"Fossies" - the Fresh Open Source Software Archive

Member "openssl-1.0.2r/CHANGES" (26 Feb 2019, 507893 Bytes) of package /linux/misc/openssl-1.0.2r.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the last Fossies "Diffs" side-by-side code changes report for "CHANGES": 1.1.1-pre8_vs_1.1.1-pre9.

    1 
    2  OpenSSL CHANGES
    3  _______________
    4 
    5  This is a high-level summary of the most important changes.
    6  For a full list of changes, see the git commit log; for example,
    7  https://github.com/openssl/openssl/commits/ and pick the appropriate
    8  release branch.
    9 
   10  Changes between 1.0.2q and 1.0.2r [26 Feb 2019]
   11 
   12   *) 0-byte record padding oracle
   13 
   14      If an application encounters a fatal protocol error and then calls
   15      SSL_shutdown() twice (once to send a close_notify, and once to receive one)
   16      then OpenSSL can respond differently to the calling application if a 0 byte
   17      record is received with invalid padding compared to if a 0 byte record is
   18      received with an invalid MAC. If the application then behaves differently
   19      based on that in a way that is detectable to the remote peer, then this
   20      amounts to a padding oracle that could be used to decrypt data.
   21 
   22      In order for this to be exploitable "non-stitched" ciphersuites must be in
   23      use. Stitched ciphersuites are optimised implementations of certain
   24      commonly used ciphersuites. Also the application must call SSL_shutdown()
   25      twice even if a protocol error has occurred (applications should not do
   26      this but some do anyway).
   27 
   28      This issue was discovered by Juraj Somorovsky, Robert Merget and Nimrod
   29      Aviram, with additional investigation by Steven Collison and Andrew
   30      Hourselt. It was reported to OpenSSL on 10th December 2018.
   31      (CVE-2019-1559)
   32      [Matt Caswell]
   33 
   34   *) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0().
   35      [Richard Levitte]
   36 
   37  Changes between 1.0.2p and 1.0.2q [20 Nov 2018]
   38 
   39   *) Microarchitecture timing vulnerability in ECC scalar multiplication
   40 
   41      OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been
   42      shown to be vulnerable to a microarchitecture timing side channel attack.
   43      An attacker with sufficient access to mount local timing attacks during
   44      ECDSA signature generation could recover the private key.
   45 
   46      This issue was reported to OpenSSL on 26th October 2018 by Alejandro
   47      Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and
   48      Nicola Tuveri.
   49      (CVE-2018-5407)
   50      [Billy Brumley]
   51 
   52   *) Timing vulnerability in DSA signature generation
   53 
   54      The OpenSSL DSA signature algorithm has been shown to be vulnerable to a
   55      timing side channel attack. An attacker could use variations in the signing
   56      algorithm to recover the private key.
   57 
   58      This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser.
   59      (CVE-2018-0734)
   60      [Paul Dale]
   61 
   62   *) Resolve a compatibility issue in EC_GROUP handling with the FIPS Object
   63      Module, accidentally introduced while backporting security fixes from the
   64      development branch and hindering the use of ECC in FIPS mode.
   65      [Nicola Tuveri]
   66 
   67  Changes between 1.0.2o and 1.0.2p [14 Aug 2018]
   68 
   69   *) Client DoS due to large DH parameter
   70 
   71      During key agreement in a TLS handshake using a DH(E) based ciphersuite a
   72      malicious server can send a very large prime value to the client. This will
   73      cause the client to spend an unreasonably long period of time generating a
   74      key for this prime resulting in a hang until the client has finished. This
   75      could be exploited in a Denial Of Service attack.
   76 
   77      This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
   78      (CVE-2018-0732)
   79      [Guido Vranken]
   80 
   81   *) Cache timing vulnerability in RSA Key Generation
   82 
   83      The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
   84      a cache timing side channel attack. An attacker with sufficient access to
   85      mount cache timing attacks during the RSA key generation process could
   86      recover the private key.
   87 
   88      This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
   89      Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
   90      (CVE-2018-0737)
   91      [Billy Brumley]
   92 
   93   *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
   94      parameter is no longer accepted, as it leads to a corrupt table.  NULL
   95      pem_str is reserved for alias entries only.
   96      [Richard Levitte]
   97 
   98   *) Revert blinding in ECDSA sign and instead make problematic addition
   99      length-invariant. Switch even to fixed-length Montgomery multiplication.
  100      [Andy Polyakov]
  101 
  102   *) Change generating and checking of primes so that the error rate of not
  103      being prime depends on the intended use based on the size of the input.
  104      For larger primes this will result in more rounds of Miller-Rabin.
  105      The maximal error rate for primes with more than 1080 bits is lowered
  106      to 2^-128.
  107      [Kurt Roeckx, Annie Yousar]
  108 
  109   *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
  110      [Kurt Roeckx]
  111 
  112   *) Add blinding to ECDSA and DSA signatures to protect against side channel
  113      attacks discovered by Keegan Ryan (NCC Group).
  114      [Matt Caswell]
  115 
  116   *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
  117      now allow empty (zero character) pass phrases.
  118      [Richard Levitte]
  119 
  120   *) Certificate time validation (X509_cmp_time) enforces stricter
  121      compliance with RFC 5280. Fractional seconds and timezone offsets
  122      are no longer allowed.
  123      [Emilia Käsper]
  124 
  125  Changes between 1.0.2n and 1.0.2o [27 Mar 2018]
  126 
  127   *) Constructed ASN.1 types with a recursive definition could exceed the stack
  128 
  129      Constructed ASN.1 types with a recursive definition (such as can be found
  130      in PKCS7) could eventually exceed the stack given malicious input with
  131      excessive recursion. This could result in a Denial Of Service attack. There
  132      are no such structures used within SSL/TLS that come from untrusted sources
  133      so this is considered safe.
  134 
  135      This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
  136      project.
  137      (CVE-2018-0739)
  138      [Matt Caswell]
  139 
  140  Changes between 1.0.2m and 1.0.2n [7 Dec 2017]
  141 
  142   *) Read/write after SSL object in error state
  143 
  144      OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state"
  145      mechanism. The intent was that if a fatal error occurred during a handshake
  146      then OpenSSL would move into the error state and would immediately fail if
  147      you attempted to continue the handshake. This works as designed for the
  148      explicit handshake functions (SSL_do_handshake(), SSL_accept() and
  149      SSL_connect()), however due to a bug it does not work correctly if
  150      SSL_read() or SSL_write() is called directly. In that scenario, if the
  151      handshake fails then a fatal error will be returned in the initial function
  152      call. If SSL_read()/SSL_write() is subsequently called by the application
  153      for the same SSL object then it will succeed and the data is passed without
  154      being decrypted/encrypted directly from the SSL/TLS record layer.
  155 
  156      In order to exploit this issue an application bug would have to be present
  157      that resulted in a call to SSL_read()/SSL_write() being issued after having
  158      already received a fatal error.
  159 
  160      This issue was reported to OpenSSL by David Benjamin (Google).
  161      (CVE-2017-3737)
  162      [Matt Caswell]
  163 
  164   *) rsaz_1024_mul_avx2 overflow bug on x86_64
  165 
  166      There is an overflow bug in the AVX2 Montgomery multiplication procedure
  167      used in exponentiation with 1024-bit moduli. No EC algorithms are affected.
  168      Analysis suggests that attacks against RSA and DSA as a result of this
  169      defect would be very difficult to perform and are not believed likely.
  170      Attacks against DH1024 are considered just feasible, because most of the
  171      work necessary to deduce information about a private key may be performed
  172      offline. The amount of resources required for such an attack would be
  173      significant. However, for an attack on TLS to be meaningful, the server
  174      would have to share the DH1024 private key among multiple clients, which is
  175      no longer an option since CVE-2016-0701.
  176 
  177      This only affects processors that support the AVX2 but not ADX extensions
  178      like Intel Haswell (4th generation).
  179 
  180      This issue was reported to OpenSSL by David Benjamin (Google). The issue
  181      was originally found via the OSS-Fuzz project.
  182      (CVE-2017-3738)
  183      [Andy Polyakov]
  184 
  185  Changes between 1.0.2l and 1.0.2m [2 Nov 2017]
  186 
  187   *) bn_sqrx8x_internal carry bug on x86_64
  188 
  189      There is a carry propagating bug in the x86_64 Montgomery squaring
  190      procedure. No EC algorithms are affected. Analysis suggests that attacks
  191      against RSA and DSA as a result of this defect would be very difficult to
  192      perform and are not believed likely. Attacks against DH are considered just
  193      feasible (although very difficult) because most of the work necessary to
  194      deduce information about a private key may be performed offline. The amount
  195      of resources required for such an attack would be very significant and
  196      likely only accessible to a limited number of attackers. An attacker would
  197      additionally need online access to an unpatched system using the target
  198      private key in a scenario with persistent DH parameters and a private
  199      key that is shared between multiple clients.
  200 
  201      This only affects processors that support the BMI1, BMI2 and ADX extensions
  202      like Intel Broadwell (5th generation) and later or AMD Ryzen.
  203 
  204      This issue was reported to OpenSSL by the OSS-Fuzz project.
  205      (CVE-2017-3736)
  206      [Andy Polyakov]
  207 
  208   *) Malformed X.509 IPAddressFamily could cause OOB read
  209 
  210      If an X.509 certificate has a malformed IPAddressFamily extension,
  211      OpenSSL could do a one-byte buffer overread. The most likely result
  212      would be an erroneous display of the certificate in text format.
  213 
  214      This issue was reported to OpenSSL by the OSS-Fuzz project.
  215      (CVE-2017-3735)
  216      [Rich Salz]
  217 
  218  Changes between 1.0.2k and 1.0.2l [25 May 2017]
  219 
  220   *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
  221      platform rather than 'mingw'.
  222      [Richard Levitte]
  223 
  224  Changes between 1.0.2j and 1.0.2k [26 Jan 2017]
  225 
  226   *) Truncated packet could crash via OOB read
  227 
  228      If one side of an SSL/TLS path is running on a 32-bit host and a specific
  229      cipher is being used, then a truncated packet can cause that host to
  230      perform an out-of-bounds read, usually resulting in a crash.
  231 
  232      This issue was reported to OpenSSL by Robert Święcki of Google.
  233      (CVE-2017-3731)
  234      [Andy Polyakov]
  235 
  236   *) BN_mod_exp may produce incorrect results on x86_64
  237 
  238      There is a carry propagating bug in the x86_64 Montgomery squaring
  239      procedure. No EC algorithms are affected. Analysis suggests that attacks
  240      against RSA and DSA as a result of this defect would be very difficult to
  241      perform and are not believed likely. Attacks against DH are considered just
  242      feasible (although very difficult) because most of the work necessary to
  243      deduce information about a private key may be performed offline. The amount
  244      of resources required for such an attack would be very significant and
  245      likely only accessible to a limited number of attackers. An attacker would
  246      additionally need online access to an unpatched system using the target
  247      private key in a scenario with persistent DH parameters and a private
  248      key that is shared between multiple clients. For example this can occur by
  249      default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
  250      similar to CVE-2015-3193 but must be treated as a separate problem.
  251 
  252      This issue was reported to OpenSSL by the OSS-Fuzz project.
  253      (CVE-2017-3732)
  254      [Andy Polyakov]
  255 
  256   *) Montgomery multiplication may produce incorrect results
  257 
  258      There is a carry propagating bug in the Broadwell-specific Montgomery
  259      multiplication procedure that handles input lengths divisible by, but
  260      longer than 256 bits. Analysis suggests that attacks against RSA, DSA
  261      and DH private keys are impossible. This is because the subroutine in
  262      question is not used in operations with the private key itself and an input
  263      of the attacker's direct choice. Otherwise the bug can manifest itself as
  264      transient authentication and key negotiation failures or reproducible
  265      erroneous outcome of public-key operations with specially crafted input.
  266      Among EC algorithms only Brainpool P-512 curves are affected and one
  267      presumably can attack ECDH key negotiation. Impact was not analyzed in
  268      detail, because pre-requisites for attack are considered unlikely. Namely
  269      multiple clients have to choose the curve in question and the server has to
  270      share the private key among them, neither of which is default behaviour.
  271      Even then only clients that chose the curve will be affected.
  272 
  273      This issue was publicly reported as transient failures and was not
  274      initially recognized as a security issue. Thanks to Richard Morgan for
  275      providing reproducible case.
  276      (CVE-2016-7055)
  277      [Andy Polyakov]
  278 
  279   *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
  280      or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
  281      prevent issues where no progress is being made and the peer continually
  282      sends unrecognised record types, using up resources processing them.
  283      [Matt Caswell]
  284 
  285  Changes between 1.0.2i and 1.0.2j [26 Sep 2016]
  286 
  287   *) Missing CRL sanity check
  288 
  289      A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
  290      but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
  291      CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
  292 
  293      This issue only affects the OpenSSL 1.0.2i
  294      (CVE-2016-7052)
  295      [Matt Caswell]
  296 
  297  Changes between 1.0.2h and 1.0.2i [22 Sep 2016]
  298 
  299   *) OCSP Status Request extension unbounded memory growth
  300 
  301      A malicious client can send an excessively large OCSP Status Request
  302      extension. If that client continually requests renegotiation, sending a
  303      large OCSP Status Request extension each time, then there will be unbounded
  304      memory growth on the server. This will eventually lead to a Denial Of
  305      Service attack through memory exhaustion. Servers with a default
  306      configuration are vulnerable even if they do not support OCSP. Builds using
  307      the "no-ocsp" build time option are not affected.
  308 
  309      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  310      (CVE-2016-6304)
  311      [Matt Caswell]
  312 
  313   *) In order to mitigate the SWEET32 attack, the DES ciphers were moved from
  314      HIGH to MEDIUM.
  315 
  316      This issue was reported to OpenSSL Karthikeyan Bhargavan and Gaetan
  317      Leurent (INRIA)
  318      (CVE-2016-2183)
  319      [Rich Salz]
  320 
  321   *) OOB write in MDC2_Update()
  322 
  323      An overflow can occur in MDC2_Update() either if called directly or
  324      through the EVP_DigestUpdate() function using MDC2. If an attacker
  325      is able to supply very large amounts of input data after a previous
  326      call to EVP_EncryptUpdate() with a partial block then a length check
  327      can overflow resulting in a heap corruption.
  328 
  329      The amount of data needed is comparable to SIZE_MAX which is impractical
  330      on most platforms.
  331 
  332      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  333      (CVE-2016-6303)
  334      [Stephen Henson]
  335 
  336   *) Malformed SHA512 ticket DoS
  337 
  338      If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
  339      DoS attack where a malformed ticket will result in an OOB read which will
  340      ultimately crash.
  341 
  342      The use of SHA512 in TLS session tickets is comparatively rare as it requires
  343      a custom server callback and ticket lookup mechanism.
  344 
  345      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  346      (CVE-2016-6302)
  347      [Stephen Henson]
  348 
  349   *) OOB write in BN_bn2dec()
  350 
  351      The function BN_bn2dec() does not check the return value of BN_div_word().
  352      This can cause an OOB write if an application uses this function with an
  353      overly large BIGNUM. This could be a problem if an overly large certificate
  354      or CRL is printed out from an untrusted source. TLS is not affected because
  355      record limits will reject an oversized certificate before it is parsed.
  356 
  357      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  358      (CVE-2016-2182)
  359      [Stephen Henson]
  360 
  361   *) OOB read in TS_OBJ_print_bio()
  362 
  363      The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
  364      the total length the OID text representation would use and not the amount
  365      of data written. This will result in OOB reads when large OIDs are
  366      presented.
  367 
  368      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  369      (CVE-2016-2180)
  370      [Stephen Henson]
  371 
  372   *) Pointer arithmetic undefined behaviour
  373 
  374      Avoid some undefined pointer arithmetic
  375 
  376      A common idiom in the codebase is to check limits in the following manner:
  377      "p + len > limit"
  378 
  379      Where "p" points to some malloc'd data of SIZE bytes and
  380      limit == p + SIZE
  381 
  382      "len" here could be from some externally supplied data (e.g. from a TLS
  383      message).
