various cipher
   8443      parameters to be set in the EVP interface. Support added for variable
   8444      key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and
   8445      setting of RC2 and RC5 parameters.
   8447      Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length
   8448      ciphers.
   8450      Remove lots of duplicated code from the EVP library. For example *every*
   8451      cipher init() function handles the 'iv' in the same way according to the
   8452      cipher mode. They also all do nothing if the 'key' parameter is NULL and
   8453      for CFB and OFB modes they zero ctx->num.
   8455      New functionality allows removal of S/MIME code RC2 hack.
   8457      Most of the routines have the same form and so can be declared in terms
   8458      of macros.
   8460      By shifting this to the top level EVP_CipherInit() it can be removed from
   8461      all individual ciphers. If the cipher wants to handle IVs or keys
   8462      differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT
   8463      flags.
   8465      Change lots of functions like EVP_EncryptUpdate() to now return a
   8466      value: although software versions of the algorithms cannot fail
   8467      any installed hardware versions can.
   8468      [Steve Henson]
   8470   *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if
   8471      this option is set, tolerate broken clients that send the negotiated
   8472      protocol version number instead of the requested protocol version
   8473      number.
   8474      [Bodo Moeller]
   8476   *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag;
   8477      i.e. non-zero for export ciphersuites, zero otherwise.
   8478      Previous versions had this flag inverted, inconsistent with
   8479      rsa_tmp_cb (..._TMP_RSA_CB).
   8480      [Bodo Moeller; problem reported by Amit Chopra]
   8482   *) Add missing DSA library text string. Work around for some IIS
   8483      key files with invalid SEQUENCE encoding.
   8484      [Steve Henson]
   8486   *) Add a document (doc/standards.txt) that list all kinds of standards
   8487      and so on that are implemented in OpenSSL.
   8488      [Richard Levitte]
   8490   *) Enhance c_rehash script. Old version would mishandle certificates
   8491      with the same subject name hash and wouldn't handle CRLs at all.
   8492      Added -fingerprint option to crl utility, to support new c_rehash
   8493      features.
   8494      [Steve Henson]
   8496   *) Eliminate non-ANSI declarations in crypto.h and stack.h.
   8497      [Ulf Mller]
   8499   *) Fix for SSL server purpose checking. Server checking was
   8500      rejecting certificates which had extended key usage present
   8501      but no ssl client purpose.
   8502      [Steve Henson, reported by Rene Grosser <grosser (a] hisolutions.com>]
   8504   *) Make PKCS#12 code work with no password. The PKCS#12 spec
   8505      is a little unclear about how a blank password is handled.
   8506      Since the password in encoded as a BMPString with terminating
   8507      double NULL a zero length password would end up as just the
   8508      double NULL. However no password at all is different and is
   8509      handled differently in the PKCS#12 key generation code. NS
   8510      treats a blank password as zero length. MSIE treats it as no
   8511      password on export: but it will try both on import. We now do
   8512      the same: PKCS12_parse() tries zero length and no password if
   8513      the password is set to "" or NULL (NULL is now a valid password:
   8514      it wasn't before) as does the pkcs12 application.
   8515      [Steve Henson]
   8517   *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use
   8518      perror when PEM_read_bio_X509_REQ fails, the error message must
   8519      be obtained from the error queue.
   8520      [Bodo Moeller]
   8522   *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing
   8523      it in ERR_remove_state if appropriate, and change ERR_get_state
   8524      accordingly to avoid race conditions (this is necessary because
   8525      thread_hash is no longer constant once set).
   8526      [Bodo Moeller]
   8528   *) Bugfix for linux-elf makefile.one.
   8529      [Ulf Mller]
   8531   *) RSA_get_default_method() will now cause a default
   8532      RSA_METHOD to be chosen if one doesn't exist already.
   8533      Previously this was only set during a call to RSA_new()
   8534      or RSA_new_method(NULL) meaning it was possible for
   8535      RSA_get_default_method() to return NULL.
   8536      [Geoff Thorpe]
   8538   *) Added native name translation to the existing DSO code
   8539      that will convert (if the flag to do so is set) filenames
   8540      that are sufficiently small and have no path information
   8541      into a canonical native form. Eg. "blah" converted to
   8542      "libblah.so" or "blah.dll" etc.
