"Fossies" - the Fresh Open Source Software Archive

Member "SAOImageDS9/openssl/CHANGES" (13 Nov 2019, 497734 Bytes) of package /linux/misc/ds9.8.1.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file.

    1 
    2  OpenSSL CHANGES
    3  _______________
    4 
    5  Changes between 1.0.2j and 1.0.2k [26 Jan 2017]
    6 
    7   *) Truncated packet could crash via OOB read
    8 
    9      If one side of an SSL/TLS path is running on a 32-bit host and a specific
   10      cipher is being used, then a truncated packet can cause that host to
   11      perform an out-of-bounds read, usually resulting in a crash.
   12 
   13      This issue was reported to OpenSSL by Robert Święcki of Google.
   14      (CVE-2017-3731)
   15      [Andy Polyakov]
   16 
   17   *) BN_mod_exp may produce incorrect results on x86_64
   18 
   19      There is a carry propagating bug in the x86_64 Montgomery squaring
   20      procedure. No EC algorithms are affected. Analysis suggests that attacks
   21      against RSA and DSA as a result of this defect would be very difficult to
   22      perform and are not believed likely. Attacks against DH are considered just
   23      feasible (although very difficult) because most of the work necessary to
   24      deduce information about a private key may be performed offline. The amount
   25      of resources required for such an attack would be very significant and
   26      likely only accessible to a limited number of attackers. An attacker would
   27      additionally need online access to an unpatched system using the target
   28      private key in a scenario with persistent DH parameters and a private
   29      key that is shared between multiple clients. For example this can occur by
   30      default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
   31      similar to CVE-2015-3193 but must be treated as a separate problem.
   32 
   33      This issue was reported to OpenSSL by the OSS-Fuzz project.
   34      (CVE-2017-3732)
   35      [Andy Polyakov]
   36 
   37   *) Montgomery multiplication may produce incorrect results
   38 
   39      There is a carry propagating bug in the Broadwell-specific Montgomery
   40      multiplication procedure that handles input lengths divisible by, but
   41      longer than 256 bits. Analysis suggests that attacks against RSA, DSA
   42      and DH private keys are impossible. This is because the subroutine in
   43      question is not used in operations with the private key itself and an input
   44      of the attacker's direct choice. Otherwise the bug can manifest itself as
   45      transient authentication and key negotiation failures or reproducible
   46      erroneous outcome of public-key operations with specially crafted input.
   47      Among EC algorithms only Brainpool P-512 curves are affected and one
   48      presumably can attack ECDH key negotiation. Impact was not analyzed in
   49      detail, because pre-requisites for attack are considered unlikely. Namely
   50      multiple clients have to choose the curve in question and the server has to
   51      share the private key among them, neither of which is default behaviour.
   52      Even then only clients that chose the curve will be affected.
   53 
   54      This issue was publicly reported as transient failures and was not
   55      initially recognized as a security issue. Thanks to Richard Morgan for
   56      providing reproducible case.
   57      (CVE-2016-7055)
   58      [Andy Polyakov]
   59 
   60   *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
   61      or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
   62      prevent issues where no progress is being made and the peer continually
   63      sends unrecognised record types, using up resources processing them.
   64      [Matt Caswell]
   65 
   66  Changes between 1.0.2i and 1.0.2j [26 Sep 2016]
   67 
   68   *) Missing CRL sanity check
   69 
   70      A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
   71      but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
   72      CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
   73 
   74      This issue only affects the OpenSSL 1.0.2i
   75      (CVE-2016-7052)
   76      [Matt Caswell]
   77 
   78  Changes between 1.0.2h and 1.0.2i [22 Sep 2016]
   79 
   80   *) OCSP Status Request extension unbounded memory growth
   81 
   82      A malicious client can send an excessively large OCSP Status Request
   83      extension. If that client continually requests renegotiation, sending a
   84      large OCSP Status Request extension each time, then there will be unbounded
   85      memory growth on the server. This will eventually lead to a Denial Of
   86      Service attack through memory exhaustion. Servers with a default
   87      configuration are vulnerable even if they do not support OCSP. Builds using
   88      the "no-ocsp" build time option are not affected.
   89 
   90      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
   91      (CVE-2016-6304)
   92      [Matt Caswell]
   93 
   94   *) In order to mitigate the SWEET32 attack, the DES ciphers were moved from
   95      HIGH to MEDIUM.
   96 
   97      This issue was reported to OpenSSL Karthikeyan Bhargavan and Gaetan
   98      Leurent (INRIA)
   99      (CVE-2016-2183)
  100      [Rich Salz]
  101 
  102   *) OOB write in MDC2_Update()
  103 
  104      An overflow can occur in MDC2_Update() either if called directly or
  105      through the EVP_DigestUpdate() function using MDC2. If an attacker
  106      is able to supply very large amounts of input data after a previous
  107      call to EVP_EncryptUpdate() with a partial block then a length check
  108      can overflow resulting in a heap corruption.
  109 
  110      The amount of data needed is comparable to SIZE_MAX which is impractical
  111      on most platforms.
  112 
  113      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  114      (CVE-2016-6303)
  115      [Stephen Henson]
  116 
  117   *) Malformed SHA512 ticket DoS
  118 
  119      If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
  120      DoS attack where a malformed ticket will result in an OOB read which will
  121      ultimately crash.
  122 
  123      The use of SHA512 in TLS session tickets is comparatively rare as it requires
  124      a custom server callback and ticket lookup mechanism.
  125 
  126      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  127      (CVE-2016-6302)
  128      [Stephen Henson]
  129 
  130   *) OOB write in BN_bn2dec()
  131 
  132      The function BN_bn2dec() does not check the return value of BN_div_word().
  133      This can cause an OOB write if an application uses this function with an
  134      overly large BIGNUM. This could be a problem if an overly large certificate
  135      or CRL is printed out from an untrusted source. TLS is not affected because
  136      record limits will reject an oversized certificate before it is parsed.
  137 
  138      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  139      (CVE-2016-2182)
  140      [Stephen Henson]
  141 
  142   *) OOB read in TS_OBJ_print_bio()
  143 
  144      The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
  145      the total length the OID text representation would use and not the amount
  146      of data written. This will result in OOB reads when large OIDs are
  147      presented.
  148 
  149      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  150      (CVE-2016-2180)
  151      [Stephen Henson]
  152 
  153   *) Pointer arithmetic undefined behaviour
  154 
  155      Avoid some undefined pointer arithmetic
  156 
  157      A common idiom in the codebase is to check limits in the following manner:
  158      "p + len > limit"
  159 
  160      Where "p" points to some malloc'd data of SIZE bytes and
  161      limit == p + SIZE
  162 
  163      "len" here could be from some externally supplied data (e.g. from a TLS
  164      message).
  165 
  166      The rules of C pointer arithmetic are such that "p + len" is only well
  167      defined where len <= SIZE. Therefore the above idiom is actually
  168      undefined behaviour.
  169 
  170      For example this could cause problems if some malloc implementation
  171      provides an address for "p" such that "p + len" actually overflows for
  172      values of len that are too big and therefore p + len < limit.
  173 
  174      This issue was reported to OpenSSL by Guido Vranken
  175      (CVE-2016-2177)
  176      [Matt Caswell]
  177 
  178   *) Constant time flag not preserved in DSA signing
  179 
  180      Operations in the DSA signing algorithm should run in constant time in
  181      order to avoid side channel attacks. A flaw in the OpenSSL DSA
  182      implementation means that a non-constant time codepath is followed for
  183      certain operations. This has been demonstrated through a cache-timing
  184      attack to be sufficient for an attacker to recover the private DSA key.
  185 
  186      This issue was reported by César Pereida (Aalto University), Billy Brumley
  187      (Tampere University of Technology), and Yuval Yarom (The University of
  188      Adelaide and NICTA).
  189      (CVE-2016-2178)
  190      [César Pereida]
  191 
  192   *) DTLS buffered message DoS
  193 
  194      In a DTLS connection where handshake messages are delivered out-of-order
  195      those messages that OpenSSL is not yet ready to process will be buffered
  196      for later use. Under certain circumstances, a flaw in the logic means that
  197      those messages do not get removed from the buffer even though the handshake
  198      has been completed. An attacker could force up to approx. 15 messages to
  199      remain in the buffer when they are no longer required. These messages will
  200      be cleared when the DTLS connection is closed. The default maximum size for
  201      a message is 100k. Therefore the attacker could force an additional 1500k
  202      to be consumed per connection. By opening many simulataneous connections an
  203      attacker could cause a DoS attack through memory exhaustion.
  204 
  205      This issue was reported to OpenSSL by Quan Luo.
  206      (CVE-2016-2179)
  207      [Matt Caswell]
  208 
  209   *) DTLS replay protection DoS
  210 
  211      A flaw in the DTLS replay attack protection mechanism means that records
  212      that arrive for future epochs update the replay protection "window" before
  213      the MAC for the record has been validated. This could be exploited by an
  214      attacker by sending a record for the next epoch (which does not have to
  215      decrypt or have a valid MAC), with a very large sequence number. This means
  216      that all subsequent legitimate packets are dropped causing a denial of
  217      service for a specific DTLS connection.
  218 
  219      This issue was reported to OpenSSL by the OCAP audit team.
  220      (CVE-2016-2181)
  221      [Matt Caswell]
  222 
  223   *) Certificate message OOB reads
  224 
  225      In OpenSSL 1.0.2 and earlier some missing message length checks can result
  226      in OOB reads of up to 2 bytes beyond an allocated buffer. There is a
  227      theoretical DoS risk but this has not been observed in practice on common
  228      platforms.
  229 
  230      The messages affected are client certificate, client certificate request
  231      and server certificate. As a result the attack can only be performed
  232      against a client or a server which enables client authentication.
  233 
  234      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  235      (CVE-2016-6306)
  236      [Stephen Henson]
  237 
  238  Changes between 1.0.2g and 1.0.2h [3 May 2016]
  239 
  240   *) Prevent padding oracle in AES-NI CBC MAC check
  241 
  242      A MITM attacker can use a padding oracle attack to decrypt traffic
  243      when the connection uses an AES CBC cipher and the server support
  244      AES-NI.
  245 
  246      This issue was introduced as part of the fix for Lucky 13 padding
  247      attack (CVE-2013-0169). The padding check was rewritten to be in
  248      constant time by making sure that always the same bytes are read and
  249      compared against either the MAC or padding bytes. But it no longer
  250      checked that there was enough data to have both the MAC and padding
  251      bytes.
  252 
  253      This issue was reported by Juraj Somorovsky using TLS-Attacker.
  254      (CVE-2016-2107)
  255      [Kurt Roeckx]
  256 
  257   *) Fix EVP_EncodeUpdate overflow
  258 
  259      An overflow can occur in the EVP_EncodeUpdate() function which is used for
  260      Base64 encoding of binary data. If an attacker is able to supply very large
  261      amounts of input data then a length check can overflow resulting in a heap
  262      corruption.
  263 
  264      Internally to OpenSSL the EVP_EncodeUpdate() function is primarly used by
  265      the PEM_write_bio* family of functions. These are mainly used within the
  266      OpenSSL command line applications, so any application which processes data
  267      from an untrusted source and outputs it as a PEM file should be considered
  268      vulnerable to this issue. User applications that call these APIs directly
  269      with large amounts of untrusted data may also be vulnerable.
  270 
  271      This issue was reported by Guido Vranken.
  272      (CVE-2016-2105)
  273      [Matt Caswell]
  274 
  275   *) Fix EVP_EncryptUpdate overflow
  276 
  277      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
  278      is able to supply very large amounts of input data after a previous call to
  279      EVP_EncryptUpdate() with a partial block then a length check can overflow
  280      resulting in a heap corruption. Following an analysis of all OpenSSL
  281      internal usage of the EVP_EncryptUpdate() function all usage is one of two
  282      forms. The first form is where the EVP_EncryptUpdate() call is known to be
  283      the first called function after an EVP_EncryptInit(), and therefore that
  284      specific call must be safe. The second form is where the length passed to
  285      EVP_EncryptUpdate() can be seen from the code to be some small value and
  286      therefore there is no possibility of an overflow. Since all instances are
  287      one of these two forms, it is believed that there can be no overflows in
  288      internal code due to this problem. It should be noted that
  289      EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
  290      Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
  291      of these calls have also been analysed too and it is believed there are no
  292      instances in internal usage where an overflow could occur.
  293 
  294      This issue was reported by Guido Vranken.
  295      (CVE-2016-2106)
  296      [Matt Caswell]
  297 
  298   *) Prevent ASN.1 BIO excessive memory allocation
  299 
  300      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
  301      a short invalid encoding can casuse allocation of large amounts of memory
  302      potentially consuming excessive resources or exhausting memory.
  303 
  304      Any application parsing untrusted data through d2i BIO functions is
  305      affected. The memory based functions such as d2i_X509() are *not* affected.
  306      Since the memory based functions are used by the TLS library, TLS
  307      applications are not affected.
  308 
  309      This issue was reported by Brian Carpenter.
  310      (CVE-2016-2109)
  311      [Stephen Henson]
  312 
  313   *) EBCDIC overread
  314 
  315      ASN1 Strings that are over 1024 bytes can cause an overread in applications
  316      using the X509_NAME_oneline() function on EBCDIC systems. This could result
  317      in arbitrary stack data being returned in the buffer.
  318 
  319      This issue was reported by Guido Vranken.
  320      (CVE-2016-2176)
  321      [Matt Caswell]
  322 
  323   *) Modify behavior of ALPN to invoke callback after SNI/servername
  324      callback, such that updates to the SSL_CTX affect ALPN.
  325      [Todd Short]
  326 
  327   *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
  328      default.
  329      [Kurt Roeckx]
  330 
  331   *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
  332      methods are enabled and ssl2 is disabled the methods return NULL.
  333      [Kurt Roeckx]
  334 
  335  Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
  336 
  337   * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
  338     Builds that are not configured with "enable-weak-ssl-ciphers" will not
  339     provide any "EXPORT" or "LOW" strength ciphers.
  340     [Viktor Dukhovni]
  341 
  342   * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
  343     is by default disabled at build-time.  Builds that are not configured with
  344     "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
  345     users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
  346     will need to explicitly call either of:
  347 
  348         SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
  349     or
  350         SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
  351 
  352     as appropriate.  Even if either of those is used, or the application
  353     explicitly uses the version-specific SSLv2_method() or its client and
  354     server variants, SSLv2 ciphers vulnerable to exhaustive search key
  355     recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
  356     ciphers, and SSLv2 56-bit DES are no longer available.
  357     (CVE-2016-0800)
  358     [Viktor Dukhovni]
  359 
  360   *) Fix a double-free in DSA code
  361 
  362      A double free bug was discovered when OpenSSL parses malformed DSA private
  363      keys and could lead to a DoS attack or memory corruption for applications
  364      that receive DSA private keys from untrusted sources.  This scenario is
  365      considered rare.
  366 
  367      This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
  368      libFuzzer.
  369      (CVE-2016-0705)
  370      [Stephen Henson]
  371 
  372   *) Disable SRP fake user seed to address a server memory leak.
  373 
  374      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
  375 
  376      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
  377      In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
  378      was changed to ignore the "fake user" SRP seed, even if the seed
  379      is configured.
  380 
  381      Users should use SRP_VBASE_get1_by_user instead. Note that in
  382      SRP_VBASE_get1_by_user, caller must free the returned value. Note
  383      also that even though configuring the SRP seed attempts to hide
  384      invalid usernames by continuing the handshake with fake
  385      credentials, this behaviour is not constant time and no strong
  386      guarantees are made that the handshake is indistinguishable from
  387      that of a valid user.
  388      (CVE-2016-0798)
  389      [Emilia Käsper]
  390 
  391   *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
  392 
  393      In the BN_hex2bn function the number of hex digits is calculated using an
  394      int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
  395      large values of |i| this can result in |bn_expand| not allocating any
  396      memory because |i * 4| is negative. This can leave the internal BIGNUM data
  397      field as NULL leading to a subsequent NULL ptr deref. For very large values
  398      of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
  399      In this case memory is allocated to the internal BIGNUM data field, but it
  400      is insufficiently sized leading to heap corruption. A similar issue exists
  401      in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
  402      is ever called by user applications with very large untrusted hex/dec data.
  403      This is anticipated to be a rare occurrence.
  404 
  405      All OpenSSL internal usage of these functions use data that is not expected
  406      to be untrusted, e.g. config file data or application command line
  407      arguments. If user developed applications generate config file data based
  408      on untrusted data then it is possible that this could also lead to security
  409      consequences. This is also anticipated to be rare.
  410 
  411      This issue was reported to OpenSSL by Guido Vranken.
  412      (CVE-2016-0797)
  413      [Matt Caswell]
  414 
  415   *) Fix memory issues in BIO_*printf functions
  416 
  417      The internal |fmtstr| function used in processing a "%s" format string in
  418      the BIO_*printf functions could overflow while calculating the length of a
  419      string and cause an OOB read when printing very long strings.
  420 
  421      Additionally the internal |doapr_outch| function can attempt to write to an
  422      OOB memory location (at an offset from the NULL pointer) in the event of a
  423      memory allocation failure. In 1.0.2 and below this could be caused where
  424      the size of a buffer to be allocated is greater than INT_MAX. E.g. this
  425      could be in processing a very long "%s" format string. Memory leaks can
  426      also occur.
  427 
  428      The first issue may mask the second issue dependent on compiler behaviour.
  429      These problems could enable attacks where large amounts of untrusted data
  430      is passed to the BIO_*printf functions. If applications use these functions
  431      in this way then they could be vulnerable. OpenSSL itself uses these
  432      functions when printing out human-readable dumps of ASN.1 data. Therefore
  433      applications that print this data could be vulnerable if the data is from
  434      untrusted sources. OpenSSL command line applications could also be
  435      vulnerable where they print out ASN.1 data, or if untrusted data is passed
  436      as command line arguments.
  437 
  438      Libssl is not considered directly vulnerable. Additionally certificates etc
  439      received via remote connections via libssl are also unlikely to be able to
  440      trigger these issues because of message size limits enforced within libssl.
  441 
  442      This issue was reported to OpenSSL Guido Vranken.
  443      (CVE-2016-0799)
  444      [Matt Caswell]
  445 
  446   *) Side channel attack on modular exponentiation
  447 
  448      A side-channel attack was found which makes use of cache-bank conflicts on
  449      the Intel Sandy-Bridge microarchitecture which could lead to the recovery
  450      of RSA keys.  The ability to exploit this issue is limited as it relies on
  451      an attacker who has control of code in a thread running on the same
  452      hyper-threaded core as the victim thread which is performing decryptions.
  453 
  454      This issue was reported to OpenSSL by Yuval Yarom, The University of
  455      Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
  456      Nadia Heninger, University of Pennsylvania with more information at
  457      http://cachebleed.info.
  458      (CVE-2016-0702)
  459      [Andy Polyakov]
  460 
  461   *) Change the req app to generate a 2048-bit RSA/DSA key by default,
  462      if no keysize is specified with default_bits. This fixes an
  463      omission in an earlier change that changed all RSA/DSA key generation
  464      apps to use 2048 bits by default.
  465      [Emilia Käsper]
  466 
  467  Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
  468 
  469   *) DH small subgroups
  470 
  471      Historically OpenSSL only ever generated DH parameters based on "safe"
  472      primes. More recently (in version 1.0.2) support was provided for
  473      generating X9.42 style parameter files such as those required for RFC 5114
  474      support. The primes used in such files may not be "safe". Where an
  475      application is using DH configured with parameters based on primes that are
  476      not "safe" then an attacker could use this fact to find a peer's private
  477      DH exponent. This attack requires that the attacker complete multiple
  478      handshakes in which the peer uses the same private DH exponent. For example
  479      this could be used to discover a TLS server's private DH exponent if it's
  480      reusing the private DH exponent or it's using a static DH ciphersuite.
  481 
  482      OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
  483      TLS. It is not on by default. If the option is not set then the server
  484      reuses the same private DH exponent for the life of the server process and
  485      would be vulnerable to this attack. It is believed that many popular
  486      applications do set this option and would therefore not be at risk.
  487 
  488      The fix for this issue adds an additional check where a "q" parameter is
  489      available (as is the case in X9.42 based parameters). This detects the
  490      only known attack, and is the only possible defense for static DH
  491      ciphersuites. This could have some performance impact.
  492 
  493      Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
  494      default and cannot be disabled. This could have some performance impact.
  495 
  496      This issue was reported to OpenSSL by Antonio Sanso (Adobe).
  497      (CVE-2016-0701)
  498      [Matt Caswell]
  499 
  500   *) SSLv2 doesn't block disabled ciphers
  501 
  502      A malicious client can negotiate SSLv2 ciphers that have been disabled on
  503      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
  504      been disabled, provided that the SSLv2 protocol was not also disabled via
  505      SSL_OP_NO_SSLv2.
  506 
  507      This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
  508      and Sebastian Schinzel.
  509      (CVE-2015-3197)
  510      [Viktor Dukhovni]
  511 
  512   *) Reject DH handshakes with parameters shorter than 1024 bits.
  513      [Kurt Roeckx]
  514 
  515  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
  516 
  517   *) BN_mod_exp may produce incorrect results on x86_64
  518 
  519      There is a carry propagating bug in the x86_64 Montgomery squaring
  520      procedure. No EC algorithms are affected. Analysis suggests that attacks
  521      against RSA and DSA as a result of this defect would be very difficult to
  522      perform and are not believed likely. Attacks against DH are considered just
  523      feasible (although very difficult) because most of the work necessary to
  524      deduce information about a private key may be performed offline. The amount
  525      of resources required for such an attack would be very significant and
  526      likely only accessible to a limited number of attackers. An attacker would
  527      additionally need online access to an unpatched system using the target
  528      private key in a scenario with persistent DH parameters and a private
  529      key that is shared between multiple clients. For example this can occur by
  530      default in OpenSSL DHE based SSL/TLS ciphersuites.
  531 
  532      This issue was reported to OpenSSL by Hanno Böck.
  533      (CVE-2015-3193)
  534      [Andy Polyakov]
  535 
  536   *) Certificate verify crash with missing PSS parameter
  537 
  538      The signature verification routines will crash with a NULL pointer
  539      dereference if presented with an ASN.1 signature using the RSA PSS
  540      algorithm and absent mask generation function parameter. Since these
  541      routines are used to verify certificate signature algorithms this can be
  542      used to crash any certificate verification operation and exploited in a
  543      DoS attack. Any application which performs certificate verification is
  544      vulnerable including OpenSSL clients and servers which enable client
  545      authentication.
  546 
  547      This issue was reported to OpenSSL by Loïc Jonas Etienne (Qnective AG).
  548      (CVE-2015-3194)
  549      [Stephen Henson]
  550 
  551   *) X509_ATTRIBUTE memory leak
  552 
  553      When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
  554      memory. This structure is used by the PKCS#7 and CMS routines so any
  555      application which reads PKCS#7 or CMS data from untrusted sources is
  556      affected. SSL/TLS is not affected.
  557 
  558      This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
  559      libFuzzer.
  560      (CVE-2015-3195)
  561      [Stephen Henson]
  562 
  563   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
  564      This changes the decoding behaviour for some invalid messages,
  565      though the change is mostly in the more lenient direction, and
  566      legacy behaviour is preserved as much as possible.
  567      [Emilia Käsper]
  568 
  569   *) In DSA_generate_parameters_ex, if the provided seed is too short,
  570      use a random seed, as already documented.
  571      [Rich Salz and Ismo Puustinen <ismo.puustinen@intel.com>]
  572 
  573  Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
  574 
  575   *) Alternate chains certificate forgery
  576 
  577      During certificate verfification, OpenSSL will attempt to find an
  578      alternative certificate chain if the first attempt to build such a chain
  579      fails. An error in the implementation of this logic can mean that an
  580      attacker could cause certain checks on untrusted certificates to be
  581      bypassed, such as the CA flag, enabling them to use a valid leaf
  582      certificate to act as a CA and "issue" an invalid certificate.
  583 
  584      This issue was reported to OpenSSL by Adam Langley/David Benjamin
  585      (Google/BoringSSL).
  586      (CVE-2015-1793)
  587      [Matt Caswell]
  588 
  589   *) Race condition handling PSK identify hint
  590 
  591      If PSK identity hints are received by a multi-threaded client then
  592      the values are wrongly updated in the parent SSL_CTX structure. This can
  593      result in a race condition potentially leading to a double free of the
  594      identify hint data.
  595      (CVE-2015-3196)
  596      [Stephen Henson]
  597 
  598  Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
  599 
  600   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
  601      incompatibility in the handling of HMAC. The previous ABI has now been
  602      restored.
  603 
  604  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
  605 
  606   *) Malformed ECParameters causes infinite loop
  607 
  608      When processing an ECParameters structure OpenSSL enters an infinite loop
  609      if the curve specified is over a specially malformed binary polynomial
  610      field.
  611 
  612      This can be used to perform denial of service against any
  613      system which processes public keys, certificate requests or
  614      certificates.  This includes TLS clients and TLS servers with
  615      client authentication enabled.
  616 
  617      This issue was reported to OpenSSL by Joseph Barr-Pixton.
  618      (CVE-2015-1788)
  619      [Andy Polyakov]
  620 
  621   *) Exploitable out-of-bounds read in X509_cmp_time
  622 
  623      X509_cmp_time does not properly check the length of the ASN1_TIME
  624      string and can read a few bytes out of bounds. In addition,
  625      X509_cmp_time accepts an arbitrary number of fractional seconds in the
  626      time string.
  627 
  628      An attacker can use this to craft malformed certificates and CRLs of
  629      various sizes and potentially cause a segmentation fault, resulting in
  630      a DoS on applications that verify certificates or CRLs. TLS clients
  631      that verify CRLs are affected. TLS clients and servers with client
  632      authentication enabled may be affected if they use custom verification
  633      callbacks.
  634 
  635      This issue was reported to OpenSSL by Robert Swiecki (Google), and
  636      independently by Hanno Böck.
  637      (CVE-2015-1789)
  638      [Emilia Käsper]
  639 
  640   *) PKCS7 crash with missing EnvelopedContent
  641 
  642      The PKCS#7 parsing code does not handle missing inner EncryptedContent
  643      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
  644      with missing content and trigger a NULL pointer dereference on parsing.
  645 
  646      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
  647      structures from untrusted sources are affected. OpenSSL clients and
  648      servers are not affected.
  649 
  650      This issue was reported to OpenSSL by Michal Zalewski (Google).
  651      (CVE-2015-1790)
  652      [Emilia Käsper]
  653 
  654   *) CMS verify infinite loop with unknown hash function
  655 
  656      When verifying a signedData message the CMS code can enter an infinite loop
  657      if presented with an unknown hash function OID. This can be used to perform
  658      denial of service against any system which verifies signedData messages using
  659      the CMS code.
  660      This issue was reported to OpenSSL by Johannes Bauer.
  661      (CVE-2015-1792)
  662      [Stephen Henson]
  663 
  664   *) Race condition handling NewSessionTicket
  665 
  666      If a NewSessionTicket is received by a multi-threaded client when attempting to
  667      reuse a previous ticket then a race condition can occur potentially leading to
  668      a double free of the ticket data.
  669      (CVE-2015-1791)
  670      [Matt Caswell]
  671 
  672   *) Removed support for the two export grade static DH ciphersuites
  673      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
  674      were newly added (along with a number of other static DH ciphersuites) to
  675      1.0.2. However the two export ones have *never* worked since they were
  676      introduced. It seems strange in any case to be adding new export
  677      ciphersuites, and given "logjam" it also does not seem correct to fix them.
  678      [Matt Caswell]
  679 
  680   *) Only support 256-bit or stronger elliptic curves with the
  681      'ecdh_auto' setting (server) or by default (client). Of supported
  682      curves, prefer P-256 (both).
  683      [Emilia Kasper]
  684 
  685   *) Reject DH handshakes with parameters shorter than 768 bits.
  686      [Kurt Roeckx and Emilia Kasper]
  687 
  688  Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
  689 
  690   *) ClientHello sigalgs DoS fix
  691 
  692      If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
  693      invalid signature algorithms extension a NULL pointer dereference will
  694      occur. This can be exploited in a DoS attack against the server.
  695 
  696      This issue was was reported to OpenSSL by David Ramos of Stanford
  697      University.
  698      (CVE-2015-0291)
  699      [Stephen Henson and Matt Caswell]
  700 
  701   *) Multiblock corrupted pointer fix
  702 
  703      OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
  704      feature only applies on 64 bit x86 architecture platforms that support AES
  705      NI instructions. A defect in the implementation of "multiblock" can cause
  706      OpenSSL's internal write buffer to become incorrectly set to NULL when
  707      using non-blocking IO. Typically, when the user application is using a
  708      socket BIO for writing, this will only result in a failed connection.
  709      However if some other BIO is used then it is likely that a segmentation
  710      fault will be triggered, thus enabling a potential DoS attack.
  711 
  712      This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
  713      (CVE-2015-0290)
  714      [Matt Caswell]
  715 
  716   *) Segmentation fault in DTLSv1_listen fix
  717 
  718      The DTLSv1_listen function is intended to be stateless and processes the
  719      initial ClientHello from many peers. It is common for user code to loop
  720      over the call to DTLSv1_listen until a valid ClientHello is received with
  721      an associated cookie. A defect in the implementation of DTLSv1_listen means
  722      that state is preserved in the SSL object from one invocation to the next
  723      that can lead to a segmentation fault. Errors processing the initial
  724      ClientHello can trigger this scenario. An example of such an error could be
  725      that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
  726      server.
  727 
  728      This issue was reported to OpenSSL by Per Allansson.
  729      (CVE-2015-0207)
  730      [Matt Caswell]
  731 
  732   *) Segmentation fault in ASN1_TYPE_cmp fix
  733 
  734      The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
  735      made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
  736      certificate signature algorithm consistency this can be used to crash any
  737      certificate verification operation and exploited in a DoS attack. Any
  738      application which performs certificate verification is vulnerable including
  739      OpenSSL clients and servers which enable client authentication.
  740      (CVE-2015-0286)
  741      [Stephen Henson]
  742 
  743   *) Segmentation fault for invalid PSS parameters fix
  744 
  745      The signature verification routines will crash with a NULL pointer
  746      dereference if presented with an ASN.1 signature using the RSA PSS
  747      algorithm and invalid parameters. Since these routines are used to verify
  748      certificate signature algorithms this can be used to crash any
  749      certificate verification operation and exploited in a DoS attack. Any
  750      application which performs certificate verification is vulnerable including
  751      OpenSSL clients and servers which enable client authentication.
  752 
  753      This issue was was reported to OpenSSL by Brian Carpenter.
  754      (CVE-2015-0208)
  755      [Stephen Henson]
  756 
  757   *) ASN.1 structure reuse memory corruption fix
  758 
  759      Reusing a structure in ASN.1 parsing may allow an attacker to cause
  760      memory corruption via an invalid write. Such reuse is and has been
  761      strongly discouraged and is believed to be rare.
  762 
  763      Applications that parse structures containing CHOICE or ANY DEFINED BY
  764      components may be affected. Certificate parsing (d2i_X509 and related
  765      functions) are however not affected. OpenSSL clients and servers are
  766      not affected.
  767      (CVE-2015-0287)
  768      [Stephen Henson]
  769 
  770   *) PKCS7 NULL pointer dereferences fix
  771 
  772      The PKCS#7 parsing code does not handle missing outer ContentInfo
  773      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
  774      missing content and trigger a NULL pointer dereference on parsing.
  775 
  776      Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
  777      otherwise parse PKCS#7 structures from untrusted sources are
  778      affected. OpenSSL clients and servers are not affected.
  779 
  780      This issue was reported to OpenSSL by Michal Zalewski (Google).
  781      (CVE-2015-0289)
  782      [Emilia Käsper]
  783 
  784   *) DoS via reachable assert in SSLv2 servers fix
  785 
  786      A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
  787      servers that both support SSLv2 and enable export cipher suites by sending
  788      a specially crafted SSLv2 CLIENT-MASTER-KEY message.
  789 
  790      This issue was discovered by Sean Burford (Google) and Emilia Käsper
  791      (OpenSSL development team).
  792      (CVE-2015-0293)
  793      [Emilia Käsper]
  794 
  795   *) Empty CKE with client auth and DHE fix
  796 
  797      If client auth is used then a server can seg fault in the event of a DHE
  798      ciphersuite being selected and a zero length ClientKeyExchange message
  799      being sent by the client. This could be exploited in a DoS attack.
  800      (CVE-2015-1787)
  801      [Matt Caswell]
  802 
  803   *) Handshake with unseeded PRNG fix
  804 
  805      Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
  806      with an unseeded PRNG. The conditions are:
  807      - The client is on a platform where the PRNG has not been seeded
  808      automatically, and the user has not seeded manually
  809      - A protocol specific client method version has been used (i.e. not
  810      SSL_client_methodv23)
  811      - A ciphersuite is used that does not require additional random data from
  812      the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
  813 
  814      If the handshake succeeds then the client random that has been used will
  815      have been generated from a PRNG with insufficient entropy and therefore the
  816      output may be predictable.
  817 
  818      For example using the following command with an unseeded openssl will
  819      succeed on an unpatched platform:
  820 
  821      openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
  822      (CVE-2015-0285)
  823      [Matt Caswell]
  824 
  825   *) Use After Free following d2i_ECPrivatekey error fix
  826 
  827      A malformed EC private key file consumed via the d2i_ECPrivateKey function
  828      could cause a use after free condition. This, in turn, could cause a double
  829      free in several private key parsing functions (such as d2i_PrivateKey
  830      or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
  831      for applications that receive EC private keys from untrusted
  832      sources. This scenario is considered rare.
  833 
  834      This issue was discovered by the BoringSSL project and fixed in their
  835      commit 517073cd4b.
  836      (CVE-2015-0209)
  837      [Matt Caswell]
  838 
  839   *) X509_to_X509_REQ NULL pointer deref fix
  840 
  841      The function X509_to_X509_REQ will crash with a NULL pointer dereference if
  842      the certificate key is invalid. This function is rarely used in practice.
  843 
  844      This issue was discovered by Brian Carpenter.
  845      (CVE-2015-0288)
  846      [Stephen Henson]
  847 
  848   *) Removed the export ciphers from the DEFAULT ciphers
  849      [Kurt Roeckx]
  850 
  851  Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
  852 
  853   *) Change RSA and DH/DSA key generation apps to generate 2048-bit
  854      keys by default.
  855      [Kurt Roeckx]
  856 
  857   *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
  858      ARMv5 through ARMv8, as opposite to "locking" it to single one.
  859      So far those who have to target multiple plaforms would compromise
  860      and argue that binary targeting say ARMv5 would still execute on
  861      ARMv8. "Universal" build resolves this compromise by providing
  862      near-optimal performance even on newer platforms.
  863      [Andy Polyakov]
  864 
  865   *) Accelerated NIST P-256 elliptic curve implementation for x86_64
  866      (other platforms pending).
  867      [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
  868 
  869   *) Add support for the SignedCertificateTimestampList certificate and
  870      OCSP response extensions from RFC6962.
  871      [Rob Stradling]
  872 
  873   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
  874      for corner cases. (Certain input points at infinity could lead to
  875      bogus results, with non-infinity inputs mapped to infinity too.)
  876      [Bodo Moeller]
  877 
  878   *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
  879      This covers AES, SHA256/512 and GHASH. "Initial" means that most
  880      common cases are optimized and there still is room for further
  881      improvements. Vector Permutation AES for Altivec is also added.
  882      [Andy Polyakov]
  883 
  884   *) Add support for little-endian ppc64 Linux target.
  885      [Marcelo Cerri (IBM)]
  886 
  887   *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
  888      SHA1, SHA256 and GHASH. "Initial" means that most common cases
  889      are optimized and there still is room for further improvements.
  890      Both 32- and 64-bit modes are supported.
  891      [Andy Polyakov, Ard Biesheuvel (Linaro)]
  892 
  893   *) Improved ARMv7 NEON support.
  894      [Andy Polyakov]
  895 
  896   *) Support for SPARC Architecture 2011 crypto extensions, first
  897      implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
  898      SHA256/512, MD5, GHASH and modular exponentiation.
  899      [Andy Polyakov, David Miller]
  900 
  901   *) Accelerated modular exponentiation for Intel processors, a.k.a.
  902      RSAZ.
  903      [Shay Gueron & Vlad Krasnov (Intel Corp)]
  904 
  905   *) Support for new and upcoming Intel processors, including AVX2,
  906      BMI and SHA ISA extensions. This includes additional "stitched"
  907      implementations, AESNI-SHA256 and GCM, and multi-buffer support
  908      for TLS encrypt.
  909 
  910      This work was sponsored by Intel Corp.
  911      [Andy Polyakov]
  912 
  913   *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
  914      supports both DTLS 1.2 and 1.0 and should use whatever version the peer
  915      supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
  916      [Steve Henson]
  917 
  918   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
  919      this fixes a limiation in previous versions of OpenSSL.
  920      [Steve Henson]
  921 
  922   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
  923      MGF1 digest and OAEP label.
  924      [Steve Henson]
  925 
  926   *) Add EVP support for key wrapping algorithms, to avoid problems with
  927      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
  928      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
  929      algorithms and include tests cases.
  930      [Steve Henson]
  931 
  932   *) Add functions to allocate and set the fields of an ECDSA_METHOD
  933      structure.
  934      [Douglas E. Engert, Steve Henson]
  935 
  936   *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
  937      difference in days and seconds between two tm or ASN1_TIME structures.
  938      [Steve Henson]
  939 
  940   *) Add -rev test option to s_server to just reverse order of characters
  941      received by client and send back to server. Also prints an abbreviated
  942      summary of the connection parameters.
  943      [Steve Henson]
  944 
  945   *) New option -brief for s_client and s_server to print out a brief summary
  946      of connection parameters.
  947      [Steve Henson]
  948 
  949   *) Add callbacks for arbitrary TLS extensions.
  950      [Trevor Perrin <trevp@trevp.net> and Ben Laurie]
  951 
  952   *) New option -crl_download in several openssl utilities to download CRLs
  953      from CRLDP extension in certificates.
  954      [Steve Henson]
  955 
  956   *) New options -CRL and -CRLform for s_client and s_server for CRLs.
  957      [Steve Henson]
  958 
  959   *) New function X509_CRL_diff to generate a delta CRL from the difference
  960      of two full CRLs. Add support to "crl" utility.
  961      [Steve Henson]
  962 
  963   *) New functions to set lookup_crls function and to retrieve
  964      X509_STORE from X509_STORE_CTX.
  965      [Steve Henson]
  966 
  967   *) Print out deprecated issuer and subject unique ID fields in
  968      certificates.
  969      [Steve Henson]
  970 
  971   *) Extend OCSP I/O functions so they can be used for simple general purpose
  972      HTTP as well as OCSP. New wrapper function which can be used to download
  973      CRLs using the OCSP API.
  974      [Steve Henson]
  975 
  976   *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
  977      [Steve Henson]
  978 
  979   *) SSL_CONF* functions. These provide a common framework for application
  980      configuration using configuration files or command lines.
  981      [Steve Henson]
  982 
  983   *) SSL/TLS tracing code. This parses out SSL/TLS records using the
  984      message callback and prints the results. Needs compile time option
  985      "enable-ssl-trace". New options to s_client and s_server to enable
  986      tracing.
  987      [Steve Henson]
  988 
  989   *) New ctrl and macro to retrieve supported points extensions.
  990      Print out extension in s_server and s_client.
  991      [Steve Henson]
  992 
  993   *) New functions to retrieve certificate signature and signature
  994      OID NID.
  995      [Steve Henson]
  996 
  997   *) Add functions to retrieve and manipulate the raw cipherlist sent by a
  998      client to OpenSSL.
  999      [Steve Henson]
 1000 
 1001   *) New Suite B modes for TLS code. These use and enforce the requirements
 1002      of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
 1003      only use Suite B curves. The Suite B modes can be set by using the
 1004      strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
 1005      [Steve Henson]
 1006 
 1007   *) New chain verification flags for Suite B levels of security. Check
 1008      algorithms are acceptable when flags are set in X509_verify_cert.
 1009      [Steve Henson]
 1010 
 1011   *) Make tls1_check_chain return a set of flags indicating checks passed
 1012      by a certificate chain. Add additional tests to handle client
 1013      certificates: checks for matching certificate type and issuer name
 1014      comparison.
 1015      [Steve Henson]
 1016 
 1017   *) If an attempt is made to use a signature algorithm not in the peer
 1018      preference list abort the handshake. If client has no suitable
 1019      signature algorithms in response to a certificate request do not
 1020      use the certificate.
 1021      [Steve Henson]
 1022 
 1023   *) If server EC tmp key is not in client preference list abort handshake.
 1024      [Steve Henson]
 1025 
 1026   *) Add support for certificate stores in CERT structure. This makes it
 1027      possible to have different stores per SSL structure or one store in
 1028      the parent SSL_CTX. Include distint stores for certificate chain
 1029      verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
 1030      to build and store a certificate chain in CERT structure: returing
 1031      an error if the chain cannot be built: this will allow applications
 1032      to test if a chain is correctly configured.
 1033 
 1034      Note: if the CERT based stores are not set then the parent SSL_CTX
 1035      store is used to retain compatibility with existing behaviour.
 1036 
 1037      [Steve Henson]
 1038 
 1039   *) New function ssl_set_client_disabled to set a ciphersuite disabled
 1040      mask based on the current session, check mask when sending client
 1041      hello and checking the requested ciphersuite.
 1042      [Steve Henson]
 1043 
 1044   *) New ctrls to retrieve and set certificate types in a certificate
 1045      request message. Print out received values in s_client. If certificate
 1046      types is not set with custom values set sensible values based on
 1047      supported signature algorithms.
 1048      [Steve Henson]
 1049 
 1050   *) Support for distinct client and server supported signature algorithms.
 1051      [Steve Henson]
 1052 
 1053   *) Add certificate callback. If set this is called whenever a certificate
 1054      is required by client or server. An application can decide which
 1055      certificate chain to present based on arbitrary criteria: for example
 1056      supported signature algorithms. Add very simple example to s_server.
 1057      This fixes many of the problems and restrictions of the existing client
 1058      certificate callback: for example you can now clear an existing
 1059      certificate and specify the whole chain.
 1060      [Steve Henson]
 1061 
 1062   *) Add new "valid_flags" field to CERT_PKEY structure which determines what
 1063      the certificate can be used for (if anything). Set valid_flags field 
 1064      in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
 1065      to have similar checks in it.
 1066 
 1067      Add new "cert_flags" field to CERT structure and include a "strict mode".
 1068      This enforces some TLS certificate requirements (such as only permitting
 1069      certificate signature algorithms contained in the supported algorithms
 1070      extension) which some implementations ignore: this option should be used
 1071      with caution as it could cause interoperability issues.
 1072      [Steve Henson]
 1073 
 1074   *) Update and tidy signature algorithm extension processing. Work out
 1075      shared signature algorithms based on preferences and peer algorithms
 1076      and print them out in s_client and s_server. Abort handshake if no
 1077      shared signature algorithms.
 1078      [Steve Henson]
 1079 
 1080   *) Add new functions to allow customised supported signature algorithms
 1081      for SSL and SSL_CTX structures. Add options to s_client and s_server
 1082      to support them.
 1083      [Steve Henson]
 1084 
 1085   *) New function SSL_certs_clear() to delete all references to certificates
 1086      from an SSL structure. Before this once a certificate had been added
 1087      it couldn't be removed.
 1088      [Steve Henson]
 1089 
 1090   *) Integrate hostname, email address and IP address checking with certificate
 1091      verification. New verify options supporting checking in opensl utility.
 1092      [Steve Henson]
 1093 
 1094   *) Fixes and wildcard matching support to hostname and email checking
 1095      functions. Add manual page.
 1096      [Florian Weimer (Red Hat Product Security Team)]
 1097 
 1098   *) New functions to check a hostname email or IP address against a
 1099      certificate. Add options x509 utility to print results of checks against
 1100      a certificate.
 1101      [Steve Henson]
 1102 
 1103   *) Fix OCSP checking.
 1104      [Rob Stradling <rob.stradling@comodo.com> and Ben Laurie]
 1105 
 1106   *) Initial experimental support for explicitly trusted non-root CAs. 
 1107      OpenSSL still tries to build a complete chain to a root but if an
 1108      intermediate CA has a trust setting included that is used. The first
 1109      setting is used: whether to trust (e.g., -addtrust option to the x509
 1110      utility) or reject.
 1111      [Steve Henson]
 1112 
 1113   *) Add -trusted_first option which attempts to find certificates in the
 1114      trusted store even if an untrusted chain is also supplied.
 1115      [Steve Henson]
 1116 
 1117   *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
 1118      platform support for Linux and Android.
 1119      [Andy Polyakov]
 1120 
 1121   *) Support for linux-x32, ILP32 environment in x86_64 framework.
 1122      [Andy Polyakov]
 1123 
 1124   *) Experimental multi-implementation support for FIPS capable OpenSSL.
 1125      When in FIPS mode the approved implementations are used as normal,
 1126      when not in FIPS mode the internal unapproved versions are used instead.
 1127      This means that the FIPS capable OpenSSL isn't forced to use the
 1128      (often lower perfomance) FIPS implementations outside FIPS mode.
 1129      [Steve Henson]
 1130 
 1131   *) Transparently support X9.42 DH parameters when calling
 1132      PEM_read_bio_DHparameters. This means existing applications can handle
 1133      the new parameter format automatically.
 1134      [Steve Henson]
 1135 
 1136   *) Initial experimental support for X9.42 DH parameter format: mainly
 1137      to support use of 'q' parameter for RFC5114 parameters.
 1138      [Steve Henson]
 1139 
 1140   *) Add DH parameters from RFC5114 including test data to dhtest.
 1141      [Steve Henson]
 1142 
 1143   *) Support for automatic EC temporary key parameter selection. If enabled
 1144      the most preferred EC parameters are automatically used instead of
 1145      hardcoded fixed parameters. Now a server just has to call:
 1146      SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
 1147      support ECDH and use the most appropriate parameters.
 1148      [Steve Henson]
 1149 
 1150   *) Enhance and tidy EC curve and point format TLS extension code. Use
 1151      static structures instead of allocation if default values are used.
 1152      New ctrls to set curves we wish to support and to retrieve shared curves.
 1153      Print out shared curves in s_server. New options to s_server and s_client
 1154      to set list of supported curves.
 1155      [Steve Henson]
 1156 
 1157   *) New ctrls to retrieve supported signature algorithms and 
 1158      supported curve values as an array of NIDs. Extend openssl utility
 1159      to print out received values.
 1160      [Steve Henson]
 1161 
 1162   *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
 1163      between NIDs and the more common NIST names such as "P-256". Enhance
 1164      ecparam utility and ECC method to recognise the NIST names for curves.
 1165      [Steve Henson]
 1166 
 1167   *) Enhance SSL/TLS certificate chain handling to support different
 1168      chains for each certificate instead of one chain in the parent SSL_CTX.
 1169      [Steve Henson]
 1170 
 1171   *) Support for fixed DH ciphersuite client authentication: where both
 1172      server and client use DH certificates with common parameters.
 1173      [Steve Henson]
 1174 
 1175   *) Support for fixed DH ciphersuites: those requiring DH server
 1176      certificates.
 1177      [Steve Henson]
 1178 
 1179   *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
 1180      the certificate.
 1181      Note: Related 1.0.2-beta specific macros X509_get_cert_info,
 1182      X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
 1183      X509_CINF_get_signature were reverted post internal team review.
 1184 
 1185  Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
 1186 
 1187   *) Build fixes for the Windows and OpenVMS platforms
 1188      [Matt Caswell and Richard Levitte]
 1189 
 1190  Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
 1191 
 1192   *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
 1193      message can cause a segmentation fault in OpenSSL due to a NULL pointer
 1194      dereference. This could lead to a Denial Of Service attack. Thanks to
 1195      Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
 1196      (CVE-2014-3571)
 1197      [Steve Henson]
 1198 
 1199   *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
 1200      dtls1_buffer_record function under certain conditions. In particular this
 1201      could occur if an attacker sent repeated DTLS records with the same
 1202      sequence number but for the next epoch. The memory leak could be exploited
 1203      by an attacker in a Denial of Service attack through memory exhaustion.
 1204      Thanks to Chris Mueller for reporting this issue.
 1205      (CVE-2015-0206)
 1206      [Matt Caswell]
 1207 
 1208   *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
 1209      built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
 1210      method would be set to NULL which could later result in a NULL pointer
 1211      dereference. Thanks to Frank Schmirler for reporting this issue.
 1212      (CVE-2014-3569)
 1213      [Kurt Roeckx]
 1214 
 1215   *) Abort handshake if server key exchange message is omitted for ephemeral
 1216      ECDH ciphersuites.
 1217 
 1218      Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
 1219      reporting this issue.
 1220      (CVE-2014-3572)
 1221      [Steve Henson]
 1222 
 1223   *) Remove non-export ephemeral RSA code on client and server. This code
 1224      violated the TLS standard by allowing the use of temporary RSA keys in
 1225      non-export ciphersuites and could be used by a server to effectively
 1226      downgrade the RSA key length used to a value smaller than the server
 1227      certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
 1228      INRIA or reporting this issue.
 1229      (CVE-2015-0204)
 1230      [Steve Henson]
 1231 
 1232   *) Fixed issue where DH client certificates are accepted without verification.
 1233      An OpenSSL server will accept a DH certificate for client authentication
 1234      without the certificate verify message. This effectively allows a client to
 1235      authenticate without the use of a private key. This only affects servers
 1236      which trust a client certificate authority which issues certificates
 1237      containing DH keys: these are extremely rare and hardly ever encountered.
 1238      Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
 1239      this issue.
 1240      (CVE-2015-0205)
 1241      [Steve Henson]
 1242 
 1243   *) Ensure that the session ID context of an SSL is updated when its
 1244      SSL_CTX is updated via SSL_set_SSL_CTX.
 1245 
 1246      The session ID context is typically set from the parent SSL_CTX,
 1247      and can vary with the CTX.
 1248      [Adam Langley]
 1249 
 1250   *) Fix various certificate fingerprint issues.
 1251 
 1252      By using non-DER or invalid encodings outside the signed portion of a
 1253      certificate the fingerprint can be changed without breaking the signature.
 1254      Although no details of the signed portion of the certificate can be changed
 1255      this can cause problems with some applications: e.g. those using the
 1256      certificate fingerprint for blacklists.
 1257 
 1258      1. Reject signatures with non zero unused bits.
 1259 
 1260      If the BIT STRING containing the signature has non zero unused bits reject
 1261      the signature. All current signature algorithms require zero unused bits.
 1262 
 1263      2. Check certificate algorithm consistency.
 1264 
 1265      Check the AlgorithmIdentifier inside TBS matches the one in the
 1266      certificate signature. NB: this will result in signature failure
 1267      errors for some broken certificates.
 1268 
 1269      Thanks to Konrad Kraszewski from Google for reporting this issue.
 1270 
 1271      3. Check DSA/ECDSA signatures use DER.
 1272 
 1273      Reencode DSA/ECDSA signatures and compare with the original received
 1274      signature. Return an error if there is a mismatch.
 1275 
 1276      This will reject various cases including garbage after signature
 1277      (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
 1278      program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
 1279      (negative or with leading zeroes).
 1280 
 1281      Further analysis was conducted and fixes were developed by Stephen Henson
 1282      of the OpenSSL core team.
 1283 
 1284      (CVE-2014-8275)
 1285      [Steve Henson]
 1286 
 1287    *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
 1288       results on some platforms, including x86_64. This bug occurs at random
 1289       with a very low probability, and is not known to be exploitable in any
 1290       way, though its exact impact is difficult to determine. Thanks to Pieter
 1291       Wuille (Blockstream) who reported this issue and also suggested an initial
 1292       fix. Further analysis was conducted by the OpenSSL development team and
 1293       Adam Langley of Google. The final fix was developed by Andy Polyakov of
 1294       the OpenSSL core team.
 1295       (CVE-2014-3570)
 1296       [Andy Polyakov]
 1297 
 1298    *) Do not resume sessions on the server if the negotiated protocol
 1299       version does not match the session's version. Resuming with a different
 1300       version, while not strictly forbidden by the RFC, is of questionable
 1301       sanity and breaks all known clients.
 1302       [David Benjamin, Emilia Käsper]
 1303 
 1304    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
 1305       early CCS messages during renegotiation. (Note that because
 1306       renegotiation is encrypted, this early CCS was not exploitable.)
 1307       [Emilia Käsper]
 1308 
 1309    *) Tighten client-side session ticket handling during renegotiation:
 1310       ensure that the client only accepts a session ticket if the server sends
 1311       the extension anew in the ServerHello. Previously, a TLS client would
 1312       reuse the old extension state and thus accept a session ticket if one was
 1313       announced in the initial ServerHello.
 1314 
 1315       Similarly, ensure that the client requires a session ticket if one
 1316       was advertised in the ServerHello. Previously, a TLS client would
 1317       ignore a missing NewSessionTicket message.
 1318       [Emilia Käsper]
 1319 
 1320  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
 1321 
 1322   *) SRTP Memory Leak.
 1323 
 1324      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
 1325      sends a carefully crafted handshake message, to cause OpenSSL to fail
 1326      to free up to 64k of memory causing a memory leak. This could be
 1327      exploited in a Denial Of Service attack. This issue affects OpenSSL
 1328      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
 1329      whether SRTP is used or configured. Implementations of OpenSSL that
 1330      have been compiled with OPENSSL_NO_SRTP defined are not affected.
 1331 
 1332      The fix was developed by the OpenSSL team.
 1333      (CVE-2014-3513)
 1334      [OpenSSL team]
 1335 
 1336   *) Session Ticket Memory Leak.
 1337 
 1338      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
 1339      integrity of that ticket is first verified. In the event of a session
 1340      ticket integrity check failing, OpenSSL will fail to free memory
 1341      causing a memory leak. By sending a large number of invalid session
 1342      tickets an attacker could exploit this issue in a Denial Of Service
 1343      attack.
 1344      (CVE-2014-3567)
 1345      [Steve Henson]
 1346 
 1347   *) Build option no-ssl3 is incomplete.
 1348 
 1349      When OpenSSL is configured with "no-ssl3" as a build option, servers
 1350      could accept and complete a SSL 3.0 handshake, and clients could be
 1351      configured to send them.
 1352      (CVE-2014-3568)
 1353      [Akamai and the OpenSSL team]
 1354 
 1355   *) Add support for TLS_FALLBACK_SCSV.
 1356      Client applications doing fallback retries should call
 1357      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
 1358      (CVE-2014-3566)
 1359      [Adam Langley, Bodo Moeller]
 1360 
 1361   *) Add additional DigestInfo checks.
 1362  
 1363      Reencode DigestInto in DER and check against the original when
 1364      verifying RSA signature: this will reject any improperly encoded
 1365      DigestInfo structures.
 1366 
 1367      Note: this is a precautionary measure and no attacks are currently known.
 1368 
 1369      [Steve Henson]
 1370 
 1371  Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
 1372 
 1373   *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
 1374      SRP code can be overrun an internal buffer. Add sanity check that
 1375      g, A, B < N to SRP code.
 1376 
 1377      Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
 1378      Group for discovering this issue.
 1379      (CVE-2014-3512)
 1380      [Steve Henson]
 1381 
 1382   *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
 1383      TLS 1.0 instead of higher protocol versions when the ClientHello message
 1384      is badly fragmented. This allows a man-in-the-middle attacker to force a
 1385      downgrade to TLS 1.0 even if both the server and the client support a
 1386      higher protocol version, by modifying the client's TLS records.
 1387 
 1388      Thanks to David Benjamin and Adam Langley (Google) for discovering and
 1389      researching this issue.
 1390      (CVE-2014-3511)
 1391      [David Benjamin]
 1392 
 1393   *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
 1394      to a denial of service attack. A malicious server can crash the client
 1395      with a null pointer dereference (read) by specifying an anonymous (EC)DH
 1396      ciphersuite and sending carefully crafted handshake messages.
 1397 
 1398      Thanks to Felix Gröbert (Google) for discovering and researching this
 1399      issue.
 1400      (CVE-2014-3510)
 1401      [Emilia Käsper]
 1402 
 1403   *) By sending carefully crafted DTLS packets an attacker could cause openssl
 1404      to leak memory. This can be exploited through a Denial of Service attack.
 1405      Thanks to Adam Langley for discovering and researching this issue.
 1406      (CVE-2014-3507)
 1407      [Adam Langley]
 1408 
 1409   *) An attacker can force openssl to consume large amounts of memory whilst
 1410      processing DTLS handshake messages. This can be exploited through a
 1411      Denial of Service attack.
 1412      Thanks to Adam Langley for discovering and researching this issue.
 1413      (CVE-2014-3506)
 1414      [Adam Langley]
 1415 
 1416   *) An attacker can force an error condition which causes openssl to crash
 1417      whilst processing DTLS packets due to memory being freed twice. This
 1418      can be exploited through a Denial of Service attack.
 1419      Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
 1420      this issue.
 1421      (CVE-2014-3505)
 1422      [Adam Langley]
 1423 
 1424   *) If a multithreaded client connects to a malicious server using a resumed
 1425      session and the server sends an ec point format extension it could write
 1426      up to 255 bytes to freed memory.
 1427 
 1428      Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
 1429      issue.
 1430      (CVE-2014-3509)
 1431      [Gabor Tyukasz]
 1432 
 1433   *) A malicious server can crash an OpenSSL client with a null pointer
 1434      dereference (read) by specifying an SRP ciphersuite even though it was not
 1435      properly negotiated with the client. This can be exploited through a
 1436      Denial of Service attack.
 1437 
 1438      Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for
 1439      discovering and researching this issue.
 1440      (CVE-2014-5139)
 1441      [Steve Henson]
 1442 
 1443   *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
 1444      X509_name_oneline, X509_name_print_ex et al. to leak some information
 1445      from the stack. Applications may be affected if they echo pretty printing
 1446      output to the attacker.
 1447 
 1448      Thanks to Ivan Fratric (Google) for discovering this issue.
 1449      (CVE-2014-3508)
 1450      [Emilia Käsper, and Steve Henson]
 1451 
 1452   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
 1453      for corner cases. (Certain input points at infinity could lead to
 1454      bogus results, with non-infinity inputs mapped to infinity too.)
 1455      [Bodo Moeller]
 1456 
 1457  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
 1458 
 1459   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
 1460      handshake can force the use of weak keying material in OpenSSL
 1461      SSL/TLS clients and servers.
 1462 
 1463      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
 1464      researching this issue. (CVE-2014-0224)
 1465      [KIKUCHI Masashi, Steve Henson]
 1466 
 1467   *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
 1468      OpenSSL DTLS client the code can be made to recurse eventually crashing
 1469      in a DoS attack.
 1470 
 1471      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
 1472      (CVE-2014-0221)
 1473      [Imre Rad, Steve Henson]
 1474 
 1475   *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
 1476      be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
 1477      client or server. This is potentially exploitable to run arbitrary
 1478      code on a vulnerable client or server.
 1479 
 1480      Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195)
 1481      [Jüri Aedla, Steve Henson]
 1482 
 1483   *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
 1484      are subject to a denial of service attack.
 1485 
 1486      Thanks to Felix Gröbert and Ivan Fratric at Google for discovering
 1487      this issue. (CVE-2014-3470)
 1488      [Felix Gröbert, Ivan Fratric, Steve Henson]
 1489 
 1490   *) Harmonize version and its documentation. -f flag is used to display
 1491      compilation flags.
 1492      [mancha <mancha1@zoho.com>]
 1493 
 1494   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
 1495      in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
 1496      [mancha <mancha1@zoho.com>]
 1497 
 1498   *) Fix some double frees. These are not thought to be exploitable.
 1499      [mancha <mancha1@zoho.com>]
 1500 
 1501  Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
 1502 
 1503   *) A missing bounds check in the handling of the TLS heartbeat extension
 1504      can be used to reveal up to 64k of memory to a connected client or
 1505      server.
 1506 
 1507      Thanks for Neel Mehta of Google Security for discovering this bug and to
 1508      Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
 1509      preparing the fix (CVE-2014-0160)
 1510      [Adam Langley, Bodo Moeller]
 1511 
 1512   *) Fix for the attack described in the paper "Recovering OpenSSL
 1513      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
 1514      by Yuval Yarom and Naomi Benger. Details can be obtained from:
 1515      http://eprint.iacr.org/2014/140
 1516 
 1517      Thanks to Yuval Yarom and Naomi Benger for discovering this
 1518      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
 1519      [Yuval Yarom and Naomi Benger]
 1520 
 1521   *) TLS pad extension: draft-agl-tls-padding-03
 1522 
 1523      Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
 1524      TLS client Hello record length value would otherwise be > 255 and
 1525      less that 512 pad with a dummy extension containing zeroes so it
 1526      is at least 512 bytes long.
 1527 
 1528      [Adam Langley, Steve Henson]
 1529 
 1530  Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
 1531 
 1532   *) Fix for TLS record tampering bug. A carefully crafted invalid 
 1533      handshake could crash OpenSSL with a NULL pointer exception.