  384 
  385      The rules of C pointer arithmetic are such that "p + len" is only well
  386      defined where len <= SIZE. Therefore the above idiom is actually
  387      undefined behaviour.
  388 
  389      For example this could cause problems if some malloc implementation
  390      provides an address for "p" such that "p + len" actually overflows for
  391      values of len that are too big and therefore p + len < limit.
  392 
  393      This issue was reported to OpenSSL by Guido Vranken
  394      (CVE-2016-2177)
  395      [Matt Caswell]
  396 
  397   *) Constant time flag not preserved in DSA signing
  398 
  399      Operations in the DSA signing algorithm should run in constant time in
  400      order to avoid side channel attacks. A flaw in the OpenSSL DSA
  401      implementation means that a non-constant time codepath is followed for
  402      certain operations. This has been demonstrated through a cache-timing
  403      attack to be sufficient for an attacker to recover the private DSA key.
  404 
  405      This issue was reported by César Pereida (Aalto University), Billy Brumley
  406      (Tampere University of Technology), and Yuval Yarom (The University of
  407      Adelaide and NICTA).
  408      (CVE-2016-2178)
  409      [César Pereida]
  410 
  411   *) DTLS buffered message DoS
  412 
  413      In a DTLS connection where handshake messages are delivered out-of-order
  414      those messages that OpenSSL is not yet ready to process will be buffered
  415      for later use. Under certain circumstances, a flaw in the logic means that
  416      those messages do not get removed from the buffer even though the handshake
  417      has been completed. An attacker could force up to approx. 15 messages to
  418      remain in the buffer when they are no longer required. These messages will
  419      be cleared when the DTLS connection is closed. The default maximum size for
  420      a message is 100k. Therefore the attacker could force an additional 1500k
  421      to be consumed per connection. By opening many simulataneous connections an
  422      attacker could cause a DoS attack through memory exhaustion.
  423 
  424      This issue was reported to OpenSSL by Quan Luo.
  425      (CVE-2016-2179)
  426      [Matt Caswell]
  427 
  428   *) DTLS replay protection DoS
  429 
  430      A flaw in the DTLS replay attack protection mechanism means that records
  431      that arrive for future epochs update the replay protection "window" before
  432      the MAC for the record has been validated. This could be exploited by an
  433      attacker by sending a record for the next epoch (which does not have to
  434      decrypt or have a valid MAC), with a very large sequence number. This means
  435      that all subsequent legitimate packets are dropped causing a denial of
  436      service for a specific DTLS connection.
  437 
  438      This issue was reported to OpenSSL by the OCAP audit team.
  439      (CVE-2016-2181)
  440      [Matt Caswell]
  441 
  442   *) Certificate message OOB reads
  443 
  444      In OpenSSL 1.0.2 and earlier some missing message length checks can result
  445      in OOB reads of up to 2 bytes beyond an allocated buffer. There is a
  446      theoretical DoS risk but this has not been observed in practice on common
  447      platforms.
  448 
  449      The messages affected are client certificate, client certificate request
  450      and server certificate. As a result the attack can only be performed
  451      against a client or a server which enables client authentication.
  452 
  453      This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
  454      (CVE-2016-6306)
  455      [Stephen Henson]
  456 
  457  Changes between 1.0.2g and 1.0.2h [3 May 2016]
  458 
  459   *) Prevent padding oracle in AES-NI CBC MAC check
  460 
  461      A MITM attacker can use a padding oracle attack to decrypt traffic
  462      when the connection uses an AES CBC cipher and the server support
  463      AES-NI.
  464 
  465      This issue was introduced as part of the fix for Lucky 13 padding
  466      attack (CVE-2013-0169). The padding check was rewritten to be in
  467      constant time by making sure that always the same bytes are read and
  468      compared against either the MAC or padding bytes. But it no longer
  469      checked that there was enough data to have both the MAC and padding
  470      bytes.
  471 
  472      This issue was reported by Juraj Somorovsky using TLS-Attacker.
  473      (CVE-2016-2107)
  474      [Kurt Roeckx]
  475 
  476   *) Fix EVP_EncodeUpdate overflow
  477 
  478      An overflow can occur in the EVP_EncodeUpdate() function which is used for
  479      Base64 encoding of binary data. If an attacker is able to supply very large
  480      amounts of input data then a length check can overflow resulting in a heap
  481      corruption.
  482 
  483      Internally to OpenSSL the EVP_EncodeUpdate() function is primarly used by
  484      the PEM_write_bio* family of functions. These are mainly used within the
  485      OpenSSL command line applications, so any application which processes data
  486      from an untrusted source and outputs it as a PEM file should be considered
  487      vulnerable to this issue. User applications that call these APIs directly
  488      with large amounts of untrusted data may also be vulnerable.
  489 
  490      This issue was reported by Guido Vranken.
  491      (CVE-2016-2105)
  492      [Matt Caswell]
  493 
  494   *) Fix EVP_EncryptUpdate overflow
  495 
  496      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
  497      is able to supply very large amounts of input data after a previous call to
  498      EVP_EncryptUpdate() with a partial block then a length check can overflow
  499      resulting in a heap corruption. Following an analysis of all OpenSSL
  500      internal usage of the EVP_EncryptUpdate() function all usage is one of two
  501      forms. The first form is where the EVP_EncryptUpdate() call is known to be
  502      the first called function after an EVP_EncryptInit(), and therefore that
  503      specific call must be safe. The second form is where the length passed to
  504      EVP_EncryptUpdate() can be seen from the code to be some small value and
  505      therefore there is no possibility of an overflow. Since all instances are
  506      one of these two forms, it is believed that there can be no overflows in
  507      internal code due to this problem. It should be noted that
  508      EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
  509      Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
  510      of these calls have also been analysed too and it is believed there are no
  511      instances in internal usage where an overflow could occur.
  512 
  513      This issue was reported by Guido Vranken.
  514      (CVE-2016-2106)
  515      [Matt Caswell]
  516 
  517   *) Prevent ASN.1 BIO excessive memory allocation
  518 
  519      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
  520      a short invalid encoding can casuse allocation of large amounts of memory
  521      potentially consuming excessive resources or exhausting memory.
  522 
  523      Any application parsing untrusted data through d2i BIO functions is
  524      affected. The memory based functions such as d2i_X509() are *not* affected.
  525      Since the memory based functions are used by the TLS library, TLS
  526      applications are not affected.
  527 
  528      This issue was reported by Brian Carpenter.
  529      (CVE-2016-2109)
  530      [Stephen Henson]
  531 
  532   *) EBCDIC overread
  533 
  534      ASN1 Strings that are over 1024 bytes can cause an overread in applications
  535      using the X509_NAME_oneline() function on EBCDIC systems. This could result
  536      in arbitrary stack data being returned in the buffer.
  537 
  538      This issue was reported by Guido Vranken.
  539      (CVE-2016-2176)
  540      [Matt Caswell]
  541 
  542   *) Modify behavior of ALPN to invoke callback after SNI/servername
  543      callback, such that updates to the SSL_CTX affect ALPN.
  544      [Todd Short]
  545 
  546   *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
  547      default.
  548      [Kurt Roeckx]
  549 
  550   *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
  551      methods are enabled and ssl2 is disabled the methods return NULL.
  552      [Kurt Roeckx]
  553 
  554  Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
  555 
  556   * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
  557     Builds that are not configured with "enable-weak-ssl-ciphers" will not
  558     provide any "EXPORT" or "LOW" strength ciphers.
  559     [Viktor Dukhovni]
  560 
  561   * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
  562     is by default disabled at build-time.  Builds that are not configured with
  563     "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
  564     users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
  565     will need to explicitly call either of:
  566 
  567         SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
  568     or
  569         SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
  570 
  571     as appropriate.  Even if either of those is used, or the application
  572     explicitly uses the version-specific SSLv2_method() or its client and
  573     server variants, SSLv2 ciphers vulnerable to exhaustive search key
  574     recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
  575     ciphers, and SSLv2 56-bit DES are no longer available.
  576     (CVE-2016-0800)
  577     [Viktor Dukhovni]
  578 
  579   *) Fix a double-free in DSA code
  580 
  581      A double free bug was discovered when OpenSSL parses malformed DSA private
  582      keys and could lead to a DoS attack or memory corruption for applications
  583      that receive DSA private keys from untrusted sources.  This scenario is
  584      considered rare.
  585 
  586      This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
  587      libFuzzer.
  588      (CVE-2016-0705)
  589      [Stephen Henson]
  590 
  591   *) Disable SRP fake user seed to address a server memory leak.
  592 
  593      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
  594 
  595      SRP_VBASE_get_by_user had inconsistent memory management behaviour.
  596      In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
  597      was changed to ignore the "fake user" SRP seed, even if the seed
  598      is configured.
  599 
  600      Users should use SRP_VBASE_get1_by_user instead. Note that in
  601      SRP_VBASE_get1_by_user, caller must free the returned value. Note
  602      also that even though configuring the SRP seed attempts to hide
  603      invalid usernames by continuing the handshake with fake
  604      credentials, this behaviour is not constant time and no strong
  605      guarantees are made that the handshake is indistinguishable from
  606      that of a valid user.
  607      (CVE-2016-0798)
  608      [Emilia Käsper]
  609 
  610   *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
  611 
  612      In the BN_hex2bn function the number of hex digits is calculated using an
  613      int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
  614      large values of |i| this can result in |bn_expand| not allocating any
  615      memory because |i * 4| is negative. This can leave the internal BIGNUM data
  616      field as NULL leading to a subsequent NULL ptr deref. For very large values
  617      of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
  618      In this case memory is allocated to the internal BIGNUM data field, but it
  619      is insufficiently sized leading to heap corruption. A similar issue exists
  620      in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
  621      is ever called by user applications with very large untrusted hex/dec data.
  622      This is anticipated to be a rare occurrence.
  623 
  624      All OpenSSL internal usage of these functions use data that is not expected
  625      to be untrusted, e.g. config file data or application command line
  626      arguments. If user developed applications generate config file data based
  627      on untrusted data then it is possible that this could also lead to security
  628      consequences. This is also anticipated to be rare.
  629 
  630      This issue was reported to OpenSSL by Guido Vranken.
  631      (CVE-2016-0797)
  632      [Matt Caswell]
  633 
  634   *) Fix memory issues in BIO_*printf functions
  635 
  636      The internal |fmtstr| function used in processing a "%s" format string in
  637      the BIO_*printf functions could overflow while calculating the length of a
  638      string and cause an OOB read when printing very long strings.
  639 
  640      Additionally the internal |doapr_outch| function can attempt to write to an
  641      OOB memory location (at an offset from the NULL pointer) in the event of a
  642      memory allocation failure. In 1.0.2 and below this could be caused where
  643      the size of a buffer to be allocated is greater than INT_MAX. E.g. this
  644      could be in processing a very long "%s" format string. Memory leaks can
  645      also occur.
  646 
  647      The first issue may mask the second issue dependent on compiler behaviour.
  648      These problems could enable attacks where large amounts of untrusted data
  649      is passed to the BIO_*printf functions. If applications use these functions
  650      in this way then they could be vulnerable. OpenSSL itself uses these
  651      functions when printing out human-readable dumps of ASN.1 data. Therefore
  652      applications that print this data could be vulnerable if the data is from
  653      untrusted sources. OpenSSL command line applications could also be
  654      vulnerable where they print out ASN.1 data, or if untrusted data is passed
  655      as command line arguments.
  656 
  657      Libssl is not considered directly vulnerable. Additionally certificates etc
  658      received via remote connections via libssl are also unlikely to be able to
  659      trigger these issues because of message size limits enforced within libssl.
  660 
  661      This issue was reported to OpenSSL Guido Vranken.
  662      (CVE-2016-0799)
  663      [Matt Caswell]
  664 
  665   *) Side channel attack on modular exponentiation
  666 
  667      A side-channel attack was found which makes use of cache-bank conflicts on
  668      the Intel Sandy-Bridge microarchitecture which could lead to the recovery
  669      of RSA keys.  The ability to exploit this issue is limited as it relies on
  670      an attacker who has control of code in a thread running on the same
  671      hyper-threaded core as the victim thread which is performing decryptions.
  672 
  673      This issue was reported to OpenSSL by Yuval Yarom, The University of
  674      Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
  675      Nadia Heninger, University of Pennsylvania with more information at
  676      http://cachebleed.info.
  677      (CVE-2016-0702)
  678      [Andy Polyakov]
  679 
  680   *) Change the req app to generate a 2048-bit RSA/DSA key by default,
  681      if no keysize is specified with default_bits. This fixes an
  682      omission in an earlier change that changed all RSA/DSA key generation
  683      apps to use 2048 bits by default.
  684      [Emilia Käsper]
  685 
  686  Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
  687 
  688   *) DH small subgroups
  689 
  690      Historically OpenSSL only ever generated DH parameters based on "safe"
  691      primes. More recently (in version 1.0.2) support was provided for
  692      generating X9.42 style parameter files such as those required for RFC 5114
  693      support. The primes used in such files may not be "safe". Where an
  694      application is using DH configured with parameters based on primes that are
  695      not "safe" then an attacker could use this fact to find a peer's private
  696      DH exponent. This attack requires that the attacker complete multiple
  697      handshakes in which the peer uses the same private DH exponent. For example
  698      this could be used to discover a TLS server's private DH exponent if it's
  699      reusing the private DH exponent or it's using a static DH ciphersuite.
  700 
  701      OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
  702      TLS. It is not on by default. If the option is not set then the server
  703      reuses the same private DH exponent for the life of the server process and
  704      would be vulnerable to this attack. It is believed that many popular
  705      applications do set this option and would therefore not be at risk.
  706 
  707      The fix for this issue adds an additional check where a "q" parameter is
  708      available (as is the case in X9.42 based parameters). This detects the
  709      only known attack, and is the only possible defense for static DH
  710      ciphersuites. This could have some performance impact.
  711 
  712      Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
  713      default and cannot be disabled. This could have some performance impact.
  714 
  715      This issue was reported to OpenSSL by Antonio Sanso (Adobe).
  716      (CVE-2016-0701)
  717      [Matt Caswell]
  718 
  719   *) SSLv2 doesn't block disabled ciphers
  720 
  721      A malicious client can negotiate SSLv2 ciphers that have been disabled on
  722      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
  723      been disabled, provided that the SSLv2 protocol was not also disabled via
  724      SSL_OP_NO_SSLv2.
  725 
  726      This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
  727      and Sebastian Schinzel.
  728      (CVE-2015-3197)
  729      [Viktor Dukhovni]
  730 
  731   *) Reject DH handshakes with parameters shorter than 1024 bits.
  732      [Kurt Roeckx]
  733 
  734  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
  735 
  736   *) BN_mod_exp may produce incorrect results on x86_64
  737 
  738      There is a carry propagating bug in the x86_64 Montgomery squaring
  739      procedure. No EC algorithms are affected. Analysis suggests that attacks
  740      against RSA and DSA as a result of this defect would be very difficult to
  741      perform and are not believed likely. Attacks against DH are considered just
  742      feasible (although very difficult) because most of the work necessary to
  743      deduce information about a private key may be performed offline. The amount
  744      of resources required for such an attack would be very significant and
  745      likely only accessible to a limited number of attackers. An attacker would
  746      additionally need online access to an unpatched system using the target
  747      private key in a scenario with persistent DH parameters and a private
  748      key that is shared between multiple clients. For example this can occur by
  749      default in OpenSSL DHE based SSL/TLS ciphersuites.
  750 
  751      This issue was reported to OpenSSL by Hanno Böck.
  752      (CVE-2015-3193)
  753      [Andy Polyakov]
  754 
  755   *) Certificate verify crash with missing PSS parameter
  756 
  757      The signature verification routines will crash with a NULL pointer
  758      dereference if presented with an ASN.1 signature using the RSA PSS
  759      algorithm and absent mask generation function parameter. Since these
  760      routines are used to verify certificate signature algorithms this can be
  761      used to crash any certificate verification operation and exploited in a
  762      DoS attack. Any application which performs certificate verification is
  763      vulnerable including OpenSSL clients and servers which enable client
  764      authentication.