   8543      [Geoff Thorpe]
   8545   *) New function ERR_error_string_n(e, buf, len) which is like
   8546      ERR_error_string(e, buf), but writes at most 'len' bytes
   8547      including the 0 terminator.  For ERR_error_string_n, 'buf'
   8548      may not be NULL.
   8549      [Damien Miller <djm (a] mindrot.org>, Bodo Moeller]
   8551   *) CONF library reworked to become more general.  A new CONF
   8552      configuration file reader "class" is implemented as well as a
   8553      new functions (NCONF_*, for "New CONF") to handle it.  The now
   8554      old CONF_* functions are still there, but are reimplemented to
   8555      work in terms of the new functions.  Also, a set of functions
   8556      to handle the internal storage of the configuration data is
   8557      provided to make it easier to write new configuration file
   8558      reader "classes" (I can definitely see something reading a
   8559      configuration file in XML format, for example), called _CONF_*,
   8560      or "the configuration storage API"...
   8562      The new configuration file reading functions are:
   8564         NCONF_new, NCONF_free, NCONF_load, NCONF_load_fp, NCONF_load_bio,
   8565         NCONF_get_section, NCONF_get_string, NCONF_get_numbre
   8567         NCONF_default, NCONF_WIN32
   8569         NCONF_dump_fp, NCONF_dump_bio
   8571      NCONF_default and NCONF_WIN32 are method (or "class") choosers,
   8572      NCONF_new creates a new CONF object.  This works in the same way
   8573      as other interfaces in OpenSSL, like the BIO interface.
   8574      NCONF_dump_* dump the internal storage of the configuration file,
   8575      which is useful for debugging.  All other functions take the same
   8576      arguments as the old CONF_* functions wth the exception of the
   8577      first that must be a `CONF *' instead of a `LHASH *'.
   8579      To make it easer to use the new classes with the old CONF_* functions,
   8580      the function CONF_set_default_method is provided.
   8581      [Richard Levitte]
   8583   *) Add '-tls1' option to 'openssl ciphers', which was already
   8584      mentioned in the documentation but had not been implemented.
   8585      (This option is not yet really useful because even the additional
   8586      experimental TLS 1.0 ciphers are currently treated as SSL 3.0 ciphers.)
   8587      [Bodo Moeller]
   8589   *) Initial DSO code added into libcrypto for letting OpenSSL (and
   8590      OpenSSL-based applications) load shared libraries and bind to
   8591      them in a portable way.
   8592      [Geoff Thorpe, with contributions from Richard Levitte]
   8594  Changes between 0.9.5 and 0.9.5a  [1 Apr 2000]
   8596   *) Make sure _lrotl and _lrotr are only used with MSVC.
   8598   *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status
   8599      (the default implementation of RAND_status).
   8601   *) Rename openssl x509 option '-crlext', which was added in 0.9.5,
   8602      to '-clrext' (= clear extensions), as intended and documented.
   8603      [Bodo Moeller; inconsistency pointed out by Michael Attili
   8604      <attili (a] amaxo.com>]
   8606   *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length
   8607      was larger than the MD block size.      
   8608      [Steve Henson, pointed out by Yost William <YostW (a] tce.com>]
   8610   *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument
   8611      fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set()
   8612      using the passed key: if the passed key was a private key the result
   8613      of X509_print(), for example, would be to print out all the private key
   8614      components.
   8615      [Steve Henson]
   8617   *) des_quad_cksum() byte order bug fix.
   8618      [Ulf Mller, using the problem description in krb4-0.9.7, where
   8619       the solution is attributed to Derrick J Brashear <shadow (a] DEMENTIA.ORG>]
   8621   *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly
   8622      discouraged.
   8623      [Steve Henson, pointed out by Brian Korver <briank (a] cs.stanford.edu>]
   8625   *) For easily testing in shell scripts whether some command
   8626      'openssl XXX' exists, the new pseudo-command 'openssl no-XXX'
   8627      returns with exit code 0 iff no command of the given name is available.