 1534      Thanks to Anton Johansson for reporting this issues.
 1535      (CVE-2013-4353)
 1536 
 1537   *) Keep original DTLS digest and encryption contexts in retransmission
 1538      structures so we can use the previous session parameters if they need
 1539      to be resent. (CVE-2013-6450)
 1540      [Steve Henson]
 1541 
 1542   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
 1543      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
 1544      Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
 1545      several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
 1546      is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
 1547      10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
 1548      [Rob Stradling, Adam Langley]
 1549 
 1550  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
 1551 
 1552   *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
 1553      supporting platforms or when small records were transferred.
 1554      [Andy Polyakov, Steve Henson]
 1555 
 1556  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
 1557 
 1558   *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
 1559 
 1560      This addresses the flaw in CBC record processing discovered by 
 1561      Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
 1562      at: http://www.isg.rhul.ac.uk/tls/     
 1563 
 1564      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
 1565      Security Group at Royal Holloway, University of London
 1566      (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
 1567      Emilia Käsper for the initial patch.
 1568      (CVE-2013-0169)
 1569      [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
 1570 
 1571   *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
 1572      ciphersuites which can be exploited in a denial of service attack.
 1573      Thanks go to and to Adam Langley <agl@chromium.org> for discovering
 1574      and detecting this bug and to Wolfgang Ettlinger
 1575      <wolfgang.ettlinger@gmail.com> for independently discovering this issue.
 1576      (CVE-2012-2686)
 1577      [Adam Langley]
 1578 
 1579   *) Return an error when checking OCSP signatures when key is NULL.
 1580      This fixes a DoS attack. (CVE-2013-0166)
 1581      [Steve Henson]
 1582 
 1583   *) Make openssl verify return errors.
 1584      [Chris Palmer <palmer@google.com> and Ben Laurie]
 1585 
 1586   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
 1587      the right response is stapled. Also change SSL_get_certificate()
 1588      so it returns the certificate actually sent.
 1589      See http://rt.openssl.org/Ticket/Display.html?id=2836.
 1590      [Rob Stradling <rob.stradling@comodo.com>]
 1591 
 1592   *) Fix possible deadlock when decoding public keys.
 1593      [Steve Henson]
 1594 
 1595   *) Don't use TLS 1.0 record version number in initial client hello
 1596      if renegotiating.
 1597      [Steve Henson]
 1598 
 1599  Changes between 1.0.1b and 1.0.1c [10 May 2012]
 1600 
 1601   *) Sanity check record length before skipping explicit IV in TLS
 1602      1.2, 1.1 and DTLS to fix DoS attack.
 1603 
 1604      Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
 1605      fuzzing as a service testing platform.
 1606      (CVE-2012-2333)
 1607      [Steve Henson]
 1608 
 1609   *) Initialise tkeylen properly when encrypting CMS messages.
 1610      Thanks to Solar Designer of Openwall for reporting this issue.
 1611      [Steve Henson]
 1612 
 1613   *) In FIPS mode don't try to use composite ciphers as they are not
 1614      approved.
 1615      [Steve Henson]
 1616 
 1617  Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
 1618 
 1619   *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
 1620      1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
 1621      mean any application compiled against OpenSSL 1.0.0 headers setting
 1622      SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
 1623      TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
 1624      0x10000000L Any application which was previously compiled against
 1625      OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
 1626      will need to be recompiled as a result. Letting be results in
 1627      inability to disable specifically TLS 1.1 and in client context,
 1628      in unlike event, limit maximum offered version to TLS 1.0 [see below].
 1629      [Steve Henson]
 1630 
 1631   *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
 1632      disable just protocol X, but all protocols above X *if* there are
 1633      protocols *below* X still enabled. In more practical terms it means
 1634      that if application wants to disable TLS1.0 in favor of TLS1.1 and
 1635      above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
 1636      SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
 1637      client side.
 1638      [Andy Polyakov]
 1639 
 1640  Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
 1641 
 1642   *) Check for potentially exploitable overflows in asn1_d2i_read_bio
 1643      BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
 1644      in CRYPTO_realloc_clean.
 1645 
 1646      Thanks to Tavis Ormandy, Google Security Team, for discovering this
 1647      issue and to Adam Langley <agl@chromium.org> for fixing it.
 1648      (CVE-2012-2110)
 1649      [Adam Langley (Google), Tavis Ormandy, Google Security Team]
 1650 
 1651   *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
 1652      [Adam Langley]
 1653 
 1654   *) Workarounds for some broken servers that "hang" if a client hello
 1655      record length exceeds 255 bytes.
 1656 
 1657      1. Do not use record version number > TLS 1.0 in initial client
 1658         hello: some (but not all) hanging servers will now work.
 1659      2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
 1660 	the number of ciphers sent in the client hello. This should be
 1661         set to an even number, such as 50, for example by passing:
 1662         -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
 1663         Most broken servers should now work.
 1664      3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
 1665 	TLS 1.2 client support entirely.
 1666      [Steve Henson]
 1667 
 1668   *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
 1669      [Andy Polyakov]
 1670 
 1671  Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
 1672 
 1673   *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
 1674      STRING form instead of a DigestInfo.
 1675      [Steve Henson]
 1676 
 1677   *) The format used for MDC2 RSA signatures is inconsistent between EVP
 1678      and the RSA_sign/RSA_verify functions. This was made more apparent when
 1679      OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
 1680      those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
 1681      the correct format in RSA_verify so both forms transparently work.
 1682      [Steve Henson]
 1683 
 1684   *) Some servers which support TLS 1.0 can choke if we initially indicate
 1685      support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
 1686      encrypted premaster secret. As a workaround use the maximum pemitted
 1687      client version in client hello, this should keep such servers happy
 1688      and still work with previous versions of OpenSSL.
 1689      [Steve Henson]
 1690 
 1691   *) Add support for TLS/DTLS heartbeats.
 1692      [Robin Seggelmann <seggelmann@fh-muenster.de>]
 1693 
 1694   *) Add support for SCTP.
 1695      [Robin Seggelmann <seggelmann@fh-muenster.de>]
 1696 
 1697   *) Improved PRNG seeding for VOS.
 1698      [Paul Green <Paul.Green@stratus.com>]
 1699 
 1700   *) Extensive assembler packs updates, most notably:
 1701 
 1702 	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
 1703 	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
 1704 	- x86_64:       bit-sliced AES implementation;
 1705 	- ARM:          NEON support, contemporary platforms optimizations;
 1706 	- s390x:        z196 support;
 1707 	- *:            GHASH and GF(2^m) multiplication implementations;
 1708 
 1709      [Andy Polyakov]
 1710 
 1711   *) Make TLS-SRP code conformant with RFC 5054 API cleanup
 1712      (removal of unnecessary code)
 1713      [Peter Sylvester <peter.sylvester@edelweb.fr>]
 1714 
 1715   *) Add TLS key material exporter from RFC 5705.
 1716      [Eric Rescorla]
 1717 
 1718   *) Add DTLS-SRTP negotiation from RFC 5764.
 1719      [Eric Rescorla]
 1720 
 1721   *) Add Next Protocol Negotiation,
 1722      http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
 1723      disabled with a no-npn flag to config or Configure. Code donated
 1724      by Google.
 1725      [Adam Langley <agl@google.com> and Ben Laurie]
 1726 
 1727   *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
 1728      NIST-P256, NIST-P521, with constant-time single point multiplication on
 1729      typical inputs. Compiler support for the nonstandard type __uint128_t is
 1730      required to use this (present in gcc 4.4 and later, for 64-bit builds).
 1731      Code made available under Apache License version 2.0.
 1732 
 1733      Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
 1734      line to include this in your build of OpenSSL, and run "make depend" (or
 1735      "make update"). This enables the following EC_METHODs:
 1736 
 1737          EC_GFp_nistp224_method()
 1738          EC_GFp_nistp256_method()
 1739          EC_GFp_nistp521_method()
 1740 
 1741      EC_GROUP_new_by_curve_name() will automatically use these (while
 1742      EC_GROUP_new_curve_GFp() currently prefers the more flexible
 1743      implementations).
 1744      [Emilia Käsper, Adam Langley, Bodo Moeller (Google)]
 1745 
 1746   *) Use type ossl_ssize_t instad of ssize_t which isn't available on
 1747      all platforms. Move ssize_t definition from e_os.h to the public
 1748      header file e_os2.h as it now appears in public header file cms.h
 1749      [Steve Henson]
 1750 
 1751   *) New -sigopt option to the ca, req and x509 utilities. Additional
 1752      signature parameters can be passed using this option and in
 1753      particular PSS. 
 1754      [Steve Henson]
 1755 
 1756   *) Add RSA PSS signing function. This will generate and set the
 1757      appropriate AlgorithmIdentifiers for PSS based on those in the
 1758      corresponding EVP_MD_CTX structure. No application support yet.
 1759      [Steve Henson]
 1760 
 1761   *) Support for companion algorithm specific ASN1 signing routines.
 1762      New function ASN1_item_sign_ctx() signs a pre-initialised
 1763      EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
 1764      the appropriate parameters.
 1765      [Steve Henson]
 1766 
 1767   *) Add new algorithm specific ASN1 verification initialisation function
 1768      to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
 1769      handling will be the same no matter what EVP_PKEY_METHOD is used.
 1770      Add a PSS handler to support verification of PSS signatures: checked
 1771      against a number of sample certificates.
 1772      [Steve Henson]
 1773 
 1774   *) Add signature printing for PSS. Add PSS OIDs.
 1775      [Steve Henson, Martin Kaiser <lists@kaiser.cx>]
 1776 
 1777   *) Add algorithm specific signature printing. An individual ASN1 method
 1778      can now print out signatures instead of the standard hex dump. 
 1779 
 1780      More complex signatures (e.g. PSS) can print out more meaningful
 1781      information. Include DSA version that prints out the signature
 1782      parameters r, s.
 1783      [Steve Henson]
 1784 
 1785   *) Password based recipient info support for CMS library: implementing
 1786      RFC3211.
 1787      [Steve Henson]
 1788 
 1789   *) Split password based encryption into PBES2 and PBKDF2 functions. This
 1790      neatly separates the code into cipher and PBE sections and is required
 1791      for some algorithms that split PBES2 into separate pieces (such as
 1792      password based CMS).
 1793      [Steve Henson]
 1794 
 1795   *) Session-handling fixes:
 1796      - Fix handling of connections that are resuming with a session ID,
 1797        but also support Session Tickets.
 1798      - Fix a bug that suppressed issuing of a new ticket if the client
 1799        presented a ticket with an expired session.
 1800      - Try to set the ticket lifetime hint to something reasonable.
 1801      - Make tickets shorter by excluding irrelevant information.
 1802      - On the client side, don't ignore renewed tickets.
 1803      [Adam Langley, Bodo Moeller (Google)]
 1804 
 1805   *) Fix PSK session representation.
 1806      [Bodo Moeller]
 1807 
 1808   *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
 1809 
 1810      This work was sponsored by Intel.
 1811      [Andy Polyakov]
 1812 
 1813   *) Add GCM support to TLS library. Some custom code is needed to split
 1814      the IV between the fixed (from PRF) and explicit (from TLS record)
 1815      portions. This adds all GCM ciphersuites supported by RFC5288 and 
 1816      RFC5289. Generalise some AES* cipherstrings to inlclude GCM and
 1817      add a special AESGCM string for GCM only.
 1818      [Steve Henson]
 1819 
 1820   *) Expand range of ctrls for AES GCM. Permit setting invocation
 1821      field on decrypt and retrieval of invocation field only on encrypt.
 1822      [Steve Henson]
 1823 
 1824   *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
 1825      As required by RFC5289 these ciphersuites cannot be used if for
 1826      versions of TLS earlier than 1.2.
 1827      [Steve Henson]
 1828 
 1829   *) For FIPS capable OpenSSL interpret a NULL default public key method
 1830      as unset and return the appopriate default but do *not* set the default.
 1831      This means we can return the appopriate method in applications that
 1832      swicth between FIPS and non-FIPS modes.
 1833      [Steve Henson]
 1834 
 1835   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
 1836      ENGINE is used then we cannot handle that in the FIPS module so we
 1837      keep original code iff non-FIPS operations are allowed.
 1838      [Steve Henson]
 1839 
 1840   *) Add -attime option to openssl utilities.
 1841      [Peter Eckersley <pde@eff.org>, Ben Laurie and Steve Henson]
 1842 
 1843   *) Redirect DSA and DH operations to FIPS module in FIPS mode.
 1844      [Steve Henson]
 1845 
 1846   *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
 1847      FIPS EC methods unconditionally for now.
 1848      [Steve Henson]
 1849 
 1850   *) New build option no-ec2m to disable characteristic 2 code.
 1851      [Steve Henson]
 1852 
 1853   *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
 1854      all cases can be covered as some introduce binary incompatibilities.
 1855      [Steve Henson]
 1856 
 1857   *) Redirect RSA operations to FIPS module including keygen,
 1858      encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
 1859      [Steve Henson]
 1860 
 1861   *) Add similar low level API blocking to ciphers.
 1862      [Steve Henson]
 1863 
 1864   *) Low level digest APIs are not approved in FIPS mode: any attempt
 1865      to use these will cause a fatal error. Applications that *really* want
 1866      to use them can use the private_* version instead.
 1867      [Steve Henson]
 1868 
 1869   *) Redirect cipher operations to FIPS module for FIPS builds. 
 1870      [Steve Henson]
 1871 
 1872   *) Redirect digest operations to FIPS module for FIPS builds. 
 1873      [Steve Henson]
 1874 
 1875   *) Update build system to add "fips" flag which will link in fipscanister.o
 1876      for static and shared library builds embedding a signature if needed.
 1877      [Steve Henson]
 1878 
 1879   *) Output TLS supported curves in preference order instead of numerical
 1880      order. This is currently hardcoded for the highest order curves first.
 1881      This should be configurable so applications can judge speed vs strength.
 1882      [Steve Henson]
 1883 
 1884   *) Add TLS v1.2 server support for client authentication. 
 1885      [Steve Henson]
 1886 
 1887   *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
 1888      and enable MD5.
 1889      [Steve Henson]
 1890 
 1891   *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
 1892      FIPS modules versions.
 1893      [Steve Henson]
 1894 
 1895   *) Add TLS v1.2 client side support for client authentication. Keep cache
 1896      of handshake records longer as we don't know the hash algorithm to use
 1897      until after the certificate request message is received.
 1898      [Steve Henson]
 1899 
 1900   *) Initial TLS v1.2 client support. Add a default signature algorithms
 1901      extension including all the algorithms we support. Parse new signature
 1902      format in client key exchange. Relax some ECC signing restrictions for
 1903      TLS v1.2 as indicated in RFC5246.
 1904      [Steve Henson]
 1905 
 1906   *) Add server support for TLS v1.2 signature algorithms extension. Switch
 1907      to new signature format when needed using client digest preference.
 1908      All server ciphersuites should now work correctly in TLS v1.2. No client
 1909      support yet and no support for client certificates.
 1910      [Steve Henson]
 1911 
 1912   *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
 1913      to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
 1914      ciphersuites. At present only RSA key exchange ciphersuites work with
 1915      TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
 1916      SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
 1917      and version checking.
 1918      [Steve Henson]
 1919 
 1920   *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
 1921      with this defined it will not be affected by any changes to ssl internal
 1922      structures. Add several utility functions to allow openssl application
 1923      to work with OPENSSL_NO_SSL_INTERN defined.
 1924      [Steve Henson]
 1925 
 1926   *) Add SRP support.
 1927      [Tom Wu <tjw@cs.stanford.edu> and Ben Laurie]
 1928 
 1929   *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
 1930      [Steve Henson]
 1931 
 1932   *) Permit abbreviated handshakes when renegotiating using the function
 1933      SSL_renegotiate_abbreviated().
 1934      [Robin Seggelmann <seggelmann@fh-muenster.de>]
 1935 
 1936   *) Add call to ENGINE_register_all_complete() to
 1937      ENGINE_load_builtin_engines(), so some implementations get used
 1938      automatically instead of needing explicit application support.
 1939      [Steve Henson]
 1940 
 1941   *) Add support for TLS key exporter as described in RFC5705.
 1942      [Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson]
 1943 
 1944   *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
 1945      a few changes are required:
 1946 
 1947        Add SSL_OP_NO_TLSv1_1 flag.
 1948        Add TLSv1_1 methods.
 1949        Update version checking logic to handle version 1.1.
 1950        Add explicit IV handling (ported from DTLS code).
 1951        Add command line options to s_client/s_server.
 1952      [Steve Henson]
 1953 
 1954  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
 1955 
 1956   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
 1957      in CMS and PKCS7 code. When RSA decryption fails use a random key for
 1958      content decryption and always return the same error. Note: this attack
 1959      needs on average 2^20 messages so it only affects automated senders. The
 1960      old behaviour can be reenabled in the CMS code by setting the
 1961      CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
 1962      an MMA defence is not necessary.
 1963      Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
 1964      this issue. (CVE-2012-0884)
 1965      [Steve Henson]
 1966 
 1967   *) Fix CVE-2011-4619: make sure we really are receiving a 
 1968      client hello before rejecting multiple SGC restarts. Thanks to
 1969      Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug.
 1970      [Steve Henson]
 1971 
 1972  Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
 1973 
 1974   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
 1975      Thanks to Antonio Martin, Enterprise Secure Access Research and
 1976      Development, Cisco Systems, Inc. for discovering this bug and
 1977      preparing a fix. (CVE-2012-0050)
 1978      [Antonio Martin]
 1979 
 1980  Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
 1981 
 1982   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
 1983      of the Vaudenay padding oracle attack on CBC mode encryption
 1984      which enables an efficient plaintext recovery attack against
 1985      the OpenSSL implementation of DTLS. Their attack exploits timing
 1986      differences arising during decryption processing. A research
 1987      paper describing this attack can be found at:
 1988                   http://www.isg.rhul.ac.uk/~kp/dtls.pdf
 1989      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
 1990      Security Group at Royal Holloway, University of London
 1991      (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
 1992      <seggelmann@fh-muenster.de> and Michael Tuexen <tuexen@fh-muenster.de>
 1993      for preparing the fix. (CVE-2011-4108)
 1994      [Robin Seggelmann, Michael Tuexen]
 1995 
 1996   *) Clear bytes used for block padding of SSL 3.0 records.
 1997      (CVE-2011-4576)
 1998      [Adam Langley (Google)]
 1999 
 2000   *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
 2001      Kadianakis <desnacked@gmail.com> for discovering this issue and
 2002      Adam Langley for preparing the fix. (CVE-2011-4619)
 2003      [Adam Langley (Google)]
 2004 
 2005   *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
 2006      [Andrey Kulikov <amdeich@gmail.com>]
 2007 
 2008   *) Prevent malformed RFC3779 data triggering an assertion failure.
 2009      Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
 2010      and Rob Austein <sra@hactrn.net> for fixing it. (CVE-2011-4577)
 2011      [Rob Austein <sra@hactrn.net>]
 2012 
 2013   *) Improved PRNG seeding for VOS.
 2014      [Paul Green <Paul.Green@stratus.com>]
 2015 
 2016   *) Fix ssl_ciph.c set-up race.
 2017      [Adam Langley (Google)]
 2018 
 2019   *) Fix spurious failures in ecdsatest.c.
 2020      [Emilia Käsper (Google)]
 2021 
 2022   *) Fix the BIO_f_buffer() implementation (which was mixing different
 2023      interpretations of the '..._len' fields).
 2024      [Adam Langley (Google)]
 2025 
 2026   *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
 2027      BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
 2028      threads won't reuse the same blinding coefficients.
 2029 
 2030      This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
 2031      lock to call BN_BLINDING_invert_ex, and avoids one use of
 2032      BN_BLINDING_update for each BN_BLINDING structure (previously,
 2033      the last update always remained unused).
 2034      [Emilia Käsper (Google)]
 2035 
 2036   *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
 2037      [Bob Buckholz (Google)]
 2038 
 2039  Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
 2040 
 2041   *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
 2042      by initialising X509_STORE_CTX properly. (CVE-2011-3207)
 2043      [Kaspar Brand <ossl@velox.ch>]
 2044 
 2045   *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
 2046      for multi-threaded use of ECDH. (CVE-2011-3210)
 2047      [Adam Langley (Google)]
 2048 
 2049   *) Fix x509_name_ex_d2i memory leak on bad inputs.
 2050      [Bodo Moeller]
 2051 
 2052   *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
 2053      signature public key algorithm by using OID xref utilities instead.
 2054      Before this you could only use some ECC ciphersuites with SHA1 only.
 2055      [Steve Henson]
 2056 
 2057   *) Add protection against ECDSA timing attacks as mentioned in the paper
 2058      by Billy Bob Brumley and Nicola Tuveri, see:
 2059 
 2060 	http://eprint.iacr.org/2011/232.pdf
 2061 
 2062      [Billy Bob Brumley and Nicola Tuveri]
 2063 
 2064  Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
 2065 
 2066   *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
 2067      [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
 2068 
 2069   *) Fix bug in string printing code: if *any* escaping is enabled we must
 2070      escape the escape character (backslash) or the resulting string is
 2071      ambiguous.
 2072      [Steve Henson]
 2073 
 2074  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
 2075 
 2076   *) Disable code workaround for ancient and obsolete Netscape browsers
 2077      and servers: an attacker can use it in a ciphersuite downgrade attack.
 2078      Thanks to Martin Rex for discovering this bug. CVE-2010-4180
 2079      [Steve Henson]
 2080 
 2081   *) Fixed J-PAKE implementation error, originally discovered by
 2082      Sebastien Martini, further info and confirmation from Stefan
 2083      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
 2084      [Ben Laurie]
 2085 
 2086  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
 2087 
 2088   *) Fix extension code to avoid race conditions which can result in a buffer
 2089      overrun vulnerability: resumed sessions must not be modified as they can
 2090      be shared by multiple threads. CVE-2010-3864
 2091      [Steve Henson]
 2092 
 2093   *) Fix WIN32 build system to correctly link an ENGINE directory into
 2094      a DLL. 
 2095      [Steve Henson]
 2096 
 2097  Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
 2098 
 2099   *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
 2100      (CVE-2010-1633)
 2101      [Steve Henson, Peter-Michael Hager <hager@dortmund.net>]
 2102 
 2103  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
 2104 
 2105   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
 2106      context. The operation can be customised via the ctrl mechanism in
 2107      case ENGINEs want to include additional functionality.
 2108      [Steve Henson]
 2109 
 2110   *) Tolerate yet another broken PKCS#8 key format: private key value negative.
 2111      [Steve Henson]
 2112 
 2113   *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
 2114      output hashes compatible with older versions of OpenSSL.
 2115      [Willy Weisz <weisz@vcpc.univie.ac.at>]
 2116 
 2117   *) Fix compression algorithm handling: if resuming a session use the
 2118      compression algorithm of the resumed session instead of determining
 2119      it from client hello again. Don't allow server to change algorithm.
 2120      [Steve Henson]
 2121 
 2122   *) Add load_crls() function to apps tidying load_certs() too. Add option
 2123      to verify utility to allow additional CRLs to be included.
 2124      [Steve Henson]
 2125 
 2126   *) Update OCSP request code to permit adding custom headers to the request:
 2127      some responders need this.
 2128      [Steve Henson]
 2129 
 2130   *) The function EVP_PKEY_sign() returns <=0 on error: check return code
 2131      correctly.
 2132      [Julia Lawall <julia@diku.dk>]
 2133 
 2134   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
 2135      needlessly dereferenced structures, used obsolete functions and
 2136      didn't handle all updated verify codes correctly.
 2137      [Steve Henson]
 2138 
 2139   *) Disable MD2 in the default configuration.
 2140      [Steve Henson]
 2141 
 2142   *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
 2143      indicate the initial BIO being pushed or popped. This makes it possible
 2144      to determine whether the BIO is the one explicitly called or as a result
 2145      of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
 2146      it handles reference counts correctly and doesn't zero out the I/O bio
 2147      when it is not being explicitly popped. WARNING: applications which
 2148      included workarounds for the old buggy behaviour will need to be modified
 2149      or they could free up already freed BIOs.
 2150      [Steve Henson]
 2151 
 2152   *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
 2153      renaming to all platforms (within the 0.9.8 branch, this was
 2154      done conditionally on Netware platforms to avoid a name clash).
 2155      [Guenter <lists@gknw.net>]
 2156 
 2157   *) Add ECDHE and PSK support to DTLS.
 2158      [Michael Tuexen <tuexen@fh-muenster.de>]
 2159 
 2160   *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
 2161      be used on C++.
 2162      [Steve Henson]
 2163 
 2164   *) Add "missing" function EVP_MD_flags() (without this the only way to
 2165      retrieve a digest flags is by accessing the structure directly. Update
 2166      EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
 2167      or cipher is registered as in the "from" argument. Print out all
 2168      registered digests in the dgst usage message instead of manually 
 2169      attempting to work them out.
 2170      [Steve Henson]
 2171 
 2172   *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
 2173      this allows the use of compression and extensions. Change default cipher
 2174      string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
 2175      by default unless an application cipher string requests it.
 2176      [Steve Henson]
 2177 
 2178   *) Alter match criteria in PKCS12_parse(). It used to try to use local
 2179      key ids to find matching certificates and keys but some PKCS#12 files
 2180      don't follow the (somewhat unwritten) rules and this strategy fails.
 2181      Now just gather all certificates together and the first private key
 2182      then look for the first certificate that matches the key.
 2183      [Steve Henson]
 2184 
 2185   *) Support use of registered digest and cipher names for dgst and cipher
 2186      commands instead of having to add each one as a special case. So now
 2187      you can do:
 2188 
 2189         openssl sha256 foo
 2190 
 2191      as well as:
 2192 
 2193         openssl dgst -sha256 foo
 2194 
 2195      and this works for ENGINE based algorithms too.
 2196 
 2197      [Steve Henson]
 2198 
 2199   *) Update Gost ENGINE to support parameter files.
 2200      [Victor B. Wagner <vitus@cryptocom.ru>]
 2201 
 2202   *) Support GeneralizedTime in ca utility. 
 2203      [Oliver Martin <oliver@volatilevoid.net>, Steve Henson]
 2204 
 2205   *) Enhance the hash format used for certificate directory links. The new
 2206      form uses the canonical encoding (meaning equivalent names will work
 2207      even if they aren't identical) and uses SHA1 instead of MD5. This form
 2208      is incompatible with the older format and as a result c_rehash should
 2209      be used to rebuild symbolic links.
 2210      [Steve Henson]
 2211 
 2212   *) Make PKCS#8 the default write format for private keys, replacing the
 2213      traditional format. This form is standardised, more secure and doesn't
 2214      include an implicit MD5 dependency.
 2215      [Steve Henson]
 2216 
 2217   *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
 2218      committed to OpenSSL should pass this lot as a minimum.
 2219      [Steve Henson]
 2220 
 2221   *) Add session ticket override functionality for use by EAP-FAST.
 2222      [Jouni Malinen <j@w1.fi>]
 2223 
 2224   *) Modify HMAC functions to return a value. Since these can be implemented
 2225      in an ENGINE errors can occur.
 2226      [Steve Henson]
 2227 
 2228   *) Type-checked OBJ_bsearch_ex.
 2229      [Ben Laurie]
 2230 
 2231   *) Type-checked OBJ_bsearch. Also some constification necessitated
 2232      by type-checking.  Still to come: TXT_DB, bsearch(?),
 2233      OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
 2234      CONF_VALUE.
 2235      [Ben Laurie]
 2236 
 2237   *) New function OPENSSL_gmtime_adj() to add a specific number of days and
 2238      seconds to a tm structure directly, instead of going through OS
 2239      specific date routines. This avoids any issues with OS routines such
 2240      as the year 2038 bug. New *_adj() functions for ASN1 time structures
 2241      and X509_time_adj_ex() to cover the extended range. The existing
 2242      X509_time_adj() is still usable and will no longer have any date issues.
 2243      [Steve Henson]
 2244 
 2245   *) Delta CRL support. New use deltas option which will attempt to locate
 2246      and search any appropriate delta CRLs available.
 2247 
 2248      This work was sponsored by Google.
 2249      [Steve Henson]
 2250 
 2251   *) Support for CRLs partitioned by reason code. Reorganise CRL processing
 2252      code and add additional score elements. Validate alternate CRL paths
 2253      as part of the CRL checking and indicate a new error "CRL path validation
 2254      error" in this case. Applications wanting additional details can use
 2255      the verify callback and check the new "parent" field. If this is not
 2256      NULL CRL path validation is taking place. Existing applications wont
 2257      see this because it requires extended CRL support which is off by
 2258      default.
 2259 
 2260      This work was sponsored by Google.
 2261      [Steve Henson]
 2262 
 2263   *) Support for freshest CRL extension.
 2264 
 2265      This work was sponsored by Google.
 2266      [Steve Henson]
 2267 
 2268   *) Initial indirect CRL support. Currently only supported in the CRLs
 2269      passed directly and not via lookup. Process certificate issuer
 2270      CRL entry extension and lookup CRL entries by bother issuer name
 2271      and serial number. Check and process CRL issuer entry in IDP extension.
 2272 
 2273      This work was sponsored by Google.
 2274      [Steve Henson]
 2275 
 2276   *) Add support for distinct certificate and CRL paths. The CRL issuer
 2277      certificate is validated separately in this case. Only enabled if
 2278      an extended CRL support flag is set: this flag will enable additional
 2279      CRL functionality in future.
 2280 
 2281      This work was sponsored by Google.
 2282      [Steve Henson]
 2283 
 2284   *) Add support for policy mappings extension.
 2285 
 2286      This work was sponsored by Google.
 2287      [Steve Henson]
 2288 
 2289   *) Fixes to pathlength constraint, self issued certificate handling,
 2290      policy processing to align with RFC3280 and PKITS tests.
 2291 
 2292      This work was sponsored by Google.
 2293      [Steve Henson]
 2294 
 2295   *) Support for name constraints certificate extension. DN, email, DNS
 2296      and URI types are currently supported.
 2297 
 2298      This work was sponsored by Google.
 2299      [Steve Henson]
 2300 
 2301   *) To cater for systems that provide a pointer-based thread ID rather
 2302      than numeric, deprecate the current numeric thread ID mechanism and
 2303      replace it with a structure and associated callback type. This
 2304      mechanism allows a numeric "hash" to be extracted from a thread ID in
 2305      either case, and on platforms where pointers are larger than 'long',
 2306      mixing is done to help ensure the numeric 'hash' is usable even if it
 2307      can't be guaranteed unique. The default mechanism is to use "&errno"
 2308      as a pointer-based thread ID to distinguish between threads.
 2309 
 2310      Applications that want to provide their own thread IDs should now use
 2311      CRYPTO_THREADID_set_callback() to register a callback that will call
 2312      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
 2313 
 2314      Note that ERR_remove_state() is now deprecated, because it is tied
 2315      to the assumption that thread IDs are numeric.  ERR_remove_state(0)
 2316      to free the current thread's error state should be replaced by
 2317      ERR_remove_thread_state(NULL).
 2318 
 2319      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
 2320      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
 2321      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
 2322      application was previously providing a numeric thread callback that
 2323      was inappropriate for distinguishing threads, then uniqueness might
 2324      have been obtained with &errno that happened immediately in the
 2325      intermediate development versions of OpenSSL; this is no longer the
 2326      case, the numeric thread callback will now override the automatic use
 2327      of &errno.)
 2328      [Geoff Thorpe, with help from Bodo Moeller]
 2329 
 2330   *) Initial support for different CRL issuing certificates. This covers a
 2331      simple case where the self issued certificates in the chain exist and
 2332      the real CRL issuer is higher in the existing chain.
 2333 
 2334      This work was sponsored by Google.
 2335      [Steve Henson]
 2336 
 2337   *) Removed effectively defunct crypto/store from the build.
 2338      [Ben Laurie]
 2339 
 2340   *) Revamp of STACK to provide stronger type-checking. Still to come:
 2341      TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
 2342      ASN1_STRING, CONF_VALUE.
 2343      [Ben Laurie]
 2344 
 2345   *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
 2346      RAM on SSL connections.  This option can save about 34k per idle SSL.
 2347      [Nick Mathewson]
 2348 
 2349   *) Revamp of LHASH to provide stronger type-checking. Still to come:
 2350      STACK, TXT_DB, bsearch, qsort.
 2351      [Ben Laurie]
 2352 
 2353   *) Initial support for Cryptographic Message Syntax (aka CMS) based
 2354      on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
 2355      support for data, signedData, compressedData, digestedData and
 2356      encryptedData, envelopedData types included. Scripts to check against
 2357      RFC4134 examples draft and interop and consistency checks of many
 2358      content types and variants.
 2359      [Steve Henson]
 2360 
 2361   *) Add options to enc utility to support use of zlib compression BIO.
 2362      [Steve Henson]
 2363 
 2364   *) Extend mk1mf to support importing of options and assembly language
 2365      files from Configure script, currently only included in VC-WIN32.
 2366      The assembly language rules can now optionally generate the source
 2367      files from the associated perl scripts.
 2368      [Steve Henson]
 2369 
 2370   *) Implement remaining functionality needed to support GOST ciphersuites.
 2371      Interop testing has been performed using CryptoPro implementations.
 2372      [Victor B. Wagner <vitus@cryptocom.ru>]
 2373 
 2374   *) s390x assembler pack.
 2375      [Andy Polyakov]
 2376 
 2377   *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
 2378      "family."
 2379      [Andy Polyakov]
 2380 
 2381   *) Implement Opaque PRF Input TLS extension as specified in
 2382      draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
 2383      official specification yet and no extension type assignment by
 2384      IANA exists, this extension (for now) will have to be explicitly
 2385      enabled when building OpenSSL by providing the extension number
 2386      to use.  For example, specify an option
 2387 
 2388          -DTLSEXT_TYPE_opaque_prf_input=0x9527
 2389 
 2390      to the "config" or "Configure" script to enable the extension,
 2391      assuming extension number 0x9527 (which is a completely arbitrary
 2392      and unofficial assignment based on the MD5 hash of the Internet
 2393      Draft).  Note that by doing so, you potentially lose
 2394      interoperability with other TLS implementations since these might
 2395      be using the same extension number for other purposes.
 2396 
 2397      SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
 2398      opaque PRF input value to use in the handshake.  This will create
 2399      an interal copy of the length-'len' string at 'src', and will
 2400      return non-zero for success.
 2401 
 2402      To get more control and flexibility, provide a callback function
 2403      by using
 2404 
 2405           SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
 2406           SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
 2407 
 2408      where
 2409 
 2410           int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
 2411           void *arg;
 2412 
 2413      Callback function 'cb' will be called in handshakes, and is
 2414      expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
 2415      Argument 'arg' is for application purposes (the value as given to
 2416      SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
 2417      be provided to the callback function).  The callback function
 2418      has to return non-zero to report success: usually 1 to use opaque
 2419      PRF input just if possible, or 2 to enforce use of the opaque PRF
 2420      input.  In the latter case, the library will abort the handshake
 2421      if opaque PRF input is not successfully negotiated.
 2422 
 2423      Arguments 'peerinput' and 'len' given to the callback function
 2424      will always be NULL and 0 in the case of a client.  A server will
 2425      see the client's opaque PRF input through these variables if
 2426      available (NULL and 0 otherwise).  Note that if the server
 2427      provides an opaque PRF input, the length must be the same as the
 2428      length of the client's opaque PRF input.
 2429 
 2430      Note that the callback function will only be called when creating
 2431      a new session (session resumption can resume whatever was
 2432      previously negotiated), and will not be called in SSL 2.0
 2433      handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
 2434      SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
 2435      for applications that need to enforce opaque PRF input.
 2436 
 2437      [Bodo Moeller]
 2438 
 2439   *) Update ssl code to support digests other than SHA1+MD5 for handshake
 2440      MAC. 
 2441 
 2442      [Victor B. Wagner <vitus@cryptocom.ru>]
 2443 
 2444   *) Add RFC4507 support to OpenSSL. This includes the corrections in
 2445      RFC4507bis. The encrypted ticket format is an encrypted encoded
 2446      SSL_SESSION structure, that way new session features are automatically
 2447      supported.
 2448 
 2449      If a client application caches session in an SSL_SESSION structure
 2450      support is transparent because tickets are now stored in the encoded
 2451      SSL_SESSION.
 2452      
 2453      The SSL_CTX structure automatically generates keys for ticket
 2454      protection in servers so again support should be possible
 2455      with no application modification.
 2456 
 2457      If a client or server wishes to disable RFC4507 support then the option
 2458      SSL_OP_NO_TICKET can be set.
 2459 
 2460      Add a TLS extension debugging callback to allow the contents of any client
 2461      or server extensions to be examined.
 2462 
 2463      This work was sponsored by Google.
 2464      [Steve Henson]
 2465 
 2466   *) Final changes to avoid use of pointer pointer casts in OpenSSL.
 2467      OpenSSL should now compile cleanly on gcc 4.2
 2468      [Peter Hartley <pdh@utter.chaos.org.uk>, Steve Henson]
 2469 
 2470   *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
 2471      support including streaming MAC support: this is required for GOST
 2472      ciphersuite support.
 2473      [Victor B. Wagner <vitus@cryptocom.ru>, Steve Henson]
 2474 
 2475   *) Add option -stream to use PKCS#7 streaming in smime utility. New
 2476      function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
 2477      to output in BER and PEM format.
 2478      [Steve Henson]
 2479 
 2480   *) Experimental support for use of HMAC via EVP_PKEY interface. This
 2481      allows HMAC to be handled via the EVP_DigestSign*() interface. The
 2482      EVP_PKEY "key" in this case is the HMAC key, potentially allowing
 2483      ENGINE support for HMAC keys which are unextractable. New -mac and
 2484      -macopt options to dgst utility.
 2485      [Steve Henson]
 2486 
 2487   *) New option -sigopt to dgst utility. Update dgst to use
 2488      EVP_Digest{Sign,Verify}*. These two changes make it possible to use
 2489      alternative signing paramaters such as X9.31 or PSS in the dgst 
 2490      utility.
 2491      [Steve Henson]
 2492 
 2493   *) Change ssl_cipher_apply_rule(), the internal function that does
 2494      the work each time a ciphersuite string requests enabling
 2495      ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
 2496      removing ("!foo+bar") a class of ciphersuites: Now it maintains
 2497      the order of disabled ciphersuites such that those ciphersuites
 2498      that most recently went from enabled to disabled not only stay
 2499      in order with respect to each other, but also have higher priority
 2500      than other disabled ciphersuites the next time ciphersuites are
 2501      enabled again.
 2502 
 2503      This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
 2504      the same ciphersuites as with "HIGH" alone, but in a specific
 2505      order where the PSK ciphersuites come first (since they are the
 2506      most recently disabled ciphersuites when "HIGH" is parsed).
 2507 
 2508      Also, change ssl_create_cipher_list() (using this new
 2509      funcionality) such that between otherwise identical
 2510      cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
 2511      the default order.
 2512      [Bodo Moeller]
 2513 
 2514   *) Change ssl_create_cipher_list() so that it automatically
 2515      arranges the ciphersuites in reasonable order before starting
 2516      to process the rule string.  Thus, the definition for "DEFAULT"
 2517      (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
 2518      remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
 2519      This makes it much easier to arrive at a reasonable default order
 2520      in applications for which anonymous ciphers are OK (meaning
 2521      that you can't actually use DEFAULT).
 2522      [Bodo Moeller; suggested by Victor Duchovni]
 2523 
 2524   *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
 2525      processing) into multiple integers instead of setting
 2526      "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
 2527      "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
 2528      (These masks as well as the individual bit definitions are hidden
 2529      away into the non-exported interface ssl/ssl_locl.h, so this
 2530      change to the definition of the SSL_CIPHER structure shouldn't
 2531      affect applications.)  This give us more bits for each of these
 2532      categories, so there is no longer a need to coagulate AES128 and
 2533      AES256 into a single algorithm bit, and to coagulate Camellia128
 2534      and Camellia256 into a single algorithm bit, which has led to all
 2535      kinds of kludges.
 2536 
 2537      Thus, among other things, the kludge introduced in 0.9.7m and
 2538      0.9.8e for masking out AES256 independently of AES128 or masking
 2539      out Camellia256 independently of AES256 is not needed here in 0.9.9.
 2540 
 2541      With the change, we also introduce new ciphersuite aliases that
 2542      so far were missing: "AES128", "AES256", "CAMELLIA128", and
 2543      "CAMELLIA256".
 2544      [Bodo Moeller]
 2545 
 2546   *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
 2547      Use the leftmost N bytes of the signature input if the input is
 2548      larger than the prime q (with N being the size in bytes of q).
 2549      [Nils Larsch]
 2550 
 2551   *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
 2552      it yet and it is largely untested.
 2553      [Steve Henson]
 2554 
 2555   *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
 2556      [Nils Larsch]
 2557 
 2558   *) Initial incomplete changes to avoid need for function casts in OpenSSL
 2559      some compilers (gcc 4.2 and later) reject their use. Safestack is
 2560      reimplemented.  Update ASN1 to avoid use of legacy functions. 
 2561      [Steve Henson]
 2562 
 2563   *) Win32/64 targets are linked with Winsock2.
 2564      [Andy Polyakov]
 2565 
 2566   *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
 2567      to external functions. This can be used to increase CRL handling 
 2568      efficiency especially when CRLs are very large by (for example) storing
 2569      the CRL revoked certificates in a database.
 2570      [Steve Henson]
 2571 
 2572   *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
 2573      new CRLs added to a directory can be used. New command line option
 2574      -verify_return_error to s_client and s_server. This causes real errors
 2575      to be returned by the verify callback instead of carrying on no matter
 2576      what. This reflects the way a "real world" verify callback would behave.
 2577      [Steve Henson]
 2578 
 2579   *) GOST engine, supporting several GOST algorithms and public key formats.
 2580      Kindly donated by Cryptocom.
 2581      [Cryptocom]
 2582 
 2583   *) Partial support for Issuing Distribution Point CRL extension. CRLs
 2584      partitioned by DP are handled but no indirect CRL or reason partitioning
 2585      (yet). Complete overhaul of CRL handling: now the most suitable CRL is
 2586      selected via a scoring technique which handles IDP and AKID in CRLs.
 2587      [Steve Henson]
 2588 
 2589   *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
 2590      will ultimately be used for all verify operations: this will remove the
 2591      X509_STORE dependency on certificate verification and allow alternative
 2592      lookup methods.  X509_STORE based implementations of these two callbacks.
 2593      [Steve Henson]
 2594 
 2595   *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
 2596      Modify get_crl() to find a valid (unexpired) CRL if possible.
 2597      [Steve Henson]
 2598 
 2599   *) New function X509_CRL_match() to check if two CRLs are identical. Normally
 2600      this would be called X509_CRL_cmp() but that name is already used by
 2601      a function that just compares CRL issuer names. Cache several CRL 
 2602      extensions in X509_CRL structure and cache CRLDP in X509.
 2603      [Steve Henson]
 2604 
 2605   *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
 2606      this maps equivalent X509_NAME structures into a consistent structure.
 2607      Name comparison can then be performed rapidly using memcmp().
 2608      [Steve Henson]
 2609 
 2610   *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
 2611      utility.
 2612      [Steve Henson]
 2613 
 2614   *) Allow digests to supply their own micalg string for S/MIME type using
 2615      the ctrl EVP_MD_CTRL_MICALG.
 2616      [Steve Henson]
 2617 
 2618   *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
 2619      EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
 2620      ctrl. It can then customise the structure before and/or after signing
 2621      if necessary.
 2622      [Steve Henson]
 2623 
 2624   *) New function OBJ_add_sigid() to allow application defined signature OIDs
 2625      to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
 2626      to free up any added signature OIDs.
 2627      [Steve Henson]
 2628 
 2629   *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
 2630      EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
 2631      digest and cipher tables. New options added to openssl utility:
 2632      list-message-digest-algorithms and list-cipher-algorithms.
 2633      [Steve Henson]
 2634 
 2635   *) Change the array representation of binary polynomials: the list
 2636      of degrees of non-zero coefficients is now terminated with -1.
 2637      Previously it was terminated with 0, which was also part of the
 2638      value; thus, the array representation was not applicable to
 2639      polynomials where t^0 has coefficient zero.  This change makes
 2640      the array representation useful in a more general context.
 2641      [Douglas Stebila]
 2642 
 2643   *) Various modifications and fixes to SSL/TLS cipher string
 2644      handling.  For ECC, the code now distinguishes between fixed ECDH
 2645      with RSA certificates on the one hand and with ECDSA certificates
 2646      on the other hand, since these are separate ciphersuites.  The
 2647      unused code for Fortezza ciphersuites has been removed.
 2648 
 2649      For consistency with EDH, ephemeral ECDH is now called "EECDH"
 2650      (not "ECDHE").  For consistency with the code for DH
 2651      certificates, use of ECDH certificates is now considered ECDH
 2652      authentication, not RSA or ECDSA authentication (the latter is
 2653      merely the CA's signing algorithm and not actively used in the
 2654      protocol).
 2655 
 2656      The temporary ciphersuite alias "ECCdraft" is no longer
 2657      available, and ECC ciphersuites are no longer excluded from "ALL"
 2658      and "DEFAULT".  The following aliases now exist for RFC 4492
 2659      ciphersuites, most of these by analogy with the DH case:
 2660 
 2661          kECDHr   - ECDH cert, signed with RSA
 2662          kECDHe   - ECDH cert, signed with ECDSA
 2663          kECDH    - ECDH cert (signed with either RSA or ECDSA)
 2664          kEECDH   - ephemeral ECDH
 2665          ECDH     - ECDH cert or ephemeral ECDH
 2666 
 2667          aECDH    - ECDH cert
 2668          aECDSA   - ECDSA cert
 2669          ECDSA    - ECDSA cert
 2670 
 2671          AECDH    - anonymous ECDH
 2672          EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
 2673 
 2674      [Bodo Moeller]
 2675 
 2676   *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
 2677      Use correct micalg parameters depending on digest(s) in signed message.
 2678      [Steve Henson]
 2679 
 2680   *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
 2681      an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
 2682      [Steve Henson]
 2683 
 2684   *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
 2685      an engine to register a method. Add ENGINE lookups for methods and
 2686      functional reference processing.
 2687      [Steve Henson]
 2688 
 2689   *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
 2690      EVP_{Sign,Verify}* which allow an application to customise the signature
 2691      process.
 2692      [Steve Henson]
 2693 
 2694   *) New -resign option to smime utility. This adds one or more signers
 2695      to an existing PKCS#7 signedData structure. Also -md option to use an
 2696      alternative message digest algorithm for signing.
 2697      [Steve Henson]
 2698 
 2699   *) Tidy up PKCS#7 routines and add new functions to make it easier to
 2700      create PKCS7 structures containing multiple signers. Update smime
 2701      application to support multiple signers.
 2702      [Steve Henson]
 2703 
 2704   *) New -macalg option to pkcs12 utility to allow setting of an alternative
 2705      digest MAC.
 2706      [Steve Henson]
 2707 
 2708   *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
 2709      Reorganize PBE internals to lookup from a static table using NIDs,
 2710      add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
 2711      EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
 2712      PRF which will be automatically used with PBES2.
 2713      [Steve Henson]
 2714 
 2715   *) Replace the algorithm specific calls to generate keys in "req" with the
 2716      new API.
 2717      [Steve Henson]
 2718 
 2719   *) Update PKCS#7 enveloped data routines to use new API. This is now
 2720      supported by any public key method supporting the encrypt operation. A
 2721      ctrl is added to allow the public key algorithm to examine or modify
 2722      the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
 2723      a no op.
 2724      [Steve Henson]
 2725 
 2726   *) Add a ctrl to asn1 method to allow a public key algorithm to express
 2727      a default digest type to use. In most cases this will be SHA1 but some
 2728      algorithms (such as GOST) need to specify an alternative digest. The
 2729      return value indicates how strong the prefernce is 1 means optional and
 2730      2 is mandatory (that is it is the only supported type). Modify
 2731      ASN1_item_sign() to accept a NULL digest argument to indicate it should
 2732      use the default md. Update openssl utilities to use the default digest
 2733      type for signing if it is not explicitly indicated.
 2734      [Steve Henson]
 2735 
 2736   *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
 2737      EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
 2738      signing method from the key type. This effectively removes the link
 2739      between digests and public key types.
 2740      [Steve Henson]
 2741 
 2742   *) Add an OID cross reference table and utility functions. Its purpose is to
 2743      translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
 2744      rsaEncryption. This will allow some of the algorithm specific hackery
 2745      needed to use the correct OID to be removed. 
 2746      [Steve Henson]
 2747 
 2748   *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
 2749      structures for PKCS7_sign(). They are now set up by the relevant public
 2750      key ASN1 method.
 2751      [Steve Henson]
 2752 
 2753   *) Add provisional EC pkey method with support for ECDSA and ECDH.
 2754      [Steve Henson]
 2755 
 2756   *) Add support for key derivation (agreement) in the API, DH method and
 2757      pkeyutl.
 2758      [Steve Henson]
 2759 
 2760   *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
 2761      public and private key formats. As a side effect these add additional 
 2762      command line functionality not previously available: DSA signatures can be
 2763      generated and verified using pkeyutl and DH key support and generation in
 2764      pkey, genpkey.
 2765      [Steve Henson]
 2766 
 2767   *) BeOS support.
 2768      [Oliver Tappe <zooey@hirschkaefer.de>]
 2769 
 2770   *) New make target "install_html_docs" installs HTML renditions of the
 2771      manual pages.
 2772      [Oliver Tappe <zooey@hirschkaefer.de>]
 2773 
 2774   *) New utility "genpkey" this is analagous to "genrsa" etc except it can
 2775      generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
 2776      support key and parameter generation and add initial key generation
 2777      functionality for RSA.
 2778      [Steve Henson]
 2779 
 2780   *) Add functions for main EVP_PKEY_method operations. The undocumented
 2781      functions EVP_PKEY_{encrypt,decrypt} have been renamed to
 2782      EVP_PKEY_{encrypt,decrypt}_old. 
 2783      [Steve Henson]
 2784 
 2785   *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
 2786      key API, doesn't do much yet.
 2787      [Steve Henson]
 2788 
 2789   *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
 2790      public key algorithms. New option to openssl utility:
 2791      "list-public-key-algorithms" to print out info.
 2792      [Steve Henson]
 2793 
 2794   *) Implement the Supported Elliptic Curves Extension for
 2795      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
 2796      [Douglas Stebila]
 2797 
 2798   *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
 2799      EVP_CIPHER structures to avoid later problems in EVP_cleanup().
 2800      [Steve Henson]
 2801 
 2802   *) New utilities pkey and pkeyparam. These are similar to algorithm specific
 2803      utilities such as rsa, dsa, dsaparam etc except they process any key
 2804      type.
 2805      [Steve Henson]
 2806 
 2807   *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
 2808      functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
 2809      EVP_PKEY_print_param() to print public key data from an EVP_PKEY
 2810      structure.
 2811      [Steve Henson]
 2812 
 2813   *) Initial support for pluggable public key ASN1.
 2814      De-spaghettify the public key ASN1 handling. Move public and private
 2815      key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
 2816      algorithm specific handling to a single module within the relevant
 2817      algorithm directory. Add functions to allow (near) opaque processing
 2818      of public and private key structures.
 2819      [Steve Henson]
 2820 
 2821   *) Implement the Supported Point Formats Extension for
 2822      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
 2823      [Douglas Stebila]
 2824 
 2825   *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
 2826      for the psk identity [hint] and the psk callback functions to the
 2827      SSL_SESSION, SSL and SSL_CTX structure.
 2828      
 2829      New ciphersuites:
 2830          PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
 2831          PSK-AES256-CBC-SHA
 2832  
 2833      New functions:
 2834          SSL_CTX_use_psk_identity_hint
 2835          SSL_get_psk_identity_hint
 2836          SSL_get_psk_identity
 2837          SSL_use_psk_identity_hint
 2838 
 2839      [Mika Kousa and Pasi Eronen of Nokia Corporation]
 2840 
 2841   *) Add RFC 3161 compliant time stamp request creation, response generation
 2842      and response verification functionality.
 2843      [Zoltán Glózik <zglozik@opentsa.org>, The OpenTSA Project]
 2844 
 2845   *) Add initial support for TLS extensions, specifically for the server_name
 2846      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
 2847      have new members for a host name.  The SSL data structure has an
 2848      additional member SSL_CTX *initial_ctx so that new sessions can be
 2849      stored in that context to allow for session resumption, even after the
 2850      SSL has been switched to a new SSL_CTX in reaction to a client's
 2851      server_name extension.
 2852 
 2853      New functions (subject to change):
 2854 
 2855          SSL_get_servername()
 2856          SSL_get_servername_type()
 2857          SSL_set_SSL_CTX()
 2858 
 2859      New CTRL codes and macros (subject to change):
 2860 
 2861          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
 2862                                  - SSL_CTX_set_tlsext_servername_callback()
 2863          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
 2864                                       - SSL_CTX_set_tlsext_servername_arg()
 2865          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
 2866 
 2867      openssl s_client has a new '-servername ...' option.
 2868 
 2869      openssl s_server has new options '-servername_host ...', '-cert2 ...',
 2870      '-key2 ...', '-servername_fatal' (subject to change).  This allows
 2871      testing the HostName extension for a specific single host name ('-cert'
 2872      and '-key' remain fallbacks for handshakes without HostName
 2873      negotiation).  If the unrecogninzed_name alert has to be sent, this by
 2874      default is a warning; it becomes fatal with the '-servername_fatal'
 2875      option.
 2876 
 2877      [Peter Sylvester,  Remy Allais, Christophe Renou]
 2878 
 2879   *) Whirlpool hash implementation is added.
 2880      [Andy Polyakov]
 2881 
 2882   *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
 2883      bn(64,32). Because of instruction set limitations it doesn't have
 2884      any negative impact on performance. This was done mostly in order
 2885      to make it possible to share assembler modules, such as bn_mul_mont
 2886      implementations, between 32- and 64-bit builds without hassle.
 2887      [Andy Polyakov]
 2888 
 2889   *) Move code previously exiled into file crypto/ec/ec2_smpt.c
 2890      to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
 2891      macro.
 2892      [Bodo Moeller]
 2893 
 2894   *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
 2895      dedicated Montgomery multiplication procedure, is introduced.
 2896      BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
 2897      "64-bit" performance on certain 32-bit targets.
 2898      [Andy Polyakov]
 2899 
 2900   *) New option SSL_OP_NO_COMP to disable use of compression selectively
 2901      in SSL structures. New SSL ctrl to set maximum send fragment size. 
 2902      Save memory by seeting the I/O buffer sizes dynamically instead of
 2903      using the maximum available value.
 2904      [Steve Henson]
 2905 
 2906   *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
 2907      in addition to the text details.
 2908      [Bodo Moeller]
 2909 
 2910   *) Very, very preliminary EXPERIMENTAL support for printing of general
 2911      ASN1 structures. This currently produces rather ugly output and doesn't
 2912      handle several customised structures at all.
 2913      [Steve Henson]
 2914 
 2915   *) Integrated support for PVK file format and some related formats such
 2916      as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
 2917      these in the 'rsa' and 'dsa' utilities.
 2918      [Steve Henson]
 2919 
 2920   *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
 2921      [Steve Henson]
 2922 
 2923   *) Remove the ancient ASN1_METHOD code. This was only ever used in one
 2924      place for the (very old) "NETSCAPE" format certificates which are now
 2925      handled using new ASN1 code equivalents.
 2926      [Steve Henson]
 2927 
 2928   *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
 2929      pointer and make the SSL_METHOD parameter in SSL_CTX_new,
 2930      SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
 2931      [Nils Larsch]
 2932 
 2933   *) Modify CRL distribution points extension code to print out previously
 2934      unsupported fields. Enhance extension setting code to allow setting of
 2935      all fields.
 2936      [Steve Henson]
 2937 
 2938   *) Add print and set support for Issuing Distribution Point CRL extension.
 2939      [Steve Henson]
 2940 
 2941   *) Change 'Configure' script to enable Camellia by default.
 2942      [NTT]
 2943 
 2944  Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
 2945 
 2946   *) When rejecting SSL/TLS records due to an incorrect version number, never
 2947      update s->server with a new major version number.  As of
 2948      - OpenSSL 0.9.8m if 'short' is a 16-bit type,
 2949      - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
 2950      the previous behavior could result in a read attempt at NULL when
 2951      receiving specific incorrect SSL/TLS records once record payload
 2952      protection is active.  (CVE-2010-0740)
 2953      [Bodo Moeller, Adam Langley <agl@chromium.org>]
 2954 
 2955   *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
 2956      could be crashed if the relevant tables were not present (e.g. chrooted).
 2957      [Tomas Hoger <thoger@redhat.com>]
 2958 
 2959  Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
 2960 
 2961   *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
 2962      [Martin Olsson, Neel Mehta]
 2963 
 2964   *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
 2965      accommodate for stack sorting, always a write lock!).
 2966      [Bodo Moeller]
 2967 
 2968   *) On some versions of WIN32 Heap32Next is very slow. This can cause
 2969      excessive delays in the RAND_poll(): over a minute. As a workaround
 2970      include a time check in the inner Heap32Next loop too.
 2971      [Steve Henson]
 2972 
 2973   *) The code that handled flushing of data in SSL/TLS originally used the
 2974      BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
 2975      the problem outlined in PR#1949. The fix suggested there however can
 2976      trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
 2977      of Apache). So instead simplify the code to flush unconditionally.
 2978      This should be fine since flushing with no data to flush is a no op.
 2979      [Steve Henson]
 2980 
 2981   *) Handle TLS versions 2.0 and later properly and correctly use the
 2982      highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
 2983      off ancient servers have a habit of sticking around for a while...
 2984      [Steve Henson]
 2985 
 2986   *) Modify compression code so it frees up structures without using the
 2987      ex_data callbacks. This works around a problem where some applications
 2988      call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
 2989      restarting) then use compression (e.g. SSL with compression) later.
 2990      This results in significant per-connection memory leaks and
 2991      has caused some security issues including CVE-2008-1678 and
 2992      CVE-2009-4355.
 2993      [Steve Henson]
 2994 
 2995   *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
 2996      change when encrypting or decrypting.
 2997      [Bodo Moeller]
 2998 
 2999   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
 3000      connect and renegotiate with servers which do not support RI.
 3001      Until RI is more widely deployed this option is enabled by default.
 3002      [Steve Henson]
 3003 
 3004   *) Add "missing" ssl ctrls to clear options and mode.
 3005      [Steve Henson]
 3006 
 3007   *) If client attempts to renegotiate and doesn't support RI respond with
 3008      a no_renegotiation alert as required by RFC5746.  Some renegotiating
 3009      TLS clients will continue a connection gracefully when they receive
 3010      the alert. Unfortunately OpenSSL mishandled this alert and would hang
 3011      waiting for a server hello which it will never receive. Now we treat a
 3012      received no_renegotiation alert as a fatal error. This is because
 3013      applications requesting a renegotiation might well expect it to succeed
 3014      and would have no code in place to handle the server denying it so the
 3015      only safe thing to do is to terminate the connection.
 3016      [Steve Henson]
 3017 
 3018   *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
 3019      peer supports secure renegotiation and 0 otherwise. Print out peer
 3020      renegotiation support in s_client/s_server.
 3021      [Steve Henson]
 3022 
 3023   *) Replace the highly broken and deprecated SPKAC certification method with
 3024      the updated NID creation version. This should correctly handle UTF8.
 3025      [Steve Henson]
 3026 
 3027   *) Implement RFC5746. Re-enable renegotiation but require the extension
 3028      as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
 3029      turns out to be a bad idea. It has been replaced by
 3030      SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
 3031      SSL_CTX_set_options(). This is really not recommended unless you
 3032      know what you are doing.
 3033      [Eric Rescorla <ekr@networkresonance.com>, Ben Laurie, Steve Henson]
 3034 
 3035   *) Fixes to stateless session resumption handling. Use initial_ctx when
 3036      issuing and attempting to decrypt tickets in case it has changed during
 3037      servername handling. Use a non-zero length session ID when attempting
 3038      stateless session resumption: this makes it possible to determine if
 3039      a resumption has occurred immediately after receiving server hello
 3040      (several places in OpenSSL subtly assume this) instead of later in
 3041      the handshake.
 3042      [Steve Henson]
 3043 
 3044   *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
 3045      CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
 3046      fixes for a few places where the return code is not checked
 3047      correctly.
 3048      [Julia Lawall <julia@diku.dk>]
 3049 
 3050   *) Add --strict-warnings option to Configure script to include devteam
 3051      warnings in other configurations.
 3052      [Steve Henson]
 3053 
 3054   *) Add support for --libdir option and LIBDIR variable in makefiles. This
 3055      makes it possible to install openssl libraries in locations which
 3056      have names other than "lib", for example "/usr/lib64" which some
 3057      systems need.