  765 
  766      This issue was reported to OpenSSL by Loïc Jonas Etienne (Qnective AG).
  767      (CVE-2015-3194)
  768      [Stephen Henson]
  769 
  770   *) X509_ATTRIBUTE memory leak
  771 
  772      When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
  773      memory. This structure is used by the PKCS#7 and CMS routines so any
  774      application which reads PKCS#7 or CMS data from untrusted sources is
  775      affected. SSL/TLS is not affected.
  776 
  777      This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
  778      libFuzzer.
  779      (CVE-2015-3195)
  780      [Stephen Henson]
  781 
  782   *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
  783      This changes the decoding behaviour for some invalid messages,
  784      though the change is mostly in the more lenient direction, and
  785      legacy behaviour is preserved as much as possible.
  786      [Emilia Käsper]
  787 
  788   *) In DSA_generate_parameters_ex, if the provided seed is too short,
  789      use a random seed, as already documented.
  790      [Rich Salz and Ismo Puustinen <ismo.puustinen@intel.com>]
  791 
  792  Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
  793 
  794   *) Alternate chains certificate forgery
  795 
  796      During certificate verfification, OpenSSL will attempt to find an
  797      alternative certificate chain if the first attempt to build such a chain
  798      fails. An error in the implementation of this logic can mean that an
  799      attacker could cause certain checks on untrusted certificates to be
  800      bypassed, such as the CA flag, enabling them to use a valid leaf
  801      certificate to act as a CA and "issue" an invalid certificate.
  802 
  803      This issue was reported to OpenSSL by Adam Langley/David Benjamin
  804      (Google/BoringSSL).
  805      (CVE-2015-1793)
  806      [Matt Caswell]
  807 
  808   *) Race condition handling PSK identify hint
  809 
  810      If PSK identity hints are received by a multi-threaded client then
  811      the values are wrongly updated in the parent SSL_CTX structure. This can
  812      result in a race condition potentially leading to a double free of the
  813      identify hint data.
  814      (CVE-2015-3196)
  815      [Stephen Henson]
  816 
  817  Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
  818 
  819   *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
  820      incompatibility in the handling of HMAC. The previous ABI has now been
  821      restored.
  822 
  823  Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
  824 
  825   *) Malformed ECParameters causes infinite loop
  826 
  827      When processing an ECParameters structure OpenSSL enters an infinite loop
  828      if the curve specified is over a specially malformed binary polynomial
  829      field.
  830 
  831      This can be used to perform denial of service against any
  832      system which processes public keys, certificate requests or
  833      certificates.  This includes TLS clients and TLS servers with
  834      client authentication enabled.
  835 
  836      This issue was reported to OpenSSL by Joseph Barr-Pixton.
  837      (CVE-2015-1788)
  838      [Andy Polyakov]
  839 
  840   *) Exploitable out-of-bounds read in X509_cmp_time
  841 
  842      X509_cmp_time does not properly check the length of the ASN1_TIME
  843      string and can read a few bytes out of bounds. In addition,
  844      X509_cmp_time accepts an arbitrary number of fractional seconds in the
  845      time string.
  846 
  847      An attacker can use this to craft malformed certificates and CRLs of
  848      various sizes and potentially cause a segmentation fault, resulting in
  849      a DoS on applications that verify certificates or CRLs. TLS clients
  850      that verify CRLs are affected. TLS clients and servers with client
  851      authentication enabled may be affected if they use custom verification
  852      callbacks.
  853 
  854      This issue was reported to OpenSSL by Robert Swiecki (Google), and
  855      independently by Hanno Böck.
  856      (CVE-2015-1789)
  857      [Emilia Käsper]
  858 
  859   *) PKCS7 crash with missing EnvelopedContent
  860 
  861      The PKCS#7 parsing code does not handle missing inner EncryptedContent
  862      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
  863      with missing content and trigger a NULL pointer dereference on parsing.
  864 
  865      Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
  866      structures from untrusted sources are affected. OpenSSL clients and
  867      servers are not affected.
  868 
  869      This issue was reported to OpenSSL by Michal Zalewski (Google).
  870      (CVE-2015-1790)
  871      [Emilia Käsper]
  872 
  873   *) CMS verify infinite loop with unknown hash function
  874 
  875      When verifying a signedData message the CMS code can enter an infinite loop
  876      if presented with an unknown hash function OID. This can be used to perform
  877      denial of service against any system which verifies signedData messages using
  878      the CMS code.
  879      This issue was reported to OpenSSL by Johannes Bauer.
  880      (CVE-2015-1792)
  881      [Stephen Henson]
  882 
  883   *) Race condition handling NewSessionTicket
  884 
  885      If a NewSessionTicket is received by a multi-threaded client when attempting to
  886      reuse a previous ticket then a race condition can occur potentially leading to
  887      a double free of the ticket data.
  888      (CVE-2015-1791)
  889      [Matt Caswell]
  890 
  891   *) Removed support for the two export grade static DH ciphersuites
  892      EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
  893      were newly added (along with a number of other static DH ciphersuites) to
  894      1.0.2. However the two export ones have *never* worked since they were
  895      introduced. It seems strange in any case to be adding new export
  896      ciphersuites, and given "logjam" it also does not seem correct to fix them.
  897      [Matt Caswell]
  898 
  899   *) Only support 256-bit or stronger elliptic curves with the
  900      'ecdh_auto' setting (server) or by default (client). Of supported
  901      curves, prefer P-256 (both).
  902      [Emilia Kasper]
  903 
  904   *) Reject DH handshakes with parameters shorter than 768 bits.
  905      [Kurt Roeckx and Emilia Kasper]
  906 
  907  Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
  908 
  909   *) ClientHello sigalgs DoS fix
  910 
  911      If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
  912      invalid signature algorithms extension a NULL pointer dereference will
  913      occur. This can be exploited in a DoS attack against the server.
  914 
  915      This issue was was reported to OpenSSL by David Ramos of Stanford
  916      University.
  917      (CVE-2015-0291)
  918      [Stephen Henson and Matt Caswell]
  919 
  920   *) Multiblock corrupted pointer fix
  921 
  922      OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
  923      feature only applies on 64 bit x86 architecture platforms that support AES
  924      NI instructions. A defect in the implementation of "multiblock" can cause
  925      OpenSSL's internal write buffer to become incorrectly set to NULL when
  926      using non-blocking IO. Typically, when the user application is using a
  927      socket BIO for writing, this will only result in a failed connection.
  928      However if some other BIO is used then it is likely that a segmentation
  929      fault will be triggered, thus enabling a potential DoS attack.
  930 
  931      This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
  932      (CVE-2015-0290)
  933      [Matt Caswell]
  934 
  935   *) Segmentation fault in DTLSv1_listen fix
  936 
  937      The DTLSv1_listen function is intended to be stateless and processes the
  938      initial ClientHello from many peers. It is common for user code to loop
  939      over the call to DTLSv1_listen until a valid ClientHello is received with
  940      an associated cookie. A defect in the implementation of DTLSv1_listen means
  941      that state is preserved in the SSL object from one invocation to the next
  942      that can lead to a segmentation fault. Errors processing the initial
  943      ClientHello can trigger this scenario. An example of such an error could be
  944      that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
  945      server.
  946 
  947      This issue was reported to OpenSSL by Per Allansson.
  948      (CVE-2015-0207)
  949      [Matt Caswell]
  950 
  951   *) Segmentation fault in ASN1_TYPE_cmp fix
  952 
  953      The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
  954      made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
  955      certificate signature algorithm consistency this can be used to crash any
  956      certificate verification operation and exploited in a DoS attack. Any
  957      application which performs certificate verification is vulnerable including
  958      OpenSSL clients and servers which enable client authentication.
  959      (CVE-2015-0286)
  960      [Stephen Henson]
  961 
  962   *) Segmentation fault for invalid PSS parameters fix
  963 
  964      The signature verification routines will crash with a NULL pointer
  965      dereference if presented with an ASN.1 signature using the RSA PSS
  966      algorithm and invalid parameters. Since these routines are used to verify
  967      certificate signature algorithms this can be used to crash any
  968      certificate verification operation and exploited in a DoS attack. Any
  969      application which performs certificate verification is vulnerable including
  970      OpenSSL clients and servers which enable client authentication.
  971 
  972      This issue was was reported to OpenSSL by Brian Carpenter.
  973      (CVE-2015-0208)
  974      [Stephen Henson]
  975 
  976   *) ASN.1 structure reuse memory corruption fix
  977 
  978      Reusing a structure in ASN.1 parsing may allow an attacker to cause
  979      memory corruption via an invalid write. Such reuse is and has been
  980      strongly discouraged and is believed to be rare.
  981 
  982      Applications that parse structures containing CHOICE or ANY DEFINED BY
  983      components may be affected. Certificate parsing (d2i_X509 and related
  984      functions) are however not affected. OpenSSL clients and servers are
  985      not affected.
  986      (CVE-2015-0287)
  987      [Stephen Henson]
  988 
  989   *) PKCS7 NULL pointer dereferences fix
  990 
  991      The PKCS#7 parsing code does not handle missing outer ContentInfo
  992      correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
  993      missing content and trigger a NULL pointer dereference on parsing.
  994 
  995      Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
  996      otherwise parse PKCS#7 structures from untrusted sources are
  997      affected. OpenSSL clients and servers are not affected.
  998 
  999      This issue was reported to OpenSSL by Michal Zalewski (Google).
 1000      (CVE-2015-0289)
 1001      [Emilia Käsper]
 1002 
 1003   *) DoS via reachable assert in SSLv2 servers fix
 1004 
 1005      A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
 1006      servers that both support SSLv2 and enable export cipher suites by sending
 1007      a specially crafted SSLv2 CLIENT-MASTER-KEY message.
 1008 
 1009      This issue was discovered by Sean Burford (Google) and Emilia Käsper
 1010      (OpenSSL development team).
 1011      (CVE-2015-0293)
 1012      [Emilia Käsper]
 1013 
 1014   *) Empty CKE with client auth and DHE fix
 1015 
 1016      If client auth is used then a server can seg fault in the event of a DHE
 1017      ciphersuite being selected and a zero length ClientKeyExchange message
 1018      being sent by the client. This could be exploited in a DoS attack.
 1019      (CVE-2015-1787)
 1020      [Matt Caswell]
 1021 
 1022   *) Handshake with unseeded PRNG fix
 1023 
 1024      Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
 1025      with an unseeded PRNG. The conditions are:
 1026      - The client is on a platform where the PRNG has not been seeded
 1027      automatically, and the user has not seeded manually
 1028      - A protocol specific client method version has been used (i.e. not
 1029      SSL_client_methodv23)
 1030      - A ciphersuite is used that does not require additional random data from
 1031      the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
 1032 
 1033      If the handshake succeeds then the client random that has been used will
 1034      have been generated from a PRNG with insufficient entropy and therefore the
 1035      output may be predictable.
 1036 
 1037      For example using the following command with an unseeded openssl will
 1038      succeed on an unpatched platform:
 1039 
 1040      openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
 1041      (CVE-2015-0285)
 1042      [Matt Caswell]
 1043 
 1044   *) Use After Free following d2i_ECPrivatekey error fix
 1045 
 1046      A malformed EC private key file consumed via the d2i_ECPrivateKey function
 1047      could cause a use after free condition. This, in turn, could cause a double
 1048      free in several private key parsing functions (such as d2i_PrivateKey
 1049      or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
 1050      for applications that receive EC private keys from untrusted
 1051      sources. This scenario is considered rare.
 1052 
 1053      This issue was discovered by the BoringSSL project and fixed in their
 1054      commit 517073cd4b.
 1055      (CVE-2015-0209)
 1056      [Matt Caswell]
 1057 
 1058   *) X509_to_X509_REQ NULL pointer deref fix
 1059 
 1060      The function X509_to_X509_REQ will crash with a NULL pointer dereference if
 1061      the certificate key is invalid. This function is rarely used in practice.
 1062 
 1063      This issue was discovered by Brian Carpenter.
 1064      (CVE-2015-0288)
 1065      [Stephen Henson]
 1066 
 1067   *) Removed the export ciphers from the DEFAULT ciphers
 1068      [Kurt Roeckx]
 1069 
 1070  Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
 1071 
 1072   *) Change RSA and DH/DSA key generation apps to generate 2048-bit
 1073      keys by default.
 1074      [Kurt Roeckx]
 1075 
 1076   *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
 1077      ARMv5 through ARMv8, as opposite to "locking" it to single one.
 1078      So far those who have to target multiple plaforms would compromise
 1079      and argue that binary targeting say ARMv5 would still execute on
 1080      ARMv8. "Universal" build resolves this compromise by providing
 1081      near-optimal performance even on newer platforms.
 1082      [Andy Polyakov]
 1083 
 1084   *) Accelerated NIST P-256 elliptic curve implementation for x86_64
 1085      (other platforms pending).
 1086      [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
 1087 
 1088   *) Add support for the SignedCertificateTimestampList certificate and
 1089      OCSP response extensions from RFC6962.
 1090      [Rob Stradling]
 1091 
 1092   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
 1093      for corner cases. (Certain input points at infinity could lead to
 1094      bogus results, with non-infinity inputs mapped to infinity too.)
 1095      [Bodo Moeller]
 1096 
 1097   *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
 1098      This covers AES, SHA256/512 and GHASH. "Initial" means that most
 1099      common cases are optimized and there still is room for further
 1100      improvements. Vector Permutation AES for Altivec is also added.
 1101      [Andy Polyakov]
 1102 
 1103   *) Add support for little-endian ppc64 Linux target.
 1104      [Marcelo Cerri (IBM)]
 1105 
 1106   *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
 1107      SHA1, SHA256 and GHASH. "Initial" means that most common cases
 1108      are optimized and there still is room for further improvements.
 1109      Both 32- and 64-bit modes are supported.
 1110      [Andy Polyakov, Ard Biesheuvel (Linaro)]
 1111 
 1112   *) Improved ARMv7 NEON support.
 1113      [Andy Polyakov]
 1114 
 1115   *) Support for SPARC Architecture 2011 crypto extensions, first
 1116      implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
 1117      SHA256/512, MD5, GHASH and modular exponentiation.
 1118      [Andy Polyakov, David Miller]
 1119 
 1120   *) Accelerated modular exponentiation for Intel processors, a.k.a.
 1121      RSAZ.
 1122      [Shay Gueron & Vlad Krasnov (Intel Corp)]
 1123 
 1124   *) Support for new and upcoming Intel processors, including AVX2,
 1125      BMI and SHA ISA extensions. This includes additional "stitched"
 1126      implementations, AESNI-SHA256 and GCM, and multi-buffer support
 1127      for TLS encrypt.
 1128 
 1129      This work was sponsored by Intel Corp.
 1130      [Andy Polyakov]
 1131 
 1132   *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
 1133      supports both DTLS 1.2 and 1.0 and should use whatever version the peer
 1134      supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
 1135      [Steve Henson]
 1136 
 1137   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
 1138      this fixes a limiation in previous versions of OpenSSL.
 1139      [Steve Henson]
 1140 
 1141   *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
 1142      MGF1 digest and OAEP label.
 1143      [Steve Henson]
 1144 
 1145   *) Add EVP support for key wrapping algorithms, to avoid problems with
 1146      existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
 1147      the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
 1148      algorithms and include tests cases.
 1149      [Steve Henson]
 1150 
 1151   *) Add functions to allocate and set the fields of an ECDSA_METHOD
 1152      structure.
 1153      [Douglas E. Engert, Steve Henson]
 1154 
 1155   *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
 1156      difference in days and seconds between two tm or ASN1_TIME structures.