   8628      'no-XXX' is printed in this case, 'XXX' otherwise.  In both cases,
   8629      the output goes to stdout and nothing is printed to stderr.
   8630      Additional arguments are always ignored.
   8632      Since for each cipher there is a command of the same name,
   8633      the 'no-cipher' compilation switches can be tested this way.
   8635      ('openssl no-XXX' is not able to detect pseudo-commands such
   8636      as 'quit', 'list-XXX-commands', or 'no-XXX' itself.)
   8637      [Bodo Moeller]
   8639   *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration.
   8640      [Bodo Moeller]
   8642   *) For SSL_[CTX_]set_tmp_dh, don't create a DH key if SSL_OP_SINGLE_DH_USE
   8643      is set; it will be thrown away anyway because each handshake creates
   8644      its own key.
   8645      ssl_cert_dup, which is used by SSL_new, now copies DH keys in addition
   8646      to parameters -- in previous versions (since OpenSSL 0.9.3) the
   8647      'default key' from SSL_CTX_set_tmp_dh would always be lost, meanining
   8648      you effectivly got SSL_OP_SINGLE_DH_USE when using this macro.
   8649      [Bodo Moeller]
   8651   *) New s_client option -ign_eof: EOF at stdin is ignored, and
   8652      'Q' and 'R' lose their special meanings (quit/renegotiate).
   8653      This is part of what -quiet does; unlike -quiet, -ign_eof
   8654      does not suppress any output.
   8655      [Richard Levitte]
   8657   *) Add compatibility options to the purpose and trust code. The
   8658      purpose X509_PURPOSE_ANY is "any purpose" which automatically
   8659      accepts a certificate or CA, this was the previous behaviour,
   8660      with all the associated security issues.
   8662      X509_TRUST_COMPAT is the old trust behaviour: only and
   8663      automatically trust self signed roots in certificate store. A
   8664      new trust setting X509_TRUST_DEFAULT is used to specify that
   8665      a purpose has no associated trust setting and it should instead
   8666      use the value in the default purpose.
   8667      [Steve Henson]
   8669   *) Fix the PKCS#8 DSA private key code so it decodes keys again
   8670      and fix a memory leak.
   8671      [Steve Henson]
   8673   *) In util/mkerr.pl (which implements 'make errors'), preserve
   8674      reason strings from the previous version of the .c file, as
   8675      the default to have only downcase letters (and digits) in
   8676      automatically generated reasons codes is not always appropriate.
   8677      [Bodo Moeller]
   8679   *) In ERR_load_ERR_strings(), build an ERR_LIB_SYS error reason table
   8680      using strerror.  Previously, ERR_reason_error_string() returned
   8681      library names as reason strings for SYSerr; but SYSerr is a special
   8682      case where small numbers are errno values, not library numbers.
   8683      [Bodo Moeller]
   8685   *) Add '-dsaparam' option to 'openssl dhparam' application.  This
   8686      converts DSA parameters into DH parameters. (When creating parameters,
   8687      DSA_generate_parameters is used.)
   8688      [Bodo Moeller]
   8690   *) Include 'length' (recommended exponent length) in C code generated
   8691      by 'openssl dhparam -C'.
   8692      [Bodo Moeller]
   8694   *) The second argument to set_label in perlasm was already being used
   8695      so couldn't be used as a "file scope" flag. Moved to third argument
   8696      which was free.
   8697      [Steve Henson]
   8699   *) In PEM_ASN1_write_bio and some other functions, use RAND_pseudo_bytes
   8700      instead of RAND_bytes for encryption IVs and salts.
   8701      [Bodo Moeller]
   8703   *) Include RAND_status() into RAND_METHOD instead of implementing
   8704      it only for md_rand.c  Otherwise replacing the PRNG by calling
   8705      RAND_set_rand_method would be impossible.
   8706      [Bodo Moeller]
   8708   *) Don't let DSA_generate_key() enter an infinite loop if the random
   8709      number generation fails.