 3058      [Steve Henson, based on patch from Jeremy Utley]
 3059 
 3060   *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
 3061      X690 8.9.12 and can produce some misleading textual output of OIDs.
 3062      [Steve Henson, reported by Dan Kaminsky]
 3063 
 3064   *) Delete MD2 from algorithm tables. This follows the recommendation in
 3065      several standards that it is not used in new applications due to
 3066      several cryptographic weaknesses. For binary compatibility reasons
 3067      the MD2 API is still compiled in by default.
 3068      [Steve Henson]
 3069 
 3070   *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
 3071      and restored.
 3072      [Steve Henson]
 3073 
 3074   *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
 3075      OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
 3076      clash.
 3077      [Guenter <lists@gknw.net>]
 3078 
 3079   *) Fix the server certificate chain building code to use X509_verify_cert(),
 3080      it used to have an ad-hoc builder which was unable to cope with anything
 3081      other than a simple chain.
 3082      [David Woodhouse <dwmw2@infradead.org>, Steve Henson]
 3083 
 3084   *) Don't check self signed certificate signatures in X509_verify_cert()
 3085      by default (a flag can override this): it just wastes time without
 3086      adding any security. As a useful side effect self signed root CAs
 3087      with non-FIPS digests are now usable in FIPS mode.
 3088      [Steve Henson]
 3089 
 3090   *) In dtls1_process_out_of_seq_message() the check if the current message
 3091      is already buffered was missing. For every new message was memory
 3092      allocated, allowing an attacker to perform an denial of service attack
 3093      with sending out of seq handshake messages until there is no memory
 3094      left. Additionally every future messege was buffered, even if the
 3095      sequence number made no sense and would be part of another handshake.
 3096      So only messages with sequence numbers less than 10 in advance will be
 3097      buffered.  (CVE-2009-1378)
 3098      [Robin Seggelmann, discovered by Daniel Mentz] 	
 3099 
 3100   *) Records are buffered if they arrive with a future epoch to be
 3101      processed after finishing the corresponding handshake. There is
 3102      currently no limitation to this buffer allowing an attacker to perform
 3103      a DOS attack with sending records with future epochs until there is no
 3104      memory left. This patch adds the pqueue_size() function to detemine
 3105      the size of a buffer and limits the record buffer to 100 entries.
 3106      (CVE-2009-1377)
 3107      [Robin Seggelmann, discovered by Daniel Mentz] 	
 3108 
 3109   *) Keep a copy of frag->msg_header.frag_len so it can be used after the
 3110      parent structure is freed.  (CVE-2009-1379)
 3111      [Daniel Mentz] 	
 3112 
 3113   *) Handle non-blocking I/O properly in SSL_shutdown() call.
 3114      [Darryl Miles <darryl-mailinglists@netbauds.net>]
 3115 
 3116   *) Add 2.5.4.* OIDs
 3117      [Ilya O. <vrghost@gmail.com>]
 3118 
 3119  Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
 3120 
 3121   *) Disable renegotiation completely - this fixes a severe security
 3122      problem (CVE-2009-3555) at the cost of breaking all
 3123      renegotiation. Renegotiation can be re-enabled by setting
 3124      SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION in s3->flags at
 3125      run-time. This is really not recommended unless you know what
 3126      you're doing.
 3127      [Ben Laurie]
 3128 
 3129  Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
 3130 
 3131   *) Don't set val to NULL when freeing up structures, it is freed up by
 3132      underlying code. If sizeof(void *) > sizeof(long) this can result in
 3133      zeroing past the valid field. (CVE-2009-0789)
 3134      [Paolo Ganci <Paolo.Ganci@AdNovum.CH>]
 3135 
 3136   *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
 3137      checked correctly. This would allow some invalid signed attributes to
 3138      appear to verify correctly. (CVE-2009-0591)
 3139      [Ivan Nestlerode <inestlerode@us.ibm.com>]
 3140 
 3141   *) Reject UniversalString and BMPString types with invalid lengths. This
 3142      prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
 3143      a legal length. (CVE-2009-0590)
 3144      [Steve Henson]
 3145 
 3146   *) Set S/MIME signing as the default purpose rather than setting it 
 3147      unconditionally. This allows applications to override it at the store
 3148      level.
 3149      [Steve Henson]
 3150 
 3151   *) Permit restricted recursion of ASN1 strings. This is needed in practice
 3152      to handle some structures.
 3153      [Steve Henson]
 3154 
 3155   *) Improve efficiency of mem_gets: don't search whole buffer each time
 3156      for a '\n'
 3157      [Jeremy Shapiro <jnshapir@us.ibm.com>]
 3158 
 3159   *) New -hex option for openssl rand.
 3160      [Matthieu Herrb]
 3161 
 3162   *) Print out UTF8String and NumericString when parsing ASN1.
 3163      [Steve Henson]
 3164 
 3165   *) Support NumericString type for name components.
 3166      [Steve Henson]
 3167 
 3168   *) Allow CC in the environment to override the automatically chosen
 3169      compiler. Note that nothing is done to ensure flags work with the
 3170      chosen compiler.
 3171      [Ben Laurie]
 3172 
 3173  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
 3174 
 3175   *) Properly check EVP_VerifyFinal() and similar return values
 3176      (CVE-2008-5077).
 3177      [Ben Laurie, Bodo Moeller, Google Security Team]
 3178 
 3179   *) Enable TLS extensions by default.
 3180      [Ben Laurie]
 3181 
 3182   *) Allow the CHIL engine to be loaded, whether the application is
 3183      multithreaded or not. (This does not release the developer from the
 3184      obligation to set up the dynamic locking callbacks.)
 3185      [Sander Temme <sander@temme.net>]
 3186 
 3187   *) Use correct exit code if there is an error in dgst command.
 3188      [Steve Henson; problem pointed out by Roland Dirlewanger]
 3189 
 3190   *) Tweak Configure so that you need to say "experimental-jpake" to enable
 3191      JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
 3192      [Bodo Moeller]
 3193 
 3194   *) Add experimental JPAKE support, including demo authentication in
 3195      s_client and s_server.
 3196      [Ben Laurie]
 3197 
 3198   *) Set the comparison function in v3_addr_canonize().
 3199      [Rob Austein <sra@hactrn.net>]
 3200 
 3201   *) Add support for XMPP STARTTLS in s_client.
 3202      [Philip Paeps <philip@freebsd.org>]
 3203 
 3204   *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
 3205      to ensure that even with this option, only ciphersuites in the
 3206      server's preference list will be accepted.  (Note that the option
 3207      applies only when resuming a session, so the earlier behavior was
 3208      just about the algorithm choice for symmetric cryptography.)
 3209      [Bodo Moeller]
 3210 
 3211  Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
 3212 
 3213   *) Fix NULL pointer dereference if a DTLS server received
 3214      ChangeCipherSpec as first record (CVE-2009-1386).
 3215      [PR #1679]
 3216 
 3217   *) Fix a state transitition in s3_srvr.c and d1_srvr.c
 3218      (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
 3219      [Nagendra Modadugu]
 3220 
 3221   *) The fix in 0.9.8c that supposedly got rid of unsafe
 3222      double-checked locking was incomplete for RSA blinding,
 3223      addressing just one layer of what turns out to have been
 3224      doubly unsafe triple-checked locking.
 3225 
 3226      So now fix this for real by retiring the MONT_HELPER macro
 3227      in crypto/rsa/rsa_eay.c.
 3228 
 3229      [Bodo Moeller; problem pointed out by Marius Schilder]
 3230 
 3231   *) Various precautionary measures:
 3232 
 3233      - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
 3234 
 3235      - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
 3236        (NB: This would require knowledge of the secret session ticket key
 3237        to exploit, in which case you'd be SOL either way.)
 3238 
 3239      - Change bn_nist.c so that it will properly handle input BIGNUMs
 3240        outside the expected range.
 3241 
 3242      - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
 3243        builds.
 3244 
 3245      [Neel Mehta, Bodo Moeller]
 3246 
 3247   *) Allow engines to be "soft loaded" - i.e. optionally don't die if
 3248      the load fails. Useful for distros.
 3249      [Ben Laurie and the FreeBSD team]
 3250 
 3251   *) Add support for Local Machine Keyset attribute in PKCS#12 files.
 3252      [Steve Henson]
 3253 
 3254   *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
 3255      [Huang Ying]
 3256 
 3257   *) Expand ENGINE to support engine supplied SSL client certificate functions.
 3258 
 3259      This work was sponsored by Logica.
 3260      [Steve Henson]
 3261 
 3262   *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
 3263      keystores. Support for SSL/TLS client authentication too.
 3264      Not compiled unless enable-capieng specified to Configure.
 3265 
 3266      This work was sponsored by Logica.
 3267      [Steve Henson]
 3268 
 3269   *) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
 3270      ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
 3271      attribute creation routines such as certifcate requests and PKCS#12
 3272      files.
 3273      [Steve Henson]
 3274 
 3275  Changes between 0.9.8g and 0.9.8h  [28 May 2008]
 3276 
 3277   *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
 3278      handshake which could lead to a cilent crash as found using the
 3279      Codenomicon TLS test suite (CVE-2008-1672) 
 3280      [Steve Henson, Mark Cox]
 3281 
 3282   *) Fix double free in TLS server name extensions which could lead to
 3283      a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
 3284      [Joe Orton]
 3285 
 3286   *) Clear error queue in SSL_CTX_use_certificate_chain_file()
 3287 
 3288      Clear the error queue to ensure that error entries left from
 3289      older function calls do not interfere with the correct operation.
 3290      [Lutz Jaenicke, Erik de Castro Lopo]
 3291 
 3292   *) Remove root CA certificates of commercial CAs:
 3293 
 3294      The OpenSSL project does not recommend any specific CA and does not
 3295      have any policy with respect to including or excluding any CA.
 3296      Therefore it does not make any sense to ship an arbitrary selection
 3297      of root CA certificates with the OpenSSL software.
 3298      [Lutz Jaenicke]
 3299 
 3300   *) RSA OAEP patches to fix two separate invalid memory reads.
 3301      The first one involves inputs when 'lzero' is greater than
 3302      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
 3303      before the beginning of from). The second one involves inputs where
 3304      the 'db' section contains nothing but zeroes (there is a one-byte
 3305      invalid read after the end of 'db').
 3306      [Ivan Nestlerode <inestlerode@us.ibm.com>]
 3307 
 3308   *) Partial backport from 0.9.9-dev:
 3309 
 3310      Introduce bn_mul_mont (dedicated Montgomery multiplication
 3311      procedure) as a candidate for BIGNUM assembler implementation.
 3312      While 0.9.9-dev uses assembler for various architectures, only
 3313      x86_64 is available by default here in the 0.9.8 branch, and
 3314      32-bit x86 is available through a compile-time setting.
 3315 
 3316      To try the 32-bit x86 assembler implementation, use Configure
 3317      option "enable-montasm" (which exists only for this backport).
 3318 
 3319      As "enable-montasm" for 32-bit x86 disclaims code stability
 3320      anyway, in this constellation we activate additional code
 3321      backported from 0.9.9-dev for further performance improvements,
 3322      namely BN_from_montgomery_word.  (To enable this otherwise,
 3323      e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
 3324 
 3325      [Andy Polyakov (backport partially by Bodo Moeller)]
 3326 
 3327   *) Add TLS session ticket callback. This allows an application to set
 3328      TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
 3329      values. This is useful for key rollover for example where several key
 3330      sets may exist with different names.
 3331      [Steve Henson]
 3332 
 3333   *) Reverse ENGINE-internal logic for caching default ENGINE handles.
 3334      This was broken until now in 0.9.8 releases, such that the only way
 3335      a registered ENGINE could be used (assuming it initialises
 3336      successfully on the host) was to explicitly set it as the default
 3337      for the relevant algorithms. This is in contradiction with 0.9.7
 3338      behaviour and the documentation. With this fix, when an ENGINE is
 3339      registered into a given algorithm's table of implementations, the
 3340      'uptodate' flag is reset so that auto-discovery will be used next
 3341      time a new context for that algorithm attempts to select an
 3342      implementation.
 3343      [Ian Lister (tweaked by Geoff Thorpe)]
 3344 
 3345   *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
 3346      implemention in the following ways:
 3347 
 3348      Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
 3349      hard coded.
 3350 
 3351      Lack of BER streaming support means one pass streaming processing is
 3352      only supported if data is detached: setting the streaming flag is
 3353      ignored for embedded content.
 3354 
 3355      CMS support is disabled by default and must be explicitly enabled
 3356      with the enable-cms configuration option.
 3357      [Steve Henson]
 3358 
 3359   *) Update the GMP engine glue to do direct copies between BIGNUM and
 3360      mpz_t when openssl and GMP use the same limb size. Otherwise the
 3361      existing "conversion via a text string export" trick is still used.
 3362      [Paul Sheer <paulsheer@gmail.com>]
 3363 
 3364   *) Zlib compression BIO. This is a filter BIO which compressed and
 3365      uncompresses any data passed through it.
 3366      [Steve Henson]
 3367 
 3368   *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
 3369      RFC3394 compatible AES key wrapping.
 3370      [Steve Henson]
 3371 
 3372   *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
 3373      sets string data without copying. X509_ALGOR_set0() and
 3374      X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
 3375      data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
 3376      from an X509_ATTRIBUTE structure optionally checking it occurs only
 3377      once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
 3378      data.
 3379      [Steve Henson]
 3380 
 3381   *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
 3382      to get the expected BN_FLG_CONSTTIME behavior.
 3383      [Bodo Moeller (Google)]
 3384   
 3385   *) Netware support:
 3386 
 3387      - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
 3388      - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
 3389      - added some more tests to do_tests.pl
 3390      - fixed RunningProcess usage so that it works with newer LIBC NDKs too
 3391      - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
 3392      - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
 3393        netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
 3394      - various changes to netware.pl to enable gcc-cross builds on Win32
 3395        platform
 3396      - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
 3397      - various changes to fix missing prototype warnings
 3398      - fixed x86nasm.pl to create correct asm files for NASM COFF output
 3399      - added AES, WHIRLPOOL and CPUID assembler code to build files
 3400      - added missing AES assembler make rules to mk1mf.pl
 3401      - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
 3402      [Guenter Knauf <eflash@gmx.net>]
 3403 
 3404   *) Implement certificate status request TLS extension defined in RFC3546.
 3405      A client can set the appropriate parameters and receive the encoded
 3406      OCSP response via a callback. A server can query the supplied parameters
 3407      and set the encoded OCSP response in the callback. Add simplified examples
 3408      to s_client and s_server.
 3409      [Steve Henson]
 3410 
 3411  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
 3412 
 3413   *) Fix various bugs:
 3414      + Binary incompatibility of ssl_ctx_st structure
 3415      + DTLS interoperation with non-compliant servers
 3416      + Don't call get_session_cb() without proposed session
 3417      + Fix ia64 assembler code
 3418      [Andy Polyakov, Steve Henson]
 3419 
 3420  Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
 3421 
 3422   *) DTLS Handshake overhaul. There were longstanding issues with
 3423      OpenSSL DTLS implementation, which were making it impossible for
 3424      RFC 4347 compliant client to communicate with OpenSSL server.
 3425      Unfortunately just fixing these incompatibilities would "cut off"
 3426      pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
 3427      server keeps tolerating non RFC compliant syntax. The opposite is
 3428      not true, 0.9.8f client can not communicate with earlier server.
 3429      This update even addresses CVE-2007-4995.
 3430      [Andy Polyakov]
 3431 
 3432   *) Changes to avoid need for function casts in OpenSSL: some compilers
 3433      (gcc 4.2 and later) reject their use.
 3434      [Kurt Roeckx <kurt@roeckx.be>, Peter Hartley <pdh@utter.chaos.org.uk>,
 3435       Steve Henson]
 3436   
 3437   *) Add RFC4507 support to OpenSSL. This includes the corrections in
 3438      RFC4507bis. The encrypted ticket format is an encrypted encoded
 3439      SSL_SESSION structure, that way new session features are automatically
 3440      supported.
 3441 
 3442      If a client application caches session in an SSL_SESSION structure
 3443      support is transparent because tickets are now stored in the encoded
 3444      SSL_SESSION.
 3445      
 3446      The SSL_CTX structure automatically generates keys for ticket
 3447      protection in servers so again support should be possible
 3448      with no application modification.
 3449 
 3450      If a client or server wishes to disable RFC4507 support then the option
 3451      SSL_OP_NO_TICKET can be set.
 3452 
 3453      Add a TLS extension debugging callback to allow the contents of any client
 3454      or server extensions to be examined.
 3455 
 3456      This work was sponsored by Google.
 3457      [Steve Henson]
 3458 
 3459   *) Add initial support for TLS extensions, specifically for the server_name
 3460      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
 3461      have new members for a host name.  The SSL data structure has an
 3462      additional member SSL_CTX *initial_ctx so that new sessions can be
 3463      stored in that context to allow for session resumption, even after the
 3464      SSL has been switched to a new SSL_CTX in reaction to a client's
 3465      server_name extension.
 3466 
 3467      New functions (subject to change):
 3468 
 3469          SSL_get_servername()
 3470          SSL_get_servername_type()
 3471          SSL_set_SSL_CTX()
 3472 
 3473      New CTRL codes and macros (subject to change):
 3474 
 3475          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
 3476                                  - SSL_CTX_set_tlsext_servername_callback()
 3477          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
 3478                                       - SSL_CTX_set_tlsext_servername_arg()
 3479          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
 3480 
 3481      openssl s_client has a new '-servername ...' option.
 3482 
 3483      openssl s_server has new options '-servername_host ...', '-cert2 ...',
 3484      '-key2 ...', '-servername_fatal' (subject to change).  This allows
 3485      testing the HostName extension for a specific single host name ('-cert'
 3486      and '-key' remain fallbacks for handshakes without HostName
 3487      negotiation).  If the unrecogninzed_name alert has to be sent, this by
 3488      default is a warning; it becomes fatal with the '-servername_fatal'
 3489      option.
 3490 
 3491      [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
 3492 
 3493   *) Add AES and SSE2 assembly language support to VC++ build.
 3494      [Steve Henson]
 3495 
 3496   *) Mitigate attack on final subtraction in Montgomery reduction.
 3497      [Andy Polyakov]
 3498 
 3499   *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
 3500      (which previously caused an internal error).
 3501      [Bodo Moeller]
 3502 
 3503   *) Squeeze another 10% out of IGE mode when in != out.
 3504      [Ben Laurie]
 3505 
 3506   *) AES IGE mode speedup.
 3507      [Dean Gaudet (Google)]
 3508 
 3509   *) Add the Korean symmetric 128-bit cipher SEED (see
 3510      http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
 3511      add SEED ciphersuites from RFC 4162:
 3512 
 3513         TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
 3514         TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"
 3515         TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"
 3516         TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
 3517 
 3518      To minimize changes between patchlevels in the OpenSSL 0.9.8
 3519      series, SEED remains excluded from compilation unless OpenSSL
 3520      is configured with 'enable-seed'.
 3521      [KISA, Bodo Moeller]
 3522 
 3523   *) Mitigate branch prediction attacks, which can be practical if a
 3524      single processor is shared, allowing a spy process to extract
 3525      information.  For detailed background information, see
 3526      http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
 3527      J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
 3528      and Necessary Software Countermeasures").  The core of the change
 3529      are new versions BN_div_no_branch() and
 3530      BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
 3531      respectively, which are slower, but avoid the security-relevant
 3532      conditional branches.  These are automatically called by BN_div()
 3533      and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
 3534      of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
 3535      remove a conditional branch.
 3536 
 3537      BN_FLG_CONSTTIME is the new name for the previous
 3538      BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
 3539      modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
 3540      in the exponent causes BN_mod_exp_mont() to use the alternative
 3541      implementation in BN_mod_exp_mont_consttime().)  The old name
 3542      remains as a deprecated alias.
 3543 
 3544      Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
 3545      RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
 3546      constant-time implementations for more than just exponentiation.
 3547      Here too the old name is kept as a deprecated alias.
 3548 
 3549      BN_BLINDING_new() will now use BN_dup() for the modulus so that
 3550      the BN_BLINDING structure gets an independent copy of the
 3551      modulus.  This means that the previous "BIGNUM *m" argument to
 3552      BN_BLINDING_new() and to BN_BLINDING_create_param() now
 3553      essentially becomes "const BIGNUM *m", although we can't actually
 3554      change this in the header file before 0.9.9.  It allows
 3555      RSA_setup_blinding() to use BN_with_flags() on the modulus to
 3556      enable BN_FLG_CONSTTIME.
 3557 
 3558      [Matthew D Wood (Intel Corp)]
 3559 
 3560   *) In the SSL/TLS server implementation, be strict about session ID
 3561      context matching (which matters if an application uses a single
 3562      external cache for different purposes).  Previously,
 3563      out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
 3564      set.  This did ensure strict client verification, but meant that,
 3565      with applications using a single external cache for quite
 3566      different requirements, clients could circumvent ciphersuite
 3567      restrictions for a given session ID context by starting a session
 3568      in a different context.
 3569      [Bodo Moeller]
 3570 
 3571   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
 3572      a ciphersuite string such as "DEFAULT:RSA" cannot enable
 3573      authentication-only ciphersuites.
 3574      [Bodo Moeller]
 3575 
 3576   *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
 3577      not complete and could lead to a possible single byte overflow
 3578      (CVE-2007-5135) [Ben Laurie]
 3579 
 3580  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
 3581 
 3582   *) Since AES128 and AES256 (and similarly Camellia128 and
 3583      Camellia256) share a single mask bit in the logic of
 3584      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
 3585      kludge to work properly if AES128 is available and AES256 isn't
 3586      (or if Camellia128 is available and Camellia256 isn't).
 3587      [Victor Duchovni]
 3588 
 3589   *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
 3590      (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
 3591      When a point or a seed is encoded in a BIT STRING, we need to
 3592      prevent the removal of trailing zero bits to get the proper DER
 3593      encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
 3594      of a NamedBitList, for which trailing 0 bits need to be removed.)
 3595      [Bodo Moeller]
 3596 
 3597   *) Have SSL/TLS server implementation tolerate "mismatched" record
 3598      protocol version while receiving ClientHello even if the
 3599      ClientHello is fragmented.  (The server can't insist on the
 3600      particular protocol version it has chosen before the ServerHello
 3601      message has informed the client about his choice.)
 3602      [Bodo Moeller]
 3603 
 3604   *) Add RFC 3779 support.
 3605      [Rob Austein for ARIN, Ben Laurie]
 3606 
 3607   *) Load error codes if they are not already present instead of using a
 3608      static variable. This allows them to be cleanly unloaded and reloaded.
 3609      Improve header file function name parsing.
 3610      [Steve Henson]
 3611 
 3612   *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
 3613      or CAPABILITY handshake as required by RFCs.
 3614      [Goetz Babin-Ebell]
 3615 
 3616  Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
 3617 
 3618   *) Introduce limits to prevent malicious keys being able to
 3619      cause a denial of service.  (CVE-2006-2940)
 3620      [Steve Henson, Bodo Moeller]
 3621 
 3622   *) Fix ASN.1 parsing of certain invalid structures that can result
 3623      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
 3624 
 3625   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
 3626      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
 3627 
 3628   *) Fix SSL client code which could crash if connecting to a
 3629      malicious SSLv2 server.  (CVE-2006-4343)
 3630      [Tavis Ormandy and Will Drewry, Google Security Team]
 3631 
 3632   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
 3633      match only those.  Before that, "AES256-SHA" would be interpreted
 3634      as a pattern and match "AES128-SHA" too (since AES128-SHA got
 3635      the same strength classification in 0.9.7h) as we currently only
 3636      have a single AES bit in the ciphersuite description bitmap.
 3637      That change, however, also applied to ciphersuite strings such as
 3638      "RC4-MD5" that intentionally matched multiple ciphersuites --
 3639      namely, SSL 2.0 ciphersuites in addition to the more common ones
 3640      from SSL 3.0/TLS 1.0.
 3641 
 3642      So we change the selection algorithm again: Naming an explicit
 3643      ciphersuite selects this one ciphersuite, and any other similar
 3644      ciphersuite (same bitmap) from *other* protocol versions.
 3645      Thus, "RC4-MD5" again will properly select both the SSL 2.0
 3646      ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
 3647 
 3648      Since SSL 2.0 does not have any ciphersuites for which the
 3649      128/256 bit distinction would be relevant, this works for now.
 3650      The proper fix will be to use different bits for AES128 and
 3651      AES256, which would have avoided the problems from the beginning;
 3652      however, bits are scarce, so we can only do this in a new release
 3653      (not just a patchlevel) when we can change the SSL_CIPHER
 3654      definition to split the single 'unsigned long mask' bitmap into
 3655      multiple values to extend the available space.
 3656 
 3657      [Bodo Moeller]
 3658 
 3659  Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
 3660 
 3661   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
 3662      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
 3663 
 3664   *) Add AES IGE and biIGE modes.
 3665      [Ben Laurie]
 3666 
 3667   *) Change the Unix randomness entropy gathering to use poll() when
 3668      possible instead of select(), since the latter has some
 3669      undesirable limitations.
 3670      [Darryl Miles via Richard Levitte and Bodo Moeller]
 3671 
 3672   *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
 3673      treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
 3674      cannot be implicitly activated as part of, e.g., the "AES" alias.
 3675      However, please upgrade to OpenSSL 0.9.9[-dev] for
 3676      non-experimental use of the ECC ciphersuites to get TLS extension
 3677      support, which is required for curve and point format negotiation
 3678      to avoid potential handshake problems.
 3679      [Bodo Moeller]
 3680 
 3681   *) Disable rogue ciphersuites:
 3682 
 3683       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
 3684       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
 3685       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
 3686 
 3687      The latter two were purportedly from
 3688      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
 3689      appear there.
 3690 
 3691      Also deactivate the remaining ciphersuites from
 3692      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
 3693      unofficial, and the ID has long expired.
 3694      [Bodo Moeller]
 3695 
 3696   *) Fix RSA blinding Heisenbug (problems sometimes occured on
 3697      dual-core machines) and other potential thread-safety issues.
 3698      [Bodo Moeller]
 3699 
 3700   *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
 3701      versions), which is now available for royalty-free use
 3702      (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
 3703      Also, add Camellia TLS ciphersuites from RFC 4132.
 3704 
 3705      To minimize changes between patchlevels in the OpenSSL 0.9.8
 3706      series, Camellia remains excluded from compilation unless OpenSSL
 3707      is configured with 'enable-camellia'.
 3708      [NTT]
 3709 
 3710   *) Disable the padding bug check when compression is in use. The padding
 3711      bug check assumes the first packet is of even length, this is not
 3712      necessarily true if compresssion is enabled and can result in false
 3713      positives causing handshake failure. The actual bug test is ancient
 3714      code so it is hoped that implementations will either have fixed it by
 3715      now or any which still have the bug do not support compression.
 3716      [Steve Henson]
 3717 
 3718  Changes between 0.9.8a and 0.9.8b  [04 May 2006]
 3719 
 3720   *) When applying a cipher rule check to see if string match is an explicit
 3721      cipher suite and only match that one cipher suite if it is.
 3722      [Steve Henson]
 3723 
 3724   *) Link in manifests for VC++ if needed.
 3725      [Austin Ziegler <halostatue@gmail.com>]
 3726 
 3727   *) Update support for ECC-based TLS ciphersuites according to
 3728      draft-ietf-tls-ecc-12.txt with proposed changes (but without
 3729      TLS extensions, which are supported starting with the 0.9.9
 3730      branch, not in the OpenSSL 0.9.8 branch).
 3731      [Douglas Stebila]
 3732 
 3733   *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
 3734      opaque EVP_CIPHER_CTX handling.
 3735      [Steve Henson]
 3736 
 3737   *) Fixes and enhancements to zlib compression code. We now only use
 3738      "zlib1.dll" and use the default __cdecl calling convention on Win32
 3739      to conform with the standards mentioned here:
 3740            http://www.zlib.net/DLL_FAQ.txt
 3741      Static zlib linking now works on Windows and the new --with-zlib-include
 3742      --with-zlib-lib options to Configure can be used to supply the location
 3743      of the headers and library. Gracefully handle case where zlib library
 3744      can't be loaded.
 3745      [Steve Henson]
 3746 
 3747   *) Several fixes and enhancements to the OID generation code. The old code
 3748      sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
 3749      handle numbers larger than ULONG_MAX, truncated printing and had a
 3750      non standard OBJ_obj2txt() behaviour.
 3751      [Steve Henson]
 3752 
 3753   *) Add support for building of engines under engine/ as shared libraries
 3754      under VC++ build system.
 3755      [Steve Henson]
 3756 
 3757   *) Corrected the numerous bugs in the Win32 path splitter in DSO.
 3758      Hopefully, we will not see any false combination of paths any more.
 3759      [Richard Levitte]
 3760 
 3761  Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
 3762 
 3763   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
 3764      (part of SSL_OP_ALL).  This option used to disable the
 3765      countermeasure against man-in-the-middle protocol-version
 3766      rollback in the SSL 2.0 server implementation, which is a bad
 3767      idea.  (CVE-2005-2969)
 3768 
 3769      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
 3770      for Information Security, National Institute of Advanced Industrial
 3771      Science and Technology [AIST], Japan)]
 3772 
 3773   *) Add two function to clear and return the verify parameter flags.
 3774      [Steve Henson]
 3775 
 3776   *) Keep cipherlists sorted in the source instead of sorting them at
 3777      runtime, thus removing the need for a lock.
 3778      [Nils Larsch]
 3779 
 3780   *) Avoid some small subgroup attacks in Diffie-Hellman.
 3781      [Nick Mathewson and Ben Laurie]
 3782 
 3783   *) Add functions for well-known primes.
 3784      [Nick Mathewson]
 3785 
 3786   *) Extended Windows CE support.
 3787      [Satoshi Nakamura and Andy Polyakov]
 3788 
 3789   *) Initialize SSL_METHOD structures at compile time instead of during
 3790      runtime, thus removing the need for a lock.
 3791      [Steve Henson]
 3792 
 3793   *) Make PKCS7_decrypt() work even if no certificate is supplied by
 3794      attempting to decrypt each encrypted key in turn. Add support to
 3795      smime utility.
 3796      [Steve Henson]
 3797 
 3798  Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
 3799 
 3800   [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
 3801   OpenSSL 0.9.8.]
 3802 
 3803   *) Add libcrypto.pc and libssl.pc for those who feel they need them.
 3804      [Richard Levitte]
 3805 
 3806   *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
 3807      key into the same file any more.
 3808      [Richard Levitte]
 3809 
 3810   *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
 3811      [Andy Polyakov]
 3812 
 3813   *) Add -utf8 command line and config file option to 'ca'.
 3814      [Stefan <stf@udoma.org]
 3815 
 3816   *) Removed the macro des_crypt(), as it seems to conflict with some
 3817      libraries.  Use DES_crypt().
 3818      [Richard Levitte]
 3819 
 3820   *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
 3821      involves renaming the source and generated shared-libs for
 3822      both. The engines will accept the corrected or legacy ids
 3823      ('ncipher' and '4758_cca' respectively) when binding. NB,
 3824      this only applies when building 'shared'.
 3825      [Corinna Vinschen <vinschen@redhat.com> and Geoff Thorpe]
 3826 
 3827   *) Add attribute functions to EVP_PKEY structure. Modify
 3828      PKCS12_create() to recognize a CSP name attribute and
 3829      use it. Make -CSP option work again in pkcs12 utility.
 3830      [Steve Henson]
 3831 
 3832   *) Add new functionality to the bn blinding code:
 3833      - automatic re-creation of the BN_BLINDING parameters after
 3834        a fixed number of uses (currently 32)
 3835      - add new function for parameter creation
 3836      - introduce flags to control the update behaviour of the
 3837        BN_BLINDING parameters
 3838      - hide BN_BLINDING structure
 3839      Add a second BN_BLINDING slot to the RSA structure to improve
 3840      performance when a single RSA object is shared among several
 3841      threads.
 3842      [Nils Larsch]
 3843 
 3844   *) Add support for DTLS.
 3845      [Nagendra Modadugu <nagendra@cs.stanford.edu> and Ben Laurie]
 3846 
 3847   *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
 3848      to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
 3849      [Walter Goulet]
 3850 
 3851   *) Remove buggy and incompletet DH cert support from
 3852      ssl/ssl_rsa.c and ssl/s3_both.c
 3853      [Nils Larsch]
 3854 
 3855   *) Use SHA-1 instead of MD5 as the default digest algorithm for
 3856      the apps/openssl applications.
 3857      [Nils Larsch]
 3858 
 3859   *) Compile clean with "-Wall -Wmissing-prototypes
 3860      -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
 3861      DEBUG_SAFESTACK must also be set.
 3862      [Ben Laurie]
 3863 
 3864   *) Change ./Configure so that certain algorithms can be disabled by default.
 3865      The new counterpiece to "no-xxx" is "enable-xxx".
 3866 
 3867      The patented RC5 and MDC2 algorithms will now be disabled unless
 3868      "enable-rc5" and "enable-mdc2", respectively, are specified.
 3869 
 3870      (IDEA remains enabled despite being patented.  This is because IDEA
 3871      is frequently required for interoperability, and there is no license
 3872      fee for non-commercial use.  As before, "no-idea" can be used to
 3873      avoid this algorithm.)
 3874 
 3875      [Bodo Moeller]
 3876 
 3877   *) Add processing of proxy certificates (see RFC 3820).  This work was
 3878      sponsored by KTH (The Royal Institute of Technology in Stockholm) and
 3879      EGEE (Enabling Grids for E-science in Europe).
 3880      [Richard Levitte]
 3881 
 3882   *) RC4 performance overhaul on modern architectures/implementations, such
 3883      as Intel P4, IA-64 and AMD64.
 3884      [Andy Polyakov]
 3885 
 3886   *) New utility extract-section.pl. This can be used specify an alternative
 3887      section number in a pod file instead of having to treat each file as
 3888      a separate case in Makefile. This can be done by adding two lines to the
 3889      pod file:
 3890 
 3891      =for comment openssl_section:XXX
 3892 
 3893      The blank line is mandatory.
 3894 
 3895      [Steve Henson]
 3896 
 3897   *) New arguments -certform, -keyform and -pass for s_client and s_server
 3898      to allow alternative format key and certificate files and passphrase
 3899      sources.
 3900      [Steve Henson]
 3901 
 3902   *) New structure X509_VERIFY_PARAM which combines current verify parameters,
 3903      update associated structures and add various utility functions.
 3904 
 3905      Add new policy related verify parameters, include policy checking in 
 3906      standard verify code. Enhance 'smime' application with extra parameters
 3907      to support policy checking and print out.
 3908      [Steve Henson]
 3909 
 3910   *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
 3911      Nehemiah processors. These extensions support AES encryption in hardware
 3912      as well as RNG (though RNG support is currently disabled).
 3913      [Michal Ludvig <michal@logix.cz>, with help from Andy Polyakov]
 3914 
 3915   *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
 3916      [Geoff Thorpe]
 3917 
 3918   *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
 3919      [Andy Polyakov and a number of other people]
 3920 
 3921   *) Improved PowerPC platform support. Most notably BIGNUM assembler
 3922      implementation contributed by IBM.
 3923      [Suresh Chari, Peter Waltenberg, Andy Polyakov]
 3924 
 3925   *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
 3926      exponent rather than 'unsigned long'. There is a corresponding change to
 3927      the new 'rsa_keygen' element of the RSA_METHOD structure.
 3928      [Jelte Jansen, Geoff Thorpe]
 3929 
 3930   *) Functionality for creating the initial serial number file is now
 3931      moved from CA.pl to the 'ca' utility with a new option -create_serial.
 3932 
 3933      (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
 3934      number file to 1, which is bound to cause problems.  To avoid
 3935      the problems while respecting compatibility between different 0.9.7
 3936      patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
 3937      CA.pl for serial number initialization.  With the new release 0.9.8,
 3938      we can fix the problem directly in the 'ca' utility.)
 3939      [Steve Henson]
 3940 
 3941   *) Reduced header interdepencies by declaring more opaque objects in
 3942      ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
 3943      give fewer recursive includes, which could break lazy source code - so
 3944      this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
 3945      developers should define this symbol when building and using openssl to
 3946      ensure they track the recommended behaviour, interfaces, [etc], but
 3947      backwards-compatible behaviour prevails when this isn't defined.
 3948      [Geoff Thorpe]
 3949 
 3950   *) New function X509_POLICY_NODE_print() which prints out policy nodes.
 3951      [Steve Henson]
 3952 
 3953   *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
 3954      This will generate a random key of the appropriate length based on the 
 3955      cipher context. The EVP_CIPHER can provide its own random key generation
 3956      routine to support keys of a specific form. This is used in the des and 
 3957      3des routines to generate a key of the correct parity. Update S/MIME
 3958      code to use new functions and hence generate correct parity DES keys.
 3959      Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
 3960      valid (weak or incorrect parity).
 3961      [Steve Henson]
 3962 
 3963   *) Add a local set of CRLs that can be used by X509_verify_cert() as well
 3964      as looking them up. This is useful when the verified structure may contain
 3965      CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
 3966      present unless the new PKCS7_NO_CRL flag is asserted.
 3967      [Steve Henson]
 3968 
 3969   *) Extend ASN1 oid configuration module. It now additionally accepts the
 3970      syntax:
 3971 
 3972      shortName = some long name, 1.2.3.4
 3973      [Steve Henson]
 3974 
 3975   *) Reimplemented the BN_CTX implementation. There is now no more static
 3976      limitation on the number of variables it can handle nor the depth of the
 3977      "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
 3978      information can now expand as required, and rather than having a single
 3979      static array of bignums, BN_CTX now uses a linked-list of such arrays
 3980      allowing it to expand on demand whilst maintaining the usefulness of
 3981      BN_CTX's "bundling".
 3982      [Geoff Thorpe]
 3983 
 3984   *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
 3985      to allow all RSA operations to function using a single BN_CTX.
 3986      [Geoff Thorpe]
 3987 
 3988   *) Preliminary support for certificate policy evaluation and checking. This
 3989      is initially intended to pass the tests outlined in "Conformance Testing
 3990      of Relying Party Client Certificate Path Processing Logic" v1.07.
 3991      [Steve Henson]
 3992 
 3993   *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
 3994      remained unused and not that useful. A variety of other little bignum
 3995      tweaks and fixes have also been made continuing on from the audit (see
 3996      below).
 3997      [Geoff Thorpe]
 3998 
 3999   *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
 4000      associated ASN1, EVP and SSL functions and old ASN1 macros.
 4001      [Richard Levitte]
 4002 
 4003   *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
 4004      and this should never fail. So the return value from the use of
 4005      BN_set_word() (which can fail due to needless expansion) is now deprecated;
 4006      if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
 4007      [Geoff Thorpe]
 4008 
 4009   *) BN_CTX_get() should return zero-valued bignums, providing the same
 4010      initialised value as BN_new().
 4011      [Geoff Thorpe, suggested by Ulf Möller]
 4012 
 4013   *) Support for inhibitAnyPolicy certificate extension.
 4014      [Steve Henson]
 4015 
 4016   *) An audit of the BIGNUM code is underway, for which debugging code is
 4017      enabled when BN_DEBUG is defined. This makes stricter enforcements on what
 4018      is considered valid when processing BIGNUMs, and causes execution to
 4019      assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
 4020      further steps are taken to deliberately pollute unused data in BIGNUM
 4021      structures to try and expose faulty code further on. For now, openssl will
 4022      (in its default mode of operation) continue to tolerate the inconsistent
 4023      forms that it has tolerated in the past, but authors and packagers should
 4024      consider trying openssl and their own applications when compiled with
 4025      these debugging symbols defined. It will help highlight potential bugs in
 4026      their own code, and will improve the test coverage for OpenSSL itself. At
 4027      some point, these tighter rules will become openssl's default to improve
 4028      maintainability, though the assert()s and other overheads will remain only
 4029      in debugging configurations. See bn.h for more details.
 4030      [Geoff Thorpe, Nils Larsch, Ulf Möller]
 4031 
 4032   *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
 4033      that can only be obtained through BN_CTX_new() (which implicitly
 4034      initialises it). The presence of this function only made it possible
 4035      to overwrite an existing structure (and cause memory leaks).
 4036      [Geoff Thorpe]
 4037 
 4038   *) Because of the callback-based approach for implementing LHASH as a
 4039      template type, lh_insert() adds opaque objects to hash-tables and
 4040      lh_doall() or lh_doall_arg() are typically used with a destructor callback
 4041      to clean up those corresponding objects before destroying the hash table
 4042      (and losing the object pointers). So some over-zealous constifications in
 4043      LHASH have been relaxed so that lh_insert() does not take (nor store) the
 4044      objects as "const" and the lh_doall[_arg] callback wrappers are not
 4045      prototyped to have "const" restrictions on the object pointers they are
 4046      given (and so aren't required to cast them away any more).
 4047      [Geoff Thorpe]
 4048 
 4049   *) The tmdiff.h API was so ugly and minimal that our own timing utility
 4050      (speed) prefers to use its own implementation. The two implementations
 4051      haven't been consolidated as yet (volunteers?) but the tmdiff API has had
 4052      its object type properly exposed (MS_TM) instead of casting to/from "char
 4053      *". This may still change yet if someone realises MS_TM and "ms_time_***"
 4054      aren't necessarily the greatest nomenclatures - but this is what was used
 4055      internally to the implementation so I've used that for now.
 4056      [Geoff Thorpe]
 4057 
 4058   *) Ensure that deprecated functions do not get compiled when
 4059      OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
 4060      the self-tests were still using deprecated key-generation functions so
 4061      these have been updated also.
 4062      [Geoff Thorpe]
 4063 
 4064   *) Reorganise PKCS#7 code to separate the digest location functionality
 4065      into PKCS7_find_digest(), digest addtion into PKCS7_bio_add_digest().
 4066      New function PKCS7_set_digest() to set the digest type for PKCS#7
 4067      digestedData type. Add additional code to correctly generate the
 4068      digestedData type and add support for this type in PKCS7 initialization
 4069      functions.
 4070      [Steve Henson]
 4071 
 4072   *) New function PKCS7_set0_type_other() this initializes a PKCS7 
 4073      structure of type "other".
 4074      [Steve Henson]
 4075 
 4076   *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
 4077      sure the loop does correctly stop and breaking ("division by zero")
 4078      modulus operations are not performed. The (pre-generated) prime
 4079      table crypto/bn/bn_prime.h was already correct, but it could not be
 4080      re-generated on some platforms because of the "division by zero"
 4081      situation in the script.
 4082      [Ralf S. Engelschall]
 4083 
 4084   *) Update support for ECC-based TLS ciphersuites according to
 4085      draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
 4086      SHA-1 now is only used for "small" curves (where the
 4087      representation of a field element takes up to 24 bytes); for
 4088      larger curves, the field element resulting from ECDH is directly
 4089      used as premaster secret.
 4090      [Douglas Stebila (Sun Microsystems Laboratories)]
 4091 
 4092   *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
 4093      curve secp160r1 to the tests.
 4094      [Douglas Stebila (Sun Microsystems Laboratories)]
 4095 
 4096   *) Add the possibility to load symbols globally with DSO.
 4097      [Götz Babin-Ebell <babin-ebell@trustcenter.de> via Richard Levitte]
 4098 
 4099   *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
 4100      control of the error stack.
 4101      [Richard Levitte]
 4102 
 4103   *) Add support for STORE in ENGINE.
 4104      [Richard Levitte]
 4105 
 4106   *) Add the STORE type.  The intention is to provide a common interface
 4107      to certificate and key stores, be they simple file-based stores, or
 4108      HSM-type store, or LDAP stores, or...
 4109      NOTE: The code is currently UNTESTED and isn't really used anywhere.
 4110      [Richard Levitte]
 4111 
 4112   *) Add a generic structure called OPENSSL_ITEM.  This can be used to
 4113      pass a list of arguments to any function as well as provide a way
 4114      for a function to pass data back to the caller.
 4115      [Richard Levitte]
 4116 
 4117   *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
 4118      works like BUF_strdup() but can be used to duplicate a portion of
 4119      a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
 4120      a memory area.
 4121      [Richard Levitte]
 4122 
 4123   *) Add the function sk_find_ex() which works like sk_find(), but will
 4124      return an index to an element even if an exact match couldn't be
 4125      found.  The index is guaranteed to point at the element where the
 4126      searched-for key would be inserted to preserve sorting order.
 4127      [Richard Levitte]
 4128 
 4129   *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
 4130      takes an extra flags argument for optional functionality.  Currently,
 4131      the following flags are defined:
 4132 
 4133 	OBJ_BSEARCH_VALUE_ON_NOMATCH
 4134 	This one gets OBJ_bsearch_ex() to return a pointer to the first
 4135 	element where the comparing function returns a negative or zero
 4136 	number.
 4137 
 4138 	OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
 4139 	This one gets OBJ_bsearch_ex() to return a pointer to the first
 4140 	element where the comparing function returns zero.  This is useful
 4141 	if there are more than one element where the comparing function
 4142 	returns zero.
 4143      [Richard Levitte]
 4144 
 4145   *) Make it possible to create self-signed certificates with 'openssl ca'
 4146      in such a way that the self-signed certificate becomes part of the
 4147      CA database and uses the same mechanisms for serial number generation
 4148      as all other certificate signing.  The new flag '-selfsign' enables
 4149      this functionality.  Adapt CA.sh and CA.pl.in.
 4150      [Richard Levitte]
 4151 
 4152   *) Add functionality to check the public key of a certificate request
 4153      against a given private.  This is useful to check that a certificate
 4154      request can be signed by that key (self-signing).
 4155      [Richard Levitte]
 4156 
 4157   *) Make it possible to have multiple active certificates with the same
 4158      subject in the CA index file.  This is done only if the keyword
 4159      'unique_subject' is set to 'no' in the main CA section (default
 4160      if 'CA_default') of the configuration file.  The value is saved
 4161      with the database itself in a separate index attribute file,
 4162      named like the index file with '.attr' appended to the name.
 4163      [Richard Levitte]
 4164 
 4165   *) Generate muti valued AVAs using '+' notation in config files for
 4166      req and dirName.
 4167      [Steve Henson]
 4168 
 4169   *) Support for nameConstraints certificate extension.
 4170      [Steve Henson]
 4171 
 4172   *) Support for policyConstraints certificate extension.
 4173      [Steve Henson]
 4174 
 4175   *) Support for policyMappings certificate extension.
 4176      [Steve Henson]
 4177 
 4178   *) Make sure the default DSA_METHOD implementation only uses its
 4179      dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
 4180      and change its own handlers to be NULL so as to remove unnecessary
 4181      indirection. This lets alternative implementations fallback to the
 4182      default implementation more easily.
 4183      [Geoff Thorpe]
 4184 
 4185   *) Support for directoryName in GeneralName related extensions
 4186      in config files.
 4187      [Steve Henson]
 4188 
 4189   *) Make it possible to link applications using Makefile.shared.
 4190      Make that possible even when linking against static libraries!
 4191      [Richard Levitte]
 4192 
 4193   *) Support for single pass processing for S/MIME signing. This now
 4194      means that S/MIME signing can be done from a pipe, in addition
 4195      cleartext signing (multipart/signed type) is effectively streaming
 4196      and the signed data does not need to be all held in memory.
 4197 
 4198      This is done with a new flag PKCS7_STREAM. When this flag is set
 4199      PKCS7_sign() only initializes the PKCS7 structure and the actual signing
 4200      is done after the data is output (and digests calculated) in
 4201      SMIME_write_PKCS7().
 4202      [Steve Henson]
 4203 
 4204   *) Add full support for -rpath/-R, both in shared libraries and
 4205      applications, at least on the platforms where it's known how
 4206      to do it.
 4207      [Richard Levitte]
 4208 
 4209   *) In crypto/ec/ec_mult.c, implement fast point multiplication with
 4210      precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
 4211      will now compute a table of multiples of the generator that
 4212      makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
 4213      faster (notably in the case of a single point multiplication,
 4214      scalar * generator).
 4215      [Nils Larsch, Bodo Moeller]
 4216 
 4217   *) IPv6 support for certificate extensions. The various extensions
 4218      which use the IP:a.b.c.d can now take IPv6 addresses using the
 4219      formats of RFC1884 2.2 . IPv6 addresses are now also displayed
 4220      correctly.
 4221      [Steve Henson]
 4222 
 4223   *) Added an ENGINE that implements RSA by performing private key
 4224      exponentiations with the GMP library. The conversions to and from
 4225      GMP's mpz_t format aren't optimised nor are any montgomery forms
 4226      cached, and on x86 it appears OpenSSL's own performance has caught up.
 4227      However there are likely to be other architectures where GMP could
 4228      provide a boost. This ENGINE is not built in by default, but it can be
 4229      specified at Configure time and should be accompanied by the necessary
 4230      linker additions, eg;
 4231          ./config -DOPENSSL_USE_GMP -lgmp
 4232      [Geoff Thorpe]
 4233 
 4234   *) "openssl engine" will not display ENGINE/DSO load failure errors when
 4235      testing availability of engines with "-t" - the old behaviour is
 4236      produced by increasing the feature's verbosity with "-tt".
 4237      [Geoff Thorpe]
 4238 
 4239   *) ECDSA routines: under certain error conditions uninitialized BN objects
 4240      could be freed. Solution: make sure initialization is performed early
 4241      enough. (Reported and fix supplied by Nils Larsch <nla@trustcenter.de>
 4242      via PR#459)
 4243      [Lutz Jaenicke]
 4244 
 4245   *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
 4246      and DH_METHOD (eg. by ENGINE implementations) to override the normal
 4247      software implementations. For DSA and DH, parameter generation can
 4248      also be overriden by providing the appropriate method callbacks.
 4249      [Geoff Thorpe]
 4250 
 4251   *) Change the "progress" mechanism used in key-generation and
 4252      primality testing to functions that take a new BN_GENCB pointer in
 4253      place of callback/argument pairs. The new API functions have "_ex"
 4254      postfixes and the older functions are reimplemented as wrappers for
 4255      the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
 4256      declarations of the old functions to help (graceful) attempts to
 4257      migrate to the new functions. Also, the new key-generation API
 4258      functions operate on a caller-supplied key-structure and return
 4259      success/failure rather than returning a key or NULL - this is to
 4260      help make "keygen" another member function of RSA_METHOD etc.
 4261 
 4262      Example for using the new callback interface:
 4263 
 4264           int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
 4265           void *my_arg = ...;
 4266           BN_GENCB my_cb;
 4267 
 4268           BN_GENCB_set(&my_cb, my_callback, my_arg);
 4269 
 4270           return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
 4271           /* For the meaning of a, b in calls to my_callback(), see the
 4272            * documentation of the function that calls the callback.
 4273            * cb will point to my_cb; my_arg can be retrieved as cb->arg.
 4274            * my_callback should return 1 if it wants BN_is_prime_ex()
 4275            * to continue, or 0 to stop.
 4276            */
 4277 
 4278      [Geoff Thorpe]
 4279 
 4280   *) Change the ZLIB compression method to be stateful, and make it
 4281      available to TLS with the number defined in 
 4282      draft-ietf-tls-compression-04.txt.
 4283      [Richard Levitte]
 4284 
 4285   *) Add the ASN.1 structures and functions for CertificatePair, which
 4286      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
 4287 
 4288      CertificatePair ::= SEQUENCE {
 4289         forward		[0]	Certificate OPTIONAL,
 4290         reverse		[1]	Certificate OPTIONAL,
 4291         -- at least one of the pair shall be present -- }
 4292 
 4293      Also implement the PEM functions to read and write certificate
 4294      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
 4295 
 4296      This needed to be defined, mostly for the sake of the LDAP
 4297      attribute crossCertificatePair, but may prove useful elsewhere as
 4298      well.
 4299      [Richard Levitte]
 4300 
 4301   *) Make it possible to inhibit symlinking of shared libraries in
 4302      Makefile.shared, for Cygwin's sake.
 4303      [Richard Levitte]
 4304 
 4305   *) Extend the BIGNUM API by creating a function 
 4306           void BN_set_negative(BIGNUM *a, int neg);
 4307      and a macro that behave like
 4308           int  BN_is_negative(const BIGNUM *a);
 4309 
 4310      to avoid the need to access 'a->neg' directly in applications.
 4311      [Nils Larsch]
 4312 
 4313   *) Implement fast modular reduction for pseudo-Mersenne primes
 4314      used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
 4315      EC_GROUP_new_curve_GFp() will now automatically use this
 4316      if applicable.
 4317      [Nils Larsch <nla@trustcenter.de>]
 4318 
 4319   *) Add new lock type (CRYPTO_LOCK_BN).
 4320      [Bodo Moeller]
 4321 
 4322   *) Change the ENGINE framework to automatically load engines
 4323      dynamically from specific directories unless they could be
 4324      found to already be built in or loaded.  Move all the
 4325      current engines except for the cryptodev one to a new
 4326      directory engines/.
 4327      The engines in engines/ are built as shared libraries if
 4328      the "shared" options was given to ./Configure or ./config.
 4329      Otherwise, they are inserted in libcrypto.a.
 4330      /usr/local/ssl/engines is the default directory for dynamic
 4331      engines, but that can be overriden at configure time through
 4332      the usual use of --prefix and/or --openssldir, and at run
 4333      time with the environment variable OPENSSL_ENGINES.
 4334      [Geoff Thorpe and Richard Levitte]
 4335 
 4336   *) Add Makefile.shared, a helper makefile to build shared
 4337      libraries.  Addapt Makefile.org.
 4338      [Richard Levitte]
 4339 
 4340   *) Add version info to Win32 DLLs.
 4341      [Peter 'Luna' Runestig" <peter@runestig.com>]
 4342 
 4343   *) Add new 'medium level' PKCS#12 API. Certificates and keys
 4344      can be added using this API to created arbitrary PKCS#12
 4345      files while avoiding the low level API.
 4346 
 4347      New options to PKCS12_create(), key or cert can be NULL and
 4348      will then be omitted from the output file. The encryption
 4349      algorithm NIDs can be set to -1 for no encryption, the mac
 4350      iteration count can be set to 0 to omit the mac.
 4351 
 4352      Enhance pkcs12 utility by making the -nokeys and -nocerts
 4353      options work when creating a PKCS#12 file. New option -nomac
 4354      to omit the mac, NONE can be set for an encryption algorithm.
 4355      New code is modified to use the enhanced PKCS12_create()
 4356      instead of the low level API.
 4357      [Steve Henson]
 4358 
 4359   *) Extend ASN1 encoder to support indefinite length constructed
 4360      encoding. This can output sequences tags and octet strings in
 4361      this form. Modify pk7_asn1.c to support indefinite length
 4362      encoding. This is experimental and needs additional code to
 4363      be useful, such as an ASN1 bio and some enhanced streaming
 4364      PKCS#7 code.
 4365 
 4366      Extend template encode functionality so that tagging is passed
 4367      down to the template encoder.
 4368      [Steve Henson]
 4369 
 4370   *) Let 'openssl req' fail if an argument to '-newkey' is not
 4371      recognized instead of using RSA as a default.
 4372      [Bodo Moeller]
 4373 
 4374   *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
 4375      As these are not official, they are not included in "ALL";
 4376      the "ECCdraft" ciphersuite group alias can be used to select them.
 4377      [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
 4378 
 4379   *) Add ECDH engine support.
 4380      [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
 4381 
 4382   *) Add ECDH in new directory crypto/ecdh/.
 4383      [Douglas Stebila (Sun Microsystems Laboratories)]
 4384 
 4385   *) Let BN_rand_range() abort with an error after 100 iterations
 4386      without success (which indicates a broken PRNG).
 4387      [Bodo Moeller]
 4388 
 4389   *) Change BN_mod_sqrt() so that it verifies that the input value
 4390      is really the square of the return value.  (Previously,
 4391      BN_mod_sqrt would show GIGO behaviour.)
 4392      [Bodo Moeller]
 4393 
 4394   *) Add named elliptic curves over binary fields from X9.62, SECG,
 4395      and WAP/WTLS; add OIDs that were still missing.
 4396 
 4397      [Sheueling Chang Shantz and Douglas Stebila
 4398      (Sun Microsystems Laboratories)]
 4399 
 4400   *) Extend the EC library for elliptic curves over binary fields
 4401      (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
 4402      New EC_METHOD:
 4403 
 4404           EC_GF2m_simple_method
 4405 
 4406      New API functions:
 4407 
 4408           EC_GROUP_new_curve_GF2m
 4409           EC_GROUP_set_curve_GF2m
 4410           EC_GROUP_get_curve_GF2m
 4411           EC_POINT_set_affine_coordinates_GF2m
 4412           EC_POINT_get_affine_coordinates_GF2m
 4413           EC_POINT_set_compressed_coordinates_GF2m
 4414 
 4415      Point compression for binary fields is disabled by default for
 4416      patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
 4417      enable it).
 4418 
 4419      As binary polynomials are represented as BIGNUMs, various members
 4420      of the EC_GROUP and EC_POINT data structures can be shared
 4421      between the implementations for prime fields and binary fields;
 4422      the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
 4423      are essentially identical to their ..._GFp counterparts.
 4424      (For simplicity, the '..._GFp' prefix has been dropped from
 4425      various internal method names.)
 4426 
 4427      An internal 'field_div' method (similar to 'field_mul' and
 4428      'field_sqr') has been added; this is used only for binary fields.
 4429 
 4430      [Sheueling Chang Shantz and Douglas Stebila
 4431      (Sun Microsystems Laboratories)]
 4432 
 4433   *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
 4434      through methods ('mul', 'precompute_mult').
 4435 
 4436      The generic implementations (now internally called 'ec_wNAF_mul'
 4437      and 'ec_wNAF_precomputed_mult') remain the default if these
 4438      methods are undefined.
 4439 
 4440      [Sheueling Chang Shantz and Douglas Stebila
 4441      (Sun Microsystems Laboratories)]
 4442 
 4443   *) New function EC_GROUP_get_degree, which is defined through
 4444      EC_METHOD.  For curves over prime fields, this returns the bit
 4445      length of the modulus.
 4446 
 4447      [Sheueling Chang Shantz and Douglas Stebila
 4448      (Sun Microsystems Laboratories)]
 4449 
 4450   *) New functions EC_GROUP_dup, EC_POINT_dup.
 4451      (These simply call ..._new  and ..._copy).
 4452 
 4453      [Sheueling Chang Shantz and Douglas Stebila
 4454      (Sun Microsystems Laboratories)]
 4455 
 4456   *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
 4457      Polynomials are represented as BIGNUMs (where the sign bit is not
 4458      used) in the following functions [macros]:  
 4459 
 4460           BN_GF2m_add
 4461           BN_GF2m_sub             [= BN_GF2m_add]
 4462           BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
 4463           BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
 4464           BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
 4465           BN_GF2m_mod_inv
 4466           BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
 4467           BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
 4468           BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
 4469           BN_GF2m_cmp             [= BN_ucmp]
 4470 
 4471      (Note that only the 'mod' functions are actually for fields GF(2^m).
 4472      BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
 4473 
 4474      For some functions, an the irreducible polynomial defining a
 4475      field can be given as an 'unsigned int[]' with strictly
 4476      decreasing elements giving the indices of those bits that are set;
 4477      i.e., p[] represents the polynomial
 4478           f(t) = t^p[0] + t^p[1] + ... + t^p[k]
 4479      where
 4480           p[0] > p[1] > ... > p[k] = 0.
 4481      This applies to the following functions:
 4482 
 4483           BN_GF2m_mod_arr
 4484           BN_GF2m_mod_mul_arr
 4485           BN_GF2m_mod_sqr_arr
 4486           BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
 4487           BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
 4488           BN_GF2m_mod_exp_arr
 4489           BN_GF2m_mod_sqrt_arr
 4490           BN_GF2m_mod_solve_quad_arr
 4491           BN_GF2m_poly2arr
 4492           BN_GF2m_arr2poly
 4493 
 4494      Conversion can be performed by the following functions:
 4495 
 4496           BN_GF2m_poly2arr
 4497           BN_GF2m_arr2poly
 4498 
 4499      bntest.c has additional tests for binary polynomial arithmetic.
 4500 
 4501      Two implementations for BN_GF2m_mod_div() are available.
 4502      The default algorithm simply uses BN_GF2m_mod_inv() and
 4503      BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
 4504      if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
 4505      copyright notice in crypto/bn/bn_gf2m.c before enabling it).
 4506 
 4507      [Sheueling Chang Shantz and Douglas Stebila
 4508      (Sun Microsystems Laboratories)]
 4509 
 4510   *) Add new error code 'ERR_R_DISABLED' that can be used when some
 4511      functionality is disabled at compile-time.
 4512      [Douglas Stebila <douglas.stebila@sun.com>]
 4513 
 4514   *) Change default behaviour of 'openssl asn1parse' so that more
 4515      information is visible when viewing, e.g., a certificate:
 4516 
 4517      Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
 4518      mode the content of non-printable OCTET STRINGs is output in a
 4519      style similar to INTEGERs, but with '[HEX DUMP]' prepended to
 4520      avoid the appearance of a printable string.