 1157      [Steve Henson]
 1158 
 1159   *) Add -rev test option to s_server to just reverse order of characters
 1160      received by client and send back to server. Also prints an abbreviated
 1161      summary of the connection parameters.
 1162      [Steve Henson]
 1163 
 1164   *) New option -brief for s_client and s_server to print out a brief summary
 1165      of connection parameters.
 1166      [Steve Henson]
 1167 
 1168   *) Add callbacks for arbitrary TLS extensions.
 1169      [Trevor Perrin <trevp@trevp.net> and Ben Laurie]
 1170 
 1171   *) New option -crl_download in several openssl utilities to download CRLs
 1172      from CRLDP extension in certificates.
 1173      [Steve Henson]
 1174 
 1175   *) New options -CRL and -CRLform for s_client and s_server for CRLs.
 1176      [Steve Henson]
 1177 
 1178   *) New function X509_CRL_diff to generate a delta CRL from the difference
 1179      of two full CRLs. Add support to "crl" utility.
 1180      [Steve Henson]
 1181 
 1182   *) New functions to set lookup_crls function and to retrieve
 1183      X509_STORE from X509_STORE_CTX.
 1184      [Steve Henson]
 1185 
 1186   *) Print out deprecated issuer and subject unique ID fields in
 1187      certificates.
 1188      [Steve Henson]
 1189 
 1190   *) Extend OCSP I/O functions so they can be used for simple general purpose
 1191      HTTP as well as OCSP. New wrapper function which can be used to download
 1192      CRLs using the OCSP API.
 1193      [Steve Henson]
 1194 
 1195   *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
 1196      [Steve Henson]
 1197 
 1198   *) SSL_CONF* functions. These provide a common framework for application
 1199      configuration using configuration files or command lines.
 1200      [Steve Henson]
 1201 
 1202   *) SSL/TLS tracing code. This parses out SSL/TLS records using the
 1203      message callback and prints the results. Needs compile time option
 1204      "enable-ssl-trace". New options to s_client and s_server to enable
 1205      tracing.
 1206      [Steve Henson]
 1207 
 1208   *) New ctrl and macro to retrieve supported points extensions.
 1209      Print out extension in s_server and s_client.
 1210      [Steve Henson]
 1211 
 1212   *) New functions to retrieve certificate signature and signature
 1213      OID NID.
 1214      [Steve Henson]
 1215 
 1216   *) Add functions to retrieve and manipulate the raw cipherlist sent by a
 1217      client to OpenSSL.
 1218      [Steve Henson]
 1219 
 1220   *) New Suite B modes for TLS code. These use and enforce the requirements
 1221      of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
 1222      only use Suite B curves. The Suite B modes can be set by using the
 1223      strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
 1224      [Steve Henson]
 1225 
 1226   *) New chain verification flags for Suite B levels of security. Check
 1227      algorithms are acceptable when flags are set in X509_verify_cert.
 1228      [Steve Henson]
 1229 
 1230   *) Make tls1_check_chain return a set of flags indicating checks passed
 1231      by a certificate chain. Add additional tests to handle client
 1232      certificates: checks for matching certificate type and issuer name
 1233      comparison.
 1234      [Steve Henson]
 1235 
 1236   *) If an attempt is made to use a signature algorithm not in the peer
 1237      preference list abort the handshake. If client has no suitable
 1238      signature algorithms in response to a certificate request do not
 1239      use the certificate.
 1240      [Steve Henson]
 1241 
 1242   *) If server EC tmp key is not in client preference list abort handshake.
 1243      [Steve Henson]
 1244 
 1245   *) Add support for certificate stores in CERT structure. This makes it
 1246      possible to have different stores per SSL structure or one store in
 1247      the parent SSL_CTX. Include distint stores for certificate chain
 1248      verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
 1249      to build and store a certificate chain in CERT structure: returing
 1250      an error if the chain cannot be built: this will allow applications
 1251      to test if a chain is correctly configured.
 1252 
 1253      Note: if the CERT based stores are not set then the parent SSL_CTX
 1254      store is used to retain compatibility with existing behaviour.
 1255 
 1256      [Steve Henson]
 1257 
 1258   *) New function ssl_set_client_disabled to set a ciphersuite disabled
 1259      mask based on the current session, check mask when sending client
 1260      hello and checking the requested ciphersuite.
 1261      [Steve Henson]
 1262 
 1263   *) New ctrls to retrieve and set certificate types in a certificate
 1264      request message. Print out received values in s_client. If certificate
 1265      types is not set with custom values set sensible values based on
 1266      supported signature algorithms.
 1267      [Steve Henson]
 1268 
 1269   *) Support for distinct client and server supported signature algorithms.
 1270      [Steve Henson]
 1271 
 1272   *) Add certificate callback. If set this is called whenever a certificate
 1273      is required by client or server. An application can decide which
 1274      certificate chain to present based on arbitrary criteria: for example
 1275      supported signature algorithms. Add very simple example to s_server.
 1276      This fixes many of the problems and restrictions of the existing client
 1277      certificate callback: for example you can now clear an existing
 1278      certificate and specify the whole chain.
 1279      [Steve Henson]
 1280 
 1281   *) Add new "valid_flags" field to CERT_PKEY structure which determines what
 1282      the certificate can be used for (if anything). Set valid_flags field 
 1283      in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
 1284      to have similar checks in it.
 1285 
 1286      Add new "cert_flags" field to CERT structure and include a "strict mode".
 1287      This enforces some TLS certificate requirements (such as only permitting
 1288      certificate signature algorithms contained in the supported algorithms
 1289      extension) which some implementations ignore: this option should be used
 1290      with caution as it could cause interoperability issues.
 1291      [Steve Henson]
 1292 
 1293   *) Update and tidy signature algorithm extension processing. Work out
 1294      shared signature algorithms based on preferences and peer algorithms
 1295      and print them out in s_client and s_server. Abort handshake if no
 1296      shared signature algorithms.
 1297      [Steve Henson]
 1298 
 1299   *) Add new functions to allow customised supported signature algorithms
 1300      for SSL and SSL_CTX structures. Add options to s_client and s_server
 1301      to support them.
 1302      [Steve Henson]
 1303 
 1304   *) New function SSL_certs_clear() to delete all references to certificates
 1305      from an SSL structure. Before this once a certificate had been added
 1306      it couldn't be removed.
 1307      [Steve Henson]
 1308 
 1309   *) Integrate hostname, email address and IP address checking with certificate
 1310      verification. New verify options supporting checking in opensl utility.
 1311      [Steve Henson]
 1312 
 1313   *) Fixes and wildcard matching support to hostname and email checking
 1314      functions. Add manual page.
 1315      [Florian Weimer (Red Hat Product Security Team)]
 1316 
 1317   *) New functions to check a hostname email or IP address against a
 1318      certificate. Add options x509 utility to print results of checks against
 1319      a certificate.
 1320      [Steve Henson]
 1321 
 1322   *) Fix OCSP checking.
 1323      [Rob Stradling <rob.stradling@comodo.com> and Ben Laurie]
 1324 
 1325   *) Initial experimental support for explicitly trusted non-root CAs. 
 1326      OpenSSL still tries to build a complete chain to a root but if an
 1327      intermediate CA has a trust setting included that is used. The first
 1328      setting is used: whether to trust (e.g., -addtrust option to the x509
 1329      utility) or reject.
 1330      [Steve Henson]
 1331 
 1332   *) Add -trusted_first option which attempts to find certificates in the
 1333      trusted store even if an untrusted chain is also supplied.
 1334      [Steve Henson]
 1335 
 1336   *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
 1337      platform support for Linux and Android.
 1338      [Andy Polyakov]
 1339 
 1340   *) Support for linux-x32, ILP32 environment in x86_64 framework.
 1341      [Andy Polyakov]
 1342 
 1343   *) Experimental multi-implementation support for FIPS capable OpenSSL.
 1344      When in FIPS mode the approved implementations are used as normal,
 1345      when not in FIPS mode the internal unapproved versions are used instead.
 1346      This means that the FIPS capable OpenSSL isn't forced to use the
 1347      (often lower perfomance) FIPS implementations outside FIPS mode.
 1348      [Steve Henson]
 1349 
 1350   *) Transparently support X9.42 DH parameters when calling
 1351      PEM_read_bio_DHparameters. This means existing applications can handle
 1352      the new parameter format automatically.
 1353      [Steve Henson]
 1354 
 1355   *) Initial experimental support for X9.42 DH parameter format: mainly
 1356      to support use of 'q' parameter for RFC5114 parameters.
 1357      [Steve Henson]
 1358 
 1359   *) Add DH parameters from RFC5114 including test data to dhtest.
 1360      [Steve Henson]
 1361 
 1362   *) Support for automatic EC temporary key parameter selection. If enabled
 1363      the most preferred EC parameters are automatically used instead of
 1364      hardcoded fixed parameters. Now a server just has to call:
 1365      SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
 1366      support ECDH and use the most appropriate parameters.
 1367      [Steve Henson]
 1368 
 1369   *) Enhance and tidy EC curve and point format TLS extension code. Use
 1370      static structures instead of allocation if default values are used.
 1371      New ctrls to set curves we wish to support and to retrieve shared curves.
 1372      Print out shared curves in s_server. New options to s_server and s_client
 1373      to set list of supported curves.
 1374      [Steve Henson]
 1375 
 1376   *) New ctrls to retrieve supported signature algorithms and 
 1377      supported curve values as an array of NIDs. Extend openssl utility
 1378      to print out received values.
 1379      [Steve Henson]
 1380 
 1381   *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
 1382      between NIDs and the more common NIST names such as "P-256". Enhance
 1383      ecparam utility and ECC method to recognise the NIST names for curves.
 1384      [Steve Henson]
 1385 
 1386   *) Enhance SSL/TLS certificate chain handling to support different
 1387      chains for each certificate instead of one chain in the parent SSL_CTX.
 1388      [Steve Henson]
 1389 
 1390   *) Support for fixed DH ciphersuite client authentication: where both
 1391      server and client use DH certificates with common parameters.
 1392      [Steve Henson]
 1393 
 1394   *) Support for fixed DH ciphersuites: those requiring DH server
 1395      certificates.
 1396      [Steve Henson]
 1397 
 1398   *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
 1399      the certificate.
 1400      Note: Related 1.0.2-beta specific macros X509_get_cert_info,
 1401      X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
 1402      X509_CINF_get_signature were reverted post internal team review.
 1403 
 1404  Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
 1405 
 1406   *) Build fixes for the Windows and OpenVMS platforms
 1407      [Matt Caswell and Richard Levitte]
 1408 
 1409  Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
 1410 
 1411   *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
 1412      message can cause a segmentation fault in OpenSSL due to a NULL pointer
 1413      dereference. This could lead to a Denial Of Service attack. Thanks to
 1414      Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
 1415      (CVE-2014-3571)
 1416      [Steve Henson]
 1417 
 1418   *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
 1419      dtls1_buffer_record function under certain conditions. In particular this
 1420      could occur if an attacker sent repeated DTLS records with the same
 1421      sequence number but for the next epoch. The memory leak could be exploited
 1422      by an attacker in a Denial of Service attack through memory exhaustion.
 1423      Thanks to Chris Mueller for reporting this issue.
 1424      (CVE-2015-0206)
 1425      [Matt Caswell]
 1426 
 1427   *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
 1428      built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
 1429      method would be set to NULL which could later result in a NULL pointer
 1430      dereference. Thanks to Frank Schmirler for reporting this issue.
 1431      (CVE-2014-3569)
 1432      [Kurt Roeckx]
 1433 
 1434   *) Abort handshake if server key exchange message is omitted for ephemeral
 1435      ECDH ciphersuites.
 1436 
 1437      Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
 1438      reporting this issue.
 1439      (CVE-2014-3572)
 1440      [Steve Henson]
 1441 
 1442   *) Remove non-export ephemeral RSA code on client and server. This code
 1443      violated the TLS standard by allowing the use of temporary RSA keys in
 1444      non-export ciphersuites and could be used by a server to effectively
 1445      downgrade the RSA key length used to a value smaller than the server
 1446      certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
 1447      INRIA or reporting this issue.
 1448      (CVE-2015-0204)
 1449      [Steve Henson]
 1450 
 1451   *) Fixed issue where DH client certificates are accepted without verification.
 1452      An OpenSSL server will accept a DH certificate for client authentication
 1453      without the certificate verify message. This effectively allows a client to
 1454      authenticate without the use of a private key. This only affects servers
 1455      which trust a client certificate authority which issues certificates
 1456      containing DH keys: these are extremely rare and hardly ever encountered.
 1457      Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
 1458      this issue.
 1459      (CVE-2015-0205)
 1460      [Steve Henson]
 1461 
 1462   *) Ensure that the session ID context of an SSL is updated when its
 1463      SSL_CTX is updated via SSL_set_SSL_CTX.
 1464 
 1465      The session ID context is typically set from the parent SSL_CTX,
 1466      and can vary with the CTX.
 1467      [Adam Langley]
 1468 
 1469   *) Fix various certificate fingerprint issues.
 1470 
 1471      By using non-DER or invalid encodings outside the signed portion of a
 1472      certificate the fingerprint can be changed without breaking the signature.
 1473      Although no details of the signed portion of the certificate can be changed
 1474      this can cause problems with some applications: e.g. those using the
 1475      certificate fingerprint for blacklists.
 1476 
 1477      1. Reject signatures with non zero unused bits.
 1478 
 1479      If the BIT STRING containing the signature has non zero unused bits reject
 1480      the signature. All current signature algorithms require zero unused bits.
 1481 
 1482      2. Check certificate algorithm consistency.
 1483 
 1484      Check the AlgorithmIdentifier inside TBS matches the one in the
 1485      certificate signature. NB: this will result in signature failure
 1486      errors for some broken certificates.
 1487 
 1488      Thanks to Konrad Kraszewski from Google for reporting this issue.
 1489 
 1490      3. Check DSA/ECDSA signatures use DER.
 1491 
 1492      Reencode DSA/ECDSA signatures and compare with the original received
 1493      signature. Return an error if there is a mismatch.
 1494 
 1495      This will reject various cases including garbage after signature
 1496      (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
 1497      program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
 1498      (negative or with leading zeroes).
 1499 
 1500      Further analysis was conducted and fixes were developed by Stephen Henson
 1501      of the OpenSSL core team.
 1502 
 1503      (CVE-2014-8275)
 1504      [Steve Henson]
 1505 
 1506    *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
 1507       results on some platforms, including x86_64. This bug occurs at random
 1508       with a very low probability, and is not known to be exploitable in any
 1509       way, though its exact impact is difficult to determine. Thanks to Pieter
 1510       Wuille (Blockstream) who reported this issue and also suggested an initial
 1511       fix. Further analysis was conducted by the OpenSSL development team and
 1512       Adam Langley of Google. The final fix was developed by Andy Polyakov of
 1513       the OpenSSL core team.
 1514       (CVE-2014-3570)
 1515       [Andy Polyakov]
 1516 
 1517    *) Do not resume sessions on the server if the negotiated protocol
 1518       version does not match the session's version. Resuming with a different
 1519       version, while not strictly forbidden by the RFC, is of questionable
 1520       sanity and breaks all known clients.
 1521       [David Benjamin, Emilia Käsper]
 1522 
 1523    *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
 1524       early CCS messages during renegotiation. (Note that because
 1525       renegotiation is encrypted, this early CCS was not exploitable.)
 1526       [Emilia Käsper]
 1527 
 1528    *) Tighten client-side session ticket handling during renegotiation:
 1529       ensure that the client only accepts a session ticket if the server sends
 1530       the extension anew in the ServerHello. Previously, a TLS client would
 1531       reuse the old extension state and thus accept a session ticket if one was
 1532       announced in the initial ServerHello.
 1533 
 1534       Similarly, ensure that the client requires a session ticket if one
 1535       was advertised in the ServerHello. Previously, a TLS client would
 1536       ignore a missing NewSessionTicket message.
 1537       [Emilia Käsper]
 1538 
 1539  Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
 1540 
 1541   *) SRTP Memory Leak.