   8710      [Bodo Moeller]
   8712   *) New 'rand' application for creating pseudo-random output.
   8713      [Bodo Moeller]
   8715   *) Added configuration support for Linux/IA64
   8716      [Rolf Haberrecker <rolf (a] suse.de>]
   8718   *) Assembler module support for Mingw32.
   8719      [Ulf Mller]
   8721   *) Shared library support for HPUX (in shlib/).
   8722      [Lutz Jaenicke <Lutz.Jaenicke (a] aet.TU-Cottbus.DE> and Anonymous]
   8724   *) Shared library support for Solaris gcc.
   8725      [Lutz Behnke <behnke (a] trustcenter.de>]
   8727  Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
   8729   *) PKCS7_encrypt() was adding text MIME headers twice because they
   8730      were added manually and by SMIME_crlf_copy().
   8731      [Steve Henson]
   8733   *) In bntest.c don't call BN_rand with zero bits argument.
   8734      [Steve Henson, pointed out by Andrew W. Gray <agray (a] iconsinc.com>]
   8736   *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
   8737      case was implemented. This caused BN_div_recp() to fail occasionally.
   8738      [Ulf Mller]
   8740   *) Add an optional second argument to the set_label() in the perl
   8741      assembly language builder. If this argument exists and is set
   8742      to 1 it signals that the assembler should use a symbol whose 
   8743      scope is the entire file, not just the current function. This
   8744      is needed with MASM which uses the format label:: for this scope.
   8745      [Steve Henson, pointed out by Peter Runestig <peter (a] runestig.com>]
   8747   *) Change the ASN1 types so they are typedefs by default. Before
   8748      almost all types were #define'd to ASN1_STRING which was causing
   8749      STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
   8750      for example.
   8751      [Steve Henson]
   8753   *) Change names of new functions to the new get1/get0 naming
   8754      convention: After 'get1', the caller owns a reference count
   8755      and has to call ..._free; 'get0' returns a pointer to some
   8756      data structure without incrementing reference counters.
   8757      (Some of the existing 'get' functions increment a reference
   8758      counter, some don't.)
   8759      Similarly, 'set1' and 'add1' functions increase reference
   8760      counters or duplicate objects.
   8761      [Steve Henson]
   8763   *) Allow for the possibility of temp RSA key generation failure:
   8764      the code used to assume it always worked and crashed on failure.
   8765      [Steve Henson]
   8767   *) Fix potential buffer overrun problem in BIO_printf().
   8768      [Ulf Mller, using public domain code by Patrick Powell; problem
   8769       pointed out by David Sacerdote <das33 (a] cornell.edu>]
   8771   *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
   8772      RAND_egd() and RAND_status().  In the command line application,
   8773      the EGD socket can be specified like a seed file using RANDFILE
   8774      or -rand.
   8775      [Ulf Mller]
   8777   *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
   8778      Some CAs (e.g. Verisign) distribute certificates in this form.
   8779      [Steve Henson]
   8781   *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
   8782      list to exclude them. This means that no special compilation option
   8783      is needed to use anonymous DH: it just needs to be included in the
   8784      cipher list.
   8785      [Steve Henson]
   8787   *) Change the EVP_MD_CTX_type macro so its meaning consistent with
   8788      EVP_MD_type. The old functionality is available in a new macro called
   8789      EVP_MD_md(). Change code that uses it and update docs.
   8790      [Steve Henson]
   8792   *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
   8793      where the 'void *' argument is replaced by a function pointer argument.
   8794      Previously 'void *' was abused to point to functions, which works on
   8795      many platforms, but is not correct.  As these functions are usually
   8796      called by macros defined in OpenSSL header files, most source code
   8797      should work without changes.
   8798      [Richard Levitte]
   8800   *) <openssl/opensslconf.h> (which is created by Configure) now contains
   8801      sections with information on -D... compiler switches used for
   8802      compiling the library so that applications can see them.  To enable
   8803      one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
   8804      must be defined.  E.g.,
   8805         #define OPENSSL_ALGORITHM_DEFINES
   8806         #include <openssl/opensslconf.h>
   8807      defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
   8808      [Richard Levitte, Ulf and Bodo Mller]
   8810   *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
   8811      record layer.