 4521      [Nils Larsch <nla@trustcenter.de>]
 4522 
 4523   *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
 4524      functions
 4525           EC_GROUP_set_asn1_flag()
 4526           EC_GROUP_get_asn1_flag()
 4527           EC_GROUP_set_point_conversion_form()
 4528           EC_GROUP_get_point_conversion_form()
 4529      These control ASN1 encoding details:
 4530      - Curves (i.e., groups) are encoded explicitly unless asn1_flag
 4531        has been set to OPENSSL_EC_NAMED_CURVE.
 4532      - Points are encoded in uncompressed form by default; options for
 4533        asn1_for are as for point2oct, namely
 4534           POINT_CONVERSION_COMPRESSED
 4535           POINT_CONVERSION_UNCOMPRESSED
 4536           POINT_CONVERSION_HYBRID
 4537 
 4538      Also add 'seed' and 'seed_len' members to EC_GROUP with access
 4539      functions
 4540           EC_GROUP_set_seed()
 4541           EC_GROUP_get0_seed()
 4542           EC_GROUP_get_seed_len()
 4543      This is used only for ASN1 purposes (so far).
 4544      [Nils Larsch <nla@trustcenter.de>]
 4545 
 4546   *) Add 'field_type' member to EC_METHOD, which holds the NID
 4547      of the appropriate field type OID.  The new function
 4548      EC_METHOD_get_field_type() returns this value.
 4549      [Nils Larsch <nla@trustcenter.de>]
 4550 
 4551   *) Add functions 
 4552           EC_POINT_point2bn()
 4553           EC_POINT_bn2point()
 4554           EC_POINT_point2hex()
 4555           EC_POINT_hex2point()
 4556      providing useful interfaces to EC_POINT_point2oct() and
 4557      EC_POINT_oct2point().
 4558      [Nils Larsch <nla@trustcenter.de>]
 4559 
 4560   *) Change internals of the EC library so that the functions
 4561           EC_GROUP_set_generator()
 4562           EC_GROUP_get_generator()
 4563           EC_GROUP_get_order()
 4564           EC_GROUP_get_cofactor()
 4565      are implemented directly in crypto/ec/ec_lib.c and not dispatched
 4566      to methods, which would lead to unnecessary code duplication when
 4567      adding different types of curves.
 4568      [Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller]
 4569 
 4570   *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
 4571      arithmetic, and such that modified wNAFs are generated
 4572      (which avoid length expansion in many cases).
 4573      [Bodo Moeller]
 4574 
 4575   *) Add a function EC_GROUP_check_discriminant() (defined via
 4576      EC_METHOD) that verifies that the curve discriminant is non-zero.
 4577 
 4578      Add a function EC_GROUP_check() that makes some sanity tests
 4579      on a EC_GROUP, its generator and order.  This includes
 4580      EC_GROUP_check_discriminant().
 4581      [Nils Larsch <nla@trustcenter.de>]
 4582 
 4583   *) Add ECDSA in new directory crypto/ecdsa/.
 4584 
 4585      Add applications 'openssl ecparam' and 'openssl ecdsa'
 4586      (these are based on 'openssl dsaparam' and 'openssl dsa').
 4587 
 4588      ECDSA support is also included in various other files across the
 4589      library.  Most notably,
 4590      - 'openssl req' now has a '-newkey ecdsa:file' option;
 4591      - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
 4592      - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
 4593        d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
 4594        them suitable for ECDSA where domain parameters must be
 4595        extracted before the specific public key;
 4596      - ECDSA engine support has been added.
 4597      [Nils Larsch <nla@trustcenter.de>]
 4598 
 4599   *) Include some named elliptic curves, and add OIDs from X9.62,
 4600      SECG, and WAP/WTLS.  Each curve can be obtained from the new
 4601      function
 4602           EC_GROUP_new_by_curve_name(),
 4603      and the list of available named curves can be obtained with
 4604           EC_get_builtin_curves().
 4605      Also add a 'curve_name' member to EC_GROUP objects, which can be
 4606      accessed via
 4607          EC_GROUP_set_curve_name()
 4608          EC_GROUP_get_curve_name()
 4609      [Nils Larsch <larsch@trustcenter.de, Bodo Moeller]
 4610  
 4611   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
 4612      was actually never needed) and in BN_mul().  The removal in BN_mul()
 4613      required a small change in bn_mul_part_recursive() and the addition
 4614      of the functions bn_cmp_part_words(), bn_sub_part_words() and
 4615      bn_add_part_words(), which do the same thing as bn_cmp_words(),
 4616      bn_sub_words() and bn_add_words() except they take arrays with
 4617      differing sizes.
 4618      [Richard Levitte]
 4619 
 4620  Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
 4621 
 4622   *) Cleanse PEM buffers before freeing them since they may contain 
 4623      sensitive data.
 4624      [Benjamin Bennett <ben@psc.edu>]
 4625 
 4626   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
 4627      a ciphersuite string such as "DEFAULT:RSA" cannot enable
 4628      authentication-only ciphersuites.
 4629      [Bodo Moeller]
 4630 
 4631   *) Since AES128 and AES256 share a single mask bit in the logic of
 4632      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
 4633      kludge to work properly if AES128 is available and AES256 isn't.
 4634      [Victor Duchovni]
 4635 
 4636   *) Expand security boundary to match 1.1.1 module.
 4637      [Steve Henson]
 4638 
 4639   *) Remove redundant features: hash file source, editing of test vectors
 4640      modify fipsld to use external fips_premain.c signature.
 4641      [Steve Henson]
 4642 
 4643   *) New perl script mkfipsscr.pl to create shell scripts or batch files to
 4644      run algorithm test programs.
 4645      [Steve Henson]
 4646 
 4647   *) Make algorithm test programs more tolerant of whitespace.
 4648      [Steve Henson]
 4649 
 4650   *) Have SSL/TLS server implementation tolerate "mismatched" record
 4651      protocol version while receiving ClientHello even if the
 4652      ClientHello is fragmented.  (The server can't insist on the
 4653      particular protocol version it has chosen before the ServerHello
 4654      message has informed the client about his choice.)
 4655      [Bodo Moeller]
 4656 
 4657   *) Load error codes if they are not already present instead of using a
 4658      static variable. This allows them to be cleanly unloaded and reloaded.
 4659      [Steve Henson]
 4660 
 4661  Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
 4662 
 4663   *) Introduce limits to prevent malicious keys being able to
 4664      cause a denial of service.  (CVE-2006-2940)
 4665      [Steve Henson, Bodo Moeller]
 4666 
 4667   *) Fix ASN.1 parsing of certain invalid structures that can result
 4668      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
 4669 
 4670   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
 4671      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
 4672 
 4673   *) Fix SSL client code which could crash if connecting to a
 4674      malicious SSLv2 server.  (CVE-2006-4343)
 4675      [Tavis Ormandy and Will Drewry, Google Security Team]
 4676 
 4677   *) Change ciphersuite string processing so that an explicit
 4678      ciphersuite selects this one ciphersuite (so that "AES256-SHA"
 4679      will no longer include "AES128-SHA"), and any other similar
 4680      ciphersuite (same bitmap) from *other* protocol versions (so that
 4681      "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
 4682      SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
 4683      changes from 0.9.8b and 0.9.8d.
 4684      [Bodo Moeller]
 4685 
 4686  Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
 4687 
 4688   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
 4689      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
 4690 
 4691   *) Change the Unix randomness entropy gathering to use poll() when
 4692      possible instead of select(), since the latter has some
 4693      undesirable limitations.
 4694      [Darryl Miles via Richard Levitte and Bodo Moeller]
 4695 
 4696   *) Disable rogue ciphersuites:
 4697 
 4698       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
 4699       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
 4700       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
 4701 
 4702      The latter two were purportedly from
 4703      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
 4704      appear there.
 4705 
 4706      Also deactive the remaining ciphersuites from
 4707      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
 4708      unofficial, and the ID has long expired.
 4709      [Bodo Moeller]
 4710 
 4711   *) Fix RSA blinding Heisenbug (problems sometimes occured on
 4712      dual-core machines) and other potential thread-safety issues.
 4713      [Bodo Moeller]
 4714 
 4715  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
 4716 
 4717   *) Adapt fipsld and the build system to link against the validated FIPS
 4718      module in FIPS mode.
 4719      [Steve Henson]
 4720 
 4721   *) Fixes for VC++ 2005 build under Windows.
 4722      [Steve Henson]
 4723 
 4724   *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
 4725      from a Windows bash shell such as MSYS. It is autodetected from the
 4726      "config" script when run from a VC++ environment. Modify standard VC++
 4727      build to use fipscanister.o from the GNU make build. 
 4728      [Steve Henson]
 4729 
 4730  Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
 4731 
 4732   *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
 4733      The value now differs depending on if you build for FIPS or not.
 4734      BEWARE!  A program linked with a shared FIPSed libcrypto can't be
 4735      safely run with a non-FIPSed libcrypto, as it may crash because of
 4736      the difference induced by this change.
 4737      [Andy Polyakov]
 4738 
 4739  Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
 4740 
 4741   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
 4742      (part of SSL_OP_ALL).  This option used to disable the
 4743      countermeasure against man-in-the-middle protocol-version
 4744      rollback in the SSL 2.0 server implementation, which is a bad
 4745      idea.  (CVE-2005-2969)
 4746 
 4747      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
 4748      for Information Security, National Institute of Advanced Industrial
 4749      Science and Technology [AIST], Japan)]
 4750 
 4751   *) Minimal support for X9.31 signatures and PSS padding modes. This is
 4752      mainly for FIPS compliance and not fully integrated at this stage.
 4753      [Steve Henson]
 4754 
 4755   *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
 4756      the exponentiation using a fixed-length exponent.  (Otherwise,
 4757      the information leaked through timing could expose the secret key
 4758      after many signatures; cf. Bleichenbacher's attack on DSA with
 4759      biased k.)
 4760      [Bodo Moeller]
 4761 
 4762   *) Make a new fixed-window mod_exp implementation the default for
 4763      RSA, DSA, and DH private-key operations so that the sequence of
 4764      squares and multiplies and the memory access pattern are
 4765      independent of the particular secret key.  This will mitigate
 4766      cache-timing and potential related attacks.
 4767 
 4768      BN_mod_exp_mont_consttime() is the new exponentiation implementation,
 4769      and this is automatically used by BN_mod_exp_mont() if the new flag
 4770      BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
 4771      will use this BN flag for private exponents unless the flag
 4772      RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
 4773      DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
 4774 
 4775      [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
 4776 
 4777   *) Change the client implementation for SSLv23_method() and
 4778      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
 4779      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
 4780      (Previously, the SSL 2.0 backwards compatible Client Hello
 4781      message format would be used even with SSL_OP_NO_SSLv2.)
 4782      [Bodo Moeller]
 4783 
 4784   *) Add support for smime-type MIME parameter in S/MIME messages which some
 4785      clients need.
 4786      [Steve Henson]
 4787 
 4788   *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
 4789      a threadsafe manner. Modify rsa code to use new function and add calls
 4790      to dsa and dh code (which had race conditions before).
 4791      [Steve Henson]
 4792 
 4793   *) Include the fixed error library code in the C error file definitions
 4794      instead of fixing them up at runtime. This keeps the error code
 4795      structures constant.
 4796      [Steve Henson]
 4797 
 4798  Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
 4799 
 4800   [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
 4801   OpenSSL 0.9.8.]
 4802 
 4803   *) Fixes for newer kerberos headers. NB: the casts are needed because
 4804      the 'length' field is signed on one version and unsigned on another
 4805      with no (?) obvious way to tell the difference, without these VC++
 4806      complains. Also the "definition" of FAR (blank) is no longer included
 4807      nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
 4808      some needed definitions.
 4809      [Steve Henson]
 4810 
 4811   *) Undo Cygwin change.
 4812      [Ulf Möller]
 4813 
 4814   *) Added support for proxy certificates according to RFC 3820.
 4815      Because they may be a security thread to unaware applications,
 4816      they must be explicitely allowed in run-time.  See
 4817      docs/HOWTO/proxy_certificates.txt for further information.
 4818      [Richard Levitte]
 4819 
 4820  Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
 4821 
 4822   *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
 4823      server and client random values. Previously
 4824      (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
 4825      less random data when sizeof(time_t) > 4 (some 64 bit platforms).
 4826 
 4827      This change has negligible security impact because:
 4828 
 4829      1. Server and client random values still have 24 bytes of pseudo random
 4830         data.
 4831 
 4832      2. Server and client random values are sent in the clear in the initial
 4833         handshake.
 4834 
 4835      3. The master secret is derived using the premaster secret (48 bytes in
 4836         size for static RSA ciphersuites) as well as client server and random
 4837         values.
 4838 
 4839      The OpenSSL team would like to thank the UK NISCC for bringing this issue
 4840      to our attention. 
 4841 
 4842      [Stephen Henson, reported by UK NISCC]
 4843 
 4844   *) Use Windows randomness collection on Cygwin.
 4845      [Ulf Möller]
 4846 
 4847   *) Fix hang in EGD/PRNGD query when communication socket is closed
 4848      prematurely by EGD/PRNGD.
 4849      [Darren Tucker <dtucker@zip.com.au> via Lutz Jänicke, resolves #1014]
 4850 
 4851   *) Prompt for pass phrases when appropriate for PKCS12 input format.
 4852      [Steve Henson]
 4853 
 4854   *) Back-port of selected performance improvements from development
 4855      branch, as well as improved support for PowerPC platforms.
 4856      [Andy Polyakov]
 4857 
 4858   *) Add lots of checks for memory allocation failure, error codes to indicate
 4859      failure and freeing up memory if a failure occurs.
 4860      [Nauticus Networks SSL Team <openssl@nauticusnet.com>, Steve Henson]
 4861 
 4862   *) Add new -passin argument to dgst.
 4863      [Steve Henson]
 4864 
 4865   *) Perform some character comparisons of different types in X509_NAME_cmp:
 4866      this is needed for some certificates that reencode DNs into UTF8Strings
 4867      (in violation of RFC3280) and can't or wont issue name rollover
 4868      certificates.
 4869      [Steve Henson]
 4870 
 4871   *) Make an explicit check during certificate validation to see that
 4872      the CA setting in each certificate on the chain is correct.  As a
 4873      side effect always do the following basic checks on extensions,
 4874      not just when there's an associated purpose to the check:
 4875 
 4876       - if there is an unhandled critical extension (unless the user
 4877         has chosen to ignore this fault)
 4878       - if the path length has been exceeded (if one is set at all)
 4879       - that certain extensions fit the associated purpose (if one has
 4880         been given)
 4881      [Richard Levitte]
 4882 
 4883  Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
 4884 
 4885   *) Avoid a race condition when CRLs are checked in a multi threaded 
 4886      environment. This would happen due to the reordering of the revoked
 4887      entries during signature checking and serial number lookup. Now the
 4888      encoding is cached and the serial number sort performed under a lock.
 4889      Add new STACK function sk_is_sorted().
 4890      [Steve Henson]
 4891 
 4892   *) Add Delta CRL to the extension code.
 4893      [Steve Henson]
 4894 
 4895   *) Various fixes to s3_pkt.c so alerts are sent properly.
 4896      [David Holmes <d.holmes@f5.com>]
 4897 
 4898   *) Reduce the chances of duplicate issuer name and serial numbers (in
 4899      violation of RFC3280) using the OpenSSL certificate creation utilities.
 4900      This is done by creating a random 64 bit value for the initial serial
 4901      number when a serial number file is created or when a self signed
 4902      certificate is created using 'openssl req -x509'. The initial serial
 4903      number file is created using 'openssl x509 -next_serial' in CA.pl
 4904      rather than being initialized to 1.
 4905      [Steve Henson]
 4906 
 4907  Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
 4908 
 4909   *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
 4910      by using the Codenomicon TLS Test Tool (CVE-2004-0079)                    
 4911      [Joe Orton, Steve Henson]   
 4912 
 4913   *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
 4914      (CVE-2004-0112)
 4915      [Joe Orton, Steve Henson]   
 4916 
 4917   *) Make it possible to have multiple active certificates with the same
 4918      subject in the CA index file.  This is done only if the keyword
 4919      'unique_subject' is set to 'no' in the main CA section (default
 4920      if 'CA_default') of the configuration file.  The value is saved
 4921      with the database itself in a separate index attribute file,
 4922      named like the index file with '.attr' appended to the name.
 4923      [Richard Levitte]
 4924 
 4925   *) X509 verify fixes. Disable broken certificate workarounds when 
 4926      X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
 4927      keyUsage extension present. Don't accept CRLs with unhandled critical
 4928      extensions: since verify currently doesn't process CRL extensions this
 4929      rejects a CRL with *any* critical extensions. Add new verify error codes
 4930      for these cases.
 4931      [Steve Henson]
 4932 
 4933   *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
 4934      A clarification of RFC2560 will require the use of OCTET STRINGs and 
 4935      some implementations cannot handle the current raw format. Since OpenSSL
 4936      copies and compares OCSP nonces as opaque blobs without any attempt at
 4937      parsing them this should not create any compatibility issues.
 4938      [Steve Henson]
 4939 
 4940   *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
 4941      calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
 4942      this HMAC (and other) operations are several times slower than OpenSSL
 4943      < 0.9.7.
 4944      [Steve Henson]
 4945 
 4946   *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
 4947      [Peter Sylvester <Peter.Sylvester@EdelWeb.fr>]
 4948 
 4949   *) Use the correct content when signing type "other".
 4950      [Steve Henson]
 4951 
 4952  Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
 4953 
 4954   *) Fix various bugs revealed by running the NISCC test suite:
 4955 
 4956      Stop out of bounds reads in the ASN1 code when presented with
 4957      invalid tags (CVE-2003-0543 and CVE-2003-0544).
 4958      
 4959      Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
 4960 
 4961      If verify callback ignores invalid public key errors don't try to check
 4962      certificate signature with the NULL public key.
 4963 
 4964      [Steve Henson]
 4965 
 4966   *) New -ignore_err option in ocsp application to stop the server
 4967      exiting on the first error in a request.
 4968      [Steve Henson]
 4969 
 4970   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
 4971      if the server requested one: as stated in TLS 1.0 and SSL 3.0
 4972      specifications.
 4973      [Steve Henson]
 4974 
 4975   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
 4976      extra data after the compression methods not only for TLS 1.0
 4977      but also for SSL 3.0 (as required by the specification).
 4978      [Bodo Moeller; problem pointed out by Matthias Loepfe]
 4979 
 4980   *) Change X509_certificate_type() to mark the key as exported/exportable
 4981      when it's 512 *bits* long, not 512 bytes.
 4982      [Richard Levitte]
 4983 
 4984   *) Change AES_cbc_encrypt() so it outputs exact multiple of
 4985      blocks during encryption.
 4986      [Richard Levitte]
 4987 
 4988   *) Various fixes to base64 BIO and non blocking I/O. On write 
 4989      flushes were not handled properly if the BIO retried. On read
 4990      data was not being buffered properly and had various logic bugs.
 4991      This also affects blocking I/O when the data being decoded is a
 4992      certain size.
 4993      [Steve Henson]
 4994 
 4995   *) Various S/MIME bugfixes and compatibility changes:
 4996      output correct application/pkcs7 MIME type if
 4997      PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
 4998      Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
 4999      of files as .eml work). Correctly handle very long lines in MIME
 5000      parser.
 5001      [Steve Henson]
 5002 
 5003  Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
 5004 
 5005   *) Countermeasure against the Klima-Pokorny-Rosa extension of
 5006      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
 5007      a protocol version number mismatch like a decryption error
 5008      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
 5009      [Bodo Moeller]
 5010 
 5011   *) Turn on RSA blinding by default in the default implementation
 5012      to avoid a timing attack. Applications that don't want it can call
 5013      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
 5014      They would be ill-advised to do so in most cases.
 5015      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
 5016 
 5017   *) Change RSA blinding code so that it works when the PRNG is not
 5018      seeded (in this case, the secret RSA exponent is abused as
 5019      an unpredictable seed -- if it is not unpredictable, there
 5020      is no point in blinding anyway).  Make RSA blinding thread-safe
 5021      by remembering the creator's thread ID in rsa->blinding and
 5022      having all other threads use local one-time blinding factors
 5023      (this requires more computation than sharing rsa->blinding, but
 5024      avoids excessive locking; and if an RSA object is not shared
 5025      between threads, blinding will still be very fast).
 5026      [Bodo Moeller]
 5027 
 5028   *) Fixed a typo bug that would cause ENGINE_set_default() to set an
 5029      ENGINE as defaults for all supported algorithms irrespective of
 5030      the 'flags' parameter. 'flags' is now honoured, so applications
 5031      should make sure they are passing it correctly.
 5032      [Geoff Thorpe]
 5033 
 5034   *) Target "mingw" now allows native Windows code to be generated in
 5035      the Cygwin environment as well as with the MinGW compiler.
 5036      [Ulf Moeller] 
 5037 
 5038  Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
 5039 
 5040   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
 5041      via timing by performing a MAC computation even if incorrrect
 5042      block cipher padding has been found.  This is a countermeasure
 5043      against active attacks where the attacker has to distinguish
 5044      between bad padding and a MAC verification error. (CVE-2003-0078)
 5045 
 5046      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
 5047      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
 5048      Martin Vuagnoux (EPFL, Ilion)]
 5049 
 5050   *) Make the no-err option work as intended.  The intention with no-err
 5051      is not to have the whole error stack handling routines removed from
 5052      libcrypto, it's only intended to remove all the function name and
 5053      reason texts, thereby removing some of the footprint that may not
 5054      be interesting if those errors aren't displayed anyway.
 5055 
 5056      NOTE: it's still possible for any application or module to have it's
 5057      own set of error texts inserted.  The routines are there, just not
 5058      used by default when no-err is given.
 5059      [Richard Levitte]
 5060 
 5061   *) Add support for FreeBSD on IA64.
 5062      [dirk.meyer@dinoex.sub.org via Richard Levitte, resolves #454]
 5063 
 5064   *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
 5065      Kerberos function mit_des_cbc_cksum().  Before this change,
 5066      the value returned by DES_cbc_cksum() was like the one from
 5067      mit_des_cbc_cksum(), except the bytes were swapped.
 5068      [Kevin Greaney <Kevin.Greaney@hp.com> and Richard Levitte]
 5069 
 5070   *) Allow an application to disable the automatic SSL chain building.
 5071      Before this a rather primitive chain build was always performed in
 5072      ssl3_output_cert_chain(): an application had no way to send the 
 5073      correct chain if the automatic operation produced an incorrect result.
 5074 
 5075      Now the chain builder is disabled if either:
 5076 
 5077      1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
 5078 
 5079      2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
 5080 
 5081      The reasoning behind this is that an application would not want the
 5082      auto chain building to take place if extra chain certificates are
 5083      present and it might also want a means of sending no additional
 5084      certificates (for example the chain has two certificates and the
 5085      root is omitted).
 5086      [Steve Henson]
 5087 
 5088   *) Add the possibility to build without the ENGINE framework.
 5089      [Steven Reddie <smr@essemer.com.au> via Richard Levitte]
 5090 
 5091   *) Under Win32 gmtime() can return NULL: check return value in
 5092      OPENSSL_gmtime(). Add error code for case where gmtime() fails.
 5093      [Steve Henson]
 5094 
 5095   *) DSA routines: under certain error conditions uninitialized BN objects
 5096      could be freed. Solution: make sure initialization is performed early
 5097      enough. (Reported and fix supplied by Ivan D Nestlerode <nestler@MIT.EDU>,
 5098      Nils Larsch <nla@trustcenter.de> via PR#459)
 5099      [Lutz Jaenicke]
 5100 
 5101   *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
 5102      checked on reconnect on the client side, therefore session resumption
 5103      could still fail with a "ssl session id is different" error. This
 5104      behaviour is masked when SSL_OP_ALL is used due to
 5105      SSL_OP_MICROSOFT_SESS_ID_BUG being set.
 5106      Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
 5107      followup to PR #377.
 5108      [Lutz Jaenicke]
 5109 
 5110   *) IA-32 assembler support enhancements: unified ELF targets, support
 5111      for SCO/Caldera platforms, fix for Cygwin shared build.
 5112      [Andy Polyakov]
 5113 
 5114   *) Add support for FreeBSD on sparc64.  As a consequence, support for
 5115      FreeBSD on non-x86 processors is separate from x86 processors on
 5116      the config script, much like the NetBSD support.
 5117      [Richard Levitte & Kris Kennaway <kris@obsecurity.org>]
 5118 
 5119  Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
 5120 
 5121   [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
 5122   OpenSSL 0.9.7.]
 5123 
 5124   *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
 5125      code (06) was taken as the first octet of the session ID and the last
 5126      octet was ignored consequently. As a result SSLv2 client side session
 5127      caching could not have worked due to the session ID mismatch between
 5128      client and server.
 5129      Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
 5130      PR #377.
 5131      [Lutz Jaenicke]
 5132 
 5133   *) Change the declaration of needed Kerberos libraries to use EX_LIBS
 5134      instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
 5135      removed entirely.
 5136      [Richard Levitte]
 5137 
 5138   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
 5139      seems that in spite of existing for more than a year, many application
 5140      author have done nothing to provide the necessary callbacks, which
 5141      means that this particular engine will not work properly anywhere.
 5142      This is a very unfortunate situation which forces us, in the name
 5143      of usability, to give the hw_ncipher.c a static lock, which is part
 5144      of libcrypto.
 5145      NOTE: This is for the 0.9.7 series ONLY.  This hack will never
 5146      appear in 0.9.8 or later.  We EXPECT application authors to have
 5147      dealt properly with this when 0.9.8 is released (unless we actually
 5148      make such changes in the libcrypto locking code that changes will
 5149      have to be made anyway).
 5150      [Richard Levitte]
 5151 
 5152   *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
 5153      octets have been read, EOF or an error occurs. Without this change
 5154      some truncated ASN1 structures will not produce an error.
 5155      [Steve Henson]
 5156 
 5157   *) Disable Heimdal support, since it hasn't been fully implemented.
 5158      Still give the possibility to force the use of Heimdal, but with
 5159      warnings and a request that patches get sent to openssl-dev.
 5160      [Richard Levitte]
 5161 
 5162   *) Add the VC-CE target, introduce the WINCE sysname, and add
 5163      INSTALL.WCE and appropriate conditionals to make it build.
 5164      [Steven Reddie <smr@essemer.com.au> via Richard Levitte]
 5165 
 5166   *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
 5167      cygssl-x.y.z.dll, where x, y and z are the major, minor and
 5168      edit numbers of the version.
 5169      [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
 5170 
 5171   *) Introduce safe string copy and catenation functions
 5172      (BUF_strlcpy() and BUF_strlcat()).
 5173      [Ben Laurie (CHATS) and Richard Levitte]
 5174 
 5175   *) Avoid using fixed-size buffers for one-line DNs.
 5176      [Ben Laurie (CHATS)]
 5177 
 5178   *) Add BUF_MEM_grow_clean() to avoid information leakage when
 5179      resizing buffers containing secrets, and use where appropriate.
 5180      [Ben Laurie (CHATS)]
 5181 
 5182   *) Avoid using fixed size buffers for configuration file location.
 5183      [Ben Laurie (CHATS)]
 5184 
 5185   *) Avoid filename truncation for various CA files.
 5186      [Ben Laurie (CHATS)]
 5187 
 5188   *) Use sizeof in preference to magic numbers.
 5189      [Ben Laurie (CHATS)]
 5190 
 5191   *) Avoid filename truncation in cert requests.
 5192      [Ben Laurie (CHATS)]
 5193 
 5194   *) Add assertions to check for (supposedly impossible) buffer
 5195      overflows.
 5196      [Ben Laurie (CHATS)]
 5197 
 5198   *) Don't cache truncated DNS entries in the local cache (this could
 5199      potentially lead to a spoofing attack).
 5200      [Ben Laurie (CHATS)]
 5201 
 5202   *) Fix various buffers to be large enough for hex/decimal
 5203      representations in a platform independent manner.
 5204      [Ben Laurie (CHATS)]
 5205 
 5206   *) Add CRYPTO_realloc_clean() to avoid information leakage when
 5207      resizing buffers containing secrets, and use where appropriate.
 5208      [Ben Laurie (CHATS)]
 5209 
 5210   *) Add BIO_indent() to avoid much slightly worrying code to do
 5211      indents.
 5212      [Ben Laurie (CHATS)]
 5213 
 5214   *) Convert sprintf()/BIO_puts() to BIO_printf().
 5215      [Ben Laurie (CHATS)]
 5216 
 5217   *) buffer_gets() could terminate with the buffer only half
 5218      full. Fixed.
 5219      [Ben Laurie (CHATS)]
 5220 
 5221   *) Add assertions to prevent user-supplied crypto functions from
 5222      overflowing internal buffers by having large block sizes, etc.
 5223      [Ben Laurie (CHATS)]
 5224 
 5225   *) New OPENSSL_assert() macro (similar to assert(), but enabled
 5226      unconditionally).
 5227      [Ben Laurie (CHATS)]
 5228 
 5229   *) Eliminate unused copy of key in RC4.
 5230      [Ben Laurie (CHATS)]
 5231 
 5232   *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
 5233      [Ben Laurie (CHATS)]
 5234 
 5235   *) Fix off-by-one error in EGD path.
 5236      [Ben Laurie (CHATS)]
 5237 
 5238   *) If RANDFILE path is too long, ignore instead of truncating.
 5239      [Ben Laurie (CHATS)]
 5240 
 5241   *) Eliminate unused and incorrectly sized X.509 structure
 5242      CBCParameter.
 5243      [Ben Laurie (CHATS)]
 5244 
 5245   *) Eliminate unused and dangerous function knumber().
 5246      [Ben Laurie (CHATS)]
 5247 
 5248   *) Eliminate unused and dangerous structure, KSSL_ERR.
 5249      [Ben Laurie (CHATS)]
 5250 
 5251   *) Protect against overlong session ID context length in an encoded
 5252      session object. Since these are local, this does not appear to be
 5253      exploitable.
 5254      [Ben Laurie (CHATS)]
 5255 
 5256   *) Change from security patch (see 0.9.6e below) that did not affect
 5257      the 0.9.6 release series:
 5258 
 5259      Remote buffer overflow in SSL3 protocol - an attacker could
 5260      supply an oversized master key in Kerberos-enabled versions.
 5261      (CVE-2002-0657)
 5262      [Ben Laurie (CHATS)]
 5263 
 5264   *) Change the SSL kerb5 codes to match RFC 2712.
 5265      [Richard Levitte]
 5266 
 5267   *) Make -nameopt work fully for req and add -reqopt switch.
 5268      [Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]
 5269 
 5270   *) The "block size" for block ciphers in CFB and OFB mode should be 1.
 5271      [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve@opera.com>]
 5272 
 5273   *) Make sure tests can be performed even if the corresponding algorithms
 5274      have been removed entirely.  This was also the last step to make
 5275      OpenSSL compilable with DJGPP under all reasonable conditions.
 5276      [Richard Levitte, Doug Kaufman <dkaufman@rahul.net>]
 5277 
 5278   *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
 5279      to allow version independent disabling of normally unselected ciphers,
 5280      which may be activated as a side-effect of selecting a single cipher.
 5281 
 5282      (E.g., cipher list string "RSA" enables ciphersuites that are left
 5283      out of "ALL" because they do not provide symmetric encryption.
 5284      "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
 5285      [Lutz Jaenicke, Bodo Moeller]
 5286 
 5287   *) Add appropriate support for separate platform-dependent build
 5288      directories.  The recommended way to make a platform-dependent
 5289      build directory is the following (tested on Linux), maybe with
 5290      some local tweaks:
 5291 
 5292 	# Place yourself outside of the OpenSSL source tree.  In
 5293 	# this example, the environment variable OPENSSL_SOURCE
 5294 	# is assumed to contain the absolute OpenSSL source directory.
 5295 	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
 5296 	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
 5297 	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
 5298 		mkdir -p `dirname $F`
 5299 		ln -s $OPENSSL_SOURCE/$F $F
 5300 	done
 5301 
 5302      To be absolutely sure not to disturb the source tree, a "make clean"
 5303      is a good thing.  If it isn't successfull, don't worry about it,
 5304      it probably means the source directory is very clean.
 5305      [Richard Levitte]
 5306 
 5307   *) Make sure any ENGINE control commands make local copies of string
 5308      pointers passed to them whenever necessary. Otherwise it is possible
 5309      the caller may have overwritten (or deallocated) the original string
 5310      data when a later ENGINE operation tries to use the stored values.
 5311      [Götz Babin-Ebell <babinebell@trustcenter.de>]
 5312 
 5313   *) Improve diagnostics in file reading and command-line digests.
 5314      [Ben Laurie aided and abetted by Solar Designer <solar@openwall.com>]
 5315 
 5316   *) Add AES modes CFB and OFB to the object database.  Correct an
 5317      error in AES-CFB decryption.
 5318      [Richard Levitte]
 5319 
 5320   *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
 5321      allows existing EVP_CIPHER_CTX structures to be reused after
 5322      calling EVP_*Final(). This behaviour is used by encryption
 5323      BIOs and some applications. This has the side effect that
 5324      applications must explicitly clean up cipher contexts with
 5325      EVP_CIPHER_CTX_cleanup() or they will leak memory.
 5326      [Steve Henson]
 5327 
 5328   *) Check the values of dna and dnb in bn_mul_recursive before calling
 5329      bn_mul_comba (a non zero value means the a or b arrays do not contain
 5330      n2 elements) and fallback to bn_mul_normal if either is not zero.
 5331      [Steve Henson]
 5332 
 5333   *) Fix escaping of non-ASCII characters when using the -subj option
 5334      of the "openssl req" command line tool. (Robert Joop <joop@fokus.gmd.de>)
 5335      [Lutz Jaenicke]
 5336 
 5337   *) Make object definitions compliant to LDAP (RFC2256): SN is the short
 5338      form for "surname", serialNumber has no short form.
 5339      Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
 5340      therefore remove "mail" short name for "internet 7".
 5341      The OID for unique identifiers in X509 certificates is
 5342      x500UniqueIdentifier, not uniqueIdentifier.
 5343      Some more OID additions. (Michael Bell <michael.bell@rz.hu-berlin.de>)
 5344      [Lutz Jaenicke]
 5345 
 5346   *) Add an "init" command to the ENGINE config module and auto initialize
 5347      ENGINEs. Without any "init" command the ENGINE will be initialized 
 5348      after all ctrl commands have been executed on it. If init=1 the 
 5349      ENGINE is initailized at that point (ctrls before that point are run
 5350      on the uninitialized ENGINE and after on the initialized one). If
 5351      init=0 then the ENGINE will not be iniatialized at all.
 5352      [Steve Henson]
 5353 
 5354   *) Fix the 'app_verify_callback' interface so that the user-defined
 5355      argument is actually passed to the callback: In the
 5356      SSL_CTX_set_cert_verify_callback() prototype, the callback
 5357      declaration has been changed from
 5358           int (*cb)()
 5359      into
 5360           int (*cb)(X509_STORE_CTX *,void *);
 5361      in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
 5362           i=s->ctx->app_verify_callback(&ctx)
 5363      has been changed into
 5364           i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
 5365 
 5366      To update applications using SSL_CTX_set_cert_verify_callback(),
 5367      a dummy argument can be added to their callback functions.
 5368      [D. K. Smetters <smetters@parc.xerox.com>]
 5369 
 5370   *) Added the '4758cca' ENGINE to support IBM 4758 cards.
 5371      [Maurice Gittens <maurice@gittens.nl>, touchups by Geoff Thorpe]
 5372 
 5373   *) Add and OPENSSL_LOAD_CONF define which will cause
 5374      OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
 5375      This allows older applications to transparently support certain
 5376      OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
 5377      Two new functions OPENSSL_add_all_algorithms_noconf() which will never
 5378      load the config file and OPENSSL_add_all_algorithms_conf() which will
 5379      always load it have also been added.
 5380      [Steve Henson]
 5381 
 5382   *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
 5383      Adjust NIDs and EVP layer.
 5384      [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]
 5385 
 5386   *) Config modules support in openssl utility.
 5387 
 5388      Most commands now load modules from the config file,
 5389      though in a few (such as version) this isn't done 
 5390      because it couldn't be used for anything.
 5391 
 5392      In the case of ca and req the config file used is
 5393      the same as the utility itself: that is the -config
 5394      command line option can be used to specify an
 5395      alternative file.
 5396      [Steve Henson]
 5397 
 5398   *) Move default behaviour from OPENSSL_config(). If appname is NULL
 5399      use "openssl_conf" if filename is NULL use default openssl config file.
 5400      [Steve Henson]
 5401 
 5402   *) Add an argument to OPENSSL_config() to allow the use of an alternative
 5403      config section name. Add a new flag to tolerate a missing config file
 5404      and move code to CONF_modules_load_file().
 5405      [Steve Henson]
 5406 
 5407   *) Support for crypto accelerator cards from Accelerated Encryption
 5408      Processing, www.aep.ie.  (Use engine 'aep')
 5409      The support was copied from 0.9.6c [engine] and adapted/corrected
 5410      to work with the new engine framework.
 5411      [AEP Inc. and Richard Levitte]
 5412 
 5413   *) Support for SureWare crypto accelerator cards from Baltimore
 5414      Technologies.  (Use engine 'sureware')
 5415      The support was copied from 0.9.6c [engine] and adapted
 5416      to work with the new engine framework.
 5417      [Richard Levitte]
 5418 
 5419   *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
 5420      make the newer ENGINE framework commands for the CHIL engine work.
 5421      [Toomas Kiisk <vix@cyber.ee> and Richard Levitte]
 5422 
 5423   *) Make it possible to produce shared libraries on ReliantUNIX.
 5424      [Robert Dahlem <Robert.Dahlem@ffm2.siemens.de> via Richard Levitte]
 5425 
 5426   *) Add the configuration target debug-linux-ppro.
 5427      Make 'openssl rsa' use the general key loading routines
 5428      implemented in apps.c, and make those routines able to
 5429      handle the key format FORMAT_NETSCAPE and the variant
 5430      FORMAT_IISSGC.
 5431      [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
 5432 
 5433  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
 5434      [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
 5435 
 5436   *) Add -keyform to rsautl, and document -engine.
 5437      [Richard Levitte, inspired by Toomas Kiisk <vix@cyber.ee>]
 5438 
 5439   *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
 5440      BIO_R_NO_SUCH_FILE error code rather than the generic
 5441      ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
 5442      [Ben Laurie]
 5443 
 5444   *) Add new functions
 5445           ERR_peek_last_error
 5446           ERR_peek_last_error_line
 5447           ERR_peek_last_error_line_data.
 5448      These are similar to
 5449           ERR_peek_error
 5450           ERR_peek_error_line
 5451           ERR_peek_error_line_data,
 5452      but report on the latest error recorded rather than the first one
 5453      still in the error queue.
 5454      [Ben Laurie, Bodo Moeller]
 5455         
 5456   *) default_algorithms option in ENGINE config module. This allows things
 5457      like:
 5458      default_algorithms = ALL
 5459      default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
 5460      [Steve Henson]
 5461 
 5462   *) Prelminary ENGINE config module.
 5463      [Steve Henson]
 5464 
 5465   *) New experimental application configuration code.
 5466      [Steve Henson]
 5467 
 5468   *) Change the AES code to follow the same name structure as all other
 5469      symmetric ciphers, and behave the same way.  Move everything to
 5470      the directory crypto/aes, thereby obsoleting crypto/rijndael.
 5471      [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]
 5472 
 5473   *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
 5474      [Ben Laurie and Theo de Raadt]
 5475 
 5476   *) Add option to output public keys in req command.
 5477      [Massimiliano Pala madwolf@openca.org]
 5478 
 5479   *) Use wNAFs in EC_POINTs_mul() for improved efficiency
 5480      (up to about 10% better than before for P-192 and P-224).
 5481      [Bodo Moeller]
 5482 
 5483   *) New functions/macros
 5484 
 5485           SSL_CTX_set_msg_callback(ctx, cb)
 5486           SSL_CTX_set_msg_callback_arg(ctx, arg)
 5487           SSL_set_msg_callback(ssl, cb)
 5488           SSL_set_msg_callback_arg(ssl, arg)
 5489 
 5490      to request calling a callback function
 5491 
 5492           void cb(int write_p, int version, int content_type,
 5493                   const void *buf, size_t len, SSL *ssl, void *arg)
 5494 
 5495      whenever a protocol message has been completely received
 5496      (write_p == 0) or sent (write_p == 1).  Here 'version' is the
 5497      protocol version  according to which the SSL library interprets
 5498      the current protocol message (SSL2_VERSION, SSL3_VERSION, or
 5499      TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
 5500      the content type as defined in the SSL 3.0/TLS 1.0 protocol
 5501      specification (change_cipher_spec(20), alert(21), handshake(22)).
 5502      'buf' and 'len' point to the actual message, 'ssl' to the
 5503      SSL object, and 'arg' is the application-defined value set by
 5504      SSL[_CTX]_set_msg_callback_arg().
 5505 
 5506      'openssl s_client' and 'openssl s_server' have new '-msg' options
 5507      to enable a callback that displays all protocol messages.
 5508      [Bodo Moeller]
 5509 
 5510   *) Change the shared library support so shared libraries are built as
 5511      soon as the corresponding static library is finished, and thereby get
 5512      openssl and the test programs linked against the shared library.
 5513      This still only happens when the keyword "shard" has been given to
 5514      the configuration scripts.
 5515 
 5516      NOTE: shared library support is still an experimental thing, and
 5517      backward binary compatibility is still not guaranteed.
 5518      ["Maciej W. Rozycki" <macro@ds2.pg.gda.pl> and Richard Levitte]
 5519 
 5520   *) Add support for Subject Information Access extension.
 5521      [Peter Sylvester <Peter.Sylvester@EdelWeb.fr>]
 5522 
 5523   *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
 5524      additional bytes when new memory had to be allocated, not just
 5525      when reusing an existing buffer.
 5526      [Bodo Moeller]
 5527 
 5528   *) New command line and configuration option 'utf8' for the req command.
 5529      This allows field values to be specified as UTF8 strings.
 5530      [Steve Henson]
 5531 
 5532   *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
 5533      runs for the former and machine-readable output for the latter.
 5534      [Ben Laurie]
 5535 
 5536   *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
 5537      of the e-mail address in the DN (i.e., it will go into a certificate
 5538      extension only).  The new configuration file option 'email_in_dn = no'
 5539      has the same effect.
 5540      [Massimiliano Pala madwolf@openca.org]
 5541 
 5542   *) Change all functions with names starting with des_ to be starting
 5543      with DES_ instead.  Add wrappers that are compatible with libdes,
 5544      but are named _ossl_old_des_*.  Finally, add macros that map the
 5545      des_* symbols to the corresponding _ossl_old_des_* if libdes
 5546      compatibility is desired.  If OpenSSL 0.9.6c compatibility is
 5547      desired, the des_* symbols will be mapped to DES_*, with one
 5548      exception.
 5549 
 5550      Since we provide two compatibility mappings, the user needs to
 5551      define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
 5552      compatibility is desired.  The default (i.e., when that macro
 5553      isn't defined) is OpenSSL 0.9.6c compatibility.
 5554 
 5555      There are also macros that enable and disable the support of old
 5556      des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
 5557      and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
 5558      are defined, the default will apply: to support the old des routines.
 5559 
 5560      In either case, one must include openssl/des.h to get the correct
 5561      definitions.  Do not try to just include openssl/des_old.h, that
 5562      won't work.
 5563 
 5564      NOTE: This is a major break of an old API into a new one.  Software
 5565      authors are encouraged to switch to the DES_ style functions.  Some
 5566      time in the future, des_old.h and the libdes compatibility functions
 5567      will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
 5568      default), and then completely removed.
 5569      [Richard Levitte]
 5570 
 5571   *) Test for certificates which contain unsupported critical extensions.
 5572      If such a certificate is found during a verify operation it is 
 5573      rejected by default: this behaviour can be overridden by either
 5574      handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
 5575      by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
 5576      X509_supported_extension() has also been added which returns 1 if a
 5577      particular extension is supported.
 5578      [Steve Henson]
 5579 
 5580   *) Modify the behaviour of EVP cipher functions in similar way to digests
 5581      to retain compatibility with existing code.
 5582      [Steve Henson]
 5583 
 5584   *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
 5585      compatibility with existing code. In particular the 'ctx' parameter does
 5586      not have to be to be initialized before the call to EVP_DigestInit() and
 5587      it is tidied up after a call to EVP_DigestFinal(). New function
 5588      EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
 5589      EVP_MD_CTX_copy() changed to not require the destination to be
 5590      initialized valid and new function EVP_MD_CTX_copy_ex() added which
 5591      requires the destination to be valid.
 5592 
 5593      Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
 5594      EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
 5595      [Steve Henson]
 5596 
 5597   *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
 5598      so that complete 'Handshake' protocol structures are kept in memory
 5599      instead of overwriting 'msg_type' and 'length' with 'body' data.
 5600      [Bodo Moeller]
 5601 
 5602   *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
 5603      [Massimo Santin via Richard Levitte]
 5604 
 5605   *) Major restructuring to the underlying ENGINE code. This includes
 5606      reduction of linker bloat, separation of pure "ENGINE" manipulation
 5607      (initialisation, etc) from functionality dealing with implementations
 5608      of specific crypto iterfaces. This change also introduces integrated
 5609      support for symmetric ciphers and digest implementations - so ENGINEs
 5610      can now accelerate these by providing EVP_CIPHER and EVP_MD
 5611      implementations of their own. This is detailed in crypto/engine/README
 5612      as it couldn't be adequately described here. However, there are a few
 5613      API changes worth noting - some RSA, DSA, DH, and RAND functions that
 5614      were changed in the original introduction of ENGINE code have now
 5615      reverted back - the hooking from this code to ENGINE is now a good
 5616      deal more passive and at run-time, operations deal directly with
 5617      RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
 5618      dereferencing through an ENGINE pointer any more. Also, the ENGINE
 5619      functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
 5620      they were not being used by the framework as there is no concept of a
 5621      BIGNUM_METHOD and they could not be generalised to the new
 5622      'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
 5623      ENGINE_cpy() has been removed as it cannot be consistently defined in
 5624      the new code.
 5625      [Geoff Thorpe]
 5626 
 5627   *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
 5628      [Steve Henson]
 5629 
 5630   *) Change mkdef.pl to sort symbols that get the same entry number,
 5631      and make sure the automatically generated functions ERR_load_*
 5632      become part of libeay.num as well.
 5633      [Richard Levitte]
 5634 
 5635   *) New function SSL_renegotiate_pending().  This returns true once
 5636      renegotiation has been requested (either SSL_renegotiate() call
 5637      or HelloRequest/ClientHello receveived from the peer) and becomes
 5638      false once a handshake has been completed.
 5639      (For servers, SSL_renegotiate() followed by SSL_do_handshake()
 5640      sends a HelloRequest, but does not ensure that a handshake takes
 5641      place.  SSL_renegotiate_pending() is useful for checking if the
 5642      client has followed the request.)
 5643      [Bodo Moeller]
 5644 
 5645   *) New SSL option SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION.
 5646      By default, clients may request session resumption even during
 5647      renegotiation (if session ID contexts permit); with this option,
 5648      session resumption is possible only in the first handshake.
 5649 
 5650      SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
 5651      more bits available for options that should not be part of
 5652      SSL_OP_ALL (such as SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION).
 5653      [Bodo Moeller]
 5654 
 5655   *) Add some demos for certificate and certificate request creation.
 5656      [Steve Henson]
 5657 
 5658   *) Make maximum certificate chain size accepted from the peer application
 5659      settable (SSL*_get/set_max_cert_list()), as proposed by
 5660      "Douglas E. Engert" <deengert@anl.gov>.
 5661      [Lutz Jaenicke]
 5662 
 5663   *) Add support for shared libraries for Unixware-7
 5664      (Boyd Lynn Gerber <gerberb@zenez.com>).
 5665      [Lutz Jaenicke]
 5666 
 5667   *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
 5668      be done prior to destruction. Use this to unload error strings from
 5669      ENGINEs that load their own error strings. NB: This adds two new API
 5670      functions to "get" and "set" this destroy handler in an ENGINE.
 5671      [Geoff Thorpe]
 5672 
 5673   *) Alter all existing ENGINE implementations (except "openssl" and
 5674      "openbsd") to dynamically instantiate their own error strings. This
 5675      makes them more flexible to be built both as statically-linked ENGINEs
 5676      and self-contained shared-libraries loadable via the "dynamic" ENGINE.
 5677      Also, add stub code to each that makes building them as self-contained
 5678      shared-libraries easier (see README.ENGINE).
 5679      [Geoff Thorpe]
 5680 
 5681   *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
 5682      implementations into applications that are completely implemented in
 5683      self-contained shared-libraries. The "dynamic" ENGINE exposes control
 5684      commands that can be used to configure what shared-library to load and
 5685      to control aspects of the way it is handled. Also, made an update to
 5686      the README.ENGINE file that brings its information up-to-date and
 5687      provides some information and instructions on the "dynamic" ENGINE
 5688      (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
 5689      [Geoff Thorpe]
 5690 
 5691   *) Make it possible to unload ranges of ERR strings with a new
 5692      "ERR_unload_strings" function.
 5693      [Geoff Thorpe]
 5694 
 5695   *) Add a copy() function to EVP_MD.
 5696      [Ben Laurie]
 5697 
 5698   *) Make EVP_MD routines take a context pointer instead of just the
 5699      md_data void pointer.
 5700      [Ben Laurie]
 5701 
 5702   *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
 5703      that the digest can only process a single chunk of data
 5704      (typically because it is provided by a piece of
 5705      hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
 5706      is only going to provide a single chunk of data, and hence the
 5707      framework needn't accumulate the data for oneshot drivers.
 5708      [Ben Laurie]
 5709 
 5710   *) As with "ERR", make it possible to replace the underlying "ex_data"
 5711      functions. This change also alters the storage and management of global
 5712      ex_data state - it's now all inside ex_data.c and all "class" code (eg.
 5713      RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
 5714      index counters. The API functions that use this state have been changed
 5715      to take a "class_index" rather than pointers to the class's local STACK
 5716      and counter, and there is now an API function to dynamically create new
 5717      classes. This centralisation allows us to (a) plug a lot of the
 5718      thread-safety problems that existed, and (b) makes it possible to clean
 5719      up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
 5720      such data would previously have always leaked in application code and
 5721      workarounds were in place to make the memory debugging turn a blind eye
 5722      to it. Application code that doesn't use this new function will still
 5723      leak as before, but their memory debugging output will announce it now
 5724      rather than letting it slide.
 5725 
 5726      Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
 5727      induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
 5728      has a return value to indicate success or failure.
 5729      [Geoff Thorpe]
 5730 
 5731   *) Make it possible to replace the underlying "ERR" functions such that the
 5732      global state (2 LHASH tables and 2 locks) is only used by the "default"
 5733      implementation. This change also adds two functions to "get" and "set"
 5734      the implementation prior to it being automatically set the first time
 5735      any other ERR function takes place. Ie. an application can call "get",
 5736      pass the return value to a module it has just loaded, and that module
 5737      can call its own "set" function using that value. This means the
 5738      module's "ERR" operations will use (and modify) the error state in the
 5739      application and not in its own statically linked copy of OpenSSL code.
 5740      [Geoff Thorpe]
 5741 
 5742   *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
 5743      reference counts. This performs normal REF_PRINT/REF_CHECK macros on
 5744      the operation, and provides a more encapsulated way for external code
 5745      (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
 5746      to use these functions rather than manually incrementing the counts.
 5747 
 5748      Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
 5749      [Geoff Thorpe]
 5750 
 5751   *) Add EVP test program.
 5752      [Ben Laurie]
 5753 
 5754   *) Add symmetric cipher support to ENGINE. Expect the API to change!
 5755      [Ben Laurie]
 5756 
 5757   *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
 5758      X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
 5759      X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
 5760      These allow a CRL to be built without having to access X509_CRL fields
 5761      directly. Modify 'ca' application to use new functions.
 5762      [Steve Henson]
 5763 
 5764   *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
 5765      bug workarounds. Rollback attack detection is a security feature.
 5766      The problem will only arise on OpenSSL servers when TLSv1 is not
 5767      available (sslv3_server_method() or SSL_OP_NO_TLSv1).
 5768      Software authors not wanting to support TLSv1 will have special reasons
 5769      for their choice and can explicitly enable this option.
 5770      [Bodo Moeller, Lutz Jaenicke]
 5771 
 5772   *) Rationalise EVP so it can be extended: don't include a union of
 5773      cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
 5774      (similar to those existing for EVP_CIPHER_CTX).
 5775      Usage example:
 5776 
 5777          EVP_MD_CTX md;
 5778 
 5779          EVP_MD_CTX_init(&md);             /* new function call */
 5780          EVP_DigestInit(&md, EVP_sha1());
 5781          EVP_DigestUpdate(&md, in, len);
 5782          EVP_DigestFinal(&md, out, NULL);
 5783          EVP_MD_CTX_cleanup(&md);          /* new function call */
 5784 
 5785      [Ben Laurie]
 5786 
 5787   *) Make DES key schedule conform to the usual scheme, as well as
 5788      correcting its structure. This means that calls to DES functions
 5789      now have to pass a pointer to a des_key_schedule instead of a
 5790      plain des_key_schedule (which was actually always a pointer
 5791      anyway): E.g.,
 5792 
 5793          des_key_schedule ks;
 5794 
 5795 	 des_set_key_checked(..., &ks);
 5796 	 des_ncbc_encrypt(..., &ks, ...);
 5797 
 5798      (Note that a later change renames 'des_...' into 'DES_...'.)
 5799      [Ben Laurie]
 5800 
 5801   *) Initial reduction of linker bloat: the use of some functions, such as
 5802      PEM causes large amounts of unused functions to be linked in due to
 5803      poor organisation. For example pem_all.c contains every PEM function
 5804      which has a knock on effect of linking in large amounts of (unused)
 5805      ASN1 code. Grouping together similar functions and splitting unrelated
 5806      functions prevents this.
 5807      [Steve Henson]
 5808 
 5809   *) Cleanup of EVP macros.
 5810      [Ben Laurie]
 5811 
 5812   *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
 5813      correct _ecb suffix.
 5814      [Ben Laurie]
 5815 
 5816   *) Add initial OCSP responder support to ocsp application. The
 5817      revocation information is handled using the text based index
 5818      use by the ca application. The responder can either handle
 5819      requests generated internally, supplied in files (for example
 5820      via a CGI script) or using an internal minimal server.
 5821      [Steve Henson]
 5822 
 5823   *) Add configuration choices to get zlib compression for TLS.
 5824      [Richard Levitte]
 5825 
 5826   *) Changes to Kerberos SSL for RFC 2712 compliance:
 5827      1.  Implemented real KerberosWrapper, instead of just using
 5828          KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw@sxw.org.uk>]
 5829      2.  Implemented optional authenticator field of KerberosWrapper.
 5830 
 5831      Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
 5832      and authenticator structs; see crypto/krb5/.
 5833 
 5834      Generalized Kerberos calls to support multiple Kerberos libraries.
 5835      [Vern Staats <staatsvr@asc.hpc.mil>,
 5836       Jeffrey Altman <jaltman@columbia.edu>
 5837       via Richard Levitte]
 5838 
 5839   *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
 5840      already does with RSA. testdsa.h now has 'priv_key/pub_key'
 5841      values for each of the key sizes rather than having just
 5842      parameters (and 'speed' generating keys each time).
 5843      [Geoff Thorpe]
 5844 
 5845   *) Speed up EVP routines.
 5846      Before:
 5847 encrypt
 5848 type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
 5849 des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
 5850 des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
 5851 des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
 5852 decrypt
 5853 des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
 5854 des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
 5855 des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
 5856      After:
 5857 encrypt
 5858 des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
 5859 decrypt
 5860 des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
 5861      [Ben Laurie]
 5862 
 5863   *) Added the OS2-EMX target.
 5864      ["Brian Havard" <brianh@kheldar.apana.org.au> and Richard Levitte]
 5865 
 5866   *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
 5867      to support NCONF routines in extension code. New function CONF_set_nconf()
 5868      to allow functions which take an NCONF to also handle the old LHASH
 5869      structure: this means that the old CONF compatible routines can be
 5870      retained (in particular wrt extensions) without having to duplicate the
 5871      code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
 5872      [Steve Henson]
 5873 
 5874   *) Enhance the general user interface with mechanisms for inner control
 5875      and with possibilities to have yes/no kind of prompts.
 5876      [Richard Levitte]
 5877 
 5878   *) Change all calls to low level digest routines in the library and
 5879      applications to use EVP. Add missing calls to HMAC_cleanup() and
 5880      don't assume HMAC_CTX can be copied using memcpy().
 5881      [Verdon Walker <VWalker@novell.com>, Steve Henson]
 5882 
 5883   *) Add the possibility to control engines through control names but with
 5884      arbitrary arguments instead of just a string.
 5885      Change the key loaders to take a UI_METHOD instead of a callback
 5886      function pointer.  NOTE: this breaks binary compatibility with earlier
 5887      versions of OpenSSL [engine].
 5888      Adapt the nCipher code for these new conditions and add a card insertion
 5889      callback.
 5890      [Richard Levitte]
 5891 
 5892   *) Enhance the general user interface with mechanisms to better support
 5893      dialog box interfaces, application-defined prompts, the possibility
 5894      to use defaults (for example default passwords from somewhere else)
 5895      and interrupts/cancellations.
 5896      [Richard Levitte]
 5897 
 5898   *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
 5899      attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
 5900      [Steve Henson]
 5901 
 5902   *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
 5903      tidy up some unnecessarily weird code in 'sk_new()').
 5904      [Geoff, reported by Diego Tartara <dtartara@novamens.com>]
 5905 
 5906   *) Change the key loading routines for ENGINEs to use the same kind
 5907      callback (pem_password_cb) as all other routines that need this
 5908      kind of callback.
 5909      [Richard Levitte]
 5910 
 5911   *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
 5912      256 bit (=32 byte) keys. Of course seeding with more entropy bytes
 5913      than this minimum value is recommended.
 5914      [Lutz Jaenicke]
 5915 
 5916   *) New random seeder for OpenVMS, using the system process statistics
 5917      that are easily reachable.
 5918      [Richard Levitte]
 5919 
 5920   *) Windows apparently can't transparently handle global
 5921      variables defined in DLLs. Initialisations such as:
 5922 
 5923         const ASN1_ITEM *it = &ASN1_INTEGER_it;
 5924 
 5925      wont compile. This is used by the any applications that need to
 5926      declare their own ASN1 modules. This was fixed by adding the option
 5927      EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
 5928      needed for static libraries under Win32.
 5929      [Steve Henson]
 5930 
 5931   *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
 5932      setting of purpose and trust fields. New X509_STORE trust and
 5933      purpose functions and tidy up setting in other SSL functions.
 5934      [Steve Henson]
 5935 
 5936   *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
 5937      structure. These are inherited by X509_STORE_CTX when it is 
 5938      initialised. This allows various defaults to be set in the
 5939      X509_STORE structure (such as flags for CRL checking and custom
 5940      purpose or trust settings) for functions which only use X509_STORE_CTX
 5941      internally such as S/MIME.
 5942 
 5943      Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
 5944      trust settings if they are not set in X509_STORE. This allows X509_STORE
 5945      purposes and trust (in S/MIME for example) to override any set by default.
 5946 
 5947      Add command line options for CRL checking to smime, s_client and s_server
 5948      applications.
 5949      [Steve Henson]
 5950 
 5951   *) Initial CRL based revocation checking. If the CRL checking flag(s)
 5952      are set then the CRL is looked up in the X509_STORE structure and
 5953      its validity and signature checked, then if the certificate is found
 5954      in the CRL the verify fails with a revoked error.
 5955 
 5956      Various new CRL related callbacks added to X509_STORE_CTX structure.
 5957 
 5958      Command line options added to 'verify' application to support this.
 5959 
 5960      This needs some additional work, such as being able to handle multiple
 5961      CRLs with different times, extension based lookup (rather than just
 5962      by subject name) and ultimately more complete V2 CRL extension
 5963      handling.
 5964      [Steve Henson]
 5965 
 5966   *) Add a general user interface API (crypto/ui/).  This is designed
 5967      to replace things like des_read_password and friends (backward
 5968      compatibility functions using this new API are provided).
 5969      The purpose is to remove prompting functions from the DES code
 5970      section as well as provide for prompting through dialog boxes in
 5971      a window system and the like.
 5972      [Richard Levitte]
 5973 
 5974   *) Add "ex_data" support to ENGINE so implementations can add state at a
 5975      per-structure level rather than having to store it globally.
 5976      [Geoff]
 5977 
 5978   *) Make it possible for ENGINE structures to be copied when retrieved by
 5979      ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
 5980      This causes the "original" ENGINE structure to act like a template,
 5981      analogous to the RSA vs. RSA_METHOD type of separation. Because of this
 5982      operational state can be localised to each ENGINE structure, despite the
 5983      fact they all share the same "methods". New ENGINE structures returned in
 5984      this case have no functional references and the return value is the single
 5985      structural reference. This matches the single structural reference returned
 5986      by ENGINE_by_id() normally, when it is incremented on the pre-existing
 5987      ENGINE structure.
 5988      [Geoff]
 5989 
 5990   *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
 5991      needs to match any other type at all we need to manually clear the
 5992      tag cache.