 1542 
 1543      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
 1544      sends a carefully crafted handshake message, to cause OpenSSL to fail
 1545      to free up to 64k of memory causing a memory leak. This could be
 1546      exploited in a Denial Of Service attack. This issue affects OpenSSL
 1547      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
 1548      whether SRTP is used or configured. Implementations of OpenSSL that
 1549      have been compiled with OPENSSL_NO_SRTP defined are not affected.
 1550 
 1551      The fix was developed by the OpenSSL team.
 1552      (CVE-2014-3513)
 1553      [OpenSSL team]
 1554 
 1555   *) Session Ticket Memory Leak.
 1556 
 1557      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
 1558      integrity of that ticket is first verified. In the event of a session
 1559      ticket integrity check failing, OpenSSL will fail to free memory
 1560      causing a memory leak. By sending a large number of invalid session
 1561      tickets an attacker could exploit this issue in a Denial Of Service
 1562      attack.
 1563      (CVE-2014-3567)
 1564      [Steve Henson]
 1565 
 1566   *) Build option no-ssl3 is incomplete.
 1567 
 1568      When OpenSSL is configured with "no-ssl3" as a build option, servers
 1569      could accept and complete a SSL 3.0 handshake, and clients could be
 1570      configured to send them.
 1571      (CVE-2014-3568)
 1572      [Akamai and the OpenSSL team]
 1573 
 1574   *) Add support for TLS_FALLBACK_SCSV.
 1575      Client applications doing fallback retries should call
 1576      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
 1577      (CVE-2014-3566)
 1578      [Adam Langley, Bodo Moeller]
 1579 
 1580   *) Add additional DigestInfo checks.
 1581  
 1582      Reencode DigestInto in DER and check against the original when
 1583      verifying RSA signature: this will reject any improperly encoded
 1584      DigestInfo structures.
 1585 
 1586      Note: this is a precautionary measure and no attacks are currently known.
 1587 
 1588      [Steve Henson]
 1589 
 1590  Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
 1591 
 1592   *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
 1593      SRP code can be overrun an internal buffer. Add sanity check that
 1594      g, A, B < N to SRP code.
 1595 
 1596      Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
 1597      Group for discovering this issue.
 1598      (CVE-2014-3512)
 1599      [Steve Henson]
 1600 
 1601   *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
 1602      TLS 1.0 instead of higher protocol versions when the ClientHello message
 1603      is badly fragmented. This allows a man-in-the-middle attacker to force a
 1604      downgrade to TLS 1.0 even if both the server and the client support a
 1605      higher protocol version, by modifying the client's TLS records.
 1606 
 1607      Thanks to David Benjamin and Adam Langley (Google) for discovering and
 1608      researching this issue.
 1609      (CVE-2014-3511)
 1610      [David Benjamin]
 1611 
 1612   *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
 1613      to a denial of service attack. A malicious server can crash the client
 1614      with a null pointer dereference (read) by specifying an anonymous (EC)DH
 1615      ciphersuite and sending carefully crafted handshake messages.
 1616 
 1617      Thanks to Felix Gröbert (Google) for discovering and researching this
 1618      issue.
 1619      (CVE-2014-3510)
 1620      [Emilia Käsper]
 1621 
 1622   *) By sending carefully crafted DTLS packets an attacker could cause openssl
 1623      to leak memory. This can be exploited through a Denial of Service attack.
 1624      Thanks to Adam Langley for discovering and researching this issue.
 1625      (CVE-2014-3507)
 1626      [Adam Langley]
 1627 
 1628   *) An attacker can force openssl to consume large amounts of memory whilst
 1629      processing DTLS handshake messages. This can be exploited through a
 1630      Denial of Service attack.
 1631      Thanks to Adam Langley for discovering and researching this issue.
 1632      (CVE-2014-3506)
 1633      [Adam Langley]
 1634 
 1635   *) An attacker can force an error condition which causes openssl to crash
 1636      whilst processing DTLS packets due to memory being freed twice. This
 1637      can be exploited through a Denial of Service attack.
 1638      Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
 1639      this issue.
 1640      (CVE-2014-3505)
 1641      [Adam Langley]
 1642 
 1643   *) If a multithreaded client connects to a malicious server using a resumed
 1644      session and the server sends an ec point format extension it could write
 1645      up to 255 bytes to freed memory.
 1646 
 1647      Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
 1648      issue.
 1649      (CVE-2014-3509)
 1650      [Gabor Tyukasz]
 1651 
 1652   *) A malicious server can crash an OpenSSL client with a null pointer
 1653      dereference (read) by specifying an SRP ciphersuite even though it was not
 1654      properly negotiated with the client. This can be exploited through a
 1655      Denial of Service attack.
 1656 
 1657      Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for
 1658      discovering and researching this issue.
 1659      (CVE-2014-5139)
 1660      [Steve Henson]
 1661 
 1662   *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
 1663      X509_name_oneline, X509_name_print_ex et al. to leak some information
 1664      from the stack. Applications may be affected if they echo pretty printing
 1665      output to the attacker.
 1666 
 1667      Thanks to Ivan Fratric (Google) for discovering this issue.
 1668      (CVE-2014-3508)
 1669      [Emilia Käsper, and Steve Henson]
 1670 
 1671   *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
 1672      for corner cases. (Certain input points at infinity could lead to
 1673      bogus results, with non-infinity inputs mapped to infinity too.)
 1674      [Bodo Moeller]
 1675 
 1676  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
 1677 
 1678   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
 1679      handshake can force the use of weak keying material in OpenSSL
 1680      SSL/TLS clients and servers.
 1681 
 1682      Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
 1683      researching this issue. (CVE-2014-0224)
 1684      [KIKUCHI Masashi, Steve Henson]
 1685 
 1686   *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
 1687      OpenSSL DTLS client the code can be made to recurse eventually crashing
 1688      in a DoS attack.
 1689 
 1690      Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
 1691      (CVE-2014-0221)
 1692      [Imre Rad, Steve Henson]
 1693 
 1694   *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
 1695      be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
 1696      client or server. This is potentially exploitable to run arbitrary
 1697      code on a vulnerable client or server.
 1698 
 1699      Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195)
 1700      [Jüri Aedla, Steve Henson]
 1701 
 1702   *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
 1703      are subject to a denial of service attack.
 1704 
 1705      Thanks to Felix Gröbert and Ivan Fratric at Google for discovering
 1706      this issue. (CVE-2014-3470)
 1707      [Felix Gröbert, Ivan Fratric, Steve Henson]
 1708 
 1709   *) Harmonize version and its documentation. -f flag is used to display
 1710      compilation flags.
 1711      [mancha <mancha1@zoho.com>]
 1712 
 1713   *) Fix eckey_priv_encode so it immediately returns an error upon a failure
 1714      in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
 1715      [mancha <mancha1@zoho.com>]
 1716 
 1717   *) Fix some double frees. These are not thought to be exploitable.
 1718      [mancha <mancha1@zoho.com>]
 1719 
 1720  Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
 1721 
 1722   *) A missing bounds check in the handling of the TLS heartbeat extension
 1723      can be used to reveal up to 64k of memory to a connected client or
 1724      server.
 1725 
 1726      Thanks for Neel Mehta of Google Security for discovering this bug and to
 1727      Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
 1728      preparing the fix (CVE-2014-0160)
 1729      [Adam Langley, Bodo Moeller]
 1730 
 1731   *) Fix for the attack described in the paper "Recovering OpenSSL
 1732      ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
 1733      by Yuval Yarom and Naomi Benger. Details can be obtained from:
 1734      http://eprint.iacr.org/2014/140
 1735 
 1736      Thanks to Yuval Yarom and Naomi Benger for discovering this
 1737      flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
 1738      [Yuval Yarom and Naomi Benger]
 1739 
 1740   *) TLS pad extension: draft-agl-tls-padding-03
 1741 
 1742      Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
 1743      TLS client Hello record length value would otherwise be > 255 and
 1744      less that 512 pad with a dummy extension containing zeroes so it
 1745      is at least 512 bytes long.
 1746 
 1747      [Adam Langley, Steve Henson]
 1748 
 1749  Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
 1750 
 1751   *) Fix for TLS record tampering bug. A carefully crafted invalid 
 1752      handshake could crash OpenSSL with a NULL pointer exception.
 1753      Thanks to Anton Johansson for reporting this issues.
 1754      (CVE-2013-4353)
 1755 
 1756   *) Keep original DTLS digest and encryption contexts in retransmission
 1757      structures so we can use the previous session parameters if they need
 1758      to be resent. (CVE-2013-6450)
 1759      [Steve Henson]
 1760 
 1761   *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
 1762      avoids preferring ECDHE-ECDSA ciphers when the client appears to be
 1763      Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
 1764      several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
 1765      is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
 1766      10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
 1767      [Rob Stradling, Adam Langley]
 1768 
 1769  Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
 1770 
 1771   *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
 1772      supporting platforms or when small records were transferred.
 1773      [Andy Polyakov, Steve Henson]
 1774 
 1775  Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
 1776 
 1777   *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
 1778 
 1779      This addresses the flaw in CBC record processing discovered by 
 1780      Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
 1781      at: http://www.isg.rhul.ac.uk/tls/     
 1782 
 1783      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
 1784      Security Group at Royal Holloway, University of London
 1785      (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
 1786      Emilia Käsper for the initial patch.
 1787      (CVE-2013-0169)
 1788      [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
 1789 
 1790   *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
 1791      ciphersuites which can be exploited in a denial of service attack.
 1792      Thanks go to and to Adam Langley <agl@chromium.org> for discovering
 1793      and detecting this bug and to Wolfgang Ettlinger
 1794      <wolfgang.ettlinger@gmail.com> for independently discovering this issue.
 1795      (CVE-2012-2686)
 1796      [Adam Langley]
 1797 
 1798   *) Return an error when checking OCSP signatures when key is NULL.
 1799      This fixes a DoS attack. (CVE-2013-0166)
 1800      [Steve Henson]
 1801 
 1802   *) Make openssl verify return errors.
 1803      [Chris Palmer <palmer@google.com> and Ben Laurie]
 1804 
 1805   *) Call OCSP Stapling callback after ciphersuite has been chosen, so
 1806      the right response is stapled. Also change SSL_get_certificate()
 1807      so it returns the certificate actually sent.
 1808      See http://rt.openssl.org/Ticket/Display.html?id=2836.
 1809      [Rob Stradling <rob.stradling@comodo.com>]
 1810 
 1811   *) Fix possible deadlock when decoding public keys.
 1812      [Steve Henson]
 1813 
 1814   *) Don't use TLS 1.0 record version number in initial client hello
 1815      if renegotiating.
 1816      [Steve Henson]
 1817 
 1818  Changes between 1.0.1b and 1.0.1c [10 May 2012]
 1819 
 1820   *) Sanity check record length before skipping explicit IV in TLS
 1821      1.2, 1.1 and DTLS to fix DoS attack.
 1822 
 1823      Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
 1824      fuzzing as a service testing platform.
 1825      (CVE-2012-2333)
 1826      [Steve Henson]
 1827 
 1828   *) Initialise tkeylen properly when encrypting CMS messages.
 1829      Thanks to Solar Designer of Openwall for reporting this issue.
 1830      [Steve Henson]
 1831 
 1832   *) In FIPS mode don't try to use composite ciphers as they are not
 1833      approved.
 1834      [Steve Henson]
 1835 
 1836  Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
 1837 
 1838   *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
 1839      1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
 1840      mean any application compiled against OpenSSL 1.0.0 headers setting
 1841      SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
 1842      TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
 1843      0x10000000L Any application which was previously compiled against
 1844      OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
 1845      will need to be recompiled as a result. Letting be results in
 1846      inability to disable specifically TLS 1.1 and in client context,
 1847      in unlike event, limit maximum offered version to TLS 1.0 [see below].
 1848      [Steve Henson]
 1849 
 1850   *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
 1851      disable just protocol X, but all protocols above X *if* there are
 1852      protocols *below* X still enabled. In more practical terms it means
 1853      that if application wants to disable TLS1.0 in favor of TLS1.1 and
 1854      above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
 1855      SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
 1856      client side.
 1857      [Andy Polyakov]
 1858 
 1859  Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
 1860 
 1861   *) Check for potentially exploitable overflows in asn1_d2i_read_bio
 1862      BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
 1863      in CRYPTO_realloc_clean.
 1864 
 1865      Thanks to Tavis Ormandy, Google Security Team, for discovering this
 1866      issue and to Adam Langley <agl@chromium.org> for fixing it.
 1867      (CVE-2012-2110)
 1868      [Adam Langley (Google), Tavis Ormandy, Google Security Team]
 1869 
 1870   *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
 1871      [Adam Langley]
 1872 
 1873   *) Workarounds for some broken servers that "hang" if a client hello
 1874      record length exceeds 255 bytes.
 1875 
 1876      1. Do not use record version number > TLS 1.0 in initial client
 1877         hello: some (but not all) hanging servers will now work.
 1878      2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
 1879 	the number of ciphers sent in the client hello. This should be
 1880         set to an even number, such as 50, for example by passing:
 1881         -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
 1882         Most broken servers should now work.
 1883      3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
 1884 	TLS 1.2 client support entirely.
 1885      [Steve Henson]
 1886 
 1887   *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
 1888      [Andy Polyakov]
 1889 
 1890  Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
 1891 
 1892   *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
 1893      STRING form instead of a DigestInfo.
 1894      [Steve Henson]
 1895 
 1896   *) The format used for MDC2 RSA signatures is inconsistent between EVP
 1897      and the RSA_sign/RSA_verify functions. This was made more apparent when
 1898      OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
 1899      those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
 1900      the correct format in RSA_verify so both forms transparently work.
 1901      [Steve Henson]
 1902 
 1903   *) Some servers which support TLS 1.0 can choke if we initially indicate
 1904      support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
 1905      encrypted premaster secret. As a workaround use the maximum pemitted
 1906      client version in client hello, this should keep such servers happy
 1907      and still work with previous versions of OpenSSL.
 1908      [Steve Henson]
 1909 
 1910   *) Add support for TLS/DTLS heartbeats.
 1911      [Robin Seggelmann <seggelmann@fh-muenster.de>]
 1912 
 1913   *) Add support for SCTP.
 1914      [Robin Seggelmann <seggelmann@fh-muenster.de>]
 1915 
 1916   *) Improved PRNG seeding for VOS.
 1917      [Paul Green <Paul.Green@stratus.com>]
 1918 
 1919   *) Extensive assembler packs updates, most notably:
 1920 
 1921 	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
 1922 	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
 1923 	- x86_64:       bit-sliced AES implementation;
 1924 	- ARM:          NEON support, contemporary platforms optimizations;
 1925 	- s390x:        z196 support;
 1926 	- *:            GHASH and GF(2^m) multiplication implementations;
 1927 
 1928      [Andy Polyakov]
 1929 
 1930   *) Make TLS-SRP code conformant with RFC 5054 API cleanup
 1931      (removal of unnecessary code)
 1932      [Peter Sylvester <peter.sylvester@edelweb.fr>]
 1933 
 1934   *) Add TLS key material exporter from RFC 5705.
 1935      [Eric Rescorla]
 1936 
 1937   *) Add DTLS-SRTP negotiation from RFC 5764.
 1938      [Eric Rescorla]
 1939 
 1940   *) Add Next Protocol Negotiation,
 1941      http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
 1942      disabled with a no-npn flag to config or Configure. Code donated
 1943      by Google.
 1944      [Adam Langley <agl@google.com> and Ben Laurie]
 1945 
 1946   *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
 1947      NIST-P256, NIST-P521, with constant-time single point multiplication on
 1948      typical inputs. Compiler support for the nonstandard type __uint128_t is
 1949      required to use this (present in gcc 4.4 and later, for 64-bit builds).