   8812      [Bodo Moeller]
   8814   *) Change the 'other' type in certificate aux info to a STACK_OF
   8815      X509_ALGOR. Although not an AlgorithmIdentifier as such it has
   8816      the required ASN1 format: arbitrary types determined by an OID.
   8817      [Steve Henson]
   8819   *) Add some PEM_write_X509_REQ_NEW() functions and a command line
   8820      argument to 'req'. This is not because the function is newer or
   8821      better than others it just uses the work 'NEW' in the certificate
   8822      request header lines. Some software needs this.
   8823      [Steve Henson]
   8825   *) Reorganise password command line arguments: now passwords can be
   8826      obtained from various sources. Delete the PEM_cb function and make
   8827      it the default behaviour: i.e. if the callback is NULL and the
   8828      usrdata argument is not NULL interpret it as a null terminated pass
   8829      phrase. If usrdata and the callback are NULL then the pass phrase
   8830      is prompted for as usual.
   8831      [Steve Henson]
   8833   *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
   8834      the support is automatically enabled. The resulting binaries will
   8835      autodetect the card and use it if present.
   8836      [Ben Laurie and Compaq Inc.]
   8838   *) Work around for Netscape hang bug. This sends certificate request
   8839      and server done in one record. Since this is perfectly legal in the
   8840      SSL/TLS protocol it isn't a "bug" option and is on by default. See
   8841      the bugs/SSLv3 entry for more info.
   8842      [Steve Henson]
   8844   *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
   8845      [Andy Polyakov]
   8847   *) Add -rand argument to smime and pkcs12 applications and read/write
   8848      of seed file.
   8849      [Steve Henson]
   8851   *) New 'passwd' tool for crypt(3) and apr1 password hashes.
   8852      [Bodo Moeller]
   8854   *) Add command line password options to the remaining applications.
   8855      [Steve Henson]
   8857   *) Bug fix for BN_div_recp() for numerators with an even number of
   8858      bits.
   8859      [Ulf Mller]
   8861   *) More tests in bntest.c, and changed test_bn output.
   8862      [Ulf Mller]
   8864   *) ./config recognizes MacOS X now.
   8865      [Andy Polyakov]
   8867   *) Bug fix for BN_div() when the first words of num and divsor are
   8868      equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
   8869      [Ulf Mller]
   8871   *) Add support for various broken PKCS#8 formats, and command line
   8872      options to produce them.
   8873      [Steve Henson]
   8875   *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
   8876      get temporary BIGNUMs from a BN_CTX.
   8877      [Ulf Mller]
   8879   *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
   8880      for p == 0.
   8881      [Ulf Mller]
   8883   *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
   8884      include a #define from the old name to the new. The original intent
   8885      was that statically linked binaries could for example just call
   8886      SSLeay_add_all_ciphers() to just add ciphers to the table and not
   8887      link with digests. This never worked becayse SSLeay_add_all_digests()
   8888      and SSLeay_add_all_ciphers() were in the same source file so calling
   8889      one would link with the other. They are now in separate source files.
   8890      [Steve Henson]
   8892   *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
   8893      [Steve Henson]
   8895   *) Use a less unusual form of the Miller-Rabin primality test (it used
   8896      a binary algorithm for exponentiation integrated into the Miller-Rabin
   8897      loop, our standard modexp algorithms are faster).
   8898      [Bodo Moeller]
   8900   *) Support for the EBCDIC character set completed.
   8901      [Martin Kraemer <Martin.Kraemer (a] Mch.SNI.De>]
   8903   *) Source code cleanups: use const where appropriate, eliminate casts,
   8904      use void * instead of char * in lhash.
   8905      [Ulf Mller] 
   8907   *) Bugfix: ssl3_send_server_key_exchange was not restartable
   8908      (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
   8909      this the server could overwrite ephemeral keys that the client
   8910      has already seen).
   8911      [Bodo Moeller]