 5993      [Steve Henson]
 5994 
 5995   *) Changes to the "openssl engine" utility to include;
 5996      - verbosity levels ('-v', '-vv', and '-vvv') that provide information
 5997        about an ENGINE's available control commands.
 5998      - executing control commands from command line arguments using the
 5999        '-pre' and '-post' switches. '-post' is only used if '-t' is
 6000        specified and the ENGINE is successfully initialised. The syntax for
 6001        the individual commands are colon-separated, for example;
 6002 	 openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
 6003      [Geoff]
 6004 
 6005   *) New dynamic control command support for ENGINEs. ENGINEs can now
 6006      declare their own commands (numbers), names (strings), descriptions,
 6007      and input types for run-time discovery by calling applications. A
 6008      subset of these commands are implicitly classed as "executable"
 6009      depending on their input type, and only these can be invoked through
 6010      the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
 6011      can be based on user input, config files, etc). The distinction is
 6012      that "executable" commands cannot return anything other than a boolean
 6013      result and can only support numeric or string input, whereas some
 6014      discoverable commands may only be for direct use through
 6015      ENGINE_ctrl(), eg. supporting the exchange of binary data, function
 6016      pointers, or other custom uses. The "executable" commands are to
 6017      support parameterisations of ENGINE behaviour that can be
 6018      unambiguously defined by ENGINEs and used consistently across any
 6019      OpenSSL-based application. Commands have been added to all the
 6020      existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
 6021      control over shared-library paths without source code alterations.
 6022      [Geoff]
 6023 
 6024   *) Changed all ENGINE implementations to dynamically allocate their
 6025      ENGINEs rather than declaring them statically. Apart from this being
 6026      necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
 6027      this also allows the implementations to compile without using the
 6028      internal engine_int.h header.
 6029      [Geoff]
 6030 
 6031   *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
 6032      'const' value. Any code that should be able to modify a RAND_METHOD
 6033      should already have non-const pointers to it (ie. they should only
 6034      modify their own ones).
 6035      [Geoff]
 6036 
 6037   *) Made a variety of little tweaks to the ENGINE code.
 6038      - "atalla" and "ubsec" string definitions were moved from header files
 6039        to C code. "nuron" string definitions were placed in variables
 6040        rather than hard-coded - allowing parameterisation of these values
 6041        later on via ctrl() commands.
 6042      - Removed unused "#if 0"'d code.
 6043      - Fixed engine list iteration code so it uses ENGINE_free() to release
 6044        structural references.
 6045      - Constified the RAND_METHOD element of ENGINE structures.
 6046      - Constified various get/set functions as appropriate and added
 6047        missing functions (including a catch-all ENGINE_cpy that duplicates
 6048        all ENGINE values onto a new ENGINE except reference counts/state).
 6049      - Removed NULL parameter checks in get/set functions. Setting a method
 6050        or function to NULL is a way of cancelling out a previously set
 6051        value.  Passing a NULL ENGINE parameter is just plain stupid anyway
 6052        and doesn't justify the extra error symbols and code.
 6053      - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
 6054        flags from engine_int.h to engine.h.
 6055      - Changed prototypes for ENGINE handler functions (init(), finish(),
 6056        ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
 6057      [Geoff]
 6058 
 6059   *) Implement binary inversion algorithm for BN_mod_inverse in addition
 6060      to the algorithm using long division.  The binary algorithm can be
 6061      used only if the modulus is odd.  On 32-bit systems, it is faster
 6062      only for relatively small moduli (roughly 20-30% for 128-bit moduli,
 6063      roughly 5-15% for 256-bit moduli), so we use it only for moduli
 6064      up to 450 bits.  In 64-bit environments, the binary algorithm
 6065      appears to be advantageous for much longer moduli; here we use it
 6066      for moduli up to 2048 bits.
 6067      [Bodo Moeller]
 6068 
 6069   *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
 6070      could not support the combine flag in choice fields.
 6071      [Steve Henson]
 6072 
 6073   *) Add a 'copy_extensions' option to the 'ca' utility. This copies
 6074      extensions from a certificate request to the certificate.
 6075      [Steve Henson]
 6076 
 6077   *) Allow multiple 'certopt' and 'nameopt' options to be separated
 6078      by commas. Add 'namopt' and 'certopt' options to the 'ca' config
 6079      file: this allows the display of the certificate about to be
 6080      signed to be customised, to allow certain fields to be included
 6081      or excluded and extension details. The old system didn't display
 6082      multicharacter strings properly, omitted fields not in the policy
 6083      and couldn't display additional details such as extensions.
 6084      [Steve Henson]
 6085 
 6086   *) Function EC_POINTs_mul for multiple scalar multiplication
 6087      of an arbitrary number of elliptic curve points
 6088           \sum scalars[i]*points[i],
 6089      optionally including the generator defined for the EC_GROUP:
 6090           scalar*generator +  \sum scalars[i]*points[i].
 6091 
 6092      EC_POINT_mul is a simple wrapper function for the typical case
 6093      that the point list has just one item (besides the optional
 6094      generator).
 6095      [Bodo Moeller]
 6096 
 6097   *) First EC_METHODs for curves over GF(p):
 6098 
 6099      EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
 6100      operations and provides various method functions that can also
 6101      operate with faster implementations of modular arithmetic.     
 6102 
 6103      EC_GFp_mont_method() reuses most functions that are part of
 6104      EC_GFp_simple_method, but uses Montgomery arithmetic.
 6105 
 6106      [Bodo Moeller; point addition and point doubling
 6107      implementation directly derived from source code provided by
 6108      Lenka Fibikova <fibikova@exp-math.uni-essen.de>]
 6109 
 6110   *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
 6111      crypto/ec/ec_lib.c):
 6112 
 6113      Curves are EC_GROUP objects (with an optional group generator)
 6114      based on EC_METHODs that are built into the library.
 6115 
 6116      Points are EC_POINT objects based on EC_GROUP objects.
 6117 
 6118      Most of the framework would be able to handle curves over arbitrary
 6119      finite fields, but as there are no obvious types for fields other
 6120      than GF(p), some functions are limited to that for now.
 6121      [Bodo Moeller]
 6122 
 6123   *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
 6124      that the file contains a complete HTTP response.
 6125      [Richard Levitte]
 6126 
 6127   *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
 6128      change the def and num file printf format specifier from "%-40sXXX"
 6129      to "%-39s XXX". The latter will always guarantee a space after the
 6130      field while the former will cause them to run together if the field
 6131      is 40 of more characters long.
 6132      [Steve Henson]
 6133 
 6134   *) Constify the cipher and digest 'method' functions and structures
 6135      and modify related functions to take constant EVP_MD and EVP_CIPHER
 6136      pointers.
 6137      [Steve Henson]
 6138 
 6139   *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
 6140      in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
 6141      [Bodo Moeller]
 6142 
 6143   *) Modify EVP_Digest*() routines so they now return values. Although the
 6144      internal software routines can never fail additional hardware versions
 6145      might.
 6146      [Steve Henson]
 6147 
 6148   *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
 6149 
 6150      Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
 6151      (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
 6152 
 6153      ASN1 error codes
 6154           ERR_R_NESTED_ASN1_ERROR
 6155           ...
 6156           ERR_R_MISSING_ASN1_EOS
 6157      were 4 .. 9, conflicting with
 6158           ERR_LIB_RSA (= ERR_R_RSA_LIB)
 6159           ...
 6160           ERR_LIB_PEM (= ERR_R_PEM_LIB).
 6161      They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
 6162 
 6163      Add new error code 'ERR_R_INTERNAL_ERROR'.
 6164      [Bodo Moeller]
 6165 
 6166   *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
 6167      suffices.
 6168      [Bodo Moeller]
 6169 
 6170   *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
 6171      sets the subject name for a new request or supersedes the
 6172      subject name in a given request. Formats that can be parsed are
 6173           'CN=Some Name, OU=myOU, C=IT'
 6174      and
 6175           'CN=Some Name/OU=myOU/C=IT'.
 6176 
 6177      Add options '-batch' and '-verbose' to 'openssl req'.
 6178      [Massimiliano Pala <madwolf@hackmasters.net>]
 6179 
 6180   *) Introduce the possibility to access global variables through
 6181      functions on platform were that's the best way to handle exporting
 6182      global variables in shared libraries.  To enable this functionality,
 6183      one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
 6184      "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
 6185      is normally done by Configure or something similar).
 6186 
 6187      To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
 6188      in the source file (foo.c) like this:
 6189 
 6190 	OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
 6191 	OPENSSL_IMPLEMENT_GLOBAL(double,bar);
 6192 
 6193      To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
 6194      and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
 6195 
 6196 	OPENSSL_DECLARE_GLOBAL(int,foo);
 6197 	#define foo OPENSSL_GLOBAL_REF(foo)
 6198 	OPENSSL_DECLARE_GLOBAL(double,bar);
 6199 	#define bar OPENSSL_GLOBAL_REF(bar)
 6200 
 6201      The #defines are very important, and therefore so is including the
 6202      header file everywhere where the defined globals are used.
 6203 
 6204      The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
 6205      of ASN.1 items, but that structure is a bit different.
 6206 
 6207      The largest change is in util/mkdef.pl which has been enhanced with
 6208      better and easier to understand logic to choose which symbols should
 6209      go into the Windows .def files as well as a number of fixes and code
 6210      cleanup (among others, algorithm keywords are now sorted
 6211      lexicographically to avoid constant rewrites).
 6212      [Richard Levitte]
 6213 
 6214   *) In BN_div() keep a copy of the sign of 'num' before writing the
 6215      result to 'rm' because if rm==num the value will be overwritten
 6216      and produce the wrong result if 'num' is negative: this caused
 6217      problems with BN_mod() and BN_nnmod().
 6218      [Steve Henson]
 6219 
 6220   *) Function OCSP_request_verify(). This checks the signature on an
 6221      OCSP request and verifies the signer certificate. The signer
 6222      certificate is just checked for a generic purpose and OCSP request
 6223      trust settings.
 6224      [Steve Henson]
 6225 
 6226   *) Add OCSP_check_validity() function to check the validity of OCSP
 6227      responses. OCSP responses are prepared in real time and may only
 6228      be a few seconds old. Simply checking that the current time lies
 6229      between thisUpdate and nextUpdate max reject otherwise valid responses
 6230      caused by either OCSP responder or client clock inaccuracy. Instead
 6231      we allow thisUpdate and nextUpdate to fall within a certain period of
 6232      the current time. The age of the response can also optionally be
 6233      checked. Two new options -validity_period and -status_age added to
 6234      ocsp utility.
 6235      [Steve Henson]
 6236 
 6237   *) If signature or public key algorithm is unrecognized print out its
 6238      OID rather that just UNKNOWN.
 6239      [Steve Henson]
 6240 
 6241   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
 6242      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
 6243      ID to be generated from the issuer certificate alone which can then be
 6244      passed to OCSP_id_issuer_cmp().
 6245      [Steve Henson]
 6246 
 6247   *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
 6248      ASN1 modules to export functions returning ASN1_ITEM pointers
 6249      instead of the ASN1_ITEM structures themselves. This adds several
 6250      new macros which allow the underlying ASN1 function/structure to
 6251      be accessed transparently. As a result code should not use ASN1_ITEM
 6252      references directly (such as &X509_it) but instead use the relevant
 6253      macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
 6254      use of the new ASN1 code on platforms where exporting structures
 6255      is problematical (for example in shared libraries) but exporting
 6256      functions returning pointers to structures is not.
 6257      [Steve Henson]
 6258 
 6259   *) Add support for overriding the generation of SSL/TLS session IDs.
 6260      These callbacks can be registered either in an SSL_CTX or per SSL.
 6261      The purpose of this is to allow applications to control, if they wish,
 6262      the arbitrary values chosen for use as session IDs, particularly as it
 6263      can be useful for session caching in multiple-server environments. A
 6264      command-line switch for testing this (and any client code that wishes
 6265      to use such a feature) has been added to "s_server".
 6266      [Geoff Thorpe, Lutz Jaenicke]
 6267 
 6268   *) Modify mkdef.pl to recognise and parse preprocessor conditionals
 6269      of the form '#if defined(...) || defined(...) || ...' and
 6270      '#if !defined(...) && !defined(...) && ...'.  This also avoids
 6271      the growing number of special cases it was previously handling.
 6272      [Richard Levitte]
 6273 
 6274   *) Make all configuration macros available for application by making
 6275      sure they are available in opensslconf.h, by giving them names starting
 6276      with "OPENSSL_" to avoid conflicts with other packages and by making
 6277      sure e_os2.h will cover all platform-specific cases together with
 6278      opensslconf.h.
 6279      Additionally, it is now possible to define configuration/platform-
 6280      specific names (called "system identities").  In the C code, these
 6281      are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
 6282      macro with the name beginning with "OPENSSL_SYS_", which is determined
 6283      from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
 6284      what is available.
 6285      [Richard Levitte]
 6286 
 6287   *) New option -set_serial to 'req' and 'x509' this allows the serial
 6288      number to use to be specified on the command line. Previously self
 6289      signed certificates were hard coded with serial number 0 and the 
 6290      CA options of 'x509' had to use a serial number in a file which was
 6291      auto incremented.
 6292      [Steve Henson]
 6293 
 6294   *) New options to 'ca' utility to support V2 CRL entry extensions.
 6295      Currently CRL reason, invalidity date and hold instruction are
 6296      supported. Add new CRL extensions to V3 code and some new objects.
 6297      [Steve Henson]
 6298 
 6299   *) New function EVP_CIPHER_CTX_set_padding() this is used to
 6300      disable standard block padding (aka PKCS#5 padding) in the EVP
 6301      API, which was previously mandatory. This means that the data is
 6302      not padded in any way and so the total length much be a multiple
 6303      of the block size, otherwise an error occurs.
 6304      [Steve Henson]
 6305 
 6306   *) Initial (incomplete) OCSP SSL support.
 6307      [Steve Henson]
 6308 
 6309   *) New function OCSP_parse_url(). This splits up a URL into its host,
 6310      port and path components: primarily to parse OCSP URLs. New -url
 6311      option to ocsp utility.
 6312      [Steve Henson]
 6313 
 6314   *) New nonce behavior. The return value of OCSP_check_nonce() now 
 6315      reflects the various checks performed. Applications can decide
 6316      whether to tolerate certain situations such as an absent nonce
 6317      in a response when one was present in a request: the ocsp application
 6318      just prints out a warning. New function OCSP_add1_basic_nonce()
 6319      this is to allow responders to include a nonce in a response even if
 6320      the request is nonce-less.
 6321      [Steve Henson]
 6322 
 6323   *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
 6324      skipped when using openssl x509 multiple times on a single input file,
 6325      e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
 6326      [Bodo Moeller]
 6327 
 6328   *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
 6329      set string type: to handle setting ASN1_TIME structures. Fix ca
 6330      utility to correctly initialize revocation date of CRLs.
 6331      [Steve Henson]
 6332 
 6333   *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
 6334      the clients preferred ciphersuites and rather use its own preferences.
 6335      Should help to work around M$ SGC (Server Gated Cryptography) bug in
 6336      Internet Explorer by ensuring unchanged hash method during stepup.
 6337      (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
 6338      [Lutz Jaenicke]
 6339 
 6340   *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
 6341      to aes and add a new 'exist' option to print out symbols that don't
 6342      appear to exist.
 6343      [Steve Henson]
 6344 
 6345   *) Additional options to ocsp utility to allow flags to be set and
 6346      additional certificates supplied.
 6347      [Steve Henson]
 6348 
 6349   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
 6350      OCSP client a number of certificate to only verify the response
 6351      signature against.
 6352      [Richard Levitte]
 6353 
 6354   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
 6355      handle the new API. Currently only ECB, CBC modes supported. Add new
 6356      AES OIDs.
 6357 
 6358      Add TLS AES ciphersuites as described in RFC3268, "Advanced
 6359      Encryption Standard (AES) Ciphersuites for Transport Layer
 6360      Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
 6361      not enabled by default and were not part of the "ALL" ciphersuite
 6362      alias because they were not yet official; they could be
 6363      explicitly requested by specifying the "AESdraft" ciphersuite
 6364      group alias.  In the final release of OpenSSL 0.9.7, the group
 6365      alias is called "AES" and is part of "ALL".)
 6366      [Ben Laurie, Steve  Henson, Bodo Moeller]
 6367 
 6368   *) New function OCSP_copy_nonce() to copy nonce value (if present) from
 6369      request to response.
 6370      [Steve Henson]
 6371 
 6372   *) Functions for OCSP responders. OCSP_request_onereq_count(),
 6373      OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
 6374      extract information from a certificate request. OCSP_response_create()
 6375      creates a response and optionally adds a basic response structure.
 6376      OCSP_basic_add1_status() adds a complete single response to a basic
 6377      response and returns the OCSP_SINGLERESP structure just added (to allow
 6378      extensions to be included for example). OCSP_basic_add1_cert() adds a
 6379      certificate to a basic response and OCSP_basic_sign() signs a basic
 6380      response with various flags. New helper functions ASN1_TIME_check()
 6381      (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
 6382      (converts ASN1_TIME to GeneralizedTime).
 6383      [Steve Henson]
 6384 
 6385   *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
 6386      in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
 6387      structure from a certificate. X509_pubkey_digest() digests the public_key
 6388      contents: this is used in various key identifiers. 
 6389      [Steve Henson]
 6390 
 6391   *) Make sk_sort() tolerate a NULL argument.
 6392      [Steve Henson reported by Massimiliano Pala <madwolf@comune.modena.it>]
 6393 
 6394   *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
 6395      passed by the function are trusted implicitly. If any of them signed the
 6396      response then it is assumed to be valid and is not verified.
 6397      [Steve Henson]
 6398 
 6399   *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
 6400      to data. This was previously part of the PKCS7 ASN1 code. This
 6401      was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
 6402      [Steve Henson, reported by Kenneth R. Robinette
 6403 				<support@securenetterm.com>]
 6404 
 6405   *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
 6406      routines: without these tracing memory leaks is very painful.
 6407      Fix leaks in PKCS12 and PKCS7 routines.
 6408      [Steve Henson]
 6409 
 6410   *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
 6411      Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
 6412      effectively meant GeneralizedTime would never be used. Now it
 6413      is initialised to -1 but X509_time_adj() now has to check the value
 6414      and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
 6415      V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
 6416      [Steve Henson, reported by Kenneth R. Robinette
 6417 				<support@securenetterm.com>]
 6418 
 6419   *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
 6420      result in a zero length in the ASN1_INTEGER structure which was
 6421      not consistent with the structure when d2i_ASN1_INTEGER() was used
 6422      and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
 6423      to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
 6424      where it did not print out a minus for negative ASN1_INTEGER.
 6425      [Steve Henson]
 6426 
 6427   *) Add summary printout to ocsp utility. The various functions which
 6428      convert status values to strings have been renamed to:
 6429      OCSP_response_status_str(), OCSP_cert_status_str() and
 6430      OCSP_crl_reason_str() and are no longer static. New options
 6431      to verify nonce values and to disable verification. OCSP response
 6432      printout format cleaned up.
 6433      [Steve Henson]
 6434 
 6435   *) Add additional OCSP certificate checks. These are those specified
 6436      in RFC2560. This consists of two separate checks: the CA of the
 6437      certificate being checked must either be the OCSP signer certificate
 6438      or the issuer of the OCSP signer certificate. In the latter case the
 6439      OCSP signer certificate must contain the OCSP signing extended key
 6440      usage. This check is performed by attempting to match the OCSP
 6441      signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
 6442      in the OCSP_CERTID structures of the response.
 6443      [Steve Henson]
 6444 
 6445   *) Initial OCSP certificate verification added to OCSP_basic_verify()
 6446      and related routines. This uses the standard OpenSSL certificate
 6447      verify routines to perform initial checks (just CA validity) and
 6448      to obtain the certificate chain. Then additional checks will be
 6449      performed on the chain. Currently the root CA is checked to see
 6450      if it is explicitly trusted for OCSP signing. This is used to set
 6451      a root CA as a global signing root: that is any certificate that
 6452      chains to that CA is an acceptable OCSP signing certificate.
 6453      [Steve Henson]
 6454 
 6455   *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
 6456      extensions from a separate configuration file.
 6457      As when reading extensions from the main configuration file,
 6458      the '-extensions ...' option may be used for specifying the
 6459      section to use.
 6460      [Massimiliano Pala <madwolf@comune.modena.it>]
 6461 
 6462   *) New OCSP utility. Allows OCSP requests to be generated or
 6463      read. The request can be sent to a responder and the output
 6464      parsed, outputed or printed in text form. Not complete yet:
 6465      still needs to check the OCSP response validity.
 6466      [Steve Henson]
 6467 
 6468   *) New subcommands for 'openssl ca':
 6469      'openssl ca -status <serial>' prints the status of the cert with
 6470      the given serial number (according to the index file).
 6471      'openssl ca -updatedb' updates the expiry status of certificates
 6472      in the index file.
 6473      [Massimiliano Pala <madwolf@comune.modena.it>]
 6474 
 6475   *) New '-newreq-nodes' command option to CA.pl.  This is like
 6476      '-newreq', but calls 'openssl req' with the '-nodes' option
 6477      so that the resulting key is not encrypted.
 6478      [Damien Miller <djm@mindrot.org>]
 6479 
 6480   *) New configuration for the GNU Hurd.
 6481      [Jonathan Bartlett <johnnyb@wolfram.com> via Richard Levitte]
 6482 
 6483   *) Initial code to implement OCSP basic response verify. This
 6484      is currently incomplete. Currently just finds the signer's
 6485      certificate and verifies the signature on the response.
 6486      [Steve Henson]
 6487 
 6488   *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
 6489      value of OPENSSLDIR.  This is available via the new '-d' option
 6490      to 'openssl version', and is also included in 'openssl version -a'.
 6491      [Bodo Moeller]
 6492 
 6493   *) Allowing defining memory allocation callbacks that will be given
 6494      file name and line number information in additional arguments
 6495      (a const char* and an int).  The basic functionality remains, as
 6496      well as the original possibility to just replace malloc(),
 6497      realloc() and free() by functions that do not know about these
 6498      additional arguments.  To register and find out the current
 6499      settings for extended allocation functions, the following
 6500      functions are provided:
 6501 
 6502 	CRYPTO_set_mem_ex_functions
 6503 	CRYPTO_set_locked_mem_ex_functions
 6504 	CRYPTO_get_mem_ex_functions
 6505 	CRYPTO_get_locked_mem_ex_functions
 6506 
 6507      These work the same way as CRYPTO_set_mem_functions and friends.
 6508      CRYPTO_get_[locked_]mem_functions now writes 0 where such an
 6509      extended allocation function is enabled.
 6510      Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
 6511      a conventional allocation function is enabled.
 6512      [Richard Levitte, Bodo Moeller]
 6513 
 6514   *) Finish off removing the remaining LHASH function pointer casts.
 6515      There should no longer be any prototype-casting required when using
 6516      the LHASH abstraction, and any casts that remain are "bugs". See
 6517      the callback types and macros at the head of lhash.h for details
 6518      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
 6519      [Geoff Thorpe]
 6520 
 6521   *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
 6522      If /dev/[u]random devices are not available or do not return enough
 6523      entropy, EGD style sockets (served by EGD or PRNGD) will automatically
 6524      be queried.
 6525      The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
 6526      /etc/entropy will be queried once each in this sequence, quering stops
 6527      when enough entropy was collected without querying more sockets.
 6528      [Lutz Jaenicke]
 6529 
 6530   *) Change the Unix RAND_poll() variant to be able to poll several
 6531      random devices, as specified by DEVRANDOM, until a sufficient amount
 6532      of data has been collected.   We spend at most 10 ms on each file
 6533      (select timeout) and read in non-blocking mode.  DEVRANDOM now
 6534      defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
 6535      (previously it was just the string "/dev/urandom"), so on typical
 6536      platforms the 10 ms delay will never occur.
 6537      Also separate out the Unix variant to its own file, rand_unix.c.
 6538      For VMS, there's a currently-empty rand_vms.c.
 6539      [Richard Levitte]
 6540 
 6541   *) Move OCSP client related routines to ocsp_cl.c. These
 6542      provide utility functions which an application needing
 6543      to issue a request to an OCSP responder and analyse the
 6544      response will typically need: as opposed to those which an
 6545      OCSP responder itself would need which will be added later.
 6546 
 6547      OCSP_request_sign() signs an OCSP request with an API similar
 6548      to PKCS7_sign(). OCSP_response_status() returns status of OCSP
 6549      response. OCSP_response_get1_basic() extracts basic response
 6550      from response. OCSP_resp_find_status(): finds and extracts status
 6551      information from an OCSP_CERTID structure (which will be created
 6552      when the request structure is built). These are built from lower
 6553      level functions which work on OCSP_SINGLERESP structures but
 6554      wont normally be used unless the application wishes to examine
 6555      extensions in the OCSP response for example.
 6556 
 6557      Replace nonce routines with a pair of functions.
 6558      OCSP_request_add1_nonce() adds a nonce value and optionally
 6559      generates a random value. OCSP_check_nonce() checks the
 6560      validity of the nonce in an OCSP response.
 6561      [Steve Henson]
 6562 
 6563   *) Change function OCSP_request_add() to OCSP_request_add0_id().
 6564      This doesn't copy the supplied OCSP_CERTID and avoids the
 6565      need to free up the newly created id. Change return type
 6566      to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
 6567      This can then be used to add extensions to the request.
 6568      Deleted OCSP_request_new(), since most of its functionality
 6569      is now in OCSP_REQUEST_new() (and the case insensitive name
 6570      clash) apart from the ability to set the request name which
 6571      will be added elsewhere.
 6572      [Steve Henson]
 6573 
 6574   *) Update OCSP API. Remove obsolete extensions argument from
 6575      various functions. Extensions are now handled using the new
 6576      OCSP extension code. New simple OCSP HTTP function which 
 6577      can be used to send requests and parse the response.
 6578      [Steve Henson]
 6579 
 6580   *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
 6581      ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
 6582      uses the special reorder version of SET OF to sort the attributes
 6583      and reorder them to match the encoded order. This resolves a long
 6584      standing problem: a verify on a PKCS7 structure just after signing
 6585      it used to fail because the attribute order did not match the
 6586      encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
 6587      it uses the received order. This is necessary to tolerate some broken
 6588      software that does not order SET OF. This is handled by encoding
 6589      as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
 6590      to produce the required SET OF.
 6591      [Steve Henson]
 6592 
 6593   *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
 6594      OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
 6595      files to get correct declarations of the ASN.1 item variables.
 6596      [Richard Levitte]
 6597 
 6598   *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
 6599      PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
 6600      asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
 6601      NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
 6602      New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
 6603      ASN1_ITEM and no wrapper functions.
 6604      [Steve Henson]
 6605 
 6606   *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
 6607      replace the old function pointer based I/O routines. Change most of
 6608      the *_d2i_bio() and *_d2i_fp() functions to use these.
 6609      [Steve Henson]
 6610 
 6611   *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
 6612      lines, recognice more "algorithms" that can be deselected, and make
 6613      it complain about algorithm deselection that isn't recognised.
 6614      [Richard Levitte]
 6615 
 6616   *) New ASN1 functions to handle dup, sign, verify, digest, pack and
 6617      unpack operations in terms of ASN1_ITEM. Modify existing wrappers
 6618      to use new functions. Add NO_ASN1_OLD which can be set to remove
 6619      some old style ASN1 functions: this can be used to determine if old
 6620      code will still work when these eventually go away.
 6621      [Steve Henson]
 6622 
 6623   *) New extension functions for OCSP structures, these follow the
 6624      same conventions as certificates and CRLs.
 6625      [Steve Henson]
 6626 
 6627   *) New function X509V3_add1_i2d(). This automatically encodes and
 6628      adds an extension. Its behaviour can be customised with various
 6629      flags to append, replace or delete. Various wrappers added for
 6630      certifcates and CRLs.
 6631      [Steve Henson]
 6632 
 6633   *) Fix to avoid calling the underlying ASN1 print routine when
 6634      an extension cannot be parsed. Correct a typo in the
 6635      OCSP_SERVICELOC extension. Tidy up print OCSP format.
 6636      [Steve Henson]
 6637 
 6638   *) Make mkdef.pl parse some of the ASN1 macros and add apropriate
 6639      entries for variables.
 6640      [Steve Henson]
 6641 
 6642   *) Add functionality to apps/openssl.c for detecting locking
 6643      problems: As the program is single-threaded, all we have
 6644      to do is register a locking callback using an array for
 6645      storing which locks are currently held by the program.
 6646      [Bodo Moeller]
 6647 
 6648   *) Use a lock around the call to CRYPTO_get_ex_new_index() in
 6649      SSL_get_ex_data_X509_STORE_idx(), which is used in
 6650      ssl_verify_cert_chain() and thus can be called at any time
 6651      during TLS/SSL handshakes so that thread-safety is essential.
 6652      Unfortunately, the ex_data design is not at all suited
 6653      for multi-threaded use, so it probably should be abolished.
 6654      [Bodo Moeller]
 6655 
 6656   *) Added Broadcom "ubsec" ENGINE to OpenSSL.
 6657      [Broadcom, tweaked and integrated by Geoff Thorpe]
 6658 
 6659   *) Move common extension printing code to new function
 6660      X509V3_print_extensions(). Reorganise OCSP print routines and
 6661      implement some needed OCSP ASN1 functions. Add OCSP extensions.
 6662      [Steve Henson]
 6663 
 6664   *) New function X509_signature_print() to remove duplication in some
 6665      print routines.
 6666      [Steve Henson]
 6667 
 6668   *) Add a special meaning when SET OF and SEQUENCE OF flags are both
 6669      set (this was treated exactly the same as SET OF previously). This
 6670      is used to reorder the STACK representing the structure to match the
 6671      encoding. This will be used to get round a problem where a PKCS7
 6672      structure which was signed could not be verified because the STACK
 6673      order did not reflect the encoded order.
 6674      [Steve Henson]
 6675 
 6676   *) Reimplement the OCSP ASN1 module using the new code.
 6677      [Steve Henson]
 6678 
 6679   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
 6680      for its ASN1 operations. The old style function pointers still exist
 6681      for now but they will eventually go away.
 6682      [Steve Henson]
 6683 
 6684   *) Merge in replacement ASN1 code from the ASN1 branch. This almost
 6685      completely replaces the old ASN1 functionality with a table driven
 6686      encoder and decoder which interprets an ASN1_ITEM structure describing
 6687      the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
 6688      largely maintained. Almost all of the old asn1_mac.h macro based ASN1
 6689      has also been converted to the new form.
 6690      [Steve Henson]
 6691 
 6692   *) Change BN_mod_exp_recp so that negative moduli are tolerated
 6693      (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
 6694      so that BN_mod_exp_mont and BN_mod_exp_mont_word work
 6695      for negative moduli.
 6696      [Bodo Moeller]
 6697 
 6698   *) Fix BN_uadd and BN_usub: Always return non-negative results instead
 6699      of not touching the result's sign bit.
 6700      [Bodo Moeller]
 6701 
 6702   *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
 6703      set.
 6704      [Bodo Moeller]
 6705 
 6706   *) Changed the LHASH code to use prototypes for callbacks, and created
 6707      macros to declare and implement thin (optionally static) functions
 6708      that provide type-safety and avoid function pointer casting for the
 6709      type-specific callbacks.
 6710      [Geoff Thorpe]
 6711 
 6712   *) Added Kerberos Cipher Suites to be used with TLS, as written in
 6713      RFC 2712.
 6714      [Veers Staats <staatsvr@asc.hpc.mil>,
 6715       Jeffrey Altman <jaltman@columbia.edu>, via Richard Levitte]
 6716 
 6717   *) Reformat the FAQ so the different questions and answers can be divided
 6718      in sections depending on the subject.
 6719      [Richard Levitte]
 6720 
 6721   *) Have the zlib compression code load ZLIB.DLL dynamically under
 6722      Windows.
 6723      [Richard Levitte]
 6724 
 6725   *) New function BN_mod_sqrt for computing square roots modulo a prime
 6726      (using the probabilistic Tonelli-Shanks algorithm unless
 6727      p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
 6728      be handled deterministically).
 6729      [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
 6730 
 6731   *) Make BN_mod_inverse faster by explicitly handling small quotients
 6732      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
 6733      512 bits], about 30% for larger ones [1024 or 2048 bits].)
 6734      [Bodo Moeller]
 6735 
 6736   *) New function BN_kronecker.
 6737      [Bodo Moeller]
 6738 
 6739   *) Fix BN_gcd so that it works on negative inputs; the result is
 6740      positive unless both parameters are zero.
 6741      Previously something reasonably close to an infinite loop was
 6742      possible because numbers could be growing instead of shrinking
 6743      in the implementation of Euclid's algorithm.
 6744      [Bodo Moeller]
 6745 
 6746   *) Fix BN_is_word() and BN_is_one() macros to take into account the
 6747      sign of the number in question.
 6748 
 6749      Fix BN_is_word(a,w) to work correctly for w == 0.
 6750 
 6751      The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
 6752      because its test if the absolute value of 'a' equals 'w'.
 6753      Note that BN_abs_is_word does *not* handle w == 0 reliably;
 6754      it exists mostly for use in the implementations of BN_is_zero(),
 6755      BN_is_one(), and BN_is_word().
 6756      [Bodo Moeller]
 6757 
 6758   *) New function BN_swap.
 6759      [Bodo Moeller]
 6760 
 6761   *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
 6762      the exponentiation functions are more likely to produce reasonable
 6763      results on negative inputs.
 6764      [Bodo Moeller]
 6765 
 6766   *) Change BN_mod_mul so that the result is always non-negative.
 6767      Previously, it could be negative if one of the factors was negative;
 6768      I don't think anyone really wanted that behaviour.
 6769      [Bodo Moeller]
 6770 
 6771   *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
 6772      (except for exponentiation, which stays in crypto/bn/bn_exp.c,
 6773      and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
 6774      and add new functions:
 6775 
 6776           BN_nnmod
 6777           BN_mod_sqr
 6778           BN_mod_add
 6779           BN_mod_add_quick
 6780           BN_mod_sub
 6781           BN_mod_sub_quick
 6782           BN_mod_lshift1
 6783           BN_mod_lshift1_quick
 6784           BN_mod_lshift
 6785           BN_mod_lshift_quick
 6786 
 6787      These functions always generate non-negative results.
 6788 
 6789      BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
 6790      such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
 6791 
 6792      BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
 6793      BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
 6794      be reduced modulo  m.
 6795      [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
 6796 
 6797 #if 0
 6798      The following entry accidentily appeared in the CHANGES file
 6799      distributed with OpenSSL 0.9.7.  The modifications described in
 6800      it do *not* apply to OpenSSL 0.9.7.
 6801 
 6802   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
 6803      was actually never needed) and in BN_mul().  The removal in BN_mul()
 6804      required a small change in bn_mul_part_recursive() and the addition
 6805      of the functions bn_cmp_part_words(), bn_sub_part_words() and
 6806      bn_add_part_words(), which do the same thing as bn_cmp_words(),
 6807      bn_sub_words() and bn_add_words() except they take arrays with
 6808      differing sizes.
 6809      [Richard Levitte]
 6810 #endif
 6811 
 6812   *) In 'openssl passwd', verify passwords read from the terminal
 6813      unless the '-salt' option is used (which usually means that
 6814      verification would just waste user's time since the resulting
 6815      hash is going to be compared with some given password hash)
 6816      or the new '-noverify' option is used.
 6817 
 6818      This is an incompatible change, but it does not affect
 6819      non-interactive use of 'openssl passwd' (passwords on the command
 6820      line, '-stdin' option, '-in ...' option) and thus should not
 6821      cause any problems.
 6822      [Bodo Moeller]
 6823 
 6824   *) Remove all references to RSAref, since there's no more need for it.
 6825      [Richard Levitte]
 6826 
 6827   *) Make DSO load along a path given through an environment variable
 6828      (SHLIB_PATH) with shl_load().
 6829      [Richard Levitte]
 6830 
 6831   *) Constify the ENGINE code as a result of BIGNUM constification.
 6832      Also constify the RSA code and most things related to it.  In a
 6833      few places, most notable in the depth of the ASN.1 code, ugly
 6834      casts back to non-const were required (to be solved at a later
 6835      time)
 6836      [Richard Levitte]
 6837 
 6838   *) Make it so the openssl application has all engines loaded by default.
 6839      [Richard Levitte]
 6840 
 6841   *) Constify the BIGNUM routines a little more.
 6842      [Richard Levitte]
 6843 
 6844   *) Add the following functions:
 6845 
 6846 	ENGINE_load_cswift()
 6847 	ENGINE_load_chil()
 6848 	ENGINE_load_atalla()
 6849 	ENGINE_load_nuron()
 6850 	ENGINE_load_builtin_engines()
 6851 
 6852      That way, an application can itself choose if external engines that
 6853      are built-in in OpenSSL shall ever be used or not.  The benefit is
 6854      that applications won't have to be linked with libdl or other dso
 6855      libraries unless it's really needed.
 6856 
 6857      Changed 'openssl engine' to load all engines on demand.
 6858      Changed the engine header files to avoid the duplication of some
 6859      declarations (they differed!).
 6860      [Richard Levitte]
 6861 
 6862   *) 'openssl engine' can now list capabilities.
 6863      [Richard Levitte]
 6864 
 6865   *) Better error reporting in 'openssl engine'.
 6866      [Richard Levitte]
 6867 
 6868   *) Never call load_dh_param(NULL) in s_server.
 6869      [Bodo Moeller]
 6870 
 6871   *) Add engine application.  It can currently list engines by name and
 6872      identity, and test if they are actually available.
 6873      [Richard Levitte]
 6874 
 6875   *) Improve RPM specification file by forcing symbolic linking and making
 6876      sure the installed documentation is also owned by root.root.
 6877      [Damien Miller <djm@mindrot.org>]
 6878 
 6879   *) Give the OpenSSL applications more possibilities to make use of
 6880      keys (public as well as private) handled by engines.
 6881      [Richard Levitte]
 6882 
 6883   *) Add OCSP code that comes from CertCo.
 6884      [Richard Levitte]
 6885 
 6886   *) Add VMS support for the Rijndael code.
 6887      [Richard Levitte]
 6888 
 6889   *) Added untested support for Nuron crypto accelerator.
 6890      [Ben Laurie]
 6891 
 6892   *) Add support for external cryptographic devices.  This code was
 6893      previously distributed separately as the "engine" branch.
 6894      [Geoff Thorpe, Richard Levitte]
 6895 
 6896   *) Rework the filename-translation in the DSO code. It is now possible to
 6897      have far greater control over how a "name" is turned into a filename
 6898      depending on the operating environment and any oddities about the
 6899      different shared library filenames on each system.
 6900      [Geoff Thorpe]
 6901 
 6902   *) Support threads on FreeBSD-elf in Configure.
 6903      [Richard Levitte]
 6904 
 6905   *) Fix for SHA1 assembly problem with MASM: it produces
 6906      warnings about corrupt line number information when assembling
 6907      with debugging information. This is caused by the overlapping
 6908      of two sections.
 6909      [Bernd Matthes <mainbug@celocom.de>, Steve Henson]
 6910 
 6911   *) NCONF changes.
 6912      NCONF_get_number() has no error checking at all.  As a replacement,
 6913      NCONF_get_number_e() is defined (_e for "error checking") and is
 6914      promoted strongly.  The old NCONF_get_number is kept around for
 6915      binary backward compatibility.
 6916      Make it possible for methods to load from something other than a BIO,
 6917      by providing a function pointer that is given a name instead of a BIO.
 6918      For example, this could be used to load configuration data from an
 6919      LDAP server.
 6920      [Richard Levitte]
 6921 
 6922   *) Fix for non blocking accept BIOs. Added new I/O special reason
 6923      BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
 6924      with non blocking I/O was not possible because no retry code was
 6925      implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
 6926      this case.
 6927      [Steve Henson]
 6928 
 6929   *) Added the beginnings of Rijndael support.
 6930      [Ben Laurie]
 6931 
 6932   *) Fix for bug in DirectoryString mask setting. Add support for
 6933      X509_NAME_print_ex() in 'req' and X509_print_ex() function
 6934      to allow certificate printing to more controllable, additional
 6935      'certopt' option to 'x509' to allow new printing options to be
 6936      set.
 6937      [Steve Henson]
 6938 
 6939   *) Clean old EAY MD5 hack from e_os.h.
 6940      [Richard Levitte]
 6941 
 6942  Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
 6943 
 6944   *) Fix null-pointer assignment in do_change_cipher_spec() revealed
 6945      by using the Codenomicon TLS Test Tool (CVE-2004-0079)
 6946      [Joe Orton, Steve Henson]
 6947 
 6948  Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
 6949 
 6950   *) Fix additional bug revealed by the NISCC test suite:
 6951 
 6952      Stop bug triggering large recursion when presented with
 6953      certain ASN.1 tags (CVE-2003-0851)
 6954      [Steve Henson]
 6955 
 6956  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
 6957 
 6958   *) Fix various bugs revealed by running the NISCC test suite:
 6959 
 6960      Stop out of bounds reads in the ASN1 code when presented with
 6961      invalid tags (CVE-2003-0543 and CVE-2003-0544).
 6962      
 6963      If verify callback ignores invalid public key errors don't try to check
 6964      certificate signature with the NULL public key.
 6965 
 6966      [Steve Henson]
 6967 
 6968   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
 6969      if the server requested one: as stated in TLS 1.0 and SSL 3.0
 6970      specifications.
 6971      [Steve Henson]
 6972 
 6973   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
 6974      extra data after the compression methods not only for TLS 1.0
 6975      but also for SSL 3.0 (as required by the specification).
 6976      [Bodo Moeller; problem pointed out by Matthias Loepfe]
 6977 
 6978   *) Change X509_certificate_type() to mark the key as exported/exportable
 6979      when it's 512 *bits* long, not 512 bytes.
 6980      [Richard Levitte]
 6981 
 6982  Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
 6983 
 6984   *) Countermeasure against the Klima-Pokorny-Rosa extension of
 6985      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
 6986      a protocol version number mismatch like a decryption error
 6987      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
 6988      [Bodo Moeller]
 6989 
 6990   *) Turn on RSA blinding by default in the default implementation
 6991      to avoid a timing attack. Applications that don't want it can call
 6992      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
 6993      They would be ill-advised to do so in most cases.
 6994      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
 6995 
 6996   *) Change RSA blinding code so that it works when the PRNG is not
 6997      seeded (in this case, the secret RSA exponent is abused as
 6998      an unpredictable seed -- if it is not unpredictable, there
 6999      is no point in blinding anyway).  Make RSA blinding thread-safe
 7000      by remembering the creator's thread ID in rsa->blinding and
 7001      having all other threads use local one-time blinding factors
 7002      (this requires more computation than sharing rsa->blinding, but
 7003      avoids excessive locking; and if an RSA object is not shared
 7004      between threads, blinding will still be very fast).
 7005      [Bodo Moeller]
 7006 
 7007  Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
 7008 
 7009   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
 7010      via timing by performing a MAC computation even if incorrrect
 7011      block cipher padding has been found.  This is a countermeasure
 7012      against active attacks where the attacker has to distinguish
 7013      between bad padding and a MAC verification error. (CVE-2003-0078)
 7014 
 7015      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
 7016      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
 7017      Martin Vuagnoux (EPFL, Ilion)]
 7018 
 7019  Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
 7020 
 7021   *) New function OPENSSL_cleanse(), which is used to cleanse a section of
 7022      memory from it's contents.  This is done with a counter that will
 7023      place alternating values in each byte.  This can be used to solve
 7024      two issues: 1) the removal of calls to memset() by highly optimizing
 7025      compilers, and 2) cleansing with other values than 0, since those can
 7026      be read through on certain media, for example a swap space on disk.
 7027      [Geoff Thorpe]
 7028 
 7029   *) Bugfix: client side session caching did not work with external caching,
 7030      because the session->cipher setting was not restored when reloading
 7031      from the external cache. This problem was masked, when
 7032      SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
 7033      (Found by Steve Haslam <steve@araqnid.ddts.net>.)
 7034      [Lutz Jaenicke]
 7035 
 7036   *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
 7037      length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
 7038      [Zeev Lieber <zeev-l@yahoo.com>]
 7039 
 7040   *) Undo an undocumented change introduced in 0.9.6e which caused
 7041      repeated calls to OpenSSL_add_all_ciphers() and 
 7042      OpenSSL_add_all_digests() to be ignored, even after calling
 7043      EVP_cleanup().
 7044      [Richard Levitte]
 7045 
 7046   *) Change the default configuration reader to deal with last line not
 7047      being properly terminated.
 7048      [Richard Levitte]
 7049 
 7050   *) Change X509_NAME_cmp() so it applies the special rules on handling
 7051      DN values that are of type PrintableString, as well as RDNs of type
 7052      emailAddress where the value has the type ia5String.
 7053      [stefank@valicert.com via Richard Levitte]
 7054 
 7055   *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
 7056      the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
 7057      doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
 7058      the bitwise-OR of the two for use by the majority of applications
 7059      wanting this behaviour, and update the docs. The documented
 7060      behaviour and actual behaviour were inconsistent and had been
 7061      changing anyway, so this is more a bug-fix than a behavioural
 7062      change.
 7063      [Geoff Thorpe, diagnosed by Nadav Har'El]
 7064 
 7065   *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
 7066      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
 7067      [Bodo Moeller]
 7068 
 7069   *) Fix initialization code race conditions in
 7070         SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
 7071         SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
 7072         SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
 7073         TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
 7074         ssl2_get_cipher_by_char(),
 7075         ssl3_get_cipher_by_char().
 7076      [Patrick McCormick <patrick@tellme.com>, Bodo Moeller]
 7077 
 7078   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
 7079      the cached sessions are flushed, as the remove_cb() might use ex_data
 7080      contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com>
 7081      (see [openssl.org #212]).
 7082      [Geoff Thorpe, Lutz Jaenicke]
 7083 
 7084   *) Fix typo in OBJ_txt2obj which incorrectly passed the content
 7085      length, instead of the encoding length to d2i_ASN1_OBJECT.
 7086      [Steve Henson]
 7087 
 7088  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
 7089 
 7090   *) [In 0.9.6g-engine release:]
 7091      Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
 7092      [Lynn Gazis <lgazis@rainbow.com>]
 7093 
 7094  Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
 7095 
 7096   *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
 7097      and get fix the header length calculation.
 7098      [Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
 7099 	Alon Kantor <alonk@checkpoint.com> (and others),
 7100 	Steve Henson]
 7101 
 7102   *) Use proper error handling instead of 'assertions' in buffer
 7103      overflow checks added in 0.9.6e.  This prevents DoS (the
 7104      assertions could call abort()).
 7105      [Arne Ansper <arne@ats.cyber.ee>, Bodo Moeller]
 7106 
 7107  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
 7108 
 7109   *) Add various sanity checks to asn1_get_length() to reject
 7110      the ASN1 length bytes if they exceed sizeof(long), will appear
 7111      negative or the content length exceeds the length of the
 7112      supplied buffer.
 7113      [Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]
 7114 
 7115   *) Fix cipher selection routines: ciphers without encryption had no flags
 7116      for the cipher strength set and where therefore not handled correctly
 7117      by the selection routines (PR #130).
 7118      [Lutz Jaenicke]
 7119 
 7120   *) Fix EVP_dsa_sha macro.
 7121      [Nils Larsch]
 7122 
 7123   *) New option
 7124           SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
 7125      for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
 7126      that was added in OpenSSL 0.9.6d.
 7127 
 7128      As the countermeasure turned out to be incompatible with some
 7129      broken SSL implementations, the new option is part of SSL_OP_ALL.
 7130      SSL_OP_ALL is usually employed when compatibility with weird SSL
 7131      implementations is desired (e.g. '-bugs' option to 's_client' and
 7132      's_server'), so the new option is automatically set in many
 7133      applications.
 7134      [Bodo Moeller]
 7135 
 7136   *) Changes in security patch:
 7137 
 7138      Changes marked "(CHATS)" were sponsored by the Defense Advanced
 7139      Research Projects Agency (DARPA) and Air Force Research Laboratory,
 7140      Air Force Materiel Command, USAF, under agreement number
 7141      F30602-01-2-0537.
 7142 
 7143   *) Add various sanity checks to asn1_get_length() to reject
 7144      the ASN1 length bytes if they exceed sizeof(long), will appear
 7145      negative or the content length exceeds the length of the
 7146      supplied buffer. (CVE-2002-0659)
 7147      [Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]
 7148 
 7149   *) Assertions for various potential buffer overflows, not known to
 7150      happen in practice.
 7151      [Ben Laurie (CHATS)]
 7152 
 7153   *) Various temporary buffers to hold ASCII versions of integers were
 7154      too small for 64 bit platforms. (CVE-2002-0655)
 7155      [Matthew Byng-Maddick <mbm@aldigital.co.uk> and Ben Laurie (CHATS)>
 7156 
 7157   *) Remote buffer overflow in SSL3 protocol - an attacker could
 7158      supply an oversized session ID to a client. (CVE-2002-0656)
 7159      [Ben Laurie (CHATS)]
 7160 
 7161   *) Remote buffer overflow in SSL2 protocol - an attacker could
 7162      supply an oversized client master key. (CVE-2002-0656)
 7163      [Ben Laurie (CHATS)]
 7164 
 7165  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
 7166 
 7167   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
 7168      encoded as NULL) with id-dsa-with-sha1.
 7169      [Nils Larsch <nla@trustcenter.de>; problem pointed out by Bodo Moeller]
 7170 
 7171   *) Check various X509_...() return values in apps/req.c.
 7172      [Nils Larsch <nla@trustcenter.de>]
 7173 
 7174   *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
 7175      an end-of-file condition would erronously be flagged, when the CRLF
 7176      was just at the end of a processed block. The bug was discovered when
 7177      processing data through a buffering memory BIO handing the data to a
 7178      BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
 7179      <ptsekov@syntrex.com> and Nedelcho Stanev.
 7180      [Lutz Jaenicke]
 7181 
 7182   *) Implement a countermeasure against a vulnerability recently found
 7183      in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
 7184      before application data chunks to avoid the use of known IVs
 7185      with data potentially chosen by the attacker.
 7186      [Bodo Moeller]
 7187 
 7188   *) Fix length checks in ssl3_get_client_hello().
 7189      [Bodo Moeller]
 7190 
 7191   *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
 7192      to prevent ssl3_read_internal() from incorrectly assuming that
 7193      ssl3_read_bytes() found application data while handshake
 7194      processing was enabled when in fact s->s3->in_read_app_data was
 7195      merely automatically cleared during the initial handshake.
 7196      [Bodo Moeller; problem pointed out by Arne Ansper <arne@ats.cyber.ee>]
 7197 
 7198   *) Fix object definitions for Private and Enterprise: they were not
 7199      recognized in their shortname (=lowercase) representation. Extend
 7200      obj_dat.pl to issue an error when using undefined keywords instead
 7201      of silently ignoring the problem (Svenning Sorensen
 7202      <sss@sss.dnsalias.net>).
 7203      [Lutz Jaenicke]
 7204 
 7205   *) Fix DH_generate_parameters() so that it works for 'non-standard'
 7206      generators, i.e. generators other than 2 and 5.  (Previously, the
 7207      code did not properly initialise the 'add' and 'rem' values to
 7208      BN_generate_prime().)
 7209 
 7210      In the new general case, we do not insist that 'generator' is
 7211      actually a primitive root: This requirement is rather pointless;
 7212      a generator of the order-q subgroup is just as good, if not
 7213      better.
 7214      [Bodo Moeller]
 7215  
 7216   *) Map new X509 verification errors to alerts. Discovered and submitted by
 7217      Tom Wu <tom@arcot.com>.
 7218      [Lutz Jaenicke]
 7219 
 7220   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
 7221      returning non-zero before the data has been completely received
 7222      when using non-blocking I/O.
 7223      [Bodo Moeller; problem pointed out by John Hughes]
 7224 
 7225   *) Some of the ciphers missed the strength entry (SSL_LOW etc).
 7226      [Ben Laurie, Lutz Jaenicke]
 7227 
 7228   *) Fix bug in SSL_clear(): bad sessions were not removed (found by
 7229      Yoram Zahavi <YoramZ@gilian.com>).
 7230      [Lutz Jaenicke]
 7231 
 7232   *) Add information about CygWin 1.3 and on, and preserve proper
 7233      configuration for the versions before that.
 7234      [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
 7235 
 7236   *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
 7237      check whether we deal with a copy of a session and do not delete from
 7238      the cache in this case. Problem reported by "Izhar Shoshani Levi"
 7239      <izhar@checkpoint.com>.
 7240      [Lutz Jaenicke]
 7241 
 7242   *) Do not store session data into the internal session cache, if it
 7243      is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
 7244      flag is set). Proposed by Aslam <aslam@funk.com>.
 7245      [Lutz Jaenicke]
 7246 
 7247   *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
 7248      value is 0.
 7249      [Richard Levitte]
 7250 
 7251   *) [In 0.9.6d-engine release:]
 7252      Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
 7253      [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
 7254 
 7255   *) Add the configuration target linux-s390x.
 7256      [Neale Ferguson <Neale.Ferguson@SoftwareAG-USA.com> via Richard Levitte]
 7257 
 7258   *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
 7259      ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
 7260      variable as an indication that a ClientHello message has been
 7261      received.  As the flag value will be lost between multiple
 7262      invocations of ssl3_accept when using non-blocking I/O, the
 7263      function may not be aware that a handshake has actually taken
 7264      place, thus preventing a new session from being added to the
 7265      session cache.
 7266 
 7267      To avoid this problem, we now set s->new_session to 2 instead of
 7268      using a local variable.
 7269      [Lutz Jaenicke, Bodo Moeller]
 7270 
 7271   *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
 7272      if the SSL_R_LENGTH_MISMATCH error is detected.
 7273      [Geoff Thorpe, Bodo Moeller]
 7274 
 7275   *) New 'shared_ldflag' column in Configure platform table.
 7276      [Richard Levitte]
 7277 
 7278   *) Fix EVP_CIPHER_mode macro.
 7279      ["Dan S. Camper" <dan@bti.net>]
 7280 
 7281   *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
 7282      type, we must throw them away by setting rr->length to 0.
 7283      [D P Chang <dpc@qualys.com>]
 7284 
 7285  Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
 7286 
 7287   *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
 7288      <Dominikus.Scherkl@biodata.com>.  (The previous implementation
 7289      worked incorrectly for those cases where  range = 10..._2  and
 7290      3*range  is two bits longer than  range.)
 7291      [Bodo Moeller]
 7292 
 7293   *) Only add signing time to PKCS7 structures if it is not already
 7294      present.
 7295      [Steve Henson]
 7296 
 7297   *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
 7298      OBJ_ld_ce should be OBJ_id_ce.
 7299      Also some ip-pda OIDs in crypto/objects/objects.txt were
 7300      incorrect (cf. RFC 3039).
 7301      [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
 7302 
 7303   *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
 7304      returns early because it has nothing to do.
 7305      [Andy Schneider <andy.schneider@bjss.co.uk>]
 7306 
 7307   *) [In 0.9.6c-engine release:]
 7308      Fix mutex callback return values in crypto/engine/hw_ncipher.c.
 7309      [Andy Schneider <andy.schneider@bjss.co.uk>]
 7310 
 7311   *) [In 0.9.6c-engine release:]
 7312      Add support for Cryptographic Appliance's keyserver technology.
 7313      (Use engine 'keyclient')
 7314      [Cryptographic Appliances and Geoff Thorpe]
 7315 
 7316   *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
 7317      is called via tools/c89.sh because arguments have to be
 7318      rearranged (all '-L' options must appear before the first object
 7319      modules).
 7320      [Richard Shapiro <rshapiro@abinitio.com>]
 7321 
 7322   *) [In 0.9.6c-engine release:]
 7323      Add support for Broadcom crypto accelerator cards, backported
 7324      from 0.9.7.
 7325      [Broadcom, Nalin Dahyabhai <nalin@redhat.com>, Mark Cox]
 7326 
 7327   *) [In 0.9.6c-engine release:]
 7328      Add support for SureWare crypto accelerator cards from 
 7329      Baltimore Technologies.  (Use engine 'sureware')
 7330      [Baltimore Technologies and Mark Cox]
 7331 
 7332   *) [In 0.9.6c-engine release:]
 7333      Add support for crypto accelerator cards from Accelerated
 7334      Encryption Processing, www.aep.ie.  (Use engine 'aep')
 7335      [AEP Inc. and Mark Cox]
 7336 
 7337   *) Add a configuration entry for gcc on UnixWare.
 7338      [Gary Benson <gbenson@redhat.com>]
 7339 
 7340   *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
 7341      messages are stored in a single piece (fixed-length part and
 7342      variable-length part combined) and fix various bugs found on the way.
 7343      [Bodo Moeller]
 7344 
 7345   *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
 7346      instead.  BIO_gethostbyname() does not know what timeouts are
 7347      appropriate, so entries would stay in cache even when they have
 7348      become invalid.
 7349      [Bodo Moeller; problem pointed out by Rich Salz <rsalz@zolera.com>
 7350 
 7351   *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
 7352      faced with a pathologically small ClientHello fragment that does
 7353      not contain client_version: Instead of aborting with an error,
 7354      simply choose the highest available protocol version (i.e.,
 7355      TLS 1.0 unless it is disabled).  In practice, ClientHello
 7356      messages are never sent like this, but this change gives us
 7357      strictly correct behaviour at least for TLS.
 7358      [Bodo Moeller]
 7359 
 7360   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
 7361      never resets s->method to s->ctx->method when called from within
 7362      one of the SSL handshake functions.
 7363      [Bodo Moeller; problem pointed out by Niko Baric]
 7364 
 7365   *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
 7366      (sent using the client's version number) if client_version is
 7367      smaller than the protocol version in use.  Also change
 7368      ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
 7369      the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
 7370      the client will at least see that alert.
 7371      [Bodo Moeller]
 7372 
 7373   *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
 7374      correctly.
 7375      [Bodo Moeller]
 7376 
 7377   *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
 7378      client receives HelloRequest while in a handshake.
 7379      [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider@bjss.co.uk>]
 7380 
 7381   *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
 7382      should end in 'break', not 'goto end' which circuments various
 7383      cleanups done in state SSL_ST_OK.   But session related stuff
 7384      must be disabled for SSL_ST_OK in the case that we just sent a
 7385      HelloRequest.
 7386 
 7387      Also avoid some overhead by not calling ssl_init_wbio_buffer()
 7388      before just sending a HelloRequest.
 7389      [Bodo Moeller, Eric Rescorla <ekr@rtfm.com>]
 7390 
 7391   *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
 7392      reveal whether illegal block cipher padding was found or a MAC
 7393      verification error occured.  (Neither SSLerr() codes nor alerts
 7394      are directly visible to potential attackers, but the information
 7395      may leak via logfiles.)
 7396 
 7397      Similar changes are not required for the SSL 2.0 implementation
 7398      because the number of padding bytes is sent in clear for SSL 2.0,
 7399      and the extra bytes are just ignored.  However ssl/s2_pkt.c
 7400      failed to verify that the purported number of padding bytes is in
 7401      the legal range.
 7402      [Bodo Moeller]
 7403 
 7404   *) Add OpenUNIX-8 support including shared libraries
 7405      (Boyd Lynn Gerber <gerberb@zenez.com>).
 7406      [Lutz Jaenicke]
 7407 
 7408   *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
 7409      'wristwatch attack' using huge encoding parameters (cf.
 7410      James H. Manger's CRYPTO 2001 paper).  Note that the
 7411      RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
 7412      encoding parameters and hence was not vulnerable.
 7413      [Bodo Moeller]
 7414 
 7415   *) BN_sqr() bug fix.
 7416      [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]
 7417 
 7418   *) Rabin-Miller test analyses assume uniformly distributed witnesses,
 7419      so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
 7420      followed by modular reduction.
 7421      [Bodo Moeller; pointed out by Adam Young <AYoung1@NCSUS.JNJ.COM>]
 7422 
 7423   *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
 7424      equivalent based on BN_pseudo_rand() instead of BN_rand().
 7425      [Bodo Moeller]
 7426 
 7427   *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
 7428      This function was broken, as the check for a new client hello message
 7429      to handle SGC did not allow these large messages.
 7430      (Tracked down by "Douglas E. Engert" <deengert@anl.gov>.)
 7431      [Lutz Jaenicke]
 7432 
 7433   *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
 7434      [Lutz Jaenicke]
 7435 
 7436   *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
 7437      for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton@netopia.com>).
 7438      [Lutz Jaenicke]
 7439 
 7440   *) Rework the configuration and shared library support for Tru64 Unix.
 7441      The configuration part makes use of modern compiler features and
 7442      still retains old compiler behavior for those that run older versions
 7443      of the OS.  The shared library support part includes a variant that
 7444      uses the RPATH feature, and is available through the special
 7445      configuration target "alpha-cc-rpath", which will never be selected
 7446      automatically.