 1950      Code made available under Apache License version 2.0.
 1951 
 1952      Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
 1953      line to include this in your build of OpenSSL, and run "make depend" (or
 1954      "make update"). This enables the following EC_METHODs:
 1955 
 1956          EC_GFp_nistp224_method()
 1957          EC_GFp_nistp256_method()
 1958          EC_GFp_nistp521_method()
 1959 
 1960      EC_GROUP_new_by_curve_name() will automatically use these (while
 1961      EC_GROUP_new_curve_GFp() currently prefers the more flexible
 1962      implementations).
 1963      [Emilia Käsper, Adam Langley, Bodo Moeller (Google)]
 1964 
 1965   *) Use type ossl_ssize_t instad of ssize_t which isn't available on
 1966      all platforms. Move ssize_t definition from e_os.h to the public
 1967      header file e_os2.h as it now appears in public header file cms.h
 1968      [Steve Henson]
 1969 
 1970   *) New -sigopt option to the ca, req and x509 utilities. Additional
 1971      signature parameters can be passed using this option and in
 1972      particular PSS. 
 1973      [Steve Henson]
 1974 
 1975   *) Add RSA PSS signing function. This will generate and set the
 1976      appropriate AlgorithmIdentifiers for PSS based on those in the
 1977      corresponding EVP_MD_CTX structure. No application support yet.
 1978      [Steve Henson]
 1979 
 1980   *) Support for companion algorithm specific ASN1 signing routines.
 1981      New function ASN1_item_sign_ctx() signs a pre-initialised
 1982      EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
 1983      the appropriate parameters.
 1984      [Steve Henson]
 1985 
 1986   *) Add new algorithm specific ASN1 verification initialisation function
 1987      to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
 1988      handling will be the same no matter what EVP_PKEY_METHOD is used.
 1989      Add a PSS handler to support verification of PSS signatures: checked
 1990      against a number of sample certificates.
 1991      [Steve Henson]
 1992 
 1993   *) Add signature printing for PSS. Add PSS OIDs.
 1994      [Steve Henson, Martin Kaiser <lists@kaiser.cx>]
 1995 
 1996   *) Add algorithm specific signature printing. An individual ASN1 method
 1997      can now print out signatures instead of the standard hex dump. 
 1998 
 1999      More complex signatures (e.g. PSS) can print out more meaningful
 2000      information. Include DSA version that prints out the signature
 2001      parameters r, s.
 2002      [Steve Henson]
 2003 
 2004   *) Password based recipient info support for CMS library: implementing
 2005      RFC3211.
 2006      [Steve Henson]
 2007 
 2008   *) Split password based encryption into PBES2 and PBKDF2 functions. This
 2009      neatly separates the code into cipher and PBE sections and is required
 2010      for some algorithms that split PBES2 into separate pieces (such as
 2011      password based CMS).
 2012      [Steve Henson]
 2013 
 2014   *) Session-handling fixes:
 2015      - Fix handling of connections that are resuming with a session ID,
 2016        but also support Session Tickets.
 2017      - Fix a bug that suppressed issuing of a new ticket if the client
 2018        presented a ticket with an expired session.
 2019      - Try to set the ticket lifetime hint to something reasonable.
 2020      - Make tickets shorter by excluding irrelevant information.
 2021      - On the client side, don't ignore renewed tickets.
 2022      [Adam Langley, Bodo Moeller (Google)]
 2023 
 2024   *) Fix PSK session representation.
 2025      [Bodo Moeller]
 2026 
 2027   *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
 2028 
 2029      This work was sponsored by Intel.
 2030      [Andy Polyakov]
 2031 
 2032   *) Add GCM support to TLS library. Some custom code is needed to split
 2033      the IV between the fixed (from PRF) and explicit (from TLS record)
 2034      portions. This adds all GCM ciphersuites supported by RFC5288 and 
 2035      RFC5289. Generalise some AES* cipherstrings to inlclude GCM and
 2036      add a special AESGCM string for GCM only.
 2037      [Steve Henson]
 2038 
 2039   *) Expand range of ctrls for AES GCM. Permit setting invocation
 2040      field on decrypt and retrieval of invocation field only on encrypt.
 2041      [Steve Henson]
 2042 
 2043   *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
 2044      As required by RFC5289 these ciphersuites cannot be used if for
 2045      versions of TLS earlier than 1.2.
 2046      [Steve Henson]
 2047 
 2048   *) For FIPS capable OpenSSL interpret a NULL default public key method
 2049      as unset and return the appopriate default but do *not* set the default.
 2050      This means we can return the appopriate method in applications that
 2051      swicth between FIPS and non-FIPS modes.
 2052      [Steve Henson]
 2053 
 2054   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
 2055      ENGINE is used then we cannot handle that in the FIPS module so we
 2056      keep original code iff non-FIPS operations are allowed.
 2057      [Steve Henson]
 2058 
 2059   *) Add -attime option to openssl utilities.
 2060      [Peter Eckersley <pde@eff.org>, Ben Laurie and Steve Henson]
 2061 
 2062   *) Redirect DSA and DH operations to FIPS module in FIPS mode.
 2063      [Steve Henson]
 2064 
 2065   *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
 2066      FIPS EC methods unconditionally for now.
 2067      [Steve Henson]
 2068 
 2069   *) New build option no-ec2m to disable characteristic 2 code.
 2070      [Steve Henson]
 2071 
 2072   *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
 2073      all cases can be covered as some introduce binary incompatibilities.
 2074      [Steve Henson]
 2075 
 2076   *) Redirect RSA operations to FIPS module including keygen,
 2077      encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
 2078      [Steve Henson]
 2079 
 2080   *) Add similar low level API blocking to ciphers.
 2081      [Steve Henson]
 2082 
 2083   *) Low level digest APIs are not approved in FIPS mode: any attempt
 2084      to use these will cause a fatal error. Applications that *really* want
 2085      to use them can use the private_* version instead.
 2086      [Steve Henson]
 2087 
 2088   *) Redirect cipher operations to FIPS module for FIPS builds. 
 2089      [Steve Henson]
 2090 
 2091   *) Redirect digest operations to FIPS module for FIPS builds. 
 2092      [Steve Henson]
 2093 
 2094   *) Update build system to add "fips" flag which will link in fipscanister.o
 2095      for static and shared library builds embedding a signature if needed.
 2096      [Steve Henson]
 2097 
 2098   *) Output TLS supported curves in preference order instead of numerical
 2099      order. This is currently hardcoded for the highest order curves first.
 2100      This should be configurable so applications can judge speed vs strength.
 2101      [Steve Henson]
 2102 
 2103   *) Add TLS v1.2 server support for client authentication. 
 2104      [Steve Henson]
 2105 
 2106   *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
 2107      and enable MD5.
 2108      [Steve Henson]
 2109 
 2110   *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
 2111      FIPS modules versions.
 2112      [Steve Henson]
 2113 
 2114   *) Add TLS v1.2 client side support for client authentication. Keep cache
 2115      of handshake records longer as we don't know the hash algorithm to use
 2116      until after the certificate request message is received.
 2117      [Steve Henson]
 2118 
 2119   *) Initial TLS v1.2 client support. Add a default signature algorithms
 2120      extension including all the algorithms we support. Parse new signature
 2121      format in client key exchange. Relax some ECC signing restrictions for
 2122      TLS v1.2 as indicated in RFC5246.
 2123      [Steve Henson]
 2124 
 2125   *) Add server support for TLS v1.2 signature algorithms extension. Switch
 2126      to new signature format when needed using client digest preference.
 2127      All server ciphersuites should now work correctly in TLS v1.2. No client
 2128      support yet and no support for client certificates.
 2129      [Steve Henson]
 2130 
 2131   *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
 2132      to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
 2133      ciphersuites. At present only RSA key exchange ciphersuites work with
 2134      TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
 2135      SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
 2136      and version checking.
 2137      [Steve Henson]
 2138 
 2139   *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
 2140      with this defined it will not be affected by any changes to ssl internal
 2141      structures. Add several utility functions to allow openssl application
 2142      to work with OPENSSL_NO_SSL_INTERN defined.
 2143      [Steve Henson]
 2144 
 2145   *) A long standing patch to add support for SRP from EdelWeb (Peter
 2146      Sylvester and Christophe Renou) was integrated.
 2147      [Christophe Renou <christophe.renou@edelweb.fr>, Peter Sylvester
 2148      <peter.sylvester@edelweb.fr>, Tom Wu <tjw@cs.stanford.edu>, and
 2149      Ben Laurie]
 2150 
 2151   *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
 2152      [Steve Henson]
 2153 
 2154   *) Permit abbreviated handshakes when renegotiating using the function
 2155      SSL_renegotiate_abbreviated().
 2156      [Robin Seggelmann <seggelmann@fh-muenster.de>]
 2157 
 2158   *) Add call to ENGINE_register_all_complete() to
 2159      ENGINE_load_builtin_engines(), so some implementations get used
 2160      automatically instead of needing explicit application support.
 2161      [Steve Henson]
 2162 
 2163   *) Add support for TLS key exporter as described in RFC5705.
 2164      [Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson]
 2165 
 2166   *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
 2167      a few changes are required:
 2168 
 2169        Add SSL_OP_NO_TLSv1_1 flag.
 2170        Add TLSv1_1 methods.
 2171        Update version checking logic to handle version 1.1.
 2172        Add explicit IV handling (ported from DTLS code).
 2173        Add command line options to s_client/s_server.
 2174      [Steve Henson]
 2175 
 2176  Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
 2177 
 2178   *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
 2179      in CMS and PKCS7 code. When RSA decryption fails use a random key for
 2180      content decryption and always return the same error. Note: this attack
 2181      needs on average 2^20 messages so it only affects automated senders. The
 2182      old behaviour can be reenabled in the CMS code by setting the
 2183      CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
 2184      an MMA defence is not necessary.
 2185      Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
 2186      this issue. (CVE-2012-0884)
 2187      [Steve Henson]
 2188 
 2189   *) Fix CVE-2011-4619: make sure we really are receiving a 
 2190      client hello before rejecting multiple SGC restarts. Thanks to
 2191      Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug.
 2192      [Steve Henson]
 2193 
 2194  Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
 2195 
 2196   *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
 2197      Thanks to Antonio Martin, Enterprise Secure Access Research and
 2198      Development, Cisco Systems, Inc. for discovering this bug and
 2199      preparing a fix. (CVE-2012-0050)
 2200      [Antonio Martin]
 2201 
 2202  Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
 2203 
 2204   *) Nadhem Alfardan and Kenny Paterson have discovered an extension
 2205      of the Vaudenay padding oracle attack on CBC mode encryption
 2206      which enables an efficient plaintext recovery attack against
 2207      the OpenSSL implementation of DTLS. Their attack exploits timing
 2208      differences arising during decryption processing. A research
 2209      paper describing this attack can be found at:
 2210                   http://www.isg.rhul.ac.uk/~kp/dtls.pdf
 2211      Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
 2212      Security Group at Royal Holloway, University of London
 2213      (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
 2214      <seggelmann@fh-muenster.de> and Michael Tuexen <tuexen@fh-muenster.de>
 2215      for preparing the fix. (CVE-2011-4108)
 2216      [Robin Seggelmann, Michael Tuexen]
 2217 
 2218   *) Clear bytes used for block padding of SSL 3.0 records.
 2219      (CVE-2011-4576)
 2220      [Adam Langley (Google)]
 2221 
 2222   *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
 2223      Kadianakis <desnacked@gmail.com> for discovering this issue and
 2224      Adam Langley for preparing the fix. (CVE-2011-4619)
 2225      [Adam Langley (Google)]
 2226 
 2227   *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
 2228      [Andrey Kulikov <amdeich@gmail.com>]
 2229 
 2230   *) Prevent malformed RFC3779 data triggering an assertion failure.
 2231      Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
 2232      and Rob Austein <sra@hactrn.net> for fixing it. (CVE-2011-4577)
 2233      [Rob Austein <sra@hactrn.net>]
 2234 
 2235   *) Improved PRNG seeding for VOS.
 2236      [Paul Green <Paul.Green@stratus.com>]
 2237 
 2238   *) Fix ssl_ciph.c set-up race.
 2239      [Adam Langley (Google)]
 2240 
 2241   *) Fix spurious failures in ecdsatest.c.
 2242      [Emilia Käsper (Google)]
 2243 
 2244   *) Fix the BIO_f_buffer() implementation (which was mixing different
 2245      interpretations of the '..._len' fields).
 2246      [Adam Langley (Google)]
 2247 
 2248   *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
 2249      BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
 2250      threads won't reuse the same blinding coefficients.
 2251 
 2252      This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
 2253      lock to call BN_BLINDING_invert_ex, and avoids one use of
 2254      BN_BLINDING_update for each BN_BLINDING structure (previously,
 2255      the last update always remained unused).
 2256      [Emilia Käsper (Google)]
 2257 
 2258   *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
 2259      [Bob Buckholz (Google)]
 2260 
 2261  Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
 2262 
 2263   *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
 2264      by initialising X509_STORE_CTX properly. (CVE-2011-3207)
 2265      [Kaspar Brand <ossl@velox.ch>]
 2266 
 2267   *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
 2268      for multi-threaded use of ECDH. (CVE-2011-3210)
 2269      [Adam Langley (Google)]
 2270 
 2271   *) Fix x509_name_ex_d2i memory leak on bad inputs.
 2272      [Bodo Moeller]
 2273 
 2274   *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
 2275      signature public key algorithm by using OID xref utilities instead.
 2276      Before this you could only use some ECC ciphersuites with SHA1 only.
 2277      [Steve Henson]
 2278 
 2279   *) Add protection against ECDSA timing attacks as mentioned in the paper
 2280      by Billy Bob Brumley and Nicola Tuveri, see:
 2281 
 2282 	http://eprint.iacr.org/2011/232.pdf
 2283 
 2284      [Billy Bob Brumley and Nicola Tuveri]
 2285 
 2286  Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
 2287 
 2288   *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
 2289      [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
 2290 
 2291   *) Fix bug in string printing code: if *any* escaping is enabled we must
 2292      escape the escape character (backslash) or the resulting string is
 2293      ambiguous.
 2294      [Steve Henson]
 2295 
 2296  Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
 2297 
 2298   *) Disable code workaround for ancient and obsolete Netscape browsers
 2299      and servers: an attacker can use it in a ciphersuite downgrade attack.
 2300      Thanks to Martin Rex for discovering this bug. CVE-2010-4180
 2301      [Steve Henson]
 2302 
 2303   *) Fixed J-PAKE implementation error, originally discovered by
 2304      Sebastien Martini, further info and confirmation from Stefan
 2305      Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
 2306      [Ben Laurie]
 2307 
 2308  Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
 2309 
 2310   *) Fix extension code to avoid race conditions which can result in a buffer
 2311      overrun vulnerability: resumed sessions must not be modified as they can
 2312      be shared by multiple threads. CVE-2010-3864
 2313      [Steve Henson]
 2314 
 2315   *) Fix WIN32 build system to correctly link an ENGINE directory into
 2316      a DLL. 
 2317      [Steve Henson]
 2318 
 2319  Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
 2320 
 2321   *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
 2322      (CVE-2010-1633)
 2323      [Steve Henson, Peter-Michael Hager <hager@dortmund.net>]
 2324 
 2325  Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
 2326 
 2327   *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
 2328      context. The operation can be customised via the ctrl mechanism in
 2329      case ENGINEs want to include additional functionality.
 2330      [Steve Henson]
 2331 
 2332   *) Tolerate yet another broken PKCS#8 key format: private key value negative.
 2333      [Steve Henson]
 2334 
 2335   *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
 2336      output hashes compatible with older versions of OpenSSL.
 2337      [Willy Weisz <weisz@vcpc.univie.ac.at>]
 2338 
 2339   *) Fix compression algorithm handling: if resuming a session use the
 2340      compression algorithm of the resumed session instead of determining
 2341      it from client hello again. Don't allow server to change algorithm.
 2342      [Steve Henson]
 2343 
 2344   *) Add load_crls() function to apps tidying load_certs() too. Add option
 2345      to verify utility to allow additional CRLs to be included.
 2346      [Steve Henson]
 2347 
 2348   *) Update OCSP request code to permit adding custom headers to the request:
 2349      some responders need this.