 7447      [Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
 7448 
 7449   *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
 7450      with the same message size as in ssl3_get_certificate_request().
 7451      Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
 7452      messages might inadvertently be reject as too long.
 7453      [Petr Lampa <lampa@fee.vutbr.cz>]
 7454 
 7455   *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
 7456      [Andy Polyakov]
 7457 
 7458   *) Modified SSL library such that the verify_callback that has been set
 7459      specificly for an SSL object with SSL_set_verify() is actually being
 7460      used. Before the change, a verify_callback set with this function was
 7461      ignored and the verify_callback() set in the SSL_CTX at the time of
 7462      the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
 7463      to allow the necessary settings.
 7464      [Lutz Jaenicke]
 7465 
 7466   *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
 7467      explicitly to NULL, as at least on Solaris 8 this seems not always to be
 7468      done automatically (in contradiction to the requirements of the C
 7469      standard). This made problems when used from OpenSSH.
 7470      [Lutz Jaenicke]
 7471 
 7472   *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
 7473      dh->length and always used
 7474 
 7475           BN_rand_range(priv_key, dh->p).
 7476 
 7477      BN_rand_range() is not necessary for Diffie-Hellman, and this
 7478      specific range makes Diffie-Hellman unnecessarily inefficient if
 7479      dh->length (recommended exponent length) is much smaller than the
 7480      length of dh->p.  We could use BN_rand_range() if the order of
 7481      the subgroup was stored in the DH structure, but we only have
 7482      dh->length.
 7483 
 7484      So switch back to
 7485 
 7486           BN_rand(priv_key, l, ...)
 7487 
 7488      where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
 7489      otherwise.
 7490      [Bodo Moeller]
 7491 
 7492   *) In
 7493 
 7494           RSA_eay_public_encrypt
 7495           RSA_eay_private_decrypt
 7496           RSA_eay_private_encrypt (signing)
 7497           RSA_eay_public_decrypt (signature verification)
 7498 
 7499      (default implementations for RSA_public_encrypt,
 7500      RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
 7501      always reject numbers >= n.
 7502      [Bodo Moeller]
 7503 
 7504   *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
 7505      to synchronize access to 'locking_thread'.  This is necessary on
 7506      systems where access to 'locking_thread' (an 'unsigned long'
 7507      variable) is not atomic.
 7508      [Bodo Moeller]
 7509 
 7510   *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
 7511      *before* setting the 'crypto_lock_rand' flag.  The previous code had
 7512      a race condition if 0 is a valid thread ID.
 7513      [Travis Vitek <vitek@roguewave.com>]
 7514 
 7515   *) Add support for shared libraries under Irix.
 7516      [Albert Chin-A-Young <china@thewrittenword.com>]
 7517 
 7518   *) Add configuration option to build on Linux on both big-endian and
 7519      little-endian MIPS.
 7520      [Ralf Baechle <ralf@uni-koblenz.de>]
 7521 
 7522   *) Add the possibility to create shared libraries on HP-UX.
 7523      [Richard Levitte]
 7524 
 7525  Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
 7526 
 7527   *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
 7528      to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
 7529      Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com>:
 7530      PRNG state recovery was possible based on the output of
 7531      one PRNG request appropriately sized to gain knowledge on
 7532      'md' followed by enough consecutive 1-byte PRNG requests
 7533      to traverse all of 'state'.
 7534 
 7535      1. When updating 'md_local' (the current thread's copy of 'md')
 7536         during PRNG output generation, hash all of the previous
 7537         'md_local' value, not just the half used for PRNG output.
 7538 
 7539      2. Make the number of bytes from 'state' included into the hash
 7540         independent from the number of PRNG bytes requested.
 7541 
 7542      The first measure alone would be sufficient to avoid
 7543      Markku-Juhani's attack.  (Actually it had never occurred
 7544      to me that the half of 'md_local' used for chaining was the
 7545      half from which PRNG output bytes were taken -- I had always
 7546      assumed that the secret half would be used.)  The second
 7547      measure makes sure that additional data from 'state' is never
 7548      mixed into 'md_local' in small portions; this heuristically
 7549      further strengthens the PRNG.
 7550      [Bodo Moeller]
 7551 
 7552   *) Fix crypto/bn/asm/mips3.s.
 7553      [Andy Polyakov]
 7554 
 7555   *) When only the key is given to "enc", the IV is undefined. Print out
 7556      an error message in this case.
 7557      [Lutz Jaenicke]
 7558 
 7559   *) Handle special case when X509_NAME is empty in X509 printing routines.
 7560      [Steve Henson]
 7561 
 7562   *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
 7563      positive and less than q.
 7564      [Bodo Moeller]
 7565 
 7566   *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
 7567      used: it isn't thread safe and the add_lock_callback should handle
 7568      that itself.
 7569      [Paul Rose <Paul.Rose@bridge.com>]
 7570 
 7571   *) Verify that incoming data obeys the block size in
 7572      ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
 7573      [Bodo Moeller]
 7574 
 7575   *) Fix OAEP check.
 7576      [Ulf Möller, Bodo Möller]
 7577 
 7578   *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
 7579      RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
 7580      when fixing the server behaviour for backwards-compatible 'client
 7581      hello' messages.  (Note that the attack is impractical against
 7582      SSL 3.0 and TLS 1.0 anyway because length and version checking
 7583      means that the probability of guessing a valid ciphertext is
 7584      around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
 7585      paper.)
 7586 
 7587      Before 0.9.5, the countermeasure (hide the error by generating a
 7588      random 'decryption result') did not work properly because
 7589      ERR_clear_error() was missing, meaning that SSL_get_error() would
 7590      detect the supposedly ignored error.
 7591 
 7592      Both problems are now fixed.
 7593      [Bodo Moeller]
 7594 
 7595   *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
 7596      (previously it was 1024).
 7597      [Bodo Moeller]
 7598 
 7599   *) Fix for compatibility mode trust settings: ignore trust settings
 7600      unless some valid trust or reject settings are present.
 7601      [Steve Henson]
 7602 
 7603   *) Fix for blowfish EVP: its a variable length cipher.
 7604      [Steve Henson]
 7605 
 7606   *) Fix various bugs related to DSA S/MIME verification. Handle missing
 7607      parameters in DSA public key structures and return an error in the
 7608      DSA routines if parameters are absent.
 7609      [Steve Henson]
 7610 
 7611   *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
 7612      in the current directory if neither $RANDFILE nor $HOME was set.
 7613      RAND_file_name() in 0.9.6a returned NULL in this case.  This has
 7614      caused some confusion to Windows users who haven't defined $HOME.
 7615      Thus RAND_file_name() is changed again: e_os.h can define a
 7616      DEFAULT_HOME, which will be used if $HOME is not set.
 7617      For Windows, we use "C:"; on other platforms, we still require
 7618      environment variables.
 7619 
 7620   *) Move 'if (!initialized) RAND_poll()' into regions protected by
 7621      CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
 7622      having multiple threads call RAND_poll() concurrently.
 7623      [Bodo Moeller]
 7624 
 7625   *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
 7626      combination of a flag and a thread ID variable.
 7627      Otherwise while one thread is in ssleay_rand_bytes (which sets the
 7628      flag), *other* threads can enter ssleay_add_bytes without obeying
 7629      the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
 7630      that they do not hold after the first thread unsets add_do_not_lock).
 7631      [Bodo Moeller]
 7632 
 7633   *) Change bctest again: '-x' expressions are not available in all
 7634      versions of 'test'.
 7635      [Bodo Moeller]
 7636 
 7637  Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
 7638 
 7639   *) Fix a couple of memory leaks in PKCS7_dataDecode()
 7640      [Steve Henson, reported by Heyun Zheng <hzheng@atdsprint.com>]
 7641 
 7642   *) Change Configure and Makefiles to provide EXE_EXT, which will contain
 7643      the default extension for executables, if any.  Also, make the perl
 7644      scripts that use symlink() to test if it really exists and use "cp"
 7645      if it doesn't.  All this made OpenSSL compilable and installable in
 7646      CygWin.
 7647      [Richard Levitte]
 7648 
 7649   *) Fix for asn1_GetSequence() for indefinite length constructed data.
 7650      If SEQUENCE is length is indefinite just set c->slen to the total
 7651      amount of data available.
 7652      [Steve Henson, reported by shige@FreeBSD.org]
 7653      [This change does not apply to 0.9.7.]
 7654 
 7655   *) Change bctest to avoid here-documents inside command substitution
 7656      (workaround for FreeBSD /bin/sh bug).
 7657      For compatibility with Ultrix, avoid shell functions (introduced
 7658      in the bctest version that searches along $PATH).
 7659      [Bodo Moeller]
 7660 
 7661   *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
 7662      with des_encrypt() defined on some operating systems, like Solaris
 7663      and UnixWare.
 7664      [Richard Levitte]
 7665 
 7666   *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
 7667      On the Importance of Eliminating Errors in Cryptographic
 7668      Computations, J. Cryptology 14 (2001) 2, 101-119,
 7669      http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
 7670      [Ulf Moeller]
 7671   
 7672   *) MIPS assembler BIGNUM division bug fix. 
 7673      [Andy Polyakov]
 7674 
 7675   *) Disabled incorrect Alpha assembler code.
 7676      [Richard Levitte]
 7677 
 7678   *) Fix PKCS#7 decode routines so they correctly update the length
 7679      after reading an EOC for the EXPLICIT tag.
 7680      [Steve Henson]
 7681      [This change does not apply to 0.9.7.]
 7682 
 7683   *) Fix bug in PKCS#12 key generation routines. This was triggered
 7684      if a 3DES key was generated with a 0 initial byte. Include
 7685      PKCS12_BROKEN_KEYGEN compilation option to retain the old
 7686      (but broken) behaviour.
 7687      [Steve Henson]
 7688 
 7689   *) Enhance bctest to search for a working bc along $PATH and print
 7690      it when found.
 7691      [Tim Rice <tim@multitalents.net> via Richard Levitte]
 7692 
 7693   *) Fix memory leaks in err.c: free err_data string if necessary;
 7694      don't write to the wrong index in ERR_set_error_data.
 7695      [Bodo Moeller]
 7696 
 7697   *) Implement ssl23_peek (analogous to ssl23_read), which previously
 7698      did not exist.
 7699      [Bodo Moeller]
 7700 
 7701   *) Replace rdtsc with _emit statements for VC++ version 5.
 7702      [Jeremy Cooper <jeremy@baymoo.org>]
 7703 
 7704   *) Make it possible to reuse SSLv2 sessions.
 7705      [Richard Levitte]
 7706 
 7707   *) In copy_email() check for >= 0 as a return value for
 7708      X509_NAME_get_index_by_NID() since 0 is a valid index.
 7709      [Steve Henson reported by Massimiliano Pala <madwolf@opensca.org>]
 7710 
 7711   *) Avoid coredump with unsupported or invalid public keys by checking if
 7712      X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
 7713      PKCS7_verify() fails with non detached data.
 7714      [Steve Henson]
 7715 
 7716   *) Don't use getenv in library functions when run as setuid/setgid.
 7717      New function OPENSSL_issetugid().
 7718      [Ulf Moeller]
 7719 
 7720   *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
 7721      due to incorrect handling of multi-threading:
 7722 
 7723      1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
 7724 
 7725      2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
 7726 
 7727      3. Count how many times MemCheck_off() has been called so that
 7728         nested use can be treated correctly.  This also avoids 
 7729         inband-signalling in the previous code (which relied on the
 7730         assumption that thread ID 0 is impossible).
 7731      [Bodo Moeller]
 7732 
 7733   *) Add "-rand" option also to s_client and s_server.
 7734      [Lutz Jaenicke]
 7735 
 7736   *) Fix CPU detection on Irix 6.x.
 7737      [Kurt Hockenbury <khockenb@stevens-tech.edu> and
 7738       "Bruce W. Forsberg" <bruce.forsberg@baesystems.com>]
 7739 
 7740   *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
 7741      was empty.
 7742      [Steve Henson]
 7743      [This change does not apply to 0.9.7.]
 7744 
 7745   *) Use the cached encoding of an X509_NAME structure rather than
 7746      copying it. This is apparently the reason for the libsafe "errors"
 7747      but the code is actually correct.
 7748      [Steve Henson]
 7749 
 7750   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
 7751      Bleichenbacher's DSA attack.
 7752      Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
 7753      to be set and top=0 forces the highest bit to be set; top=-1 is new
 7754      and leaves the highest bit random.
 7755      [Ulf Moeller, Bodo Moeller]
 7756 
 7757   *) In the NCONF_...-based implementations for CONF_... queries
 7758      (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
 7759      a temporary CONF structure with the data component set to NULL
 7760      (which gives segmentation faults in lh_retrieve).
 7761      Instead, use NULL for the CONF pointer in CONF_get_string and
 7762      CONF_get_number (which may use environment variables) and directly
 7763      return NULL from CONF_get_section.
 7764      [Bodo Moeller]
 7765 
 7766   *) Fix potential buffer overrun for EBCDIC.
 7767      [Ulf Moeller]
 7768 
 7769   *) Tolerate nonRepudiation as being valid for S/MIME signing and certSign
 7770      keyUsage if basicConstraints absent for a CA.
 7771      [Steve Henson]
 7772 
 7773   *) Make SMIME_write_PKCS7() write mail header values with a format that
 7774      is more generally accepted (no spaces before the semicolon), since
 7775      some programs can't parse those values properly otherwise.  Also make
 7776      sure BIO's that break lines after each write do not create invalid
 7777      headers.
 7778      [Richard Levitte]
 7779 
 7780   *) Make the CRL encoding routines work with empty SEQUENCE OF. The
 7781      macros previously used would not encode an empty SEQUENCE OF
 7782      and break the signature.
 7783      [Steve Henson]
 7784      [This change does not apply to 0.9.7.]
 7785 
 7786   *) Zero the premaster secret after deriving the master secret in
 7787      DH ciphersuites.
 7788      [Steve Henson]
 7789 
 7790   *) Add some EVP_add_digest_alias registrations (as found in
 7791      OpenSSL_add_all_digests()) to SSL_library_init()
 7792      aka OpenSSL_add_ssl_algorithms().  This provides improved
 7793      compatibility with peers using X.509 certificates
 7794      with unconventional AlgorithmIdentifier OIDs.
 7795      [Bodo Moeller]
 7796 
 7797   *) Fix for Irix with NO_ASM.
 7798      ["Bruce W. Forsberg" <bruce.forsberg@baesystems.com>]
 7799 
 7800   *) ./config script fixes.
 7801      [Ulf Moeller, Richard Levitte]
 7802 
 7803   *) Fix 'openssl passwd -1'.
 7804      [Bodo Moeller]
 7805 
 7806   *) Change PKCS12_key_gen_asc() so it can cope with non null
 7807      terminated strings whose length is passed in the passlen
 7808      parameter, for example from PEM callbacks. This was done
 7809      by adding an extra length parameter to asc2uni().
 7810      [Steve Henson, reported by <oddissey@samsung.co.kr>]
 7811 
 7812   *) Fix C code generated by 'openssl dsaparam -C': If a BN_bin2bn
 7813      call failed, free the DSA structure.
 7814      [Bodo Moeller]
 7815 
 7816   *) Fix to uni2asc() to cope with zero length Unicode strings.
 7817      These are present in some PKCS#12 files.
 7818      [Steve Henson]
 7819 
 7820   *) Increase s2->wbuf allocation by one byte in ssl2_new (ssl/s2_lib.c).
 7821      Otherwise do_ssl_write (ssl/s2_pkt.c) will write beyond buffer limits
 7822      when writing a 32767 byte record.
 7823      [Bodo Moeller; problem reported by Eric Day <eday@concentric.net>]
 7824 
 7825   *) In RSA_eay_public_{en,ed}crypt and RSA_eay_mod_exp (rsa_eay.c),
 7826      obtain lock CRYPTO_LOCK_RSA before setting rsa->_method_mod_{n,p,q}.
 7827 
 7828      (RSA objects have a reference count access to which is protected
 7829      by CRYPTO_LOCK_RSA [see rsa_lib.c, s3_srvr.c, ssl_cert.c, ssl_rsa.c],
 7830      so they are meant to be shared between threads.)
 7831      [Bodo Moeller, Geoff Thorpe; original patch submitted by
 7832      "Reddie, Steven" <Steven.Reddie@ca.com>]
 7833 
 7834   *) Fix a deadlock in CRYPTO_mem_leaks().
 7835      [Bodo Moeller]
 7836 
 7837   *) Use better test patterns in bntest.
 7838      [Ulf Möller]
 7839 
 7840   *) rand_win.c fix for Borland C.
 7841      [Ulf Möller]
 7842  
 7843   *) BN_rshift bugfix for n == 0.
 7844      [Bodo Moeller]
 7845 
 7846   *) Add a 'bctest' script that checks for some known 'bc' bugs
 7847      so that 'make test' does not abort just because 'bc' is broken.
 7848      [Bodo Moeller]
 7849 
 7850   *) Store verify_result within SSL_SESSION also for client side to
 7851      avoid potential security hole. (Re-used sessions on the client side
 7852      always resulted in verify_result==X509_V_OK, not using the original
 7853      result of the server certificate verification.)
 7854      [Lutz Jaenicke]
 7855 
 7856   *) Fix ssl3_pending: If the record in s->s3->rrec is not of type
 7857      SSL3_RT_APPLICATION_DATA, return 0.
 7858      Similarly, change ssl2_pending to return 0 if SSL_in_init(s) is true.
 7859      [Bodo Moeller]
 7860 
 7861   *) Fix SSL_peek:
 7862      Both ssl2_peek and ssl3_peek, which were totally broken in earlier
 7863      releases, have been re-implemented by renaming the previous
 7864      implementations of ssl2_read and ssl3_read to ssl2_read_internal
 7865      and ssl3_read_internal, respectively, and adding 'peek' parameters
 7866      to them.  The new ssl[23]_{read,peek} functions are calls to
 7867      ssl[23]_read_internal with the 'peek' flag set appropriately.
 7868      A 'peek' parameter has also been added to ssl3_read_bytes, which
 7869      does the actual work for ssl3_read_internal.
 7870      [Bodo Moeller]
 7871 
 7872   *) Initialise "ex_data" member of RSA/DSA/DH structures prior to calling
 7873      the method-specific "init()" handler. Also clean up ex_data after
 7874      calling the method-specific "finish()" handler. Previously, this was
 7875      happening the other way round.
 7876      [Geoff Thorpe]
 7877 
 7878   *) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
 7879      The previous value, 12, was not always sufficient for BN_mod_exp().
 7880      [Bodo Moeller]
 7881 
 7882   *) Make sure that shared libraries get the internal name engine with
 7883      the full version number and not just 0.  This should mark the
 7884      shared libraries as not backward compatible.  Of course, this should
 7885      be changed again when we can guarantee backward binary compatibility.
 7886      [Richard Levitte]
 7887 
 7888   *) Fix typo in get_cert_by_subject() in by_dir.c
 7889      [Jean-Marc Desperrier <jean-marc.desperrier@certplus.com>]
 7890 
 7891   *) Rework the system to generate shared libraries:
 7892 
 7893      - Make note of the expected extension for the shared libraries and
 7894        if there is a need for symbolic links from for example libcrypto.so.0
 7895        to libcrypto.so.0.9.7.  There is extended info in Configure for
 7896        that.
 7897 
 7898      - Make as few rebuilds of the shared libraries as possible.
 7899 
 7900      - Still avoid linking the OpenSSL programs with the shared libraries.
 7901 
 7902      - When installing, install the shared libraries separately from the
 7903        static ones.
 7904      [Richard Levitte]
 7905 
 7906   *) Fix SSL_CTX_set_read_ahead macro to actually use its argument.
 7907 
 7908      Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
 7909      and not in SSL_clear because the latter is also used by the
 7910      accept/connect functions; previously, the settings made by
 7911      SSL_set_read_ahead would be lost during the handshake.
 7912      [Bodo Moeller; problems reported by Anders Gertz <gertz@epact.se>]     
 7913 
 7914   *) Correct util/mkdef.pl to be selective about disabled algorithms.
 7915      Previously, it would create entries for disableed algorithms no
 7916      matter what.
 7917      [Richard Levitte]
 7918 
 7919   *) Added several new manual pages for SSL_* function.
 7920      [Lutz Jaenicke]
 7921 
 7922  Changes between 0.9.5a and 0.9.6  [24 Sep 2000]
 7923 
 7924   *) In ssl23_get_client_hello, generate an error message when faced
 7925      with an initial SSL 3.0/TLS record that is too small to contain the
 7926      first two bytes of the ClientHello message, i.e. client_version.
 7927      (Note that this is a pathologic case that probably has never happened
 7928      in real life.)  The previous approach was to use the version number
 7929      from the record header as a substitute; but our protocol choice
 7930      should not depend on that one because it is not authenticated
 7931      by the Finished messages.
 7932      [Bodo Moeller]
 7933 
 7934   *) More robust randomness gathering functions for Windows.
 7935      [Jeffrey Altman <jaltman@columbia.edu>]
 7936 
 7937   *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
 7938      not set then we don't setup the error code for issuer check errors
 7939      to avoid possibly overwriting other errors which the callback does
 7940      handle. If an application does set the flag then we assume it knows
 7941      what it is doing and can handle the new informational codes
 7942      appropriately.
 7943      [Steve Henson]
 7944 
 7945   *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
 7946      a general "ANY" type, as such it should be able to decode anything
 7947      including tagged types. However it didn't check the class so it would
 7948      wrongly interpret tagged types in the same way as their universal
 7949      counterpart and unknown types were just rejected. Changed so that the
 7950      tagged and unknown types are handled in the same way as a SEQUENCE:
 7951      that is the encoding is stored intact. There is also a new type
 7952      "V_ASN1_OTHER" which is used when the class is not universal, in this
 7953      case we have no idea what the actual type is so we just lump them all
 7954      together.
 7955      [Steve Henson]
 7956 
 7957   *) On VMS, stdout may very well lead to a file that is written to
 7958      in a record-oriented fashion.  That means that every write() will
 7959      write a separate record, which will be read separately by the
 7960      programs trying to read from it.  This can be very confusing.
 7961 
 7962      The solution is to put a BIO filter in the way that will buffer
 7963      text until a linefeed is reached, and then write everything a
 7964      line at a time, so every record written will be an actual line,
 7965      not chunks of lines and not (usually doesn't happen, but I've
 7966      seen it once) several lines in one record.  BIO_f_linebuffer() is
 7967      the answer.
 7968 
 7969      Currently, it's a VMS-only method, because that's where it has
 7970      been tested well enough.
 7971      [Richard Levitte]
 7972 
 7973   *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
 7974      it can return incorrect results.
 7975      (Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
 7976      but it was in 0.9.6-beta[12].)
 7977      [Bodo Moeller]
 7978 
 7979   *) Disable the check for content being present when verifying detached
 7980      signatures in pk7_smime.c. Some versions of Netscape (wrongly)
 7981      include zero length content when signing messages.
 7982      [Steve Henson]
 7983 
 7984   *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
 7985      BIO_ctrl (for BIO pairs).
 7986      [Bodo Möller]
 7987 
 7988   *) Add DSO method for VMS.
 7989      [Richard Levitte]
 7990 
 7991   *) Bug fix: Montgomery multiplication could produce results with the
 7992      wrong sign.
 7993      [Ulf Möller]
 7994 
 7995   *) Add RPM specification openssl.spec and modify it to build three
 7996      packages.  The default package contains applications, application
 7997      documentation and run-time libraries.  The devel package contains
 7998      include files, static libraries and function documentation.  The
 7999      doc package contains the contents of the doc directory.  The original
 8000      openssl.spec was provided by Damien Miller <djm@mindrot.org>.
 8001      [Richard Levitte]
 8002      
 8003   *) Add a large number of documentation files for many SSL routines.
 8004      [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
 8005 
 8006   *) Add a configuration entry for Sony News 4.
 8007      [NAKAJI Hiroyuki <nakaji@tutrp.tut.ac.jp>]
 8008 
 8009   *) Don't set the two most significant bits to one when generating a
 8010      random number < q in the DSA library.
 8011      [Ulf Möller]
 8012 
 8013   *) New SSL API mode 'SSL_MODE_AUTO_RETRY'.  This disables the default
 8014      behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if
 8015      the underlying transport is blocking) if a handshake took place.
 8016      (The default behaviour is needed by applications such as s_client
 8017      and s_server that use select() to determine when to use SSL_read;
 8018      but for applications that know in advance when to expect data, it
 8019      just makes things more complicated.)
 8020      [Bodo Moeller]
 8021 
 8022   *) Add RAND_egd_bytes(), which gives control over the number of bytes read
 8023      from EGD.
 8024      [Ben Laurie]
 8025 
 8026   *) Add a few more EBCDIC conditionals that make `req' and `x509'
 8027      work better on such systems.
 8028      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
 8029 
 8030   *) Add two demo programs for PKCS12_parse() and PKCS12_create().
 8031      Update PKCS12_parse() so it copies the friendlyName and the
 8032      keyid to the certificates aux info.
 8033      [Steve Henson]
 8034 
 8035   *) Fix bug in PKCS7_verify() which caused an infinite loop
 8036      if there was more than one signature.
 8037      [Sven Uszpelkat <su@celocom.de>]
 8038 
 8039   *) Major change in util/mkdef.pl to include extra information
 8040      about each symbol, as well as presentig variables as well
 8041      as functions.  This change means that there's n more need
 8042      to rebuild the .num files when some algorithms are excluded.
 8043      [Richard Levitte]
 8044 
 8045   *) Allow the verify time to be set by an application,
 8046      rather than always using the current time.
 8047      [Steve Henson]
 8048   
 8049   *) Phase 2 verify code reorganisation. The certificate
 8050      verify code now looks up an issuer certificate by a
 8051      number of criteria: subject name, authority key id
 8052      and key usage. It also verifies self signed certificates
 8053      by the same criteria. The main comparison function is
 8054      X509_check_issued() which performs these checks.
 8055  
 8056      Lot of changes were necessary in order to support this
 8057      without completely rewriting the lookup code.
 8058  
 8059      Authority and subject key identifier are now cached.
 8060  
 8061      The LHASH 'certs' is X509_STORE has now been replaced
 8062      by a STACK_OF(X509_OBJECT). This is mainly because an
 8063      LHASH can't store or retrieve multiple objects with
 8064      the same hash value.
 8065 
 8066      As a result various functions (which were all internal
 8067      use only) have changed to handle the new X509_STORE
 8068      structure. This will break anything that messed round
 8069      with X509_STORE internally.
 8070  
 8071      The functions X509_STORE_add_cert() now checks for an
 8072      exact match, rather than just subject name.
 8073  
 8074      The X509_STORE API doesn't directly support the retrieval
 8075      of multiple certificates matching a given criteria, however
 8076      this can be worked round by performing a lookup first
 8077      (which will fill the cache with candidate certificates)
 8078      and then examining the cache for matches. This is probably
 8079      the best we can do without throwing out X509_LOOKUP
 8080      entirely (maybe later...).
 8081  
 8082      The X509_VERIFY_CTX structure has been enhanced considerably.
 8083  
 8084      All certificate lookup operations now go via a get_issuer()
 8085      callback. Although this currently uses an X509_STORE it
 8086      can be replaced by custom lookups. This is a simple way
 8087      to bypass the X509_STORE hackery necessary to make this
 8088      work and makes it possible to use more efficient techniques
 8089      in future. A very simple version which uses a simple
 8090      STACK for its trusted certificate store is also provided
 8091      using X509_STORE_CTX_trusted_stack().
 8092  
 8093      The verify_cb() and verify() callbacks now have equivalents
 8094      in the X509_STORE_CTX structure.
 8095  
 8096      X509_STORE_CTX also has a 'flags' field which can be used
 8097      to customise the verify behaviour.
 8098      [Steve Henson]
 8099  
 8100   *) Add new PKCS#7 signing option PKCS7_NOSMIMECAP which 
 8101      excludes S/MIME capabilities.
 8102      [Steve Henson]
 8103 
 8104   *) When a certificate request is read in keep a copy of the
 8105      original encoding of the signed data and use it when outputing
 8106      again. Signatures then use the original encoding rather than
 8107      a decoded, encoded version which may cause problems if the
 8108      request is improperly encoded.
 8109      [Steve Henson]
 8110 
 8111   *) For consistency with other BIO_puts implementations, call
 8112      buffer_write(b, ...) directly in buffer_puts instead of calling
 8113      BIO_write(b, ...).
 8114 
 8115      In BIO_puts, increment b->num_write as in BIO_write.
 8116      [Peter.Sylvester@EdelWeb.fr]
 8117 
 8118   *) Fix BN_mul_word for the case where the word is 0. (We have to use
 8119      BN_zero, we may not return a BIGNUM with an array consisting of
 8120      words set to zero.)
 8121      [Bodo Moeller]
 8122 
 8123   *) Avoid calling abort() from within the library when problems are
 8124      detected, except if preprocessor symbols have been defined
 8125      (such as REF_CHECK, BN_DEBUG etc.).
 8126      [Bodo Moeller]
 8127 
 8128   *) New openssl application 'rsautl'. This utility can be
 8129      used for low level RSA operations. DER public key
 8130      BIO/fp routines also added.
 8131      [Steve Henson]
 8132 
 8133   *) New Configure entry and patches for compiling on QNX 4.
 8134      [Andreas Schneider <andreas@ds3.etech.fh-hamburg.de>]
 8135 
 8136   *) A demo state-machine implementation was sponsored by
 8137      Nuron (http://www.nuron.com/) and is now available in
 8138      demos/state_machine.
 8139      [Ben Laurie]
 8140 
 8141   *) New options added to the 'dgst' utility for signature
 8142      generation and verification.
 8143      [Steve Henson]
 8144 
 8145   *) Unrecognized PKCS#7 content types are now handled via a
 8146      catch all ASN1_TYPE structure. This allows unsupported
 8147      types to be stored as a "blob" and an application can
 8148      encode and decode it manually.
 8149      [Steve Henson]
 8150 
 8151   *) Fix various signed/unsigned issues to make a_strex.c
 8152      compile under VC++.
 8153      [Oscar Jacobsson <oscar.jacobsson@celocom.com>]
 8154 
 8155   *) ASN1 fixes. i2d_ASN1_OBJECT was not returning the correct
 8156      length if passed a buffer. ASN1_INTEGER_to_BN failed
 8157      if passed a NULL BN and its argument was negative.
 8158      [Steve Henson, pointed out by Sven Heiberg <sven@tartu.cyber.ee>]
 8159 
 8160   *) Modification to PKCS#7 encoding routines to output definite
 8161      length encoding. Since currently the whole structures are in
 8162      memory there's not real point in using indefinite length 
 8163      constructed encoding. However if OpenSSL is compiled with
 8164      the flag PKCS7_INDEFINITE_ENCODING the old form is used.
 8165      [Steve Henson]
 8166 
 8167   *) Added BIO_vprintf() and BIO_vsnprintf().
 8168      [Richard Levitte]
 8169 
 8170   *) Added more prefixes to parse for in the the strings written
 8171      through a logging bio, to cover all the levels that are available
 8172      through syslog.  The prefixes are now:
 8173 
 8174 	PANIC, EMERG, EMR	=>	LOG_EMERG
 8175 	ALERT, ALR		=>	LOG_ALERT
 8176 	CRIT, CRI		=>	LOG_CRIT
 8177 	ERROR, ERR		=>	LOG_ERR
 8178 	WARNING, WARN, WAR	=>	LOG_WARNING
 8179 	NOTICE, NOTE, NOT	=>	LOG_NOTICE
 8180 	INFO, INF		=>	LOG_INFO
 8181 	DEBUG, DBG		=>	LOG_DEBUG
 8182 
 8183      and as before, if none of those prefixes are present at the
 8184      beginning of the string, LOG_ERR is chosen.
 8185 
 8186      On Win32, the LOG_* levels are mapped according to this:
 8187 
 8188 	LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR	=> EVENTLOG_ERROR_TYPE
 8189 	LOG_WARNING				=> EVENTLOG_WARNING_TYPE
 8190 	LOG_NOTICE, LOG_INFO, LOG_DEBUG		=> EVENTLOG_INFORMATION_TYPE
 8191 
 8192      [Richard Levitte]
 8193 
 8194   *) Made it possible to reconfigure with just the configuration
 8195      argument "reconf" or "reconfigure".  The command line arguments
 8196      are stored in Makefile.ssl in the variable CONFIGURE_ARGS,
 8197      and are retrieved from there when reconfiguring.
 8198      [Richard Levitte]
 8199 
 8200   *) MD4 implemented.
 8201      [Assar Westerlund <assar@sics.se>, Richard Levitte]
 8202 
 8203   *) Add the arguments -CAfile and -CApath to the pkcs12 utility.
 8204      [Richard Levitte]
 8205 
 8206   *) The obj_dat.pl script was messing up the sorting of object
 8207      names. The reason was that it compared the quoted version
 8208      of strings as a result "OCSP" > "OCSP Signing" because
 8209      " > SPACE. Changed script to store unquoted versions of
 8210      names and add quotes on output. It was also omitting some
 8211      names from the lookup table if they were given a default
 8212      value (that is if SN is missing it is given the same
 8213      value as LN and vice versa), these are now added on the
 8214      grounds that if an object has a name we should be able to
 8215      look it up. Finally added warning output when duplicate
 8216      short or long names are found.
 8217      [Steve Henson]
 8218 
 8219   *) Changes needed for Tandem NSK.
 8220      [Scott Uroff <scott@xypro.com>]
 8221 
 8222   *) Fix SSL 2.0 rollback checking: Due to an off-by-one error in
 8223      RSA_padding_check_SSLv23(), special padding was never detected
 8224      and thus the SSL 3.0/TLS 1.0 countermeasure against protocol
 8225      version rollback attacks was not effective.
 8226 
 8227      In s23_clnt.c, don't use special rollback-attack detection padding
 8228      (RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the
 8229      client; similarly, in s23_srvr.c, don't do the rollback check if
 8230      SSL 2.0 is the only protocol enabled in the server.
 8231      [Bodo Moeller]
 8232 
 8233   *) Make it possible to get hexdumps of unprintable data with 'openssl
 8234      asn1parse'.  By implication, the functions ASN1_parse_dump() and
 8235      BIO_dump_indent() are added.
 8236      [Richard Levitte]
 8237 
 8238   *) New functions ASN1_STRING_print_ex() and X509_NAME_print_ex()
 8239      these print out strings and name structures based on various
 8240      flags including RFC2253 support and proper handling of
 8241      multibyte characters. Added options to the 'x509' utility 
 8242      to allow the various flags to be set.
 8243      [Steve Henson]
 8244 
 8245   *) Various fixes to use ASN1_TIME instead of ASN1_UTCTIME.
 8246      Also change the functions X509_cmp_current_time() and
 8247      X509_gmtime_adj() work with an ASN1_TIME structure,
 8248      this will enable certificates using GeneralizedTime in validity
 8249      dates to be checked.
 8250      [Steve Henson]
 8251 
 8252   *) Make the NEG_PUBKEY_BUG code (which tolerates invalid
 8253      negative public key encodings) on by default,
 8254      NO_NEG_PUBKEY_BUG can be set to disable it.
 8255      [Steve Henson]
 8256 
 8257   *) New function c2i_ASN1_OBJECT() which acts on ASN1_OBJECT
 8258      content octets. An i2c_ASN1_OBJECT is unnecessary because
 8259      the encoding can be trivially obtained from the structure.
 8260      [Steve Henson]
 8261 
 8262   *) crypto/err.c locking bugfix: Use write locks (CRYPTO_w_[un]lock),
 8263      not read locks (CRYPTO_r_[un]lock).
 8264      [Bodo Moeller]
 8265 
 8266   *) A first attempt at creating official support for shared
 8267      libraries through configuration.  I've kept it so the
 8268      default is static libraries only, and the OpenSSL programs
 8269      are always statically linked for now, but there are
 8270      preparations for dynamic linking in place.
 8271      This has been tested on Linux and Tru64.
 8272      [Richard Levitte]
 8273 
 8274   *) Randomness polling function for Win9x, as described in:
 8275      Peter Gutmann, Software Generation of Practically Strong
 8276      Random Numbers.
 8277      [Ulf Möller]
 8278 
 8279   *) Fix so PRNG is seeded in req if using an already existing
 8280      DSA key.
 8281      [Steve Henson]
 8282 
 8283   *) New options to smime application. -inform and -outform
 8284      allow alternative formats for the S/MIME message including
 8285      PEM and DER. The -content option allows the content to be
 8286      specified separately. This should allow things like Netscape
 8287      form signing output easier to verify.
 8288      [Steve Henson]
 8289 
 8290   *) Fix the ASN1 encoding of tags using the 'long form'.
 8291      [Steve Henson]
 8292 
 8293   *) New ASN1 functions, i2c_* and c2i_* for INTEGER and BIT
 8294      STRING types. These convert content octets to and from the
 8295      underlying type. The actual tag and length octets are
 8296      already assumed to have been read in and checked. These
 8297      are needed because all other string types have virtually
 8298      identical handling apart from the tag. By having versions
 8299      of the ASN1 functions that just operate on content octets
 8300      IMPLICIT tagging can be handled properly. It also allows
 8301      the ASN1_ENUMERATED code to be cut down because ASN1_ENUMERATED
 8302      and ASN1_INTEGER are identical apart from the tag.
 8303      [Steve Henson]
 8304 
 8305   *) Change the handling of OID objects as follows:
 8306 
 8307      - New object identifiers are inserted in objects.txt, following
 8308        the syntax given in objects.README.
 8309      - objects.pl is used to process obj_mac.num and create a new
 8310        obj_mac.h.
 8311      - obj_dat.pl is used to create a new obj_dat.h, using the data in
 8312        obj_mac.h.
 8313 
 8314      This is currently kind of a hack, and the perl code in objects.pl
 8315      isn't very elegant, but it works as I intended.  The simplest way
 8316      to check that it worked correctly is to look in obj_dat.h and
 8317      check the array nid_objs and make sure the objects haven't moved
 8318      around (this is important!).  Additions are OK, as well as
 8319      consistent name changes. 
 8320      [Richard Levitte]
 8321 
 8322   *) Add BSD-style MD5-based passwords to 'openssl passwd' (option '-1').
 8323      [Bodo Moeller]
 8324 
 8325   *) Addition of the command line parameter '-rand file' to 'openssl req'.
 8326      The given file adds to whatever has already been seeded into the
 8327      random pool through the RANDFILE configuration file option or
 8328      environment variable, or the default random state file.
 8329      [Richard Levitte]
 8330 
 8331   *) mkstack.pl now sorts each macro group into lexical order.
 8332      Previously the output order depended on the order the files
 8333      appeared in the directory, resulting in needless rewriting
 8334      of safestack.h .
 8335      [Steve Henson]
 8336 
 8337   *) Patches to make OpenSSL compile under Win32 again. Mostly
 8338      work arounds for the VC++ problem that it treats func() as
 8339      func(void). Also stripped out the parts of mkdef.pl that
 8340      added extra typesafe functions: these no longer exist.
 8341      [Steve Henson]
 8342 
 8343   *) Reorganisation of the stack code. The macros are now all 
 8344      collected in safestack.h . Each macro is defined in terms of
 8345      a "stack macro" of the form SKM_<name>(type, a, b). The 
 8346      DEBUG_SAFESTACK is now handled in terms of function casts,
 8347      this has the advantage of retaining type safety without the
 8348      use of additional functions. If DEBUG_SAFESTACK is not defined
 8349      then the non typesafe macros are used instead. Also modified the
 8350      mkstack.pl script to handle the new form. Needs testing to see
 8351      if which (if any) compilers it chokes and maybe make DEBUG_SAFESTACK
 8352      the default if no major problems. Similar behaviour for ASN1_SET_OF
 8353      and PKCS12_STACK_OF.
 8354      [Steve Henson]
 8355 
 8356   *) When some versions of IIS use the 'NET' form of private key the
 8357      key derivation algorithm is different. Normally MD5(password) is
 8358      used as a 128 bit RC4 key. In the modified case
 8359      MD5(MD5(password) + "SGCKEYSALT")  is used insted. Added some
 8360      new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same
 8361      as the old Netscape_RSA functions except they have an additional
 8362      'sgckey' parameter which uses the modified algorithm. Also added
 8363      an -sgckey command line option to the rsa utility. Thanks to 
 8364      Adrian Peck <bertie@ncipher.com> for posting details of the modified
 8365      algorithm to openssl-dev.
 8366      [Steve Henson]
 8367 
 8368   *) The evp_local.h macros were using 'c.##kname' which resulted in
 8369      invalid expansion on some systems (SCO 5.0.5 for example).
 8370      Corrected to 'c.kname'.
 8371      [Phillip Porch <root@theporch.com>]
 8372 
 8373   *) New X509_get1_email() and X509_REQ_get1_email() functions that return
 8374      a STACK of email addresses from a certificate or request, these look
 8375      in the subject name and the subject alternative name extensions and 
 8376      omit any duplicate addresses.
 8377      [Steve Henson]
 8378 
 8379   *) Re-implement BN_mod_exp2_mont using independent (and larger) windows.
 8380      This makes DSA verification about 2 % faster.
 8381      [Bodo Moeller]
 8382 
 8383   *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5
 8384      (meaning that now 2^5 values will be precomputed, which is only 4 KB
 8385      plus overhead for 1024 bit moduli).
 8386      This makes exponentiations about 0.5 % faster for 1024 bit
 8387      exponents (as measured by "openssl speed rsa2048").
 8388      [Bodo Moeller]
 8389 
 8390   *) Rename memory handling macros to avoid conflicts with other
 8391      software:
 8392           Malloc         =>  OPENSSL_malloc
 8393           Malloc_locked  =>  OPENSSL_malloc_locked
 8394           Realloc        =>  OPENSSL_realloc
 8395           Free           =>  OPENSSL_free
 8396      [Richard Levitte]
 8397 
 8398   *) New function BN_mod_exp_mont_word for small bases (roughly 15%
 8399      faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange).
 8400      [Bodo Moeller]
 8401 
 8402   *) CygWin32 support.
 8403      [John Jarvie <jjarvie@newsguy.com>]
 8404 
 8405   *) The type-safe stack code has been rejigged. It is now only compiled
 8406      in when OpenSSL is configured with the DEBUG_SAFESTACK option and
 8407      by default all type-specific stack functions are "#define"d back to
 8408      standard stack functions. This results in more streamlined output
 8409      but retains the type-safety checking possibilities of the original
 8410      approach.
 8411      [Geoff Thorpe]
 8412 
 8413   *) The STACK code has been cleaned up, and certain type declarations
 8414      that didn't make a lot of sense have been brought in line. This has
 8415      also involved a cleanup of sorts in safestack.h to more correctly
 8416      map type-safe stack functions onto their plain stack counterparts.
 8417      This work has also resulted in a variety of "const"ifications of
 8418      lots of the code, especially "_cmp" operations which should normally
 8419      be prototyped with "const" parameters anyway.
 8420      [Geoff Thorpe]
 8421 
 8422   *) When generating bytes for the first time in md_rand.c, 'stir the pool'
 8423      by seeding with STATE_SIZE dummy bytes (with zero entropy count).
 8424      (The PRNG state consists of two parts, the large pool 'state' and 'md',
 8425      where all of 'md' is used each time the PRNG is used, but 'state'
 8426      is used only indexed by a cyclic counter. As entropy may not be
 8427      well distributed from the beginning, 'md' is important as a
 8428      chaining variable. However, the output function chains only half
 8429      of 'md', i.e. 80 bits.  ssleay_rand_add, on the other hand, chains
 8430      all of 'md', and seeding with STATE_SIZE dummy bytes will result
 8431      in all of 'state' being rewritten, with the new values depending
 8432      on virtually all of 'md'.  This overcomes the 80 bit limitation.)
 8433      [Bodo Moeller]
 8434 
 8435   *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when
 8436      the handshake is continued after ssl_verify_cert_chain();
 8437      otherwise, if SSL_VERIFY_NONE is set, remaining error codes
 8438      can lead to 'unexplainable' connection aborts later.
 8439      [Bodo Moeller; problem tracked down by Lutz Jaenicke]
 8440 
 8441   *) Major EVP API cipher revision.
 8442      Add hooks for extra EVP features. This allows various cipher
 8443      parameters to be set in the EVP interface. Support added for variable
 8444      key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and
 8445      setting of RC2 and RC5 parameters.
 8446 
 8447      Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length
 8448      ciphers.
 8449 
 8450      Remove lots of duplicated code from the EVP library. For example *every*
 8451      cipher init() function handles the 'iv' in the same way according to the
 8452      cipher mode. They also all do nothing if the 'key' parameter is NULL and
 8453      for CFB and OFB modes they zero ctx->num.
 8454 
 8455      New functionality allows removal of S/MIME code RC2 hack.
 8456 
 8457      Most of the routines have the same form and so can be declared in terms
 8458      of macros.
 8459 
 8460      By shifting this to the top level EVP_CipherInit() it can be removed from
 8461      all individual ciphers. If the cipher wants to handle IVs or keys
 8462      differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT
 8463      flags.
 8464 
 8465      Change lots of functions like EVP_EncryptUpdate() to now return a
 8466      value: although software versions of the algorithms cannot fail
 8467      any installed hardware versions can.
 8468      [Steve Henson]
 8469 
 8470   *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if
 8471      this option is set, tolerate broken clients that send the negotiated
 8472      protocol version number instead of the requested protocol version
 8473      number.
 8474      [Bodo Moeller]
 8475 
 8476   *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag;
 8477      i.e. non-zero for export ciphersuites, zero otherwise.
 8478      Previous versions had this flag inverted, inconsistent with
 8479      rsa_tmp_cb (..._TMP_RSA_CB).
 8480      [Bodo Moeller; problem reported by Amit Chopra]
 8481 
 8482   *) Add missing DSA library text string. Work around for some IIS
 8483      key files with invalid SEQUENCE encoding.
 8484      [Steve Henson]
 8485 
 8486   *) Add a document (doc/standards.txt) that list all kinds of standards
 8487      and so on that are implemented in OpenSSL.
 8488      [Richard Levitte]
 8489 
 8490   *) Enhance c_rehash script. Old version would mishandle certificates
 8491      with the same subject name hash and wouldn't handle CRLs at all.
 8492      Added -fingerprint option to crl utility, to support new c_rehash
 8493      features.
 8494      [Steve Henson]
 8495 
 8496   *) Eliminate non-ANSI declarations in crypto.h and stack.h.
 8497      [Ulf Möller]
 8498 
 8499   *) Fix for SSL server purpose checking. Server checking was
 8500      rejecting certificates which had extended key usage present
 8501      but no ssl client purpose.
 8502      [Steve Henson, reported by Rene Grosser <grosser@hisolutions.com>]
 8503 
 8504   *) Make PKCS#12 code work with no password. The PKCS#12 spec
 8505      is a little unclear about how a blank password is handled.
 8506      Since the password in encoded as a BMPString with terminating
 8507      double NULL a zero length password would end up as just the
 8508      double NULL. However no password at all is different and is
 8509      handled differently in the PKCS#12 key generation code. NS
 8510      treats a blank password as zero length. MSIE treats it as no
 8511      password on export: but it will try both on import. We now do
 8512      the same: PKCS12_parse() tries zero length and no password if
 8513      the password is set to "" or NULL (NULL is now a valid password:
 8514      it wasn't before) as does the pkcs12 application.
 8515      [Steve Henson]
 8516 
 8517   *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use
 8518      perror when PEM_read_bio_X509_REQ fails, the error message must
 8519      be obtained from the error queue.
 8520      [Bodo Moeller]
 8521 
 8522   *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing
 8523      it in ERR_remove_state if appropriate, and change ERR_get_state
 8524      accordingly to avoid race conditions (this is necessary because
 8525      thread_hash is no longer constant once set).
 8526      [Bodo Moeller]
 8527 
 8528   *) Bugfix for linux-elf makefile.one.
 8529      [Ulf Möller]
 8530 
 8531   *) RSA_get_default_method() will now cause a default
 8532      RSA_METHOD to be chosen if one doesn't exist already.
 8533      Previously this was only set during a call to RSA_new()
 8534      or RSA_new_method(NULL) meaning it was possible for
 8535      RSA_get_default_method() to return NULL.
 8536      [Geoff Thorpe]
 8537 
 8538   *) Added native name translation to the existing DSO code
 8539      that will convert (if the flag to do so is set) filenames
 8540      that are sufficiently small and have no path information
 8541      into a canonical native form. Eg. "blah" converted to
 8542      "libblah.so" or "blah.dll" etc.
 8543      [Geoff Thorpe]
 8544 
 8545   *) New function ERR_error_string_n(e, buf, len) which is like
 8546      ERR_error_string(e, buf), but writes at most 'len' bytes
 8547      including the 0 terminator.  For ERR_error_string_n, 'buf'
 8548      may not be NULL.
 8549      [Damien Miller <djm@mindrot.org>, Bodo Moeller]
 8550 
 8551   *) CONF library reworked to become more general.  A new CONF
 8552      configuration file reader "class" is implemented as well as a
 8553      new functions (NCONF_*, for "New CONF") to handle it.  The now
 8554      old CONF_* functions are still there, but are reimplemented to
 8555      work in terms of the new functions.  Also, a set of functions
 8556      to handle the internal storage of the configuration data is
 8557      provided to make it easier to write new configuration file
 8558      reader "classes" (I can definitely see something reading a
 8559      configuration file in XML format, for example), called _CONF_*,
 8560      or "the configuration storage API"...
 8561 
 8562      The new configuration file reading functions are:
 8563 
 8564         NCONF_new, NCONF_free, NCONF_load, NCONF_load_fp, NCONF_load_bio,
 8565         NCONF_get_section, NCONF_get_string, NCONF_get_numbre
 8566 
 8567         NCONF_default, NCONF_WIN32
 8568 
 8569         NCONF_dump_fp, NCONF_dump_bio
 8570 
 8571      NCONF_default and NCONF_WIN32 are method (or "class") choosers,
 8572      NCONF_new creates a new CONF object.  This works in the same way
 8573      as other interfaces in OpenSSL, like the BIO interface.
 8574      NCONF_dump_* dump the internal storage of the configuration file,
 8575      which is useful for debugging.  All other functions take the same
 8576      arguments as the old CONF_* functions wth the exception of the
 8577      first that must be a `CONF *' instead of a `LHASH *'.
 8578 
 8579      To make it easer to use the new classes with the old CONF_* functions,
 8580      the function CONF_set_default_method is provided.
 8581      [Richard Levitte]
 8582 
 8583   *) Add '-tls1' option to 'openssl ciphers', which was already
 8584      mentioned in the documentation but had not been implemented.
 8585      (This option is not yet really useful because even the additional
 8586      experimental TLS 1.0 ciphers are currently treated as SSL 3.0 ciphers.)
 8587      [Bodo Moeller]
 8588 
 8589   *) Initial DSO code added into libcrypto for letting OpenSSL (and
 8590      OpenSSL-based applications) load shared libraries and bind to
 8591      them in a portable way.
 8592      [Geoff Thorpe, with contributions from Richard Levitte]
 8593 
 8594  Changes between 0.9.5 and 0.9.5a  [1 Apr 2000]
 8595 
 8596   *) Make sure _lrotl and _lrotr are only used with MSVC.
 8597 
 8598   *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status
 8599      (the default implementation of RAND_status).
 8600 
 8601   *) Rename openssl x509 option '-crlext', which was added in 0.9.5,
 8602      to '-clrext' (= clear extensions), as intended and documented.
 8603      [Bodo Moeller; inconsistency pointed out by Michael Attili
 8604      <attili@amaxo.com>]
 8605 
 8606   *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length
 8607      was larger than the MD block size.      
 8608      [Steve Henson, pointed out by Yost William <YostW@tce.com>]
 8609 
 8610   *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument
 8611      fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set()
 8612      using the passed key: if the passed key was a private key the result
 8613      of X509_print(), for example, would be to print out all the private key
 8614      components.
 8615      [Steve Henson]
 8616 
 8617   *) des_quad_cksum() byte order bug fix.
 8618      [Ulf Möller, using the problem description in krb4-0.9.7, where
 8619       the solution is attributed to Derrick J Brashear <shadow@DEMENTIA.ORG>]
 8620 
 8621   *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly
 8622      discouraged.
 8623      [Steve Henson, pointed out by Brian Korver <briank@cs.stanford.edu>]
 8624 
 8625   *) For easily testing in shell scripts whether some command
 8626      'openssl XXX' exists, the new pseudo-command 'openssl no-XXX'
 8627      returns with exit code 0 iff no command of the given name is available.
 8628      'no-XXX' is printed in this case, 'XXX' otherwise.  In both cases,
 8629      the output goes to stdout and nothing is printed to stderr.
 8630      Additional arguments are always ignored.
 8631 
 8632      Since for each cipher there is a command of the same name,
 8633      the 'no-cipher' compilation switches can be tested this way.
 8634 
 8635      ('openssl no-XXX' is not able to detect pseudo-commands such
 8636      as 'quit', 'list-XXX-commands', or 'no-XXX' itself.)
 8637      [Bodo Moeller]
 8638 
 8639   *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration.
 8640      [Bodo Moeller]
 8641 
 8642   *) For SSL_[CTX_]set_tmp_dh, don't create a DH key if SSL_OP_SINGLE_DH_USE
 8643      is set; it will be thrown away anyway because each handshake creates
 8644      its own key.
 8645      ssl_cert_dup, which is used by SSL_new, now copies DH keys in addition
 8646      to parameters -- in previous versions (since OpenSSL 0.9.3) the
 8647      'default key' from SSL_CTX_set_tmp_dh would always be lost, meanining
 8648      you effectivly got SSL_OP_SINGLE_DH_USE when using this macro.
 8649      [Bodo Moeller]
 8650 
 8651   *) New s_client option -ign_eof: EOF at stdin is ignored, and
 8652      'Q' and 'R' lose their special meanings (quit/renegotiate).
 8653      This is part of what -quiet does; unlike -quiet, -ign_eof
 8654      does not suppress any output.
 8655      [Richard Levitte]
 8656 
 8657   *) Add compatibility options to the purpose and trust code. The
 8658      purpose X509_PURPOSE_ANY is "any purpose" which automatically
 8659      accepts a certificate or CA, this was the previous behaviour,
 8660      with all the associated security issues.
 8661 
 8662      X509_TRUST_COMPAT is the old trust behaviour: only and
 8663      automatically trust self signed roots in certificate store. A
 8664      new trust setting X509_TRUST_DEFAULT is used to specify that
 8665      a purpose has no associated trust setting and it should instead
 8666      use the value in the default purpose.
 8667      [Steve Henson]
 8668 
 8669   *) Fix the PKCS#8 DSA private key code so it decodes keys again
 8670      and fix a memory leak.
 8671      [Steve Henson]
 8672 
 8673   *) In util/mkerr.pl (which implements 'make errors'), preserve
 8674      reason strings from the previous version of the .c file, as
 8675      the default to have only downcase letters (and digits) in
 8676      automatically generated reasons codes is not always appropriate.
 8677      [Bodo Moeller]
 8678 
 8679   *) In ERR_load_ERR_strings(), build an ERR_LIB_SYS error reason table
 8680      using strerror.  Previously, ERR_reason_error_string() returned
 8681      library names as reason strings for SYSerr; but SYSerr is a special
 8682      case where small numbers are errno values, not library numbers.
 8683      [Bodo Moeller]
 8684 
 8685   *) Add '-dsaparam' option to 'openssl dhparam' application.  This
 8686      converts DSA parameters into DH parameters. (When creating parameters,
 8687      DSA_generate_parameters is used.)
 8688      [Bodo Moeller]
 8689 
 8690   *) Include 'length' (recommended exponent length) in C code generated
 8691      by 'openssl dhparam -C'.
 8692      [Bodo Moeller]
 8693 
 8694   *) The second argument to set_label in perlasm was already being used
 8695      so couldn't be used as a "file scope" flag. Moved to third argument
 8696      which was free.
 8697      [Steve Henson]
 8698 
 8699   *) In PEM_ASN1_write_bio and some other functions, use RAND_pseudo_bytes
 8700      instead of RAND_bytes for encryption IVs and salts.
 8701      [Bodo Moeller]
 8702 
 8703   *) Include RAND_status() into RAND_METHOD instead of implementing
 8704      it only for md_rand.c  Otherwise replacing the PRNG by calling
 8705      RAND_set_rand_method would be impossible.
 8706      [Bodo Moeller]
 8707 
 8708   *) Don't let DSA_generate_key() enter an infinite loop if the random
 8709      number generation fails.
 8710      [Bodo Moeller]
 8711 
 8712   *) New 'rand' application for creating pseudo-random output.
 8713      [Bodo Moeller]
 8714 
 8715   *) Added configuration support for Linux/IA64
 8716      [Rolf Haberrecker <rolf@suse.de>]
 8717 
 8718   *) Assembler module support for Mingw32.
 8719      [Ulf Möller]
 8720 
 8721   *) Shared library support for HPUX (in shlib/).
 8722      [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE> and Anonymous]
 8723 
 8724   *) Shared library support for Solaris gcc.
 8725      [Lutz Behnke <behnke@trustcenter.de>]
 8726 
 8727  Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
 8728 
 8729   *) PKCS7_encrypt() was adding text MIME headers twice because they
 8730      were added manually and by SMIME_crlf_copy().
 8731      [Steve Henson]
 8732 
 8733   *) In bntest.c don't call BN_rand with zero bits argument.
 8734      [Steve Henson, pointed out by Andrew W. Gray <agray@iconsinc.com>]
 8735 
 8736   *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
 8737      case was implemented. This caused BN_div_recp() to fail occasionally.
 8738      [Ulf Möller]
 8739 
 8740   *) Add an optional second argument to the set_label() in the perl
 8741      assembly language builder. If this argument exists and is set
 8742      to 1 it signals that the assembler should use a symbol whose 
 8743      scope is the entire file, not just the current function. This
 8744      is needed with MASM which uses the format label:: for this scope.
 8745      [Steve Henson, pointed out by Peter Runestig <peter@runestig.com>]
 8746 
 8747   *) Change the ASN1 types so they are typedefs by default. Before
 8748      almost all types were #define'd to ASN1_STRING which was causing
 8749      STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
 8750      for example.
 8751      [Steve Henson]
 8752 
 8753   *) Change names of new functions to the new get1/get0 naming
 8754      convention: After 'get1', the caller owns a reference count
 8755      and has to call ..._free; 'get0' returns a pointer to some
 8756      data structure without incrementing reference counters.
 8757      (Some of the existing 'get' functions increment a reference
 8758      counter, some don't.)
 8759      Similarly, 'set1' and 'add1' functions increase reference
 8760      counters or duplicate objects.
 8761      [Steve Henson]
 8762 
 8763   *) Allow for the possibility of temp RSA key generation failure:
 8764      the code used to assume it always worked and crashed on failure.
 8765      [Steve Henson]
 8766 
 8767   *) Fix potential buffer overrun problem in BIO_printf().
 8768      [Ulf Möller, using public domain code by Patrick Powell; problem
 8769       pointed out by David Sacerdote <das33@cornell.edu>]
 8770 
 8771   *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
 8772      RAND_egd() and RAND_status().  In the command line application,
 8773      the EGD socket can be specified like a seed file using RANDFILE
 8774      or -rand.
 8775      [Ulf Möller]
 8776 
 8777   *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
 8778      Some CAs (e.g. Verisign) distribute certificates in this form.
 8779      [Steve Henson]
 8780 
 8781   *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
 8782      list to exclude them. This means that no special compilation option
 8783      is needed to use anonymous DH: it just needs to be included in the
 8784      cipher list.
 8785      [Steve Henson]
 8786 
 8787   *) Change the EVP_MD_CTX_type macro so its meaning consistent with
 8788      EVP_MD_type. The old functionality is available in a new macro called
 8789      EVP_MD_md(). Change code that uses it and update docs.
 8790      [Steve Henson]
 8791 
 8792   *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
 8793      where the 'void *' argument is replaced by a function pointer argument.
 8794      Previously 'void *' was abused to point to functions, which works on
 8795      many platforms, but is not correct.  As these functions are usually
 8796      called by macros defined in OpenSSL header files, most source code
 8797      should work without changes.
 8798      [Richard Levitte]
 8799 
 8800   *) <openssl/opensslconf.h> (which is created by Configure) now contains
 8801      sections with information on -D... compiler switches used for
 8802      compiling the library so that applications can see them.  To enable
 8803      one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
 8804      must be defined.  E.g.,
 8805         #define OPENSSL_ALGORITHM_DEFINES
 8806         #include <openssl/opensslconf.h>
 8807      defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
 8808      [Richard Levitte, Ulf and Bodo Möller]
 8809 
 8810   *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
 8811      record layer.
 8812      [Bodo Moeller]
 8813 
 8814   *) Change the 'other' type in certificate aux info to a STACK_OF
 8815      X509_ALGOR. Although not an AlgorithmIdentifier as such it has
 8816      the required ASN1 format: arbitrary types determined by an OID.
 8817      [Steve Henson]
 8818 
 8819   *) Add some PEM_write_X509_REQ_NEW() functions and a command line
 8820      argument to 'req'. This is not because the function is newer or
 8821      better than others it just uses the work 'NEW' in the certificate
 8822      request header lines. Some software needs this.
 8823      [Steve Henson]
 8824 
 8825   *) Reorganise password command line arguments: now passwords can be
 8826      obtained from various sources. Delete the PEM_cb function and make
 8827      it the default behaviour: i.e. if the callback is NULL and the
 8828      usrdata argument is not NULL interpret it as a null terminated pass
 8829      phrase. If usrdata and the callback are NULL then the pass phrase
 8830      is prompted for as usual.
 8831      [Steve Henson]
 8832 
 8833   *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
 8834      the support is automatically enabled. The resulting binaries will
 8835      autodetect the card and use it if present.
 8836      [Ben Laurie and Compaq Inc.]
 8837 
 8838   *) Work around for Netscape hang bug. This sends certificate request
 8839      and server done in one record. Since this is perfectly legal in the
 8840      SSL/TLS protocol it isn't a "bug" option and is on by default. See
 8841      the bugs/SSLv3 entry for more info.
 8842      [Steve Henson]
 8843 
 8844   *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
 8845      [Andy Polyakov]
 8846 
 8847   *) Add -rand argument to smime and pkcs12 applications and read/write
 8848      of seed file.
 8849      [Steve Henson]
 8850 
 8851   *) New 'passwd' tool for crypt(3) and apr1 password hashes.
 8852      [Bodo Moeller]
 8853 
 8854   *) Add command line password options to the remaining applications.
 8855      [Steve Henson]
 8856 
 8857   *) Bug fix for BN_div_recp() for numerators with an even number of
 8858      bits.
 8859      [Ulf Möller]
 8860 
 8861   *) More tests in bntest.c, and changed test_bn output.
 8862      [Ulf Möller]
 8863 
 8864   *) ./config recognizes MacOS X now.
 8865      [Andy Polyakov]
 8866 
 8867   *) Bug fix for BN_div() when the first words of num and divsor are
 8868      equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
 8869      [Ulf Möller]
 8870 
 8871   *) Add support for various broken PKCS#8 formats, and command line
 8872      options to produce them.
 8873      [Steve Henson]
 8874 
 8875   *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
 8876      get temporary BIGNUMs from a BN_CTX.
 8877      [Ulf Möller]
 8878 
 8879   *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
 8880      for p == 0.
 8881      [Ulf Möller]
 8882 
 8883   *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
 8884      include a #define from the old name to the new. The original intent
 8885      was that statically linked binaries could for example just call
 8886      SSLeay_add_all_ciphers() to just add ciphers to the table and not
 8887      link with digests. This never worked becayse SSLeay_add_all_digests()
 8888      and SSLeay_add_all_ciphers() were in the same source file so calling
 8889      one would link with the other. They are now in separate source files.
 8890      [Steve Henson]
 8891 
 8892   *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
 8893      [Steve Henson]
 8894 
 8895   *) Use a less unusual form of the Miller-Rabin primality test (it used
 8896      a binary algorithm for exponentiation integrated into the Miller-Rabin
 8897      loop, our standard modexp algorithms are faster).
 8898      [Bodo Moeller]
 8899 
 8900   *) Support for the EBCDIC character set completed.
 8901      [Martin Kraemer <Martin.Kraemer@Mch.SNI.De>]
 8902 
 8903   *) Source code cleanups: use const where appropriate, eliminate casts,
 8904      use void * instead of char * in lhash.
 8905      [Ulf Möller] 
 8906 
 8907   *) Bugfix: ssl3_send_server_key_exchange was not restartable
 8908      (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
 8909      this the server could overwrite ephemeral keys that the client
 8910      has already seen).
 8911      [Bodo Moeller]
 8912 
 8913   *) Turn DSA_is_prime into a macro that calls BN_is_prime,
 8914      using 50 iterations of the Rabin-Miller test.
 8915 
 8916      DSA_generate_parameters now uses BN_is_prime_fasttest (with 50
 8917      iterations of the Rabin-Miller test as required by the appendix
 8918      to FIPS PUB 186[-1]) instead of DSA_is_prime.
 8919      As BN_is_prime_fasttest includes trial division, DSA parameter
 8920      generation becomes much faster.
 8921 
 8922      This implies a change for the callback functions in DSA_is_prime
 8923      and DSA_generate_parameters: The callback function is called once
 8924      for each positive witness in the Rabin-Miller test, not just
 8925      occasionally in the inner loop; and the parameters to the
 8926      callback function now provide an iteration count for the outer
 8927      loop rather than for the current invocation of the inner loop.
 8928      DSA_generate_parameters additionally can call the callback
 8929      function with an 'iteration count' of -1, meaning that a
 8930      candidate has passed the trial division test (when q is generated 
 8931      from an application-provided seed, trial division is skipped).
 8932      [Bodo Moeller]
 8933 
 8934   *) New function BN_is_prime_fasttest that optionally does trial
 8935      division before starting the Rabin-Miller test and has
 8936      an additional BN_CTX * argument (whereas BN_is_prime always
 8937      has to allocate at least one BN_CTX).
 8938      'callback(1, -1, cb_arg)' is called when a number has passed the
 8939      trial division stage.
 8940      [Bodo Moeller]
 8941 
 8942   *) Fix for bug in CRL encoding. The validity dates weren't being handled
 8943      as ASN1_TIME.
 8944      [Steve Henson]
 8945 
 8946   *) New -pkcs12 option to CA.pl script to write out a PKCS#12 file.
 8947      [Steve Henson]
 8948 
 8949   *) New function BN_pseudo_rand().
 8950      [Ulf Möller]
 8951 
 8952   *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable)
 8953      bignum version of BN_from_montgomery() with the working code from
 8954      SSLeay 0.9.0 (the word based version is faster anyway), and clean up
 8955      the comments.
 8956      [Ulf Möller]
 8957 
 8958   *) Avoid a race condition in s2_clnt.c (function get_server_hello) that
 8959      made it impossible to use the same SSL_SESSION data structure in
 8960      SSL2 clients in multiple threads.
 8961      [Bodo Moeller]
 8962 
 8963   *) The return value of RAND_load_file() no longer counts bytes obtained
 8964      by stat().  RAND_load_file(..., -1) is new and uses the complete file
 8965      to seed the PRNG (previously an explicit byte count was required).
 8966      [Ulf Möller, Bodo Möller]
 8967 
 8968   *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes
 8969      used (char *) instead of (void *) and had casts all over the place.
 8970      [Steve Henson]
 8971 
 8972   *) Make BN_generate_prime() return NULL on error if ret!=NULL.
 8973      [Ulf Möller]
 8974 
 8975   *) Retain source code compatibility for BN_prime_checks macro:
 8976      BN_is_prime(..., BN_prime_checks, ...) now uses
 8977      BN_prime_checks_for_size to determine the appropriate number of
 8978      Rabin-Miller iterations.
 8979      [Ulf Möller]
 8980 
 8981   *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to
 8982      DH_CHECK_P_NOT_SAFE_PRIME.
 8983      (Check if this is true? OpenPGP calls them "strong".)
 8984      [Ulf Möller]
 8985 
 8986   *) Merge the functionality of "dh" and "gendh" programs into a new program
 8987      "dhparam". The old programs are retained for now but will handle DH keys
 8988      (instead of parameters) in future.
 8989      [Steve Henson]
 8990 
 8991   *) Make the ciphers, s_server and s_client programs check the return values
 8992      when a new cipher list is set.
 8993      [Steve Henson]
 8994 
 8995   *) Enhance the SSL/TLS cipher mechanism to correctly handle the TLS 56bit
 8996      ciphers. Before when the 56bit ciphers were enabled the sorting was
 8997      wrong.
 8998 
 8999      The syntax for the cipher sorting has been extended to support sorting by
 9000      cipher-strength (using the strength_bits hard coded in the tables).
 9001      The new command is "@STRENGTH" (see also doc/apps/ciphers.pod).
 9002 
 9003      Fix a bug in the cipher-command parser: when supplying a cipher command
 9004      string with an "undefined" symbol (neither command nor alphanumeric
 9005      [A-Za-z0-9], ssl_set_cipher_list used to hang in an endless loop. Now
 9006      an error is flagged.
 9007 
 9008      Due to the strength-sorting extension, the code of the
 9009      ssl_create_cipher_list() function was completely rearranged. I hope that
 9010      the readability was also increased :-)
 9011      [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
 9012 
 9013   *) Minor change to 'x509' utility. The -CAcreateserial option now uses 1
 9014      for the first serial number and places 2 in the serial number file. This
 9015      avoids problems when the root CA is created with serial number zero and
 9016      the first user certificate has the same issuer name and serial number
 9017      as the root CA.
 9018      [Steve Henson]
 9019 
 9020   *) Fixes to X509_ATTRIBUTE utilities, change the 'req' program so it uses
 9021      the new code. Add documentation for this stuff.
 9022      [Steve Henson]
 9023 
 9024   *) Changes to X509_ATTRIBUTE utilities. These have been renamed from
 9025      X509_*() to X509at_*() on the grounds that they don't handle X509
 9026      structures and behave in an analagous way to the X509v3 functions:
 9027      they shouldn't be called directly but wrapper functions should be used
 9028      instead.
 9029 
 9030      So we also now have some wrapper functions that call the X509at functions
 9031      when passed certificate requests. (TO DO: similar things can be done with
 9032      PKCS#7 signed and unsigned attributes, PKCS#12 attributes and a few other
 9033      things. Some of these need some d2i or i2d and print functionality
 9034      because they handle more complex structures.)
 9035      [Steve Henson]
 9036 
 9037   *) Add missing #ifndefs that caused missing symbols when building libssl
 9038      as a shared library without RSA.  Use #ifndef NO_SSL2 instead of
 9039      NO_RSA in ssl/s2*.c. 
 9040      [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller]
 9041 
 9042   *) Precautions against using the PRNG uninitialized: RAND_bytes() now
 9043      has a return value which indicates the quality of the random data
 9044      (1 = ok, 0 = not seeded).  Also an error is recorded on the thread's
 9045      error queue. New function RAND_pseudo_bytes() generates output that is
 9046      guaranteed to be unique but not unpredictable. RAND_add is like
 9047      RAND_seed, but takes an extra argument for an entropy estimate
 9048      (RAND_seed always assumes full entropy).
 9049      [Ulf Möller]
 9050 
 9051   *) Do more iterations of Rabin-Miller probable prime test (specifically,
 9052      3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes
 9053      instead of only 2 for all lengths; see BN_prime_checks_for_size definition
 9054      in crypto/bn/bn_prime.c for the complete table).  This guarantees a
 9055      false-positive rate of at most 2^-80 for random input.
 9056      [Bodo Moeller]
 9057 
 9058   *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs.
 9059      [Bodo Moeller]
 9060 
 9061   *) New function X509_CTX_rget_chain() (renamed to X509_CTX_get1_chain
 9062      in the 0.9.5 release), this returns the chain
 9063      from an X509_CTX structure with a dup of the stack and all
 9064      the X509 reference counts upped: so the stack will exist
 9065      after X509_CTX_cleanup() has been called. Modify pkcs12.c
 9066      to use this.
 9067 
 9068      Also make SSL_SESSION_print() print out the verify return
 9069      code.
 9070      [Steve Henson]
 9071 
 9072   *) Add manpage for the pkcs12 command. Also change the default
 9073      behaviour so MAC iteration counts are used unless the new
 9074      -nomaciter option is used. This improves file security and
 9075      only older versions of MSIE (4.0 for example) need it.
 9076      [Steve Henson]
 9077 
 9078   *) Honor the no-xxx Configure options when creating .DEF files.
 9079      [Ulf Möller]
 9080 
 9081   *) Add PKCS#10 attributes to field table: challengePassword, 
 9082      unstructuredName and unstructuredAddress. These are taken from
 9083      draft PKCS#9 v2.0 but are compatible with v1.2 provided no 
 9084      international characters are used.
 9085 
 9086      More changes to X509_ATTRIBUTE code: allow the setting of types
 9087      based on strings. Remove the 'loc' parameter when adding
 9088      attributes because these will be a SET OF encoding which is sorted
 9089      in ASN1 order.
 9090      [Steve Henson]
 9091 
 9092   *) Initial changes to the 'req' utility to allow request generation
 9093      automation. This will allow an application to just generate a template
 9094      file containing all the field values and have req construct the
 9095      request.
 9096 
 9097      Initial support for X509_ATTRIBUTE handling. Stacks of these are
 9098      used all over the place including certificate requests and PKCS#7
 9099      structures. They are currently handled manually where necessary with
 9100      some primitive wrappers for PKCS#7. The new functions behave in a
 9101      manner analogous to the X509 extension functions: they allow
 9102      attributes to be looked up by NID and added.
 9103 
 9104      Later something similar to the X509V3 code would be desirable to
 9105      automatically handle the encoding, decoding and printing of the
 9106      more complex types. The string types like challengePassword can
 9107      be handled by the string table functions.
 9108 
 9109      Also modified the multi byte string table handling. Now there is
 9110      a 'global mask' which masks out certain types. The table itself
 9111      can use the flag STABLE_NO_MASK to ignore the mask setting: this
 9112      is useful when for example there is only one permissible type
 9113      (as in countryName) and using the mask might result in no valid
 9114      types at all.
 9115      [Steve Henson]
 9116 
 9117   *) Clean up 'Finished' handling, and add functions SSL_get_finished and
 9118      SSL_get_peer_finished to allow applications to obtain the latest
 9119      Finished messages sent to the peer or expected from the peer,
 9120      respectively.  (SSL_get_peer_finished is usually the Finished message
 9121      actually received from the peer, otherwise the protocol will be aborted.)
 9122 
 9123      As the Finished message are message digests of the complete handshake
 9124      (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
 9125      be used for external authentication procedures when the authentication
 9126      provided by SSL/TLS is not desired or is not enough.
 9127      [Bodo Moeller]
 9128 
 9129   *) Enhanced support for Alpha Linux is added. Now ./config checks if
 9130      the host supports BWX extension and if Compaq C is present on the
 9131      $PATH. Just exploiting of the BWX extension results in 20-30%
 9132      performance kick for some algorithms, e.g. DES and RC4 to mention
 9133      a couple. Compaq C in turn generates ~20% faster code for MD5 and
 9134      SHA1.
 9135      [Andy Polyakov]
 9136 
 9137   *) Add support for MS "fast SGC". This is arguably a violation of the
 9138      SSL3/TLS protocol. Netscape SGC does two handshakes: the first with
 9139      weak crypto and after checking the certificate is SGC a second one
 9140      with strong crypto. MS SGC stops the first handshake after receiving
 9141      the server certificate message and sends a second client hello. Since
 9142      a server will typically do all the time consuming operations before
 9143      expecting any further messages from the client (server key exchange
 9144      is the most expensive) there is little difference between the two.
 9145 
 9146      To get OpenSSL to support MS SGC we have to permit a second client
 9147      hello message after we have sent server done. In addition we have to
 9148      reset the MAC if we do get this second client hello.
 9149      [Steve Henson]
 9150 
 9151   *) Add a function 'd2i_AutoPrivateKey()' this will automatically decide
 9152      if a DER encoded private key is RSA or DSA traditional format. Changed
 9153      d2i_PrivateKey_bio() to use it. This is only needed for the "traditional"
 9154      format DER encoded private key. Newer code should use PKCS#8 format which
 9155      has the key type encoded in the ASN1 structure. Added DER private key
 9156      support to pkcs8 application.
 9157      [Steve Henson]
 9158 
 9159   *) SSL 3/TLS 1 servers now don't request certificates when an anonymous
 9160      ciphersuites has been selected (as required by the SSL 3/TLS 1
 9161      specifications).  Exception: When SSL_VERIFY_FAIL_IF_NO_PEER_CERT
 9162      is set, we interpret this as a request to violate the specification
 9163      (the worst that can happen is a handshake failure, and 'correct'
 9164      behaviour would result in a handshake failure anyway).
 9165      [Bodo Moeller]
 9166 
 9167   *) In SSL_CTX_add_session, take into account that there might be multiple
 9168      SSL_SESSION structures with the same session ID (e.g. when two threads
 9169      concurrently obtain them from an external cache).
 9170      The internal cache can handle only one SSL_SESSION with a given ID,
 9171      so if there's a conflict, we now throw out the old one to achieve
 9172      consistency.
 9173      [Bodo Moeller]
 9174 
 9175   *) Add OIDs for idea and blowfish in CBC mode. This will allow both
 9176      to be used in PKCS#5 v2.0 and S/MIME.  Also add checking to
 9177      some routines that use cipher OIDs: some ciphers do not have OIDs
 9178      defined and so they cannot be used for S/MIME and PKCS#5 v2.0 for
 9179      example.
 9180      [Steve Henson]
 9181 
 9182   *) Simplify the trust setting structure and code. Now we just have
 9183      two sequences of OIDs for trusted and rejected settings. These will
 9184      typically have values the same as the extended key usage extension
 9185      and any application specific purposes.
 9186 
 9187      The trust checking code now has a default behaviour: it will just
 9188      check for an object with the same NID as the passed id. Functions can
 9189      be provided to override either the default behaviour or the behaviour
 9190      for a given id. SSL client, server and email already have functions
 9191      in place for compatibility: they check the NID and also return "trusted"
 9192      if the certificate is self signed.
 9193      [Steve Henson]
 9194 
 9195   *) Add d2i,i2d bio/fp functions for PrivateKey: these convert the
 9196      traditional format into an EVP_PKEY structure.
 9197      [Steve Henson]
 9198 
 9199   *) Add a password callback function PEM_cb() which either prompts for
 9200      a password if usr_data is NULL or otherwise assumes it is a null
 9201      terminated password. Allow passwords to be passed on command line
 9202      environment or config files in a few more utilities.
 9203      [Steve Henson]
 9204 
 9205   *) Add a bunch of DER and PEM functions to handle PKCS#8 format private
 9206      keys. Add some short names for PKCS#8 PBE algorithms and allow them
 9207      to be specified on the command line for the pkcs8 and pkcs12 utilities.
 9208      Update documentation.
 9209      [Steve Henson]
 9210 
 9211   *) Support for ASN1 "NULL" type. This could be handled before by using
 9212      ASN1_TYPE but there wasn't any function that would try to read a NULL
 9213      and produce an error if it couldn't. For compatibility we also have
 9214      ASN1_NULL_new() and ASN1_NULL_free() functions but these are faked and
 9215      don't allocate anything because they don't need to.
 9216      [Steve Henson]
 9217 
 9218   *) Initial support for MacOS is now provided. Examine INSTALL.MacOS
 9219      for details.
 9220      [Andy Polyakov, Roy Woods <roy@centicsystems.ca>]
 9221 
 9222   *) Rebuild of the memory allocation routines used by OpenSSL code and
 9223      possibly others as well.  The purpose is to make an interface that
 9224      provide hooks so anyone can build a separate set of allocation and
 9225      deallocation routines to be used by OpenSSL, for example memory
 9226      pool implementations, or something else, which was previously hard
 9227      since Malloc(), Realloc() and Free() were defined as macros having
 9228      the values malloc, realloc and free, respectively (except for Win32
 9229      compilations).  The same is provided for memory debugging code.
 9230      OpenSSL already comes with functionality to find memory leaks, but
 9231      this gives people a chance to debug other memory problems.
 9232 
 9233      With these changes, a new set of functions and macros have appeared:
 9234 
 9235        CRYPTO_set_mem_debug_functions()	        [F]
 9236        CRYPTO_get_mem_debug_functions()         [F]
 9237        CRYPTO_dbg_set_options()	                [F]
 9238        CRYPTO_dbg_get_options()                 [F]
 9239        CRYPTO_malloc_debug_init()               [M]
 9240 
 9241      The memory debug functions are NULL by default, unless the library
 9242      is compiled with CRYPTO_MDEBUG or friends is defined.  If someone
 9243      wants to debug memory anyway, CRYPTO_malloc_debug_init() (which
 9244      gives the standard debugging functions that come with OpenSSL) or
 9245      CRYPTO_set_mem_debug_functions() (tells OpenSSL to use functions
 9246      provided by the library user) must be used.  When the standard
 9247      debugging functions are used, CRYPTO_dbg_set_options can be used to
 9248      request additional information:
 9249      CRYPTO_dbg_set_options(V_CYRPTO_MDEBUG_xxx) corresponds to setting
 9250      the CRYPTO_MDEBUG_xxx macro when compiling the library.   
 9251 
 9252      Also, things like CRYPTO_set_mem_functions will always give the
 9253      expected result (the new set of functions is used for allocation
 9254      and deallocation) at all times, regardless of platform and compiler
 9255      options.
 9256 
 9257      To finish it up, some functions that were never use in any other
 9258      way than through macros have a new API and new semantic:
 9259 
 9260        CRYPTO_dbg_malloc()
 9261        CRYPTO_dbg_realloc()
 9262        CRYPTO_dbg_free()
 9263 
 9264      All macros of value have retained their old syntax.
 9265      [Richard Levitte and Bodo Moeller]
 9266 
 9267   *) Some S/MIME fixes. The OID for SMIMECapabilities was wrong, the
 9268      ordering of SMIMECapabilities wasn't in "strength order" and there
 9269      was a missing NULL in the AlgorithmIdentifier for the SHA1 signature
 9270      algorithm.
 9271      [Steve Henson]
 9272 
 9273   *) Some ASN1 types with illegal zero length encoding (INTEGER,
 9274      ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines.
 9275      [Frans Heymans <fheymans@isaserver.be>, modified by Steve Henson]
 9276 
 9277   *) Merge in my S/MIME library for OpenSSL. This provides a simple
 9278      S/MIME API on top of the PKCS#7 code, a MIME parser (with enough
 9279      functionality to handle multipart/signed properly) and a utility
 9280      called 'smime' to call all this stuff. This is based on code I
 9281      originally wrote for Celo who have kindly allowed it to be
 9282      included in OpenSSL.
 9283      [Steve Henson]
 9284 
 9285   *) Add variants des_set_key_checked and des_set_key_unchecked of
 9286      des_set_key (aka des_key_sched).  Global variable des_check_key
 9287      decides which of these is called by des_set_key; this way
 9288      des_check_key behaves as it always did, but applications and
 9289      the library itself, which was buggy for des_check_key == 1,
 9290      have a cleaner way to pick the version they need.
 9291      [Bodo Moeller]
 9292 
 9293   *) New function PKCS12_newpass() which changes the password of a
 9294      PKCS12 structure.
 9295      [Steve Henson]
 9296 
 9297   *) Modify X509_TRUST and X509_PURPOSE so it also uses a static and
 9298      dynamic mix. In both cases the ids can be used as an index into the
 9299      table. Also modified the X509_TRUST_add() and X509_PURPOSE_add()
 9300      functions so they accept a list of the field values and the
 9301      application doesn't need to directly manipulate the X509_TRUST
 9302      structure.
 9303      [Steve Henson]
 9304 
 9305   *) Modify the ASN1_STRING_TABLE stuff so it also uses bsearch and doesn't
 9306      need initialising.
 9307      [Steve Henson]
 9308 
 9309   *) Modify the way the V3 extension code looks up extensions. This now
 9310      works in a similar way to the object code: we have some "standard"
 9311      extensions in a static table which is searched with OBJ_bsearch()
 9312      and the application can add dynamic ones if needed. The file
 9313      crypto/x509v3/ext_dat.h now has the info: this file needs to be
 9314      updated whenever a new extension is added to the core code and kept
 9315      in ext_nid order. There is a simple program 'tabtest.c' which checks
 9316      this. New extensions are not added too often so this file can readily
 9317      be maintained manually.
 9318 
 9319      There are two big advantages in doing things this way. The extensions
 9320      can be looked up immediately and no longer need to be "added" using
 9321      X509V3_add_standard_extensions(): this function now does nothing.
 9322      [Side note: I get *lots* of email saying the extension code doesn't
 9323       work because people forget to call this function]
 9324      Also no dynamic allocation is done unless new extensions are added:
 9325      so if we don't add custom extensions there is no need to call
 9326      X509V3_EXT_cleanup().
 9327      [Steve Henson]
 9328 
 9329   *) Modify enc utility's salting as follows: make salting the default. Add a
 9330      magic header, so unsalted files fail gracefully instead of just decrypting
 9331      to garbage. This is because not salting is a big security hole, so people
 9332      should be discouraged from doing it.
 9333      [Ben Laurie]
 9334 
 9335   *) Fixes and enhancements to the 'x509' utility. It allowed a message
 9336      digest to be passed on the command line but it only used this
 9337      parameter when signing a certificate. Modified so all relevant
 9338      operations are affected by the digest parameter including the
 9339      -fingerprint and -x509toreq options. Also -x509toreq choked if a
 9340      DSA key was used because it didn't fix the digest.
 9341      [Steve Henson]
 9342 
 9343   *) Initial certificate chain verify code. Currently tests the untrusted
 9344      certificates for consistency with the verify purpose (which is set
 9345      when the X509_STORE_CTX structure is set up) and checks the pathlength.
 9346 
 9347      There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour:
 9348      this is because it will reject chains with invalid extensions whereas
 9349      every previous version of OpenSSL and SSLeay made no checks at all.
 9350 
 9351      Trust code: checks the root CA for the relevant trust settings. Trust
 9352      settings have an initial value consistent with the verify purpose: e.g.
 9353      if the verify purpose is for SSL client use it expects the CA to be
 9354      trusted for SSL client use. However the default value can be changed to
 9355      permit custom trust settings: one example of this would be to only trust
 9356      certificates from a specific "secure" set of CAs.
 9357 
 9358      Also added X509_STORE_CTX_new() and X509_STORE_CTX_free() functions
 9359      which should be used for version portability: especially since the
 9360      verify structure is likely to change more often now.
 9361 
 9362      SSL integration. Add purpose and trust to SSL_CTX and SSL and functions
 9363      to set them. If not set then assume SSL clients will verify SSL servers
 9364      and vice versa.
 9365 
 9366      Two new options to the verify program: -untrusted allows a set of
 9367      untrusted certificates to be passed in and -purpose which sets the
 9368      intended purpose of the certificate. If a purpose is set then the
 9369      new chain verify code is used to check extension consistency.
 9370      [Steve Henson]
 9371 
 9372   *) Support for the authority information access extension.
 9373      [Steve Henson]
 9374 
 9375   *) Modify RSA and DSA PEM read routines to transparently handle
 9376      PKCS#8 format private keys. New *_PUBKEY_* functions that handle
 9377      public keys in a format compatible with certificate
 9378      SubjectPublicKeyInfo structures. Unfortunately there were already
 9379      functions called *_PublicKey_* which used various odd formats so
 9380      these are retained for compatibility: however the DSA variants were
 9381      never in a public release so they have been deleted. Changed dsa/rsa
 9382      utilities to handle the new format: note no releases ever handled public
 9383      keys so we should be OK.
 9384 
 9385      The primary motivation for this change is to avoid the same fiasco
 9386      that dogs private keys: there are several incompatible private key
 9387      formats some of which are standard and some OpenSSL specific and
 9388      require various evil hacks to allow partial transparent handling and
 9389      even then it doesn't work with DER formats. Given the option anything
 9390      other than PKCS#8 should be dumped: but the other formats have to
 9391      stay in the name of compatibility.
 9392 
 9393      With public keys and the benefit of hindsight one standard format 
 9394      is used which works with EVP_PKEY, RSA or DSA structures: though
 9395      it clearly returns an error if you try to read the wrong kind of key.
 9396 
 9397      Added a -pubkey option to the 'x509' utility to output the public key.
 9398      Also rename the EVP_PKEY_get_*() to EVP_PKEY_rget_*()
 9399      (renamed to EVP_PKEY_get1_*() in the OpenSSL 0.9.5 release) and add
 9400      EVP_PKEY_rset_*() functions (renamed to EVP_PKEY_set1_*())
 9401      that do the same as the EVP_PKEY_assign_*() except they up the
 9402      reference count of the added key (they don't "swallow" the
 9403      supplied key).
 9404      [Steve Henson]
 9405 
 9406   *) Fixes to crypto/x509/by_file.c the code to read in certificates and
 9407      CRLs would fail if the file contained no certificates or no CRLs:
 9408      added a new function to read in both types and return the number
 9409      read: this means that if none are read it will be an error. The
 9410      DER versions of the certificate and CRL reader would always fail
 9411      because it isn't possible to mix certificates and CRLs in DER format
 9412      without choking one or the other routine. Changed this to just read
 9413      a certificate: this is the best we can do. Also modified the code
 9414      in apps/verify.c to take notice of return codes: it was previously
 9415      attempting to read in certificates from NULL pointers and ignoring
 9416      any errors: this is one reason why the cert and CRL reader seemed
 9417      to work. It doesn't check return codes from the default certificate
 9418      routines: these may well fail if the certificates aren't installed.
 9419      [Steve Henson]
 9420 
 9421   *) Code to support otherName option in GeneralName.
 9422      [Steve Henson]
 9423 
 9424   *) First update to verify code. Change the verify utility
 9425      so it warns if it is passed a self signed certificate:
 9426      for consistency with the normal behaviour. X509_verify
 9427      has been modified to it will now verify a self signed
 9428      certificate if *exactly* the same certificate appears
 9429      in the store: it was previously impossible to trust a
 9430      single self signed certificate. This means that:
 9431      openssl verify ss.pem
 9432      now gives a warning about a self signed certificate but
 9433      openssl verify -CAfile ss.pem ss.pem
 9434      is OK.
 9435      [Steve Henson]
 9436 
 9437   *) For servers, store verify_result in SSL_SESSION data structure
 9438      (and add it to external session representation).
 9439      This is needed when client certificate verifications fails,
 9440      but an application-provided verification callback (set by
 9441      SSL_CTX_set_cert_verify_callback) allows accepting the session
 9442      anyway (i.e. leaves x509_store_ctx->error != X509_V_OK
 9443      but returns 1): When the session is reused, we have to set
 9444      ssl->verify_result to the appropriate error code to avoid
 9445      security holes.
 9446      [Bodo Moeller, problem pointed out by Lutz Jaenicke]
 9447 
 9448   *) Fix a bug in the new PKCS#7 code: it didn't consider the
 9449      case in PKCS7_dataInit() where the signed PKCS7 structure
 9450      didn't contain any existing data because it was being created.
 9451      [Po-Cheng Chen <pocheng@nst.com.tw>, slightly modified by Steve Henson]
 9452 
 9453   *) Add a salt to the key derivation routines in enc.c. This
 9454      forms the first 8 bytes of the encrypted file. Also add a
 9455      -S option to allow a salt to be input on the command line.
 9456      [Steve Henson]
 9457 
 9458   *) New function X509_cmp(). Oddly enough there wasn't a function
 9459      to compare two certificates. We do this by working out the SHA1
 9460      hash and comparing that. X509_cmp() will be needed by the trust
 9461      code.
 9462      [Steve Henson]
 9463 
 9464   *) SSL_get1_session() is like SSL_get_session(), but increments
 9465      the reference count in the SSL_SESSION returned.
 9466      [Geoff Thorpe <geoff@eu.c2.net>]
 9467 
 9468   *) Fix for 'req': it was adding a null to request attributes.
 9469      Also change the X509_LOOKUP and X509_INFO code to handle
 9470      certificate auxiliary information.
 9471      [Steve Henson]
 9472 
 9473   *) Add support for 40 and 64 bit RC2 and RC4 algorithms: document
 9474      the 'enc' command.
 9475      [Steve Henson]
 9476 
 9477   *) Add the possibility to add extra information to the memory leak
 9478      detecting output, to form tracebacks, showing from where each
 9479      allocation was originated: CRYPTO_push_info("constant string") adds
 9480      the string plus current file name and line number to a per-thread
 9481      stack, CRYPTO_pop_info() does the obvious, CRYPTO_remove_all_info()
 9482      is like calling CYRPTO_pop_info() until the stack is empty.
 9483      Also updated memory leak detection code to be multi-thread-safe.
 9484      [Richard Levitte]
 9485 
 9486   *) Add options -text and -noout to pkcs7 utility and delete the
 9487      encryption options which never did anything. Update docs.
 9488      [Steve Henson]
 9489 
 9490   *) Add options to some of the utilities to allow the pass phrase
 9491      to be included on either the command line (not recommended on
 9492      OSes like Unix) or read from the environment. Update the
 9493      manpages and fix a few bugs.
 9494      [Steve Henson]
 9495 
 9496   *) Add a few manpages for some of the openssl commands.
 9497      [Steve Henson]
 9498 
 9499   *) Fix the -revoke option in ca. It was freeing up memory twice,
 9500      leaking and not finding already revoked certificates.
 9501      [Steve Henson]
 9502 
 9503   *) Extensive changes to support certificate auxiliary information.
 9504      This involves the use of X509_CERT_AUX structure and X509_AUX
 9505      functions. An X509_AUX function such as PEM_read_X509_AUX()
 9506      can still read in a certificate file in the usual way but it
 9507      will also read in any additional "auxiliary information". By
 9508      doing things this way a fair degree of compatibility can be
 9509      retained: existing certificates can have this information added
 9510      using the new 'x509' options. 
 9511 
 9512      Current auxiliary information includes an "alias" and some trust
 9513      settings. The trust settings will ultimately be used in enhanced
 9514      certificate chain verification routines: currently a certificate
 9515      can only be trusted if it is self signed and then it is trusted
 9516      for all purposes.
 9517      [Steve Henson]
 9518 
 9519   *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD).
 9520      The problem was that one of the replacement routines had not been working
 9521      since SSLeay releases.  For now the offending routine has been replaced
 9522      with non-optimised assembler.  Even so, this now gives around 95%
 9523      performance improvement for 1024 bit RSA signs.
 9524      [Mark Cox]
 9525 
 9526   *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2 
 9527      handling. Most clients have the effective key size in bits equal to
 9528      the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key.
 9529      A few however don't do this and instead use the size of the decrypted key
 9530      to determine the RC2 key length and the AlgorithmIdentifier to determine
 9531      the effective key length. In this case the effective key length can still
 9532      be 40 bits but the key length can be 168 bits for example. This is fixed
 9533      by manually forcing an RC2 key into the EVP_PKEY structure because the
 9534      EVP code can't currently handle unusual RC2 key sizes: it always assumes
 9535      the key length and effective key length are equal.
 9536      [Steve Henson]
 9537 
 9538   *) Add a bunch of functions that should simplify the creation of 
 9539      X509_NAME structures. Now you should be able to do:
 9540      X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC, "Steve", -1, -1, 0);
 9541      and have it automatically work out the correct field type and fill in
 9542      the structures. The more adventurous can try:
 9543      X509_NAME_add_entry_by_txt(nm, field, MBSTRING_UTF8, str, -1, -1, 0);
 9544      and it will (hopefully) work out the correct multibyte encoding.
 9545      [Steve Henson]
 9546 
 9547   *) Change the 'req' utility to use the new field handling and multibyte
 9548      copy routines. Before the DN field creation was handled in an ad hoc
 9549      way in req, ca, and x509 which was rather broken and didn't support
 9550      BMPStrings or UTF8Strings. Since some software doesn't implement
 9551      BMPStrings or UTF8Strings yet, they can be enabled using the config file
 9552      using the dirstring_type option. See the new comment in the default
 9553      openssl.cnf for more info.
 9554      [Steve Henson]
 9555 
 9556   *) Make crypto/rand/md_rand.c more robust:
 9557      - Assure unique random numbers after fork().
 9558      - Make sure that concurrent threads access the global counter and
 9559        md serializably so that we never lose entropy in them
 9560        or use exactly the same state in multiple threads.
 9561        Access to the large state is not always serializable because
 9562        the additional locking could be a performance killer, and
 9563        md should be large enough anyway.
 9564      [Bodo Moeller]
 9565 
 9566   *) New file apps/app_rand.c with commonly needed functionality
 9567      for handling the random seed file.
 9568 
 9569      Use the random seed file in some applications that previously did not:
 9570           ca,
 9571           dsaparam -genkey (which also ignored its '-rand' option), 
 9572           s_client,
 9573           s_server,
 9574           x509 (when signing).
 9575      Except on systems with /dev/urandom, it is crucial to have a random
 9576      seed file at least for key creation, DSA signing, and for DH exchanges;
 9577      for RSA signatures we could do without one.
 9578 
 9579      gendh and gendsa (unlike genrsa) used to read only the first byte
 9580      of each file listed in the '-rand' option.  The function as previously
 9581      found in genrsa is now in app_rand.c and is used by all programs
 9582      that support '-rand'.
 9583      [Bodo Moeller]
 9584 
 9585   *) In RAND_write_file, use mode 0600 for creating files;
 9586      don't just chmod when it may be too late.
 9587      [Bodo Moeller]
 9588 
 9589   *) Report an error from X509_STORE_load_locations
 9590      when X509_LOOKUP_load_file or X509_LOOKUP_add_dir failed.
 9591      [Bill Perry]
 9592 
 9593   *) New function ASN1_mbstring_copy() this copies a string in either
 9594      ASCII, Unicode, Universal (4 bytes per character) or UTF8 format
 9595      into an ASN1_STRING type. A mask of permissible types is passed
 9596      and it chooses the "minimal" type to use or an error if not type
 9597      is suitable.
 9598      [Steve Henson]
 9599 
 9600   *) Add function equivalents to the various macros in asn1.h. The old
 9601      macros are retained with an M_ prefix. Code inside the library can
 9602      use the M_ macros. External code (including the openssl utility)
 9603      should *NOT* in order to be "shared library friendly".
 9604      [Steve Henson]
 9605 
 9606   *) Add various functions that can check a certificate's extensions
 9607      to see if it usable for various purposes such as SSL client,
 9608      server or S/MIME and CAs of these types. This is currently 
 9609      VERY EXPERIMENTAL but will ultimately be used for certificate chain
 9610      verification. Also added a -purpose flag to x509 utility to
 9611      print out all the purposes.
 9612      [Steve Henson]
 9613 
 9614   *) Add a CRYPTO_EX_DATA to X509 certificate structure and associated
 9615      functions.
 9616      [Steve Henson]
 9617 
 9618   *) New X509V3_{X509,CRL,REVOKED}_get_d2i() functions. These will search
 9619      for, obtain and decode and extension and obtain its critical flag.
 9620      This allows all the necessary extension code to be handled in a
 9621      single function call.
 9622      [Steve Henson]
 9623 
 9624   *) RC4 tune-up featuring 30-40% performance improvement on most RISC
 9625      platforms. See crypto/rc4/rc4_enc.c for further details.
 9626      [Andy Polyakov]
 9627 
 9628   *) New -noout option to asn1parse. This causes no output to be produced
 9629      its main use is when combined with -strparse and -out to extract data
 9630      from a file (which may not be in ASN.1 format).
 9631      [Steve Henson]
 9632 
 9633   *) Fix for pkcs12 program. It was hashing an invalid certificate pointer
 9634      when producing the local key id.
 9635      [Richard Levitte <levitte@stacken.kth.se>]
 9636 
 9637   *) New option -dhparam in s_server. This allows a DH parameter file to be
 9638      stated explicitly. If it is not stated then it tries the first server
 9639      certificate file. The previous behaviour hard coded the filename
 9640      "server.pem".
 9641      [Steve Henson]
 9642 
 9643   *) Add -pubin and -pubout options to the rsa and dsa commands. These allow
 9644      a public key to be input or output. For example:
 9645      openssl rsa -in key.pem -pubout -out pubkey.pem
 9646      Also added necessary DSA public key functions to handle this.
 9647      [Steve Henson]
 9648 
 9649   *) Fix so PKCS7_dataVerify() doesn't crash if no certificates are contained
 9650      in the message. This was handled by allowing
 9651      X509_find_by_issuer_and_serial() to tolerate a NULL passed to it.
 9652      [Steve Henson, reported by Sampo Kellomaki <sampo@mail.neuronio.pt>]
 9653 
 9654   *) Fix for bug in d2i_ASN1_bytes(): other ASN1 functions add an extra null
 9655      to the end of the strings whereas this didn't. This would cause problems
 9656      if strings read with d2i_ASN1_bytes() were later modified.
 9657      [Steve Henson, reported by Arne Ansper <arne@ats.cyber.ee>]
 9658 
 9659   *) Fix for base64 decode bug. When a base64 bio reads only one line of
 9660      data and it contains EOF it will end up returning an error. This is
 9661      caused by input 46 bytes long. The cause is due to the way base64
 9662      BIOs find the start of base64 encoded data. They do this by trying a
 9663      trial decode on each line until they find one that works. When they
 9664      do a flag is set and it starts again knowing it can pass all the
 9665      data directly through the decoder. Unfortunately it doesn't reset
 9666      the context it uses. This means that if EOF is reached an attempt
 9667      is made to pass two EOFs through the context and this causes the
 9668      resulting error. This can also cause other problems as well. As is
 9669      usual with these problems it takes *ages* to find and the fix is
 9670      trivial: move one line.
 9671      [Steve Henson, reported by ian@uns.ns.ac.yu (Ivan Nejgebauer) ]
 9672 
 9673   *) Ugly workaround to get s_client and s_server working under Windows. The
 9674      old code wouldn't work because it needed to select() on sockets and the
 9675      tty (for keypresses and to see if data could be written). Win32 only
 9676      supports select() on sockets so we select() with a 1s timeout on the
 9677      sockets and then see if any characters are waiting to be read, if none
 9678      are present then we retry, we also assume we can always write data to
 9679      the tty. This isn't nice because the code then blocks until we've
 9680      received a complete line of data and it is effectively polling the
 9681      keyboard at 1s intervals: however it's quite a bit better than not
 9682      working at all :-) A dedicated Windows application might handle this
 9683      with an event loop for example.
 9684      [Steve Henson]
 9685 
 9686   *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign
 9687      and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions
 9688      will be called when RSA_sign() and RSA_verify() are used. This is useful
 9689      if rsa_pub_dec() and rsa_priv_enc() equivalents are not available.
 9690      For this to work properly RSA_public_decrypt() and RSA_private_encrypt()
 9691      should *not* be used: RSA_sign() and RSA_verify() must be used instead.
 9692      This necessitated the support of an extra signature type NID_md5_sha1
 9693      for SSL signatures and modifications to the SSL library to use it instead
 9694      of calling RSA_public_decrypt() and RSA_private_encrypt().
 9695      [Steve Henson]
 9696 
 9697   *) Add new -verify -CAfile and -CApath options to the crl program, these
 9698      will lookup a CRL issuers certificate and verify the signature in a
 9699      similar way to the verify program. Tidy up the crl program so it
 9700      no longer accesses structures directly. Make the ASN1 CRL parsing a bit
 9701      less strict. It will now permit CRL extensions even if it is not
 9702      a V2 CRL: this will allow it to tolerate some broken CRLs.
 9703      [Steve Henson]
 9704 
 9705   *) Initialize all non-automatic variables each time one of the openssl
 9706      sub-programs is started (this is necessary as they may be started
 9707      multiple times from the "OpenSSL>" prompt).
 9708      [Lennart Bang, Bodo Moeller]
 9709 
 9710   *) Preliminary compilation option RSA_NULL which disables RSA crypto without
 9711      removing all other RSA functionality (this is what NO_RSA does). This
 9712      is so (for example) those in the US can disable those operations covered
 9713      by the RSA patent while allowing storage and parsing of RSA keys and RSA
 9714      key generation.
 9715      [Steve Henson]
 9716 
 9717   *) Non-copying interface to BIO pairs.
 9718      (still largely untested)
 9719      [Bodo Moeller]
 9720 
 9721   *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive
 9722      ASCII string. This was handled independently in various places before.
 9723      [Steve Henson]
 9724 
 9725   *) New functions UTF8_getc() and UTF8_putc() that parse and generate
 9726      UTF8 strings a character at a time.
 9727      [Steve Henson]
 9728 
 9729   *) Use client_version from client hello to select the protocol
 9730      (s23_srvr.c) and for RSA client key exchange verification
 9731      (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications.
 9732      [Bodo Moeller]
 9733 
 9734   *) Add various utility functions to handle SPKACs, these were previously
 9735      handled by poking round in the structure internals. Added new function
 9736      NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
 9737      print, verify and generate SPKACs. Based on an original idea from
 9738      Massimiliano Pala <madwolf@comune.modena.it> but extensively modified.
 9739      [Steve Henson]
 9740 
 9741   *) RIPEMD160 is operational on all platforms and is back in 'make test'.
 9742      [Andy Polyakov]
 9743 
 9744   *) Allow the config file extension section to be overwritten on the
 9745      command line. Based on an original idea from Massimiliano Pala
 9746      <madwolf@comune.modena.it>. The new option is called -extensions
 9747      and can be applied to ca, req and x509. Also -reqexts to override
 9748      the request extensions in req and -crlexts to override the crl extensions
 9749      in ca.
 9750      [Steve Henson]
 9751 
 9752   *) Add new feature to the SPKAC handling in ca.  Now you can include
 9753      the same field multiple times by preceding it by "XXXX." for example:
 9754      1.OU="Unit name 1"
 9755      2.OU="Unit name 2"
 9756      this is the same syntax as used in the req config file.
 9757      [Steve Henson]
 9758 
 9759   *) Allow certificate extensions to be added to certificate requests. These
 9760      are specified in a 'req_extensions' option of the req section of the
 9761      config file. They can be printed out with the -text option to req but
 9762      are otherwise ignored at present.
 9763      [Steve Henson]
 9764 
 9765   *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first
 9766      data read consists of only the final block it would not decrypted because
 9767      EVP_CipherUpdate() would correctly report zero bytes had been decrypted.
 9768      A misplaced 'break' also meant the decrypted final block might not be
 9769      copied until the next read.
 9770      [Steve Henson]
 9771 
 9772   *) Initial support for DH_METHOD. Again based on RSA_METHOD. Also added
 9773      a few extra parameters to the DH structure: these will be useful if
 9774      for example we want the value of 'q' or implement X9.42 DH.
 9775      [Steve Henson]
 9776 
 9777   *) Initial support for DSA_METHOD. This is based on the RSA_METHOD and
 9778      provides hooks that allow the default DSA functions or functions on a
 9779      "per key" basis to be replaced. This allows hardware acceleration and
 9780      hardware key storage to be handled without major modification to the
 9781      library. Also added low level modexp hooks and CRYPTO_EX structure and 
 9782      associated functions.
 9783      [Steve Henson]
 9784 
 9785   *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
 9786      as "read only": it can't be written to and the buffer it points to will
 9787      not be freed. Reading from a read only BIO is much more efficient than
 9788      a normal memory BIO. This was added because there are several times when
 9789      an area of memory needs to be read from a BIO. The previous method was
 9790      to create a memory BIO and write the data to it, this results in two
 9791      copies of the data and an O(n^2) reading algorithm. There is a new
 9792      function BIO_new_mem_buf() which creates a read only memory BIO from
 9793      an area of memory. Also modified the PKCS#7 routines to use read only
 9794      memory BIOs.
 9795      [Steve Henson]
 9796 
 9797   *) Bugfix: ssl23_get_client_hello did not work properly when called in
 9798      state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
 9799      a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
 9800      but a retry condition occured while trying to read the rest.
 9801      [Bodo Moeller]
 9802 
 9803   *) The PKCS7_ENC_CONTENT_new() function was setting the content type as
 9804      NID_pkcs7_encrypted by default: this was wrong since this should almost
 9805      always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle
 9806      the encrypted data type: this is a more sensible place to put it and it
 9807      allows the PKCS#12 code to be tidied up that duplicated this
 9808      functionality.
 9809      [Steve Henson]
 9810 
 9811   *) Changed obj_dat.pl script so it takes its input and output files on
 9812      the command line. This should avoid shell escape redirection problems
 9813      under Win32.
 9814      [Steve Henson]
 9815 
 9816   *) Initial support for certificate extension requests, these are included
 9817      in things like Xenroll certificate requests. Included functions to allow
 9818      extensions to be obtained and added.
 9819      [Steve Henson]
 9820 
 9821   *) -crlf option to s_client and s_server for sending newlines as
 9822      CRLF (as required by many protocols).
 9823      [Bodo Moeller]
 9824 
 9825  Changes between 0.9.3a and 0.9.4  [09 Aug 1999]
 9826   
 9827   *) Install libRSAglue.a when OpenSSL is built with RSAref.
 9828      [Ralf S. Engelschall]
 9829 
 9830   *) A few more ``#ifndef NO_FP_API / #endif'' pairs for consistency.
 9831      [Andrija Antonijevic <TheAntony2@bigfoot.com>]
 9832 
 9833   *) Fix -startdate and -enddate (which was missing) arguments to 'ca'
 9834      program.
 9835      [Steve Henson]
 9836 
 9837   *) New function DSA_dup_DH, which duplicates DSA parameters/keys as
 9838      DH parameters/keys (q is lost during that conversion, but the resulting
 9839      DH parameters contain its length).
 9840 
 9841      For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is
 9842      much faster than DH_generate_parameters (which creates parameters
 9843      where p = 2*q + 1), and also the smaller q makes DH computations
 9844      much more efficient (160-bit exponentiation instead of 1024-bit
 9845      exponentiation); so this provides a convenient way to support DHE
 9846      ciphersuites in SSL/TLS servers (see ssl/ssltest.c).  It is of
 9847      utter importance to use
 9848          SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 9849      or
 9850          SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 9851      when such DH parameters are used, because otherwise small subgroup
 9852      attacks may become possible!
 9853      [Bodo Moeller]
 9854 
 9855   *) Avoid memory leak in i2d_DHparams.
 9856      [Bodo Moeller]
 9857 
 9858   *) Allow the -k option to be used more than once in the enc program:
 9859      this allows the same encrypted message to be read by multiple recipients.
 9860      [Steve Henson]
 9861 
 9862   *) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts
 9863      an ASN1_OBJECT to a text string. If the "no_name" parameter is set then
 9864      it will always use the numerical form of the OID, even if it has a short
 9865      or long name.
 9866      [Steve Henson]
 9867 
 9868   *) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp
 9869      method only got called if p,q,dmp1,dmq1,iqmp components were present,
 9870      otherwise bn_mod_exp was called. In the case of hardware keys for example
 9871      no private key components need be present and it might store extra data
 9872      in the RSA structure, which cannot be accessed from bn_mod_exp.
 9873      By setting RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for
 9874      private key operations.
 9875      [Steve Henson]
 9876 
 9877   *) Added support for SPARC Linux.
 9878      [Andy Polyakov]
 9879 
 9880   *) pem_password_cb function type incompatibly changed from
 9881           typedef int pem_password_cb(char *buf, int size, int rwflag);
 9882      to
 9883           ....(char *buf, int size, int rwflag, void *userdata);
 9884      so that applications can pass data to their callbacks:
 9885      The PEM[_ASN1]_{read,write}... functions and macros now take an
 9886      additional void * argument, which is just handed through whenever
 9887      the password callback is called.
 9888      [Damien Miller <dmiller@ilogic.com.au>; tiny changes by Bodo Moeller]
 9889 
 9890      New function SSL_CTX_set_default_passwd_cb_userdata.
 9891 
 9892      Compatibility note: As many C implementations push function arguments
 9893      onto the stack in reverse order, the new library version is likely to
 9894      interoperate with programs that have been compiled with the old
 9895      pem_password_cb definition (PEM_whatever takes some data that
 9896      happens to be on the stack as its last argument, and the callback
 9897      just ignores this garbage); but there is no guarantee whatsoever that
 9898      this will work.
 9899 
 9900   *) The -DPLATFORM="\"$(PLATFORM)\"" definition and the similar -DCFLAGS=...
 9901      (both in crypto/Makefile.ssl for use by crypto/cversion.c) caused
 9902      problems not only on Windows, but also on some Unix platforms.
 9903      To avoid problematic command lines, these definitions are now in an
 9904      auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl
 9905      for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds).
 9906      [Bodo Moeller]
 9907 
 9908   *) MIPS III/IV assembler module is reimplemented.
 9909      [Andy Polyakov]
 9910 
 9911   *) More DES library cleanups: remove references to srand/rand and
 9912      delete an unused file.
 9913      [Ulf Möller]
 9914 
 9915   *) Add support for the the free Netwide assembler (NASM) under Win32,
 9916      since not many people have MASM (ml) and it can be hard to obtain.
 9917      This is currently experimental but it seems to work OK and pass all
 9918      the tests. Check out INSTALL.W32 for info.
 9919      [Steve Henson]
 9920 
 9921   *) Fix memory leaks in s3_clnt.c: All non-anonymous SSL3/TLS1 connections
 9922      without temporary keys kept an extra copy of the server key,
 9923      and connections with temporary keys did not free everything in case
 9924      of an error.
 9925      [Bodo Moeller]
 9926 
 9927   *) New function RSA_check_key and new openssl rsa option -check
 9928      for verifying the consistency of RSA keys.
 9929      [Ulf Moeller, Bodo Moeller]
 9930 
 9931   *) Various changes to make Win32 compile work: 
 9932      1. Casts to avoid "loss of data" warnings in p5_crpt2.c
 9933      2. Change unsigned int to int in b_dump.c to avoid "signed/unsigned
 9934         comparison" warnings.
 9935      3. Add sk_<TYPE>_sort to DEF file generator and do make update.
 9936      [Steve Henson]
 9937 
 9938   *) Add a debugging option to PKCS#5 v2 key generation function: when
 9939      you #define DEBUG_PKCS5V2 passwords, salts, iteration counts and
 9940      derived keys are printed to stderr.
 9941      [Steve Henson]
 9942 
 9943   *) Copy the flags in ASN1_STRING_dup().
 9944      [Roman E. Pavlov <pre@mo.msk.ru>]
 9945 
 9946   *) The x509 application mishandled signing requests containing DSA
 9947      keys when the signing key was also DSA and the parameters didn't match.
 9948 
 9949      It was supposed to omit the parameters when they matched the signing key:
 9950      the verifying software was then supposed to automatically use the CA's
 9951      parameters if they were absent from the end user certificate.
 9952 
 9953      Omitting parameters is no longer recommended. The test was also
 9954      the wrong way round! This was probably due to unusual behaviour in
 9955      EVP_cmp_parameters() which returns 1 if the parameters match. 
 9956      This meant that parameters were omitted when they *didn't* match and
 9957      the certificate was useless. Certificates signed with 'ca' didn't have
 9958      this bug.
 9959      [Steve Henson, reported by Doug Erickson <Doug.Erickson@Part.NET>]
 9960 
 9961   *) Memory leak checking (-DCRYPTO_MDEBUG) had some problems.
 9962      The interface is as follows:
 9963      Applications can use
 9964          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON) aka MemCheck_start(),
 9965          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF) aka MemCheck_stop();
 9966      "off" is now the default.
 9967      The library internally uses
 9968          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE) aka MemCheck_off(),
 9969          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE) aka MemCheck_on()
 9970      to disable memory-checking temporarily.
 9971 
 9972      Some inconsistent states that previously were possible (and were
 9973      even the default) are now avoided.
 9974 
 9975      -DCRYPTO_MDEBUG_TIME is new and additionally stores the current time
 9976      with each memory chunk allocated; this is occasionally more helpful
 9977      than just having a counter.
 9978 
 9979      -DCRYPTO_MDEBUG_THREAD is also new and adds the thread ID.
 9980 
 9981      -DCRYPTO_MDEBUG_ALL enables all of the above, plus any future
 9982      extensions.
 9983      [Bodo Moeller]
 9984 
 9985   *) Introduce "mode" for SSL structures (with defaults in SSL_CTX),
 9986      which largely parallels "options", but is for changing API behaviour,
 9987      whereas "options" are about protocol behaviour.
 9988      Initial "mode" flags are:
 9989 
 9990      SSL_MODE_ENABLE_PARTIAL_WRITE   Allow SSL_write to report success when
 9991                                      a single record has been written.
 9992      SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER  Don't insist that SSL_write
 9993                                      retries use the same buffer location.
 9994                                      (But all of the contents must be
 9995                                      copied!)
 9996      [Bodo Moeller]
 9997 
 9998   *) Bugfix: SSL_set_options ignored its parameter, only SSL_CTX_set_options
 9999      worked.
10000 
10001   *) Fix problems with no-hmac etc.
10002      [Ulf Möller, pointed out by Brian Wellington <bwelling@tislabs.com>]
10003 
10004   *) New functions RSA_get_default_method(), RSA_set_method() and
10005      RSA_get_method(). These allows replacement of RSA_METHODs without having
10006      to mess around with the internals of an RSA structure.
10007      [Steve Henson]
10008 
10009   *) Fix memory leaks in DSA_do_sign and DSA_is_prime.
10010      Also really enable memory leak checks in openssl.c and in some
10011      test programs.
10012      [Chad C. Mulligan, Bodo Moeller]
10013 
10014   *) Fix a bug in d2i_ASN1_INTEGER() and i2d_ASN1_INTEGER() which can mess
10015      up the length of negative integers. This has now been simplified to just
10016      store the length when it is first determined and use it later, rather
10017      than trying to keep track of where data is copied and updating it to
10018      point to the end.
10019      [Steve Henson, reported by Brien Wheeler
10020       <bwheeler@authentica-security.com>]
10021 
10022   *) Add a new function PKCS7_signatureVerify. This allows the verification
10023      of a PKCS#7 signature but with the signing certificate passed to the
10024      function itself. This contrasts with PKCS7_dataVerify which assumes the
10025      certificate is present in the PKCS#7 structure. This isn't always the
10026      case: certificates can be omitted from a PKCS#7 structure and be
10027      distributed by "out of band" means (such as a certificate database).
10028      [Steve Henson]
10029 
10030   *) Complete the PEM_* macros with DECLARE_PEM versions to replace the
10031      function prototypes in pem.h, also change util/mkdef.pl to add the
10032      necessary function names. 
10033      [Steve Henson]
10034 
10035   *) mk1mf.pl (used by Windows builds) did not properly read the
10036      options set by Configure in the top level Makefile, and Configure
10037      was not even able to write more than one option correctly.
10038      Fixed, now "no-idea no-rc5 -DCRYPTO_MDEBUG" etc. works as intended.
10039      [Bodo Moeller]
10040 
10041   *) New functions CONF_load_bio() and CONF_load_fp() to allow a config
10042      file to be loaded from a BIO or FILE pointer. The BIO version will
10043      for example allow memory BIOs to contain config info.
10044      [Steve Henson]
10045 
10046   *) New function "CRYPTO_num_locks" that returns CRYPTO_NUM_LOCKS.
10047      Whoever hopes to achieve shared-library compatibility across versions
10048      must use this, not the compile-time macro.
10049      (Exercise 0.9.4: Which is the minimum library version required by
10050      such programs?)
10051      Note: All this applies only to multi-threaded programs, others don't
10052      need locks.
10053      [Bodo Moeller]
10054 
10055   *) Add missing case to s3_clnt.c state machine -- one of the new SSL tests
10056      through a BIO pair triggered the default case, i.e.
10057      SSLerr(...,SSL_R_UNKNOWN_STATE).
10058      [Bodo Moeller]
10059 
10060   *) New "BIO pair" concept (crypto/bio/bss_bio.c) so that applications
10061      can use the SSL library even if none of the specific BIOs is
10062      appropriate.
10063      [Bodo Moeller]
10064 
10065   *) Fix a bug in i2d_DSAPublicKey() which meant it returned the wrong value
10066      for the encoded length.
10067      [Jeon KyoungHo <khjeon@sds.samsung.co.kr>]
10068 
10069   *) Add initial documentation of the X509V3 functions.
10070      [Steve Henson]
10071 
10072   *) Add a new pair of functions PEM_write_PKCS8PrivateKey() and 
10073      PEM_write_bio_PKCS8PrivateKey() that are equivalent to
10074      PEM_write_PrivateKey() and PEM_write_bio_PrivateKey() but use the more
10075      secure PKCS#8 private key format with a high iteration count.
10076      [Steve Henson]
10077 
10078   *) Fix determination of Perl interpreter: A perl or perl5
10079      _directory_ in $PATH was also accepted as the interpreter.
10080      [Ralf S. Engelschall]
10081 
10082   *) Fix demos/sign/sign.c: well there wasn't anything strictly speaking
10083      wrong with it but it was very old and did things like calling
10084      PEM_ASN1_read() directly and used MD5 for the hash not to mention some
10085      unusual formatting.
10086      [Steve Henson]
10087 
10088   *) Fix demos/selfsign.c: it used obsolete and deleted functions, changed
10089      to use the new extension code.
10090      [Steve Henson]
10091 
10092   *) Implement the PEM_read/PEM_write functions in crypto/pem/pem_all.c
10093      with macros. This should make it easier to change their form, add extra
10094      arguments etc. Fix a few PEM prototypes which didn't have cipher as a
10095      constant.
10096      [Steve Henson]
10097 
10098   *) Add to configuration table a new entry that can specify an alternative
10099      name for unistd.h (for pre-POSIX systems); we need this for NeXTstep,
10100      according to Mark Crispin <MRC@Panda.COM>.
10101      [Bodo Moeller]
10102 
10103 #if 0
10104   *) DES CBC did not update the IV. Weird.