 2350      [Steve Henson]
 2351 
 2352   *) The function EVP_PKEY_sign() returns <=0 on error: check return code
 2353      correctly.
 2354      [Julia Lawall <julia@diku.dk>]
 2355 
 2356   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
 2357      needlessly dereferenced structures, used obsolete functions and
 2358      didn't handle all updated verify codes correctly.
 2359      [Steve Henson]
 2360 
 2361   *) Disable MD2 in the default configuration.
 2362      [Steve Henson]
 2363 
 2364   *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
 2365      indicate the initial BIO being pushed or popped. This makes it possible
 2366      to determine whether the BIO is the one explicitly called or as a result
 2367      of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
 2368      it handles reference counts correctly and doesn't zero out the I/O bio
 2369      when it is not being explicitly popped. WARNING: applications which
 2370      included workarounds for the old buggy behaviour will need to be modified
 2371      or they could free up already freed BIOs.
 2372      [Steve Henson]
 2373 
 2374   *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
 2375      renaming to all platforms (within the 0.9.8 branch, this was
 2376      done conditionally on Netware platforms to avoid a name clash).
 2377      [Guenter <lists@gknw.net>]
 2378 
 2379   *) Add ECDHE and PSK support to DTLS.
 2380      [Michael Tuexen <tuexen@fh-muenster.de>]
 2381 
 2382   *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
 2383      be used on C++.
 2384      [Steve Henson]
 2385 
 2386   *) Add "missing" function EVP_MD_flags() (without this the only way to
 2387      retrieve a digest flags is by accessing the structure directly. Update
 2388      EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
 2389      or cipher is registered as in the "from" argument. Print out all
 2390      registered digests in the dgst usage message instead of manually 
 2391      attempting to work them out.
 2392      [Steve Henson]
 2393 
 2394   *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
 2395      this allows the use of compression and extensions. Change default cipher
 2396      string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
 2397      by default unless an application cipher string requests it.
 2398      [Steve Henson]
 2399 
 2400   *) Alter match criteria in PKCS12_parse(). It used to try to use local
 2401      key ids to find matching certificates and keys but some PKCS#12 files
 2402      don't follow the (somewhat unwritten) rules and this strategy fails.
 2403      Now just gather all certificates together and the first private key
 2404      then look for the first certificate that matches the key.
 2405      [Steve Henson]
 2406 
 2407   *) Support use of registered digest and cipher names for dgst and cipher
 2408      commands instead of having to add each one as a special case. So now
 2409      you can do:
 2410 
 2411         openssl sha256 foo
 2412 
 2413      as well as:
 2414 
 2415         openssl dgst -sha256 foo
 2416 
 2417      and this works for ENGINE based algorithms too.
 2418 
 2419      [Steve Henson]
 2420 
 2421   *) Update Gost ENGINE to support parameter files.
 2422      [Victor B. Wagner <vitus@cryptocom.ru>]
 2423 
 2424   *) Support GeneralizedTime in ca utility. 
 2425      [Oliver Martin <oliver@volatilevoid.net>, Steve Henson]
 2426 
 2427   *) Enhance the hash format used for certificate directory links. The new
 2428      form uses the canonical encoding (meaning equivalent names will work
 2429      even if they aren't identical) and uses SHA1 instead of MD5. This form
 2430      is incompatible with the older format and as a result c_rehash should
 2431      be used to rebuild symbolic links.
 2432      [Steve Henson]
 2433 
 2434   *) Make PKCS#8 the default write format for private keys, replacing the
 2435      traditional format. This form is standardised, more secure and doesn't
 2436      include an implicit MD5 dependency.
 2437      [Steve Henson]
 2438 
 2439   *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
 2440      committed to OpenSSL should pass this lot as a minimum.
 2441      [Steve Henson]
 2442 
 2443   *) Add session ticket override functionality for use by EAP-FAST.
 2444      [Jouni Malinen <j@w1.fi>]
 2445 
 2446   *) Modify HMAC functions to return a value. Since these can be implemented
 2447      in an ENGINE errors can occur.
 2448      [Steve Henson]
 2449 
 2450   *) Type-checked OBJ_bsearch_ex.
 2451      [Ben Laurie]
 2452 
 2453   *) Type-checked OBJ_bsearch. Also some constification necessitated
 2454      by type-checking.  Still to come: TXT_DB, bsearch(?),
 2455      OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
 2456      CONF_VALUE.
 2457      [Ben Laurie]
 2458 
 2459   *) New function OPENSSL_gmtime_adj() to add a specific number of days and
 2460      seconds to a tm structure directly, instead of going through OS
 2461      specific date routines. This avoids any issues with OS routines such
 2462      as the year 2038 bug. New *_adj() functions for ASN1 time structures
 2463      and X509_time_adj_ex() to cover the extended range. The existing
 2464      X509_time_adj() is still usable and will no longer have any date issues.
 2465      [Steve Henson]
 2466 
 2467   *) Delta CRL support. New use deltas option which will attempt to locate
 2468      and search any appropriate delta CRLs available.
 2469 
 2470      This work was sponsored by Google.
 2471      [Steve Henson]
 2472 
 2473   *) Support for CRLs partitioned by reason code. Reorganise CRL processing
 2474      code and add additional score elements. Validate alternate CRL paths
 2475      as part of the CRL checking and indicate a new error "CRL path validation
 2476      error" in this case. Applications wanting additional details can use
 2477      the verify callback and check the new "parent" field. If this is not
 2478      NULL CRL path validation is taking place. Existing applications wont
 2479      see this because it requires extended CRL support which is off by
 2480      default.
 2481 
 2482      This work was sponsored by Google.
 2483      [Steve Henson]
 2484 
 2485   *) Support for freshest CRL extension.
 2486 
 2487      This work was sponsored by Google.
 2488      [Steve Henson]
 2489 
 2490   *) Initial indirect CRL support. Currently only supported in the CRLs
 2491      passed directly and not via lookup. Process certificate issuer
 2492      CRL entry extension and lookup CRL entries by bother issuer name
 2493      and serial number. Check and process CRL issuer entry in IDP extension.
 2494 
 2495      This work was sponsored by Google.
 2496      [Steve Henson]
 2497 
 2498   *) Add support for distinct certificate and CRL paths. The CRL issuer
 2499      certificate is validated separately in this case. Only enabled if
 2500      an extended CRL support flag is set: this flag will enable additional
 2501      CRL functionality in future.
 2502 
 2503      This work was sponsored by Google.
 2504      [Steve Henson]
 2505 
 2506   *) Add support for policy mappings extension.
 2507 
 2508      This work was sponsored by Google.
 2509      [Steve Henson]
 2510 
 2511   *) Fixes to pathlength constraint, self issued certificate handling,
 2512      policy processing to align with RFC3280 and PKITS tests.
 2513 
 2514      This work was sponsored by Google.
 2515      [Steve Henson]
 2516 
 2517   *) Support for name constraints certificate extension. DN, email, DNS
 2518      and URI types are currently supported.
 2519 
 2520      This work was sponsored by Google.
 2521      [Steve Henson]
 2522 
 2523   *) To cater for systems that provide a pointer-based thread ID rather
 2524      than numeric, deprecate the current numeric thread ID mechanism and
 2525      replace it with a structure and associated callback type. This
 2526      mechanism allows a numeric "hash" to be extracted from a thread ID in
 2527      either case, and on platforms where pointers are larger than 'long',
 2528      mixing is done to help ensure the numeric 'hash' is usable even if it
 2529      can't be guaranteed unique. The default mechanism is to use "&errno"
 2530      as a pointer-based thread ID to distinguish between threads.
 2531 
 2532      Applications that want to provide their own thread IDs should now use
 2533      CRYPTO_THREADID_set_callback() to register a callback that will call
 2534      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
 2535 
 2536      Note that ERR_remove_state() is now deprecated, because it is tied
 2537      to the assumption that thread IDs are numeric.  ERR_remove_state(0)
 2538      to free the current thread's error state should be replaced by
 2539      ERR_remove_thread_state(NULL).
 2540 
 2541      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
 2542      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
 2543      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
 2544      application was previously providing a numeric thread callback that
 2545      was inappropriate for distinguishing threads, then uniqueness might
 2546      have been obtained with &errno that happened immediately in the
 2547      intermediate development versions of OpenSSL; this is no longer the
 2548      case, the numeric thread callback will now override the automatic use
 2549      of &errno.)
 2550      [Geoff Thorpe, with help from Bodo Moeller]
 2551 
 2552   *) Initial support for different CRL issuing certificates. This covers a
 2553      simple case where the self issued certificates in the chain exist and
 2554      the real CRL issuer is higher in the existing chain.
 2555 
 2556      This work was sponsored by Google.
 2557      [Steve Henson]
 2558 
 2559   *) Removed effectively defunct crypto/store from the build.
 2560      [Ben Laurie]
 2561 
 2562   *) Revamp of STACK to provide stronger type-checking. Still to come:
 2563      TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
 2564      ASN1_STRING, CONF_VALUE.
 2565      [Ben Laurie]
 2566 
 2567   *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
 2568      RAM on SSL connections.  This option can save about 34k per idle SSL.
 2569      [Nick Mathewson]
 2570 
 2571   *) Revamp of LHASH to provide stronger type-checking. Still to come:
 2572      STACK, TXT_DB, bsearch, qsort.
 2573      [Ben Laurie]
 2574 
 2575   *) Initial support for Cryptographic Message Syntax (aka CMS) based
 2576      on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
 2577      support for data, signedData, compressedData, digestedData and
 2578      encryptedData, envelopedData types included. Scripts to check against
 2579      RFC4134 examples draft and interop and consistency checks of many
 2580      content types and variants.
 2581      [Steve Henson]
 2582 
 2583   *) Add options to enc utility to support use of zlib compression BIO.
 2584      [Steve Henson]
 2585 
 2586   *) Extend mk1mf to support importing of options and assembly language
 2587      files from Configure script, currently only included in VC-WIN32.
 2588      The assembly language rules can now optionally generate the source
 2589      files from the associated perl scripts.
 2590      [Steve Henson]
 2591 
 2592   *) Implement remaining functionality needed to support GOST ciphersuites.
 2593      Interop testing has been performed using CryptoPro implementations.
 2594      [Victor B. Wagner <vitus@cryptocom.ru>]
 2595 
 2596   *) s390x assembler pack.
 2597      [Andy Polyakov]
 2598 
 2599   *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
 2600      "family."
 2601      [Andy Polyakov]
 2602 
 2603   *) Implement Opaque PRF Input TLS extension as specified in
 2604      draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
 2605      official specification yet and no extension type assignment by
 2606      IANA exists, this extension (for now) will have to be explicitly
 2607      enabled when building OpenSSL by providing the extension number
 2608      to use.  For example, specify an option
 2609 
 2610          -DTLSEXT_TYPE_opaque_prf_input=0x9527
 2611 
 2612      to the "config" or "Configure" script to enable the extension,
 2613      assuming extension number 0x9527 (which is a completely arbitrary
 2614      and unofficial assignment based on the MD5 hash of the Internet
 2615      Draft).  Note that by doing so, you potentially lose
 2616      interoperability with other TLS implementations since these might
 2617      be using the same extension number for other purposes.
 2618 
 2619      SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
 2620      opaque PRF input value to use in the handshake.  This will create
 2621      an interal copy of the length-'len' string at 'src', and will
 2622      return non-zero for success.
 2623 
 2624      To get more control and flexibility, provide a callback function
 2625      by using
 2626 
 2627           SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
 2628           SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
 2629 
 2630      where
 2631 
 2632           int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
 2633           void *arg;
 2634 
 2635      Callback function 'cb' will be called in handshakes, and is
 2636      expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
 2637      Argument 'arg' is for application purposes (the value as given to
 2638      SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
 2639      be provided to the callback function).  The callback function
 2640      has to return non-zero to report success: usually 1 to use opaque
 2641      PRF input just if possible, or 2 to enforce use of the opaque PRF
 2642      input.  In the latter case, the library will abort the handshake
 2643      if opaque PRF input is not successfully negotiated.
 2644 
 2645      Arguments 'peerinput' and 'len' given to the callback function
 2646      will always be NULL and 0 in the case of a client.  A server will
 2647      see the client's opaque PRF input through these variables if
 2648      available (NULL and 0 otherwise).  Note that if the server
 2649      provides an opaque PRF input, the length must be the same as the
 2650      length of the client's opaque PRF input.
 2651 
 2652      Note that the callback function will only be called when creating
 2653      a new session (session resumption can resume whatever was
 2654      previously negotiated), and will not be called in SSL 2.0
 2655      handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
 2656      SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
 2657      for applications that need to enforce opaque PRF input.
 2658 
 2659      [Bodo Moeller]
 2660 
 2661   *) Update ssl code to support digests other than SHA1+MD5 for handshake
 2662      MAC. 
 2663 
 2664      [Victor B. Wagner <vitus@cryptocom.ru>]
 2665 
 2666   *) Add RFC4507 support to OpenSSL. This includes the corrections in
 2667      RFC4507bis. The encrypted ticket format is an encrypted encoded
 2668      SSL_SESSION structure, that way new session features are automatically
 2669      supported.
 2670 
 2671      If a client application caches session in an SSL_SESSION structure
 2672      support is transparent because tickets are now stored in the encoded
 2673      SSL_SESSION.
 2674      
 2675      The SSL_CTX structure automatically generates keys for ticket
 2676      protection in servers so again support should be possible
 2677      with no application modification.
 2678 
 2679      If a client or server wishes to disable RFC4507 support then the option
 2680      SSL_OP_NO_TICKET can be set.
 2681 
 2682      Add a TLS extension debugging callback to allow the contents of any client
 2683      or server extensions to be examined.
 2684 
 2685      This work was sponsored by Google.
 2686      [Steve Henson]
 2687 
 2688   *) Final changes to avoid use of pointer pointer casts in OpenSSL.
 2689      OpenSSL should now compile cleanly on gcc 4.2
 2690      [Peter Hartley <pdh@utter.chaos.org.uk>, Steve Henson]
 2691 
 2692   *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
 2693      support including streaming MAC support: this is required for GOST
 2694      ciphersuite support.
 2695      [Victor B. Wagner <vitus@cryptocom.ru>, Steve Henson]
 2696 
 2697   *) Add option -stream to use PKCS#7 streaming in smime utility. New
 2698      function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
 2699      to output in BER and PEM format.
 2700      [Steve Henson]
 2701 
 2702   *) Experimental support for use of HMAC via EVP_PKEY interface. This
 2703      allows HMAC to be handled via the EVP_DigestSign*() interface. The
 2704      EVP_PKEY "key" in this case is the HMAC key, potentially allowing
 2705      ENGINE support for HMAC keys which are unextractable. New -mac and
 2706      -macopt options to dgst utility.
 2707      [Steve Henson]
 2708 
 2709   *) New option -sigopt to dgst utility. Update dgst to use
 2710      EVP_Digest{Sign,Verify}*. These two changes make it possible to use
 2711      alternative signing paramaters such as X9.31 or PSS in the dgst 
 2712      utility.
 2713      [Steve Henson]
 2714 
 2715   *) Change ssl_cipher_apply_rule(), the internal function that does
 2716      the work each time a ciphersuite string requests enabling
 2717      ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
 2718      removing ("!foo+bar") a class of ciphersuites: Now it maintains
 2719      the order of disabled ciphersuites such that those ciphersuites
 2720      that most recently went from enabled to disabled not only stay
 2721      in order with respect to each other, but also have higher priority
 2722      than other disabled ciphersuites the next time ciphersuites are
 2723      enabled again.
 2724 
 2725      This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
 2726      the same ciphersuites as with "HIGH" alone, but in a specific
 2727      order where the PSK ciphersuites come first (since they are the
 2728      most recently disabled ciphersuites when "HIGH" is parsed).
 2729 
 2730      Also, change ssl_create_cipher_list() (using this new
 2731      funcionality) such that between otherwise identical
 2732      cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
 2733      the default order.