10105      [Ben Laurie]
10106 #else
10107      des_cbc_encrypt does not update the IV, but des_ncbc_encrypt does.
10108      Changing the behaviour of the former might break existing programs --
10109      where IV updating is needed, des_ncbc_encrypt can be used.
10110 #endif
10111 
10112   *) When bntest is run from "make test" it drives bc to check its
10113      calculations, as well as internally checking them. If an internal check
10114      fails, it needs to cause bc to give a non-zero result or make test carries
10115      on without noticing the failure. Fixed.
10116      [Ben Laurie]
10117 
10118   *) DES library cleanups.
10119      [Ulf Möller]
10120 
10121   *) Add support for PKCS#5 v2.0 PBE algorithms. This will permit PKCS#8 to be
10122      used with any cipher unlike PKCS#5 v1.5 which can at most handle 64 bit
10123      ciphers. NOTE: although the key derivation function has been verified
10124      against some published test vectors it has not been extensively tested
10125      yet. Added a -v2 "cipher" option to pkcs8 application to allow the use
10126      of v2.0.
10127      [Steve Henson]
10128 
10129   *) Instead of "mkdir -p", which is not fully portable, use new
10130      Perl script "util/mkdir-p.pl".
10131      [Bodo Moeller]
10132 
10133   *) Rewrite the way password based encryption (PBE) is handled. It used to
10134      assume that the ASN1 AlgorithmIdentifier parameter was a PBEParameter
10135      structure. This was true for the PKCS#5 v1.5 and PKCS#12 PBE algorithms
10136      but doesn't apply to PKCS#5 v2.0 where it can be something else. Now
10137      the 'parameter' field of the AlgorithmIdentifier is passed to the
10138      underlying key generation function so it must do its own ASN1 parsing.
10139      This has also changed the EVP_PBE_CipherInit() function which now has a
10140      'parameter' argument instead of literal salt and iteration count values
10141      and the function EVP_PBE_ALGOR_CipherInit() has been deleted.
10142      [Steve Henson]
10143 
10144   *) Support for PKCS#5 v1.5 compatible password based encryption algorithms
10145      and PKCS#8 functionality. New 'pkcs8' application linked to openssl.
10146      Needed to change the PEM_STRING_EVP_PKEY value which was just "PRIVATE
10147      KEY" because this clashed with PKCS#8 unencrypted string. Since this
10148      value was just used as a "magic string" and not used directly its
10149      value doesn't matter.
10150      [Steve Henson]
10151 
10152   *) Introduce some semblance of const correctness to BN. Shame C doesn't
10153      support mutable.
10154      [Ben Laurie]
10155 
10156   *) "linux-sparc64" configuration (ultrapenguin).
10157      [Ray Miller <ray.miller@oucs.ox.ac.uk>]
10158      "linux-sparc" configuration.
10159      [Christian Forster <fo@hawo.stw.uni-erlangen.de>]
10160 
10161   *) config now generates no-xxx options for missing ciphers.
10162      [Ulf Möller]
10163 
10164   *) Support the EBCDIC character set (work in progress).
10165      File ebcdic.c not yet included because it has a different license.
10166      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
10167 
10168   *) Support BS2000/OSD-POSIX.
10169      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
10170 
10171   *) Make callbacks for key generation use void * instead of char *.
10172      [Ben Laurie]
10173 
10174   *) Make S/MIME samples compile (not yet tested).
10175      [Ben Laurie]
10176 
10177   *) Additional typesafe stacks.
10178      [Ben Laurie]
10179 
10180   *) New configuration variants "bsdi-elf-gcc" (BSD/OS 4.x).
10181      [Bodo Moeller]
10182 
10183 
10184  Changes between 0.9.3 and 0.9.3a  [29 May 1999]
10185 
10186   *) New configuration variant "sco5-gcc".
10187 
10188   *) Updated some demos.
10189      [Sean O Riordain, Wade Scholine]
10190 
10191   *) Add missing BIO_free at exit of pkcs12 application.
10192      [Wu Zhigang]
10193 
10194   *) Fix memory leak in conf.c.
10195      [Steve Henson]
10196 
10197   *) Updates for Win32 to assembler version of MD5.
10198      [Steve Henson]
10199 
10200   *) Set #! path to perl in apps/der_chop to where we found it
10201      instead of using a fixed path.
10202      [Bodo Moeller]
10203 
10204   *) SHA library changes for irix64-mips4-cc.
10205      [Andy Polyakov]
10206 
10207   *) Improvements for VMS support.
10208      [Richard Levitte]
10209 
10210 
10211  Changes between 0.9.2b and 0.9.3  [24 May 1999]
10212 
10213   *) Bignum library bug fix. IRIX 6 passes "make test" now!
10214      This also avoids the problems with SC4.2 and unpatched SC5.  
10215      [Andy Polyakov <appro@fy.chalmers.se>]
10216 
10217   *) New functions sk_num, sk_value and sk_set to replace the previous macros.
10218      These are required because of the typesafe stack would otherwise break 
10219      existing code. If old code used a structure member which used to be STACK
10220      and is now STACK_OF (for example cert in a PKCS7_SIGNED structure) with
10221      sk_num or sk_value it would produce an error because the num, data members
10222      are not present in STACK_OF. Now it just produces a warning. sk_set
10223      replaces the old method of assigning a value to sk_value
10224      (e.g. sk_value(x, i) = y) which the library used in a few cases. Any code
10225      that does this will no longer work (and should use sk_set instead) but
10226      this could be regarded as a "questionable" behaviour anyway.
10227      [Steve Henson]
10228 
10229   *) Fix most of the other PKCS#7 bugs. The "experimental" code can now
10230      correctly handle encrypted S/MIME data.
10231      [Steve Henson]
10232 
10233   *) Change type of various DES function arguments from des_cblock
10234      (which means, in function argument declarations, pointer to char)
10235      to des_cblock * (meaning pointer to array with 8 char elements),
10236      which allows the compiler to do more typechecking; it was like
10237      that back in SSLeay, but with lots of ugly casts.
10238 
10239      Introduce new type const_des_cblock.
10240      [Bodo Moeller]
10241 
10242   *) Reorganise the PKCS#7 library and get rid of some of the more obvious
10243      problems: find RecipientInfo structure that matches recipient certificate
10244      and initialise the ASN1 structures properly based on passed cipher.
10245      [Steve Henson]
10246 
10247   *) Belatedly make the BN tests actually check the results.
10248      [Ben Laurie]
10249 
10250   *) Fix the encoding and decoding of negative ASN1 INTEGERS and conversion
10251      to and from BNs: it was completely broken. New compilation option
10252      NEG_PUBKEY_BUG to allow for some broken certificates that encode public
10253      key elements as negative integers.
10254      [Steve Henson]
10255 
10256   *) Reorganize and speed up MD5.
10257      [Andy Polyakov <appro@fy.chalmers.se>]
10258 
10259   *) VMS support.
10260      [Richard Levitte <richard@levitte.org>]
10261 
10262   *) New option -out to asn1parse to allow the parsed structure to be
10263      output to a file. This is most useful when combined with the -strparse
10264      option to examine the output of things like OCTET STRINGS.
10265      [Steve Henson]
10266 
10267   *) Make SSL library a little more fool-proof by not requiring any longer
10268      that SSL_set_{accept,connect}_state be called before
10269      SSL_{accept,connect} may be used (SSL_set_..._state is omitted
10270      in many applications because usually everything *appeared* to work as
10271      intended anyway -- now it really works as intended).
10272      [Bodo Moeller]
10273 
10274   *) Move openssl.cnf out of lib/.
10275      [Ulf Möller]
10276 
10277   *) Fix various things to let OpenSSL even pass ``egcc -pipe -O2 -Wall
10278      -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes
10279      -Wmissing-declarations -Wnested-externs -Winline'' with EGCS 1.1.2+ 
10280      [Ralf S. Engelschall]
10281 
10282   *) Various fixes to the EVP and PKCS#7 code. It may now be able to
10283      handle PKCS#7 enveloped data properly.
10284      [Sebastian Akerman <sak@parallelconsulting.com>, modified by Steve]
10285 
10286   *) Create a duplicate of the SSL_CTX's CERT in SSL_new instead of
10287      copying pointers.  The cert_st handling is changed by this in
10288      various ways (and thus what used to be known as ctx->default_cert
10289      is now called ctx->cert, since we don't resort to s->ctx->[default_]cert
10290      any longer when s->cert does not give us what we need).
10291      ssl_cert_instantiate becomes obsolete by this change.
10292      As soon as we've got the new code right (possibly it already is?),
10293      we have solved a couple of bugs of the earlier code where s->cert
10294      was used as if it could not have been shared with other SSL structures.
10295 
10296      Note that using the SSL API in certain dirty ways now will result
10297      in different behaviour than observed with earlier library versions:
10298      Changing settings for an SSL_CTX *ctx after having done s = SSL_new(ctx)
10299      does not influence s as it used to.
10300      
10301      In order to clean up things more thoroughly, inside SSL_SESSION
10302      we don't use CERT any longer, but a new structure SESS_CERT
10303      that holds per-session data (if available); currently, this is
10304      the peer's certificate chain and, for clients, the server's certificate
10305      and temporary key.  CERT holds only those values that can have
10306      meaningful defaults in an SSL_CTX.
10307      [Bodo Moeller]
10308 
10309   *) New function X509V3_EXT_i2d() to create an X509_EXTENSION structure
10310      from the internal representation. Various PKCS#7 fixes: remove some
10311      evil casts and set the enc_dig_alg field properly based on the signing
10312      key type.
10313      [Steve Henson]
10314 
10315   *) Allow PKCS#12 password to be set from the command line or the
10316      environment. Let 'ca' get its config file name from the environment
10317      variables "OPENSSL_CONF" or "SSLEAY_CONF" (for consistency with 'req'
10318      and 'x509').
10319      [Steve Henson]
10320 
10321   *) Allow certificate policies extension to use an IA5STRING for the
10322      organization field. This is contrary to the PKIX definition but
10323      VeriSign uses it and IE5 only recognises this form. Document 'x509'
10324      extension option.
10325      [Steve Henson]
10326 
10327   *) Add PEDANTIC compiler flag to allow compilation with gcc -pedantic,
10328      without disallowing inline assembler and the like for non-pedantic builds.
10329      [Ben Laurie]
10330 
10331   *) Support Borland C++ builder.
10332      [Janez Jere <jj@void.si>, modified by Ulf Möller]
10333 
10334   *) Support Mingw32.
10335      [Ulf Möller]
10336 
10337   *) SHA-1 cleanups and performance enhancements.
10338      [Andy Polyakov <appro@fy.chalmers.se>]
10339 
10340   *) Sparc v8plus assembler for the bignum library.
10341      [Andy Polyakov <appro@fy.chalmers.se>]
10342 
10343   *) Accept any -xxx and +xxx compiler options in Configure.
10344      [Ulf Möller]
10345 
10346   *) Update HPUX configuration.
10347      [Anonymous]
10348   
10349   *) Add missing sk_<type>_unshift() function to safestack.h
10350      [Ralf S. Engelschall]
10351 
10352   *) New function SSL_CTX_use_certificate_chain_file that sets the
10353      "extra_cert"s in addition to the certificate.  (This makes sense
10354      only for "PEM" format files, as chains as a whole are not
10355      DER-encoded.)
10356      [Bodo Moeller]
10357 
10358   *) Support verify_depth from the SSL API.
10359      x509_vfy.c had what can be considered an off-by-one-error:
10360      Its depth (which was not part of the external interface)
10361      was actually counting the number of certificates in a chain;
10362      now it really counts the depth.
10363      [Bodo Moeller]
10364 
10365   *) Bugfix in crypto/x509/x509_cmp.c: The SSLerr macro was used
10366      instead of X509err, which often resulted in confusing error
10367      messages since the error codes are not globally unique
10368      (e.g. an alleged error in ssl3_accept when a certificate
10369      didn't match the private key).
10370 
10371   *) New function SSL_CTX_set_session_id_context that allows to set a default
10372      value (so that you don't need SSL_set_session_id_context for each
10373      connection using the SSL_CTX).
10374      [Bodo Moeller]
10375 
10376   *) OAEP decoding bug fix.
10377      [Ulf Möller]
10378 
10379   *) Support INSTALL_PREFIX for package builders, as proposed by
10380      David Harris.
10381      [Bodo Moeller]
10382 
10383   *) New Configure options "threads" and "no-threads".  For systems
10384      where the proper compiler options are known (currently Solaris
10385      and Linux), "threads" is the default.
10386      [Bodo Moeller]
10387 
10388   *) New script util/mklink.pl as a faster substitute for util/mklink.sh.
10389      [Bodo Moeller]
10390 
10391   *) Install various scripts to $(OPENSSLDIR)/misc, not to
10392      $(INSTALLTOP)/bin -- they shouldn't clutter directories
10393      such as /usr/local/bin.
10394      [Bodo Moeller]
10395 
10396   *) "make linux-shared" to build shared libraries.
10397      [Niels Poppe <niels@netbox.org>]
10398 
10399   *) New Configure option no-<cipher> (rsa, idea, rc5, ...).
10400      [Ulf Möller]
10401 
10402   *) Add the PKCS#12 API documentation to openssl.txt. Preliminary support for
10403      extension adding in x509 utility.
10404      [Steve Henson]
10405 
10406   *) Remove NOPROTO sections and error code comments.
10407      [Ulf Möller]
10408 
10409   *) Partial rewrite of the DEF file generator to now parse the ANSI
10410      prototypes.
10411      [Steve Henson]
10412 
10413   *) New Configure options --prefix=DIR and --openssldir=DIR.
10414      [Ulf Möller]
10415 
10416   *) Complete rewrite of the error code script(s). It is all now handled
10417      by one script at the top level which handles error code gathering,
10418      header rewriting and C source file generation. It should be much better
10419      than the old method: it now uses a modified version of Ulf's parser to
10420      read the ANSI prototypes in all header files (thus the old K&R definitions
10421      aren't needed for error creation any more) and do a better job of
10422      translating function codes into names. The old 'ASN1 error code imbedded
10423      in a comment' is no longer necessary and it doesn't use .err files which
10424      have now been deleted. Also the error code call doesn't have to appear all
10425      on one line (which resulted in some large lines...).
10426      [Steve Henson]
10427 
10428   *) Change #include filenames from <foo.h> to <openssl/foo.h>.
10429      [Bodo Moeller]
10430 
10431   *) Change behaviour of ssl2_read when facing length-0 packets: Don't return
10432      0 (which usually indicates a closed connection), but continue reading.
10433      [Bodo Moeller]
10434 
10435   *) Fix some race conditions.
10436      [Bodo Moeller]
10437 
10438   *) Add support for CRL distribution points extension. Add Certificate
10439      Policies and CRL distribution points documentation.
10440      [Steve Henson]
10441 
10442   *) Move the autogenerated header file parts to crypto/opensslconf.h.
10443      [Ulf Möller]
10444 
10445   *) Fix new 56-bit DES export ciphersuites: they were using 7 bytes instead of
10446      8 of keying material. Merlin has also confirmed interop with this fix
10447      between OpenSSL and Baltimore C/SSL 2.0 and J/SSL 2.0.
10448      [Merlin Hughes <merlin@baltimore.ie>]
10449 
10450   *) Fix lots of warnings.
10451      [Richard Levitte <levitte@stacken.kth.se>]
10452  
10453   *) In add_cert_dir() in crypto/x509/by_dir.c, break out of the loop if
10454      the directory spec didn't end with a LIST_SEPARATOR_CHAR.
10455      [Richard Levitte <levitte@stacken.kth.se>]
10456  
10457   *) Fix problems with sizeof(long) == 8.
10458      [Andy Polyakov <appro@fy.chalmers.se>]
10459 
10460   *) Change functions to ANSI C.
10461      [Ulf Möller]
10462 
10463   *) Fix typos in error codes.
10464      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>, Ulf Möller]
10465 
10466   *) Remove defunct assembler files from Configure.
10467      [Ulf Möller]
10468 
10469   *) SPARC v8 assembler BIGNUM implementation.
10470      [Andy Polyakov <appro@fy.chalmers.se>]
10471 
10472   *) Support for Certificate Policies extension: both print and set.
10473      Various additions to support the r2i method this uses.
10474      [Steve Henson]
10475 
10476   *) A lot of constification, and fix a bug in X509_NAME_oneline() that could
10477      return a const string when you are expecting an allocated buffer.
10478      [Ben Laurie]
10479 
10480   *) Add support for ASN1 types UTF8String and VISIBLESTRING, also the CHOICE
10481      types DirectoryString and DisplayText.
10482      [Steve Henson]
10483 
10484   *) Add code to allow r2i extensions to access the configuration database,
10485      add an LHASH database driver and add several ctx helper functions.
10486      [Steve Henson]
10487 
10488   *) Fix an evil bug in bn_expand2() which caused various BN functions to
10489      fail when they extended the size of a BIGNUM.
10490      [Steve Henson]
10491 
10492   *) Various utility functions to handle SXNet extension. Modify mkdef.pl to
10493      support typesafe stack.
10494      [Steve Henson]
10495 
10496   *) Fix typo in SSL_[gs]et_options().
10497      [Nils Frostberg <nils@medcom.se>]
10498 
10499   *) Delete various functions and files that belonged to the (now obsolete)
10500      old X509V3 handling code.
10501      [Steve Henson]
10502 
10503   *) New Configure option "rsaref".
10504      [Ulf Möller]
10505 
10506   *) Don't auto-generate pem.h.
10507      [Bodo Moeller]
10508 
10509   *) Introduce type-safe ASN.1 SETs.
10510      [Ben Laurie]
10511 
10512   *) Convert various additional casted stacks to type-safe STACK_OF() variants.
10513      [Ben Laurie, Ralf S. Engelschall, Steve Henson]
10514 
10515   *) Introduce type-safe STACKs. This will almost certainly break lots of code
10516      that links with OpenSSL (well at least cause lots of warnings), but fear
10517      not: the conversion is trivial, and it eliminates loads of evil casts. A
10518      few STACKed things have been converted already. Feel free to convert more.
10519      In the fullness of time, I'll do away with the STACK type altogether.
10520      [Ben Laurie]
10521 
10522   *) Add `openssl ca -revoke <certfile>' facility which revokes a certificate
10523      specified in <certfile> by updating the entry in the index.txt file.
10524      This way one no longer has to edit the index.txt file manually for
10525      revoking a certificate. The -revoke option does the gory details now.
10526      [Massimiliano Pala <madwolf@openca.org>, Ralf S. Engelschall]
10527 
10528   *) Fix `openssl crl -noout -text' combination where `-noout' killed the
10529      `-text' option at all and this way the `-noout -text' combination was
10530      inconsistent in `openssl crl' with the friends in `openssl x509|rsa|dsa'.
10531      [Ralf S. Engelschall]
10532 
10533   *) Make sure a corresponding plain text error message exists for the
10534      X509_V_ERR_CERT_REVOKED/23 error number which can occur when a
10535      verify callback function determined that a certificate was revoked.
10536      [Ralf S. Engelschall]
10537 
10538   *) Bugfix: In test/testenc, don't test "openssl <cipher>" for
10539      ciphers that were excluded, e.g. by -DNO_IDEA.  Also, test
10540      all available cipers including rc5, which was forgotten until now.
10541      In order to let the testing shell script know which algorithms
10542      are available, a new (up to now undocumented) command
10543      "openssl list-cipher-commands" is used.
10544      [Bodo Moeller]
10545 
10546   *) Bugfix: s_client occasionally would sleep in select() when
10547      it should have checked SSL_pending() first.
10548      [Bodo Moeller]
10549 
10550   *) New functions DSA_do_sign and DSA_do_verify to provide access to
10551      the raw DSA values prior to ASN.1 encoding.
10552      [Ulf Möller]
10553 
10554   *) Tweaks to Configure
10555      [Niels Poppe <niels@netbox.org>]
10556 
10557   *) Add support for PKCS#5 v2.0 ASN1 PBES2 structures. No other support,
10558      yet...
10559      [Steve Henson]
10560 
10561   *) New variables $(RANLIB) and $(PERL) in the Makefiles.
10562      [Ulf Möller]
10563 
10564   *) New config option to avoid instructions that are illegal on the 80386.
10565      The default code is faster, but requires at least a 486.
10566      [Ulf Möller]
10567   
10568   *) Got rid of old SSL2_CLIENT_VERSION (inconsistently used) and
10569      SSL2_SERVER_VERSION (not used at all) macros, which are now the
10570      same as SSL2_VERSION anyway.
10571      [Bodo Moeller]
10572 
10573   *) New "-showcerts" option for s_client.
10574      [Bodo Moeller]
10575 
10576   *) Still more PKCS#12 integration. Add pkcs12 application to openssl
10577      application. Various cleanups and fixes.
10578      [Steve Henson]
10579 
10580   *) More PKCS#12 integration. Add new pkcs12 directory with Makefile.ssl and
10581      modify error routines to work internally. Add error codes and PBE init
10582      to library startup routines.
10583      [Steve Henson]
10584 
10585   *) Further PKCS#12 integration. Added password based encryption, PKCS#8 and
10586      packing functions to asn1 and evp. Changed function names and error
10587      codes along the way.
10588      [Steve Henson]
10589 
10590   *) PKCS12 integration: and so it begins... First of several patches to
10591      slowly integrate PKCS#12 functionality into OpenSSL. Add PKCS#12
10592      objects to objects.h
10593      [Steve Henson]
10594 
10595   *) Add a new 'indent' option to some X509V3 extension code. Initial ASN1
10596      and display support for Thawte strong extranet extension.
10597      [Steve Henson]
10598 
10599   *) Add LinuxPPC support.
10600      [Jeff Dubrule <igor@pobox.org>]
10601 
10602   *) Get rid of redundant BN file bn_mulw.c, and rename bn_div64 to
10603      bn_div_words in alpha.s.
10604      [Hannes Reinecke <H.Reinecke@hw.ac.uk> and Ben Laurie]
10605 
10606   *) Make sure the RSA OAEP test is skipped under -DRSAref because
10607      OAEP isn't supported when OpenSSL is built with RSAref.
10608      [Ulf Moeller <ulf@fitug.de>]
10609 
10610   *) Move definitions of IS_SET/IS_SEQUENCE inside crypto/asn1/asn1.h 
10611      so they no longer are missing under -DNOPROTO. 
10612      [Soren S. Jorvang <soren@t.dk>]
10613 
10614 
10615  Changes between 0.9.1c and 0.9.2b  [22 Mar 1999]
10616 
10617   *) Make SSL_get_peer_cert_chain() work in servers. Unfortunately, it still
10618      doesn't work when the session is reused. Coming soon!
10619      [Ben Laurie]
10620 
10621   *) Fix a security hole, that allows sessions to be reused in the wrong
10622      context thus bypassing client cert protection! All software that uses
10623      client certs and session caches in multiple contexts NEEDS PATCHING to
10624      allow session reuse! A fuller solution is in the works.
10625      [Ben Laurie, problem pointed out by Holger Reif, Bodo Moeller (and ???)]
10626 
10627   *) Some more source tree cleanups (removed obsolete files
10628      crypto/bf/asm/bf586.pl, test/test.txt and crypto/sha/asm/f.s; changed
10629      permission on "config" script to be executable) and a fix for the INSTALL
10630      document.
10631      [Ulf Moeller <ulf@fitug.de>]
10632 
10633   *) Remove some legacy and erroneous uses of malloc, free instead of
10634      Malloc, Free.
10635      [Lennart Bang <lob@netstream.se>, with minor changes by Steve]
10636 
10637   *) Make rsa_oaep_test return non-zero on error.
10638      [Ulf Moeller <ulf@fitug.de>]
10639 
10640   *) Add support for native Solaris shared libraries. Configure
10641      solaris-sparc-sc4-pic, make, then run shlib/solaris-sc4.sh. It'd be nice
10642      if someone would make that last step automatic.
10643      [Matthias Loepfe <Matthias.Loepfe@AdNovum.CH>]
10644 
10645   *) ctx_size was not built with the right compiler during "make links". Fixed.
10646      [Ben Laurie]
10647 
10648   *) Change the meaning of 'ALL' in the cipher list. It now means "everything
10649      except NULL ciphers". This means the default cipher list will no longer
10650      enable NULL ciphers. They need to be specifically enabled e.g. with
10651      the string "DEFAULT:eNULL".
10652      [Steve Henson]
10653 
10654   *) Fix to RSA private encryption routines: if p < q then it would
10655      occasionally produce an invalid result. This will only happen with
10656      externally generated keys because OpenSSL (and SSLeay) ensure p > q.
10657      [Steve Henson]
10658 
10659   *) Be less restrictive and allow also `perl util/perlpath.pl
10660      /path/to/bin/perl' in addition to `perl util/perlpath.pl /path/to/bin',
10661      because this way one can also use an interpreter named `perl5' (which is
10662      usually the name of Perl 5.xxx on platforms where an Perl 4.x is still
10663      installed as `perl').
10664      [Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
10665 
10666   *) Let util/clean-depend.pl work also with older Perl 5.00x versions.
10667      [Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
10668 
10669   *) Fix Makefile.org so CC,CFLAG etc are passed to 'make links' add
10670      advapi32.lib to Win32 build and change the pem test comparision
10671      to fc.exe (thanks to Ulrich Kroener <kroneru@yahoo.com> for the
10672      suggestion). Fix misplaced ASNI prototypes and declarations in evp.h
10673      and crypto/des/ede_cbcm_enc.c.
10674      [Steve Henson]
10675 
10676   *) DES quad checksum was broken on big-endian architectures. Fixed.
10677      [Ben Laurie]
10678 
10679   *) Comment out two functions in bio.h that aren't implemented. Fix up the
10680      Win32 test batch file so it (might) work again. The Win32 test batch file
10681      is horrible: I feel ill....
10682      [Steve Henson]
10683 
10684   *) Move various #ifdefs around so NO_SYSLOG, NO_DIRENT etc are now selected
10685      in e_os.h. Audit of header files to check ANSI and non ANSI
10686      sections: 10 functions were absent from non ANSI section and not exported
10687      from Windows DLLs. Fixed up libeay.num for new functions.
10688      [Steve Henson]
10689 
10690   *) Make `openssl version' output lines consistent.
10691      [Ralf S. Engelschall]
10692 
10693   *) Fix Win32 symbol export lists for BIO functions: Added
10694      BIO_get_ex_new_index, BIO_get_ex_num, BIO_get_ex_data and BIO_set_ex_data
10695      to ms/libeay{16,32}.def.
10696      [Ralf S. Engelschall]
10697 
10698   *) Second round of fixing the OpenSSL perl/ stuff. It now at least compiled
10699      fine under Unix and passes some trivial tests I've now added. But the
10700      whole stuff is horribly incomplete, so a README.1ST with a disclaimer was
10701      added to make sure no one expects that this stuff really works in the
10702      OpenSSL 0.9.2 release.  Additionally I've started to clean the XS sources
10703      up and fixed a few little bugs and inconsistencies in OpenSSL.{pm,xs} and
10704      openssl_bio.xs.
10705      [Ralf S. Engelschall]
10706 
10707   *) Fix the generation of two part addresses in perl.
10708      [Kenji Miyake <kenji@miyake.org>, integrated by Ben Laurie]
10709 
10710   *) Add config entry for Linux on MIPS.
10711      [John Tobey <jtobey@channel1.com>]
10712 
10713   *) Make links whenever Configure is run, unless we are on Windoze.
10714      [Ben Laurie]
10715 
10716   *) Permit extensions to be added to CRLs using crl_section in openssl.cnf.
10717      Currently only issuerAltName and AuthorityKeyIdentifier make any sense
10718      in CRLs.
10719      [Steve Henson]
10720 
10721   *) Add a useful kludge to allow package maintainers to specify compiler and
10722      other platforms details on the command line without having to patch the
10723      Configure script everytime: One now can use ``perl Configure
10724      <id>:<details>'', i.e. platform ids are allowed to have details appended
10725      to them (seperated by colons). This is treated as there would be a static
10726      pre-configured entry in Configure's %table under key <id> with value
10727      <details> and ``perl Configure <id>'' is called.  So, when you want to
10728      perform a quick test-compile under FreeBSD 3.1 with pgcc and without
10729      assembler stuff you can use ``perl Configure "FreeBSD-elf:pgcc:-O6:::"''
10730      now, which overrides the FreeBSD-elf entry on-the-fly.
10731      [Ralf S. Engelschall]
10732 
10733   *) Disable new TLS1 ciphersuites by default: they aren't official yet.
10734      [Ben Laurie]
10735 
10736   *) Allow DSO flags like -fpic, -fPIC, -KPIC etc. to be specified
10737      on the `perl Configure ...' command line. This way one can compile
10738      OpenSSL libraries with Position Independent Code (PIC) which is needed
10739      for linking it into DSOs.
10740      [Ralf S. Engelschall]
10741 
10742   *) Remarkably, export ciphers were totally broken and no-one had noticed!
10743      Fixed.
10744      [Ben Laurie]
10745 
10746   *) Cleaned up the LICENSE document: The official contact for any license
10747      questions now is the OpenSSL core team under openssl-core@openssl.org.
10748      And add a paragraph about the dual-license situation to make sure people
10749      recognize that _BOTH_ the OpenSSL license _AND_ the SSLeay license apply
10750      to the OpenSSL toolkit.
10751      [Ralf S. Engelschall]
10752 
10753   *) General source tree makefile cleanups: Made `making xxx in yyy...'
10754      display consistent in the source tree and replaced `/bin/rm' by `rm'.
10755      Additonally cleaned up the `make links' target: Remove unnecessary
10756      semicolons, subsequent redundant removes, inline point.sh into mklink.sh
10757      to speed processing and no longer clutter the display with confusing
10758      stuff. Instead only the actually done links are displayed.
10759      [Ralf S. Engelschall]
10760 
10761   *) Permit null encryption ciphersuites, used for authentication only. It used
10762      to be necessary to set the preprocessor define SSL_ALLOW_ENULL to do this.
10763      It is now necessary to set SSL_FORBID_ENULL to prevent the use of null
10764      encryption.
10765      [Ben Laurie]
10766 
10767   *) Add a bunch of fixes to the PKCS#7 stuff. It used to sometimes reorder
10768      signed attributes when verifying signatures (this would break them), 
10769      the detached data encoding was wrong and public keys obtained using
10770      X509_get_pubkey() weren't freed.
10771      [Steve Henson]
10772 
10773   *) Add text documentation for the BUFFER functions. Also added a work around
10774      to a Win95 console bug. This was triggered by the password read stuff: the
10775      last character typed gets carried over to the next fread(). If you were 
10776      generating a new cert request using 'req' for example then the last
10777      character of the passphrase would be CR which would then enter the first
10778      field as blank.
10779      [Steve Henson]
10780 
10781   *) Added the new `Includes OpenSSL Cryptography Software' button as
10782      doc/openssl_button.{gif,html} which is similar in style to the old SSLeay
10783      button and can be used by applications based on OpenSSL to show the
10784      relationship to the OpenSSL project.  
10785      [Ralf S. Engelschall]
10786 
10787   *) Remove confusing variables in function signatures in files
10788      ssl/ssl_lib.c and ssl/ssl.h.
10789      [Lennart Bong <lob@kulthea.stacken.kth.se>]
10790 
10791   *) Don't install bss_file.c under PREFIX/include/
10792      [Lennart Bong <lob@kulthea.stacken.kth.se>]
10793 
10794   *) Get the Win32 compile working again. Modify mkdef.pl so it can handle
10795      functions that return function pointers and has support for NT specific
10796      stuff. Fix mk1mf.pl and VC-32.pl to support NT differences also. Various
10797      #ifdef WIN32 and WINNTs sprinkled about the place and some changes from
10798      unsigned to signed types: this was killing the Win32 compile.
10799      [Steve Henson]
10800 
10801   *) Add new certificate file to stack functions,
10802      SSL_add_dir_cert_subjects_to_stack() and
10803      SSL_add_file_cert_subjects_to_stack().  These largely supplant
10804      SSL_load_client_CA_file(), and can be used to add multiple certs easily
10805      to a stack (usually this is then handed to SSL_CTX_set_client_CA_list()).
10806      This means that Apache-SSL and similar packages don't have to mess around
10807      to add as many CAs as they want to the preferred list.
10808      [Ben Laurie]
10809 
10810   *) Experiment with doxygen documentation. Currently only partially applied to
10811      ssl/ssl_lib.c.
10812      See http://www.stack.nl/~dimitri/doxygen/index.html, and run doxygen with
10813      openssl.doxy as the configuration file.
10814      [Ben Laurie]
10815   
10816   *) Get rid of remaining C++-style comments which strict C compilers hate.
10817      [Ralf S. Engelschall, pointed out by Carlos Amengual]
10818 
10819   *) Changed BN_RECURSION in bn_mont.c to BN_RECURSION_MONT so it is not
10820      compiled in by default: it has problems with large keys.
10821      [Steve Henson]
10822 
10823   *) Add a bunch of SSL_xxx() functions for configuring the temporary RSA and
10824      DH private keys and/or callback functions which directly correspond to
10825      their SSL_CTX_xxx() counterparts but work on a per-connection basis. This
10826      is needed for applications which have to configure certificates on a
10827      per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis
10828      (e.g. s_server). 
10829         For the RSA certificate situation is makes no difference, but
10830      for the DSA certificate situation this fixes the "no shared cipher"
10831      problem where the OpenSSL cipher selection procedure failed because the
10832      temporary keys were not overtaken from the context and the API provided
10833      no way to reconfigure them. 
10834         The new functions now let applications reconfigure the stuff and they
10835      are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh,
10836      SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback.  Additionally a new
10837      non-public-API function ssl_cert_instantiate() is used as a helper
10838      function and also to reduce code redundancy inside ssl_rsa.c.
10839      [Ralf S. Engelschall]
10840 
10841   *) Move s_server -dcert and -dkey options out of the undocumented feature
10842      area because they are useful for the DSA situation and should be
10843      recognized by the users.
10844      [Ralf S. Engelschall]
10845 
10846   *) Fix the cipher decision scheme for export ciphers: the export bits are
10847      *not* within SSL_MKEY_MASK or SSL_AUTH_MASK, they are within
10848      SSL_EXP_MASK.  So, the original variable has to be used instead of the
10849      already masked variable.
10850      [Richard Levitte <levitte@stacken.kth.se>]
10851 
10852   *) Fix 'port' variable from `int' to `unsigned int' in crypto/bio/b_sock.c
10853      [Richard Levitte <levitte@stacken.kth.se>]
10854 
10855   *) Change type of another md_len variable in pk7_doit.c:PKCS7_dataFinal()
10856      from `int' to `unsigned int' because it's a length and initialized by
10857      EVP_DigestFinal() which expects an `unsigned int *'.
10858      [Richard Levitte <levitte@stacken.kth.se>]
10859 
10860   *) Don't hard-code path to Perl interpreter on shebang line of Configure
10861      script. Instead use the usual Shell->Perl transition trick.
10862      [Ralf S. Engelschall]
10863 
10864   *) Make `openssl x509 -noout -modulus' functional also for DSA certificates
10865      (in addition to RSA certificates) to match the behaviour of `openssl dsa
10866      -noout -modulus' as it's already the case for `openssl rsa -noout
10867      -modulus'.  For RSA the -modulus is the real "modulus" while for DSA
10868      currently the public key is printed (a decision which was already done by
10869      `openssl dsa -modulus' in the past) which serves a similar purpose.
10870      Additionally the NO_RSA no longer completely removes the whole -modulus
10871      option; it now only avoids using the RSA stuff. Same applies to NO_DSA
10872      now, too.
10873      [Ralf S.  Engelschall]
10874 
10875   *) Add Arne Ansper's reliable BIO - this is an encrypted, block-digested
10876      BIO. See the source (crypto/evp/bio_ok.c) for more info.
10877      [Arne Ansper <arne@ats.cyber.ee>]
10878 
10879   *) Dump the old yucky req code that tried (and failed) to allow raw OIDs
10880      to be added. Now both 'req' and 'ca' can use new objects defined in the
10881      config file.
10882      [Steve Henson]
10883 
10884   *) Add cool BIO that does syslog (or event log on NT).
10885      [Arne Ansper <arne@ats.cyber.ee>, integrated by Ben Laurie]
10886 
10887   *) Add support for new TLS ciphersuites, TLS_RSA_EXPORT56_WITH_RC4_56_MD5,
10888      TLS_RSA_EXPORT56_WITH_RC2_CBC_56_MD5 and
10889      TLS_RSA_EXPORT56_WITH_DES_CBC_SHA, as specified in "56-bit Export Cipher
10890      Suites For TLS", draft-ietf-tls-56-bit-ciphersuites-00.txt.
10891      [Ben Laurie]
10892 
10893   *) Add preliminary config info for new extension code.
10894      [Steve Henson]
10895 
10896   *) Make RSA_NO_PADDING really use no padding.
10897      [Ulf Moeller <ulf@fitug.de>]
10898 
10899   *) Generate errors when private/public key check is done.
10900      [Ben Laurie]
10901 
10902   *) Overhaul for 'crl' utility. New function X509_CRL_print. Partial support
10903      for some CRL extensions and new objects added.
10904      [Steve Henson]
10905 
10906   *) Really fix the ASN1 IMPLICIT bug this time... Partial support for private
10907      key usage extension and fuller support for authority key id.
10908      [Steve Henson]
10909 
10910   *) Add OAEP encryption for the OpenSSL crypto library. OAEP is the improved
10911      padding method for RSA, which is recommended for new applications in PKCS
10912      #1 v2.0 (RFC 2437, October 1998).
10913      OAEP (Optimal Asymmetric Encryption Padding) has better theoretical
10914      foundations than the ad-hoc padding used in PKCS #1 v1.5. It is secure
10915      against Bleichbacher's attack on RSA.
10916      [Ulf Moeller <ulf@fitug.de>, reformatted, corrected and integrated by
10917       Ben Laurie]
10918 
10919   *) Updates to the new SSL compression code
10920      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
10921 
10922   *) Fix so that the version number in the master secret, when passed
10923      via RSA, checks that if TLS was proposed, but we roll back to SSLv3
10924      (because the server will not accept higher), that the version number
10925      is 0x03,0x01, not 0x03,0x00
10926      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
10927 
10928   *) Run extensive memory leak checks on SSL apps. Fixed *lots* of memory
10929      leaks in ssl/ relating to new X509_get_pubkey() behaviour. Also fixes
10930      in apps/ and an unrelated leak in crypto/dsa/dsa_vrf.c
10931      [Steve Henson]
10932 
10933   *) Support for RAW extensions where an arbitrary extension can be
10934      created by including its DER encoding. See apps/openssl.cnf for
10935      an example.
10936      [Steve Henson]
10937 
10938   *) Make sure latest Perl versions don't interpret some generated C array
10939      code as Perl array code in the crypto/err/err_genc.pl script.
10940      [Lars Weber <3weber@informatik.uni-hamburg.de>]
10941 
10942   *) Modify ms/do_ms.bat to not generate assembly language makefiles since
10943      not many people have the assembler. Various Win32 compilation fixes and
10944      update to the INSTALL.W32 file with (hopefully) more accurate Win32
10945      build instructions.
10946      [Steve Henson]
10947 
10948   *) Modify configure script 'Configure' to automatically create crypto/date.h
10949      file under Win32 and also build pem.h from pem.org. New script
10950      util/mkfiles.pl to create the MINFO file on environments that can't do a
10951      'make files': perl util/mkfiles.pl >MINFO should work.
10952      [Steve Henson]
10953 
10954   *) Major rework of DES function declarations, in the pursuit of correctness
10955      and purity. As a result, many evil casts evaporated, and some weirdness,
10956      too. You may find this causes warnings in your code. Zapping your evil
10957      casts will probably fix them. Mostly.
10958      [Ben Laurie]
10959 
10960   *) Fix for a typo in asn1.h. Bug fix to object creation script
10961      obj_dat.pl. It considered a zero in an object definition to mean
10962      "end of object": none of the objects in objects.h have any zeros
10963      so it wasn't spotted.
10964      [Steve Henson, reported by Erwann ABALEA <eabalea@certplus.com>]
10965 
10966   *) Add support for Triple DES Cipher Block Chaining with Output Feedback
10967      Masking (CBCM). In the absence of test vectors, the best I have been able
10968      to do is check that the decrypt undoes the encrypt, so far. Send me test
10969      vectors if you have them.
10970      [Ben Laurie]
10971 
10972   *) Correct calculation of key length for export ciphers (too much space was
10973      allocated for null ciphers). This has not been tested!
10974      [Ben Laurie]
10975 
10976   *) Modifications to the mkdef.pl for Win32 DEF file creation. The usage
10977      message is now correct (it understands "crypto" and "ssl" on its
10978      command line). There is also now an "update" option. This will update
10979      the util/ssleay.num and util/libeay.num files with any new functions.
10980      If you do a: 
10981      perl util/mkdef.pl crypto ssl update
10982      it will update them.
10983      [Steve Henson]
10984 
10985   *) Overhauled the Perl interface (perl/*):
10986      - ported BN stuff to OpenSSL's different BN library
10987      - made the perl/ source tree CVS-aware
10988      - renamed the package from SSLeay to OpenSSL (the files still contain
10989        their history because I've copied them in the repository)
10990      - removed obsolete files (the test scripts will be replaced
10991        by better Test::Harness variants in the future)
10992      [Ralf S. Engelschall]
10993 
10994   *) First cut for a very conservative source tree cleanup:
10995      1. merge various obsolete readme texts into doc/ssleay.txt
10996      where we collect the old documents and readme texts.
10997      2. remove the first part of files where I'm already sure that we no
10998      longer need them because of three reasons: either they are just temporary
10999      files which were left by Eric or they are preserved original files where
11000      I've verified that the diff is also available in the CVS via "cvs diff
11001      -rSSLeay_0_8_1b" or they were renamed (as it was definitely the case for
11002      the crypto/md/ stuff).
11003      [Ralf S. Engelschall]
11004 
11005   *) More extension code. Incomplete support for subject and issuer alt
11006      name, issuer and authority key id. Change the i2v function parameters
11007      and add an extra 'crl' parameter in the X509V3_CTX structure: guess
11008      what that's for :-) Fix to ASN1 macro which messed up
11009      IMPLICIT tag and add f_enum.c which adds a2i, i2a for ENUMERATED.
11010      [Steve Henson]
11011 
11012   *) Preliminary support for ENUMERATED type. This is largely copied from the
11013      INTEGER code.
11014      [Steve Henson]
11015 
11016   *) Add new function, EVP_MD_CTX_copy() to replace frequent use of memcpy.
11017      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
11018 
11019   *) Make sure `make rehash' target really finds the `openssl' program.
11020      [Ralf S. Engelschall, Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
11021 
11022   *) Squeeze another 7% of speed out of MD5 assembler, at least on a P2. I'd
11023      like to hear about it if this slows down other processors.
11024      [Ben Laurie]
11025 
11026   *) Add CygWin32 platform information to Configure script.
11027      [Alan Batie <batie@aahz.jf.intel.com>]
11028 
11029   *) Fixed ms/32all.bat script: `no_asm' -> `no-asm'
11030      [Rainer W. Gerling <gerling@mpg-gv.mpg.de>]
11031   
11032   *) New program nseq to manipulate netscape certificate sequences
11033      [Steve Henson]
11034 
11035   *) Modify crl2pkcs7 so it supports multiple -certfile arguments. Fix a
11036      few typos.
11037      [Steve Henson]
11038 
11039   *) Fixes to BN code.  Previously the default was to define BN_RECURSION
11040      but the BN code had some problems that would cause failures when
11041      doing certificate verification and some other functions.
11042      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
11043 
11044   *) Add ASN1 and PEM code to support netscape certificate sequences.
11045      [Steve Henson]
11046 
11047   *) Add ASN1 and PEM code to support netscape certificate sequences.
11048      [Steve Henson]
11049 
11050   *) Add several PKIX and private extended key usage OIDs.
11051      [Steve Henson]
11052 
11053   *) Modify the 'ca' program to handle the new extension code. Modify
11054      openssl.cnf for new extension format, add comments.
11055      [Steve Henson]
11056 
11057   *) More X509 V3 changes. Fix typo in v3_bitstr.c. Add support to 'req'
11058      and add a sample to openssl.cnf so req -x509 now adds appropriate
11059      CA extensions.
11060      [Steve Henson]
11061 
11062   *) Continued X509 V3 changes. Add to other makefiles, integrate with the
11063      error code, add initial support to X509_print() and x509 application.
11064      [Steve Henson]
11065 
11066   *) Takes a deep breath and start addding X509 V3 extension support code. Add
11067      files in crypto/x509v3. Move original stuff to crypto/x509v3/old. All this
11068      stuff is currently isolated and isn't even compiled yet.
11069      [Steve Henson]
11070 
11071   *) Continuing patches for GeneralizedTime. Fix up certificate and CRL
11072      ASN1 to use ASN1_TIME and modify print routines to use ASN1_TIME_print.
11073      Removed the versions check from X509 routines when loading extensions:
11074      this allows certain broken certificates that don't set the version
11075      properly to be processed.
11076      [Steve Henson]
11077 
11078   *) Deal with irritating shit to do with dependencies, in YAAHW (Yet Another
11079      Ad Hoc Way) - Makefile.ssls now all contain local dependencies, which
11080      can still be regenerated with "make depend".
11081      [Ben Laurie]
11082 
11083   *) Spelling mistake in C version of CAST-128.
11084      [Ben Laurie, reported by Jeremy Hylton <jeremy@cnri.reston.va.us>]
11085 
11086   *) Changes to the error generation code. The perl script err-code.pl 
11087      now reads in the old error codes and retains the old numbers, only
11088      adding new ones if necessary. It also only changes the .err files if new
11089      codes are added. The makefiles have been modified to only insert errors
11090      when needed (to avoid needlessly modifying header files). This is done
11091      by only inserting errors if the .err file is newer than the auto generated
11092      C file. To rebuild all the error codes from scratch (the old behaviour)
11093      either modify crypto/Makefile.ssl to pass the -regen flag to err_code.pl
11094      or delete all the .err files.
11095      [Steve Henson]
11096 
11097   *) CAST-128 was incorrectly implemented for short keys. The C version has
11098      been fixed, but is untested. The assembler versions are also fixed, but
11099      new assembler HAS NOT BEEN GENERATED FOR WIN32 - the Makefile needs fixing
11100      to regenerate it if needed.
11101      [Ben Laurie, reported (with fix for C version) by Jun-ichiro itojun
11102       Hagino <itojun@kame.net>]
11103 
11104   *) File was opened incorrectly in randfile.c.
11105      [Ulf Möller <ulf@fitug.de>]
11106 
11107   *) Beginning of support for GeneralizedTime. d2i, i2d, check and print
11108      functions. Also ASN1_TIME suite which is a CHOICE of UTCTime or
11109      GeneralizedTime. ASN1_TIME is the proper type used in certificates et
11110      al: it's just almost always a UTCTime. Note this patch adds new error
11111      codes so do a "make errors" if there are problems.
11112      [Steve Henson]
11113 
11114   *) Correct Linux 1 recognition in config.
11115      [Ulf Möller <ulf@fitug.de>]
11116 
11117   *) Remove pointless MD5 hash when using DSA keys in ca.
11118      [Anonymous <nobody@replay.com>]
11119 
11120   *) Generate an error if given an empty string as a cert directory. Also
11121      generate an error if handed NULL (previously returned 0 to indicate an
11122      error, but didn't set one).
11123      [Ben Laurie, reported by Anonymous <nobody@replay.com>]
11124 
11125   *) Add prototypes to SSL methods. Make SSL_write's buffer const, at last.
11126      [Ben Laurie]
11127 
11128   *) Fix the dummy function BN_ref_mod_exp() in rsaref.c to have the correct
11129      parameters. This was causing a warning which killed off the Win32 compile.
11130      [Steve Henson]
11131 
11132   *) Remove C++ style comments from crypto/bn/bn_local.h.
11133      [Neil Costigan <neil.costigan@celocom.com>]
11134 
11135   *) The function OBJ_txt2nid was broken. It was supposed to return a nid
11136      based on a text string, looking up short and long names and finally
11137      "dot" format. The "dot" format stuff didn't work. Added new function
11138      OBJ_txt2obj to do the same but return an ASN1_OBJECT and rewrote 
11139      OBJ_txt2nid to use it. OBJ_txt2obj can also return objects even if the
11140      OID is not part of the table.
11141      [Steve Henson]
11142 
11143   *) Add prototypes to X509 lookup/verify methods, fixing a bug in
11144      X509_LOOKUP_by_alias().
11145      [Ben Laurie]
11146 
11147   *) Sort openssl functions by name.
11148      [Ben Laurie]
11149 
11150   *) Get the gendsa program working (hopefully) and add it to app list. Remove
11151      encryption from sample DSA keys (in case anyone is interested the password
11152      was "1234").
11153      [Steve Henson]
11154 
11155   *) Make _all_ *_free functions accept a NULL pointer.
11156      [Frans Heymans <fheymans@isaserver.be>]
11157 
11158   *) If a DH key is generated in s3_srvr.c, don't blow it by trying to use
11159      NULL pointers.
11160      [Anonymous <nobody@replay.com>]
11161 
11162   *) s_server should send the CAfile as acceptable CAs, not its own cert.
11163      [Bodo Moeller <3moeller@informatik.uni-hamburg.de>]
11164 
11165   *) Don't blow it for numeric -newkey arguments to apps/req.
11166      [Bodo Moeller <3moeller@informatik.uni-hamburg.de>]
11167 
11168   *) Temp key "for export" tests were wrong in s3_srvr.c.
11169      [Anonymous <nobody@replay.com>]
11170 
11171   *) Add prototype for temp key callback functions
11172      SSL_CTX_set_tmp_{rsa,dh}_callback().
11173      [Ben Laurie]
11174 
11175   *) Make DH_free() tolerate being passed a NULL pointer (like RSA_free() and
11176      DSA_free()). Make X509_PUBKEY_set() check for errors in d2i_PublicKey().
11177      [Steve Henson]
11178 
11179   *) X509_name_add_entry() freed the wrong thing after an error.
11180      [Arne Ansper <arne@ats.cyber.ee>]
11181 
11182   *) rsa_eay.c would attempt to free a NULL context.
11183      [Arne Ansper <arne@ats.cyber.ee>]
11184 
11185   *) BIO_s_socket() had a broken should_retry() on Windoze.
11186      [Arne Ansper <arne@ats.cyber.ee>]
11187 
11188   *) BIO_f_buffer() didn't pass on BIO_CTRL_FLUSH.
11189      [Arne Ansper <arne@ats.cyber.ee>]
11190 
11191   *) Make sure the already existing X509_STORE->depth variable is initialized
11192      in X509_STORE_new(), but document the fact that this variable is still
11193      unused in the certificate verification process.
11194      [Ralf S. Engelschall]
11195 
11196   *) Fix the various library and apps files to free up pkeys obtained from
11197      X509_PUBKEY_get() et al. Also allow x509.c to handle netscape extensions.
11198      [Steve Henson]
11199 
11200   *) Fix reference counting in X509_PUBKEY_get(). This makes
11201      demos/maurice/example2.c work, amongst others, probably.
11202      [Steve Henson and Ben Laurie]
11203 
11204   *) First cut of a cleanup for apps/. First the `ssleay' program is now named
11205      `openssl' and second, the shortcut symlinks for the `openssl <command>'
11206      are no longer created. This way we have a single and consistent command
11207      line interface `openssl <command>', similar to `cvs <command>'.
11208      [Ralf S. Engelschall, Paul Sutton and Ben Laurie]
11209 
11210   *) ca.c: move test for DSA keys inside #ifndef NO_DSA. Make pubkey
11211      BIT STRING wrapper always have zero unused bits.
11212      [Steve Henson]
11213 
11214   *) Add CA.pl, perl version of CA.sh, add extended key usage OID.
11215      [Steve Henson]
11216 
11217   *) Make the top-level INSTALL documentation easier to understand.
11218      [Paul Sutton]
11219 
11220   *) Makefiles updated to exit if an error occurs in a sub-directory
11221      make (including if user presses ^C) [Paul Sutton]
11222 
11223   *) Make Montgomery context stuff explicit in RSA data structure.
11224      [Ben Laurie]
11225 
11226   *) Fix build order of pem and err to allow for generated pem.h.
11227      [Ben Laurie]
11228 
11229   *) Fix renumbering bug in X509_NAME_delete_entry().
11230      [Ben Laurie]
11231 
11232   *) Enhanced the err-ins.pl script so it makes the error library number 
11233      global and can add a library name. This is needed for external ASN1 and
11234      other error libraries.
11235      [Steve Henson]
11236 
11237   *) Fixed sk_insert which never worked properly.
11238      [Steve Henson]
11239 
11240   *) Fix ASN1 macros so they can handle indefinite length construted 
11241      EXPLICIT tags. Some non standard certificates use these: they can now
11242      be read in.
11243      [Steve Henson]
11244 
11245   *) Merged the various old/obsolete SSLeay documentation files (doc/xxx.doc)
11246      into a single doc/ssleay.txt bundle. This way the information is still
11247      preserved but no longer messes up this directory. Now it's new room for
11248      the new set of documenation files.
11249      [Ralf S. Engelschall]
11250 
11251   *) SETs were incorrectly DER encoded. This was a major pain, because they
11252      shared code with SEQUENCEs, which aren't coded the same. This means that
11253      almost everything to do with SETs or SEQUENCEs has either changed name or
11254      number of arguments.
11255      [Ben Laurie, based on a partial fix by GP Jayan <gp@nsj.co.jp>]
11256 
11257   *) Fix test data to work with the above.
11258      [Ben Laurie]
11259 
11260   *) Fix the RSA header declarations that hid a bug I fixed in 0.9.0b but
11261      was already fixed by Eric for 0.9.1 it seems.
11262      [Ben Laurie - pointed out by Ulf Möller <ulf@fitug.de>]
11263 
11264   *) Autodetect FreeBSD3.
11265      [Ben Laurie]
11266 
11267   *) Fix various bugs in Configure. This affects the following platforms:
11268      nextstep
11269      ncr-scde
11270      unixware-2.0
11271      unixware-2.0-pentium
11272      sco5-cc.
11273      [Ben Laurie]
11274 
11275   *) Eliminate generated files from CVS. Reorder tests to regenerate files
11276      before they are needed.
11277      [Ben Laurie]
11278 
11279   *) Generate Makefile.ssl from Makefile.org (to keep CVS happy).
11280      [Ben Laurie]
11281 
11282 
11283  Changes between 0.9.1b and 0.9.1c  [23-Dec-1998]
11284 
11285   *) Added OPENSSL_VERSION_NUMBER to crypto/crypto.h and 
11286      changed SSLeay to OpenSSL in version strings.
11287      [Ralf S. Engelschall]
11288   
11289   *) Some fixups to the top-level documents.
11290      [Paul Sutton]
11291 
11292   *) Fixed the nasty bug where rsaref.h was not found under compile-time
11293      because the symlink to include/ was missing.
11294      [Ralf S. Engelschall]
11295 
11296   *) Incorporated the popular no-RSA/DSA-only patches 
11297      which allow to compile a RSA-free SSLeay.
11298      [Andrew Cooke / Interrader Ldt., Ralf S. Engelschall]
11299 
11300   *) Fixed nasty rehash problem under `make -f Makefile.ssl links'
11301      when "ssleay" is still not found.
11302      [Ralf S. Engelschall]
11303 
11304   *) Added more platforms to Configure: Cray T3E, HPUX 11, 
11305      [Ralf S. Engelschall, Beckmann <beckman@acl.lanl.gov>]
11306 
11307   *) Updated the README file.
11308      [Ralf S. Engelschall]
11309 
11310   *) Added various .cvsignore files in the CVS repository subdirs
11311      to make a "cvs update" really silent.
11312      [Ralf S. Engelschall]
11313 
11314   *) Recompiled the error-definition header files and added
11315      missing symbols to the Win32 linker tables.
11316      [Ralf S. Engelschall]
11317 
11318   *) Cleaned up the top-level documents;
11319      o new files: CHANGES and LICENSE
11320      o merged VERSION, HISTORY* and README* files a CHANGES.SSLeay 
11321      o merged COPYRIGHT into LICENSE
11322      o removed obsolete TODO file
11323      o renamed MICROSOFT to INSTALL.W32
11324      [Ralf S. Engelschall]
11325 
11326   *) Removed dummy files from the 0.9.1b source tree: 
11327      crypto/asn1/x crypto/bio/cd crypto/bio/fg crypto/bio/grep crypto/bio/vi
11328      crypto/bn/asm/......add.c crypto/bn/asm/a.out crypto/dsa/f crypto/md5/f
11329      crypto/pem/gmon.out crypto/perlasm/f crypto/pkcs7/build crypto/rsa/f
11330      crypto/sha/asm/f crypto/threads/f ms/zzz ssl/f ssl/f.mak test/f
11331      util/f.mak util/pl/f util/pl/f.mak crypto/bf/bf_locl.old apps/f
11332      [Ralf S. Engelschall]
11333 
11334   *) Added various platform portability fixes.
11335      [Mark J. Cox]
11336 
11337   *) The Genesis of the OpenSSL rpject:
11338      We start with the latest (unreleased) SSLeay version 0.9.1b which Eric A.
11339      Young and Tim J. Hudson created while they were working for C2Net until
11340      summer 1998.
11341      [The OpenSSL Project]
11342  
11343 
11344  Changes between 0.9.0b and 0.9.1b  [not released]
11345 
11346   *) Updated a few CA certificates under certs/
11347      [Eric A. Young]
11348 
11349   *) Changed some BIGNUM api stuff.
11350      [Eric A. Young]
11351 
11352   *) Various platform ports: OpenBSD, Ultrix, IRIX 64bit, NetBSD, 
11353      DGUX x86, Linux Alpha, etc.
11354      [Eric A. Young]
11355 
11356   *) New COMP library [crypto/comp/] for SSL Record Layer Compression: 
11357      RLE (dummy implemented) and ZLIB (really implemented when ZLIB is
11358      available).
11359      [Eric A. Young]
11360 
11361   *) Add -strparse option to asn1pars program which parses nested 
11362      binary structures 
11363      [Dr Stephen Henson <shenson@bigfoot.com>]
11364 
11365   *) Added "oid_file" to ssleay.cnf for "ca" and "req" programs.
11366      [Eric A. Young]
11367 
11368   *) DSA fix for "ca" program.
11369      [Eric A. Young]
11370 
11371   *) Added "-genkey" option to "dsaparam" program.
11372      [Eric A. Young]
11373 
11374   *) Added RIPE MD160 (rmd160) message digest.
11375      [Eric A. Young]
11376 
11377   *) Added -a (all) option to "ssleay version" command.
11378      [Eric A. Young]
11379 
11380   *) Added PLATFORM define which is the id given to Configure.
11381      [Eric A. Young]
11382 
11383   *) Added MemCheck_XXXX functions to crypto/mem.c for memory checking.
11384      [Eric A. Young]
11385 
11386   *) Extended the ASN.1 parser routines.
11387      [Eric A. Young]
11388 
11389   *) Extended BIO routines to support REUSEADDR, seek, tell, etc.
11390      [Eric A. Young]
11391 
11392   *) Added a BN_CTX to the BN library.
11393      [Eric A. Young]
11394 
11395   *) Fixed the weak key values in DES library
11396      [Eric A. Young]
11397 
11398   *) Changed API in EVP library for cipher aliases.
11399      [Eric A. Young]
11400 
11401   *) Added support for RC2/64bit cipher.
11402      [Eric A. Young]
11403 
11404   *) Converted the lhash library to the crypto/mem.c functions.
11405      [Eric A. Young]
11406 
11407   *) Added more recognized ASN.1 object ids.
11408      [Eric A. Young]
11409 
11410   *) Added more RSA padding checks for SSL/TLS.
11411      [Eric A. Young]
11412 
11413   *) Added BIO proxy/filter functionality.
11414      [Eric A. Young]
11415 
11416   *) Added extra_certs to SSL_CTX which can be used
11417      send extra CA certificates to the client in the CA cert chain sending
11418      process. It can be configured with SSL_CTX_add_extra_chain_cert().
11419      [Eric A. Young]
11420 
11421   *) Now Fortezza is denied in the authentication phase because
11422      this is key exchange mechanism is not supported by SSLeay at all.
11423      [Eric A. Young]
11424 
11425   *) Additional PKCS1 checks.
11426      [Eric A. Young]
11427 
11428   *) Support the string "TLSv1" for all TLS v1 ciphers.
11429      [Eric A. Young]
11430 
11431   *) Added function SSL_get_ex_data_X509_STORE_CTX_idx() which gives the
11432      ex_data index of the SSL context in the X509_STORE_CTX ex_data.
11433      [Eric A. Young]
11434 
11435   *) Fixed a few memory leaks.
11436      [Eric A. Young]
11437 
11438   *) Fixed various code and comment typos.
11439      [Eric A. Young]
11440 
11441   *) A minor bug in ssl/s3_clnt.c where there would always be 4 0 
11442      bytes sent in the client random.
11443      [Edward Bishop <ebishop@spyglass.com>]
11444