 2734      [Bodo Moeller]
 2735 
 2736   *) Change ssl_create_cipher_list() so that it automatically
 2737      arranges the ciphersuites in reasonable order before starting
 2738      to process the rule string.  Thus, the definition for "DEFAULT"
 2739      (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
 2740      remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
 2741      This makes it much easier to arrive at a reasonable default order
 2742      in applications for which anonymous ciphers are OK (meaning
 2743      that you can't actually use DEFAULT).
 2744      [Bodo Moeller; suggested by Victor Duchovni]
 2745 
 2746   *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
 2747      processing) into multiple integers instead of setting
 2748      "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
 2749      "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
 2750      (These masks as well as the individual bit definitions are hidden
 2751      away into the non-exported interface ssl/ssl_locl.h, so this
 2752      change to the definition of the SSL_CIPHER structure shouldn't
 2753      affect applications.)  This give us more bits for each of these
 2754      categories, so there is no longer a need to coagulate AES128 and
 2755      AES256 into a single algorithm bit, and to coagulate Camellia128
 2756      and Camellia256 into a single algorithm bit, which has led to all
 2757      kinds of kludges.
 2758 
 2759      Thus, among other things, the kludge introduced in 0.9.7m and
 2760      0.9.8e for masking out AES256 independently of AES128 or masking
 2761      out Camellia256 independently of AES256 is not needed here in 0.9.9.
 2762 
 2763      With the change, we also introduce new ciphersuite aliases that
 2764      so far were missing: "AES128", "AES256", "CAMELLIA128", and
 2765      "CAMELLIA256".
 2766      [Bodo Moeller]
 2767 
 2768   *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
 2769      Use the leftmost N bytes of the signature input if the input is
 2770      larger than the prime q (with N being the size in bytes of q).
 2771      [Nils Larsch]
 2772 
 2773   *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
 2774      it yet and it is largely untested.
 2775      [Steve Henson]
 2776 
 2777   *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
 2778      [Nils Larsch]
 2779 
 2780   *) Initial incomplete changes to avoid need for function casts in OpenSSL
 2781      some compilers (gcc 4.2 and later) reject their use. Safestack is
 2782      reimplemented.  Update ASN1 to avoid use of legacy functions. 
 2783      [Steve Henson]
 2784 
 2785   *) Win32/64 targets are linked with Winsock2.
 2786      [Andy Polyakov]
 2787 
 2788   *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
 2789      to external functions. This can be used to increase CRL handling 
 2790      efficiency especially when CRLs are very large by (for example) storing
 2791      the CRL revoked certificates in a database.
 2792      [Steve Henson]
 2793 
 2794   *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
 2795      new CRLs added to a directory can be used. New command line option
 2796      -verify_return_error to s_client and s_server. This causes real errors
 2797      to be returned by the verify callback instead of carrying on no matter
 2798      what. This reflects the way a "real world" verify callback would behave.
 2799      [Steve Henson]
 2800 
 2801   *) GOST engine, supporting several GOST algorithms and public key formats.
 2802      Kindly donated by Cryptocom.
 2803      [Cryptocom]
 2804 
 2805   *) Partial support for Issuing Distribution Point CRL extension. CRLs
 2806      partitioned by DP are handled but no indirect CRL or reason partitioning
 2807      (yet). Complete overhaul of CRL handling: now the most suitable CRL is
 2808      selected via a scoring technique which handles IDP and AKID in CRLs.
 2809      [Steve Henson]
 2810 
 2811   *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
 2812      will ultimately be used for all verify operations: this will remove the
 2813      X509_STORE dependency on certificate verification and allow alternative
 2814      lookup methods.  X509_STORE based implementations of these two callbacks.
 2815      [Steve Henson]
 2816 
 2817   *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
 2818      Modify get_crl() to find a valid (unexpired) CRL if possible.
 2819      [Steve Henson]
 2820 
 2821   *) New function X509_CRL_match() to check if two CRLs are identical. Normally
 2822      this would be called X509_CRL_cmp() but that name is already used by
 2823      a function that just compares CRL issuer names. Cache several CRL 
 2824      extensions in X509_CRL structure and cache CRLDP in X509.
 2825      [Steve Henson]
 2826 
 2827   *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
 2828      this maps equivalent X509_NAME structures into a consistent structure.
 2829      Name comparison can then be performed rapidly using memcmp().
 2830      [Steve Henson]
 2831 
 2832   *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
 2833      utility.
 2834      [Steve Henson]
 2835 
 2836   *) Allow digests to supply their own micalg string for S/MIME type using
 2837      the ctrl EVP_MD_CTRL_MICALG.
 2838      [Steve Henson]
 2839 
 2840   *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
 2841      EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
 2842      ctrl. It can then customise the structure before and/or after signing
 2843      if necessary.
 2844      [Steve Henson]
 2845 
 2846   *) New function OBJ_add_sigid() to allow application defined signature OIDs
 2847      to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
 2848      to free up any added signature OIDs.
 2849      [Steve Henson]
 2850 
 2851   *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
 2852      EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
 2853      digest and cipher tables. New options added to openssl utility:
 2854      list-message-digest-algorithms and list-cipher-algorithms.
 2855      [Steve Henson]
 2856 
 2857   *) Change the array representation of binary polynomials: the list
 2858      of degrees of non-zero coefficients is now terminated with -1.
 2859      Previously it was terminated with 0, which was also part of the
 2860      value; thus, the array representation was not applicable to
 2861      polynomials where t^0 has coefficient zero.  This change makes
 2862      the array representation useful in a more general context.
 2863      [Douglas Stebila]
 2864 
 2865   *) Various modifications and fixes to SSL/TLS cipher string
 2866      handling.  For ECC, the code now distinguishes between fixed ECDH
 2867      with RSA certificates on the one hand and with ECDSA certificates
 2868      on the other hand, since these are separate ciphersuites.  The
 2869      unused code for Fortezza ciphersuites has been removed.
 2870 
 2871      For consistency with EDH, ephemeral ECDH is now called "EECDH"
 2872      (not "ECDHE").  For consistency with the code for DH
 2873      certificates, use of ECDH certificates is now considered ECDH
 2874      authentication, not RSA or ECDSA authentication (the latter is
 2875      merely the CA's signing algorithm and not actively used in the
 2876      protocol).
 2877 
 2878      The temporary ciphersuite alias "ECCdraft" is no longer
 2879      available, and ECC ciphersuites are no longer excluded from "ALL"
 2880      and "DEFAULT".  The following aliases now exist for RFC 4492
 2881      ciphersuites, most of these by analogy with the DH case:
 2882 
 2883          kECDHr   - ECDH cert, signed with RSA
 2884          kECDHe   - ECDH cert, signed with ECDSA
 2885          kECDH    - ECDH cert (signed with either RSA or ECDSA)
 2886          kEECDH   - ephemeral ECDH
 2887          ECDH     - ECDH cert or ephemeral ECDH
 2888 
 2889          aECDH    - ECDH cert
 2890          aECDSA   - ECDSA cert
 2891          ECDSA    - ECDSA cert
 2892 
 2893          AECDH    - anonymous ECDH
 2894          EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
 2895 
 2896      [Bodo Moeller]
 2897 
 2898   *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
 2899      Use correct micalg parameters depending on digest(s) in signed message.
 2900      [Steve Henson]
 2901 
 2902   *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
 2903      an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
 2904      [Steve Henson]
 2905 
 2906   *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
 2907      an engine to register a method. Add ENGINE lookups for methods and
 2908      functional reference processing.
 2909      [Steve Henson]
 2910 
 2911   *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
 2912      EVP_{Sign,Verify}* which allow an application to customise the signature
 2913      process.
 2914      [Steve Henson]
 2915 
 2916   *) New -resign option to smime utility. This adds one or more signers
 2917      to an existing PKCS#7 signedData structure. Also -md option to use an
 2918      alternative message digest algorithm for signing.
 2919      [Steve Henson]
 2920 
 2921   *) Tidy up PKCS#7 routines and add new functions to make it easier to
 2922      create PKCS7 structures containing multiple signers. Update smime
 2923      application to support multiple signers.
 2924      [Steve Henson]
 2925 
 2926   *) New -macalg option to pkcs12 utility to allow setting of an alternative
 2927      digest MAC.
 2928      [Steve Henson]
 2929 
 2930   *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
 2931      Reorganize PBE internals to lookup from a static table using NIDs,
 2932      add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
 2933      EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
 2934      PRF which will be automatically used with PBES2.
 2935      [Steve Henson]
 2936 
 2937   *) Replace the algorithm specific calls to generate keys in "req" with the
 2938      new API.
 2939      [Steve Henson]
 2940 
 2941   *) Update PKCS#7 enveloped data routines to use new API. This is now
 2942      supported by any public key method supporting the encrypt operation. A
 2943      ctrl is added to allow the public key algorithm to examine or modify
 2944      the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
 2945      a no op.
 2946      [Steve Henson]
 2947 
 2948   *) Add a ctrl to asn1 method to allow a public key algorithm to express
 2949      a default digest type to use. In most cases this will be SHA1 but some
 2950      algorithms (such as GOST) need to specify an alternative digest. The
 2951      return value indicates how strong the prefernce is 1 means optional and
 2952      2 is mandatory (that is it is the only supported type). Modify
 2953      ASN1_item_sign() to accept a NULL digest argument to indicate it should
 2954      use the default md. Update openssl utilities to use the default digest
 2955      type for signing if it is not explicitly indicated.
 2956      [Steve Henson]
 2957 
 2958   *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
 2959      EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
 2960      signing method from the key type. This effectively removes the link
 2961      between digests and public key types.
 2962      [Steve Henson]
 2963 
 2964   *) Add an OID cross reference table and utility functions. Its purpose is to
 2965      translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
 2966      rsaEncryption. This will allow some of the algorithm specific hackery
 2967      needed to use the correct OID to be removed. 
 2968      [Steve Henson]
 2969 
 2970   *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
 2971      structures for PKCS7_sign(). They are now set up by the relevant public
 2972      key ASN1 method.
 2973      [Steve Henson]
 2974 
 2975   *) Add provisional EC pkey method with support for ECDSA and ECDH.
 2976      [Steve Henson]
 2977 
 2978   *) Add support for key derivation (agreement) in the API, DH method and
 2979      pkeyutl.
 2980      [Steve Henson]
 2981 
 2982   *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
 2983      public and private key formats. As a side effect these add additional 
 2984      command line functionality not previously available: DSA signatures can be
 2985      generated and verified using pkeyutl and DH key support and generation in
 2986      pkey, genpkey.
 2987      [Steve Henson]
 2988 
 2989   *) BeOS support.
 2990      [Oliver Tappe <zooey@hirschkaefer.de>]
 2991 
 2992   *) New make target "install_html_docs" installs HTML renditions of the
 2993      manual pages.
 2994      [Oliver Tappe <zooey@hirschkaefer.de>]
 2995 
 2996   *) New utility "genpkey" this is analagous to "genrsa" etc except it can
 2997      generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
 2998      support key and parameter generation and add initial key generation
 2999      functionality for RSA.
 3000      [Steve Henson]
 3001 
 3002   *) Add functions for main EVP_PKEY_method operations. The undocumented
 3003      functions EVP_PKEY_{encrypt,decrypt} have been renamed to
 3004      EVP_PKEY_{encrypt,decrypt}_old. 
 3005      [Steve Henson]
 3006 
 3007   *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
 3008      key API, doesn't do much yet.
 3009      [Steve Henson]
 3010 
 3011   *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
 3012      public key algorithms. New option to openssl utility:
 3013      "list-public-key-algorithms" to print out info.
 3014      [Steve Henson]
 3015 
 3016   *) Implement the Supported Elliptic Curves Extension for
 3017      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
 3018      [Douglas Stebila]
 3019 
 3020   *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
 3021      EVP_CIPHER structures to avoid later problems in EVP_cleanup().
 3022      [Steve Henson]
 3023 
 3024   *) New utilities pkey and pkeyparam. These are similar to algorithm specific
 3025      utilities such as rsa, dsa, dsaparam etc except they process any key
 3026      type.
 3027      [Steve Henson]
 3028 
 3029   *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
 3030      functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
 3031      EVP_PKEY_print_param() to print public key data from an EVP_PKEY
 3032      structure.
 3033      [Steve Henson]
 3034 
 3035   *) Initial support for pluggable public key ASN1.
 3036      De-spaghettify the public key ASN1 handling. Move public and private
 3037      key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
 3038      algorithm specific handling to a single module within the relevant
 3039      algorithm directory. Add functions to allow (near) opaque processing
 3040      of public and private key structures.
 3041      [Steve Henson]
 3042 
 3043   *) Implement the Supported Point Formats Extension for
 3044      ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
 3045      [Douglas Stebila]
 3046 
 3047   *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
 3048      for the psk identity [hint] and the psk callback functions to the
 3049      SSL_SESSION, SSL and SSL_CTX structure.
 3050      
 3051      New ciphersuites:
 3052          PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
 3053          PSK-AES256-CBC-SHA
 3054  
 3055      New functions:
 3056          SSL_CTX_use_psk_identity_hint
 3057          SSL_get_psk_identity_hint
 3058          SSL_get_psk_identity
 3059          SSL_use_psk_identity_hint
 3060 
 3061      [Mika Kousa and Pasi Eronen of Nokia Corporation]
 3062 
 3063   *) Add RFC 3161 compliant time stamp request creation, response generation
 3064      and response verification functionality.
 3065      [Zoltán Glózik <zglozik@opentsa.org>, The OpenTSA Project]
 3066 
 3067   *) Add initial support for TLS extensions, specifically for the server_name
 3068      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
 3069      have new members for a host name.  The SSL data structure has an
 3070      additional member SSL_CTX *initial_ctx so that new sessions can be
 3071      stored in that context to allow for session resumption, even after the
 3072      SSL has been switched to a new SSL_CTX in reaction to a client's
 3073      server_name extension.
 3074 
 3075      New functions (subject to change):
 3076 
 3077          SSL_get_servername()
 3078          SSL_get_servername_type()
 3079          SSL_set_SSL_CTX()
 3080 
 3081      New CTRL codes and macros (subject to change):
 3082 
 3083          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
 3084                                  - SSL_CTX_set_tlsext_servername_callback()
 3085          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
 3086                                       - SSL_CTX_set_tlsext_servername_arg()
 3087          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
 3088 
 3089      openssl s_client has a new '-servername ...' option.
 3090 
 3091      openssl s_server has new options '-servername_host ...', '-cert2 ...',
 3092      '-key2 ...', '-servername_fatal' (subject to change).  This allows
 3093      testing the HostName extension for a specific single host name ('-cert'
 3094      and '-key' remain fallbacks for handshakes without HostName
 3095      negotiation).  If the unrecogninzed_name alert has to be sent, this by
 3096      default is a warning; it becomes fatal with the '-servername_fatal'
 3097      option.
 3098 
 3099      [Peter Sylvester,  Remy Allais, Christophe Renou]
 3100 
 3101   *) Whirlpool hash implementation is added.
 3102      [Andy Polyakov]
 3103 
 3104   *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
 3105      bn(64,32). Because of instruction set limitations it doesn't have
 3106      any negative impact on performance. This was done mostly in order
 3107      to make it possible to share assembler modules, such as bn_mul_mont
 3108      implementations, between 32- and 64-bit builds without hassle.
 3109      [Andy Polyakov]
 3110 
 3111   *) Move code previously exiled into file crypto/ec/ec2_smpt.c
 3112      to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
 3113      macro.
 3114      [Bodo Moeller]
 3115 
 3116   *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
 3117      dedicated Montgomery multiplication procedure, is introduced.
 3118      BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
 3119      "64-bit" performance on certain 32-bit targets.
 3120      [Andy Polyakov]
 3121 
 3122   *) New option SSL_OP_NO_COMP to disable use of compression selectively
 3123      in SSL structures. New SSL ctrl to set maximum send fragment size. 
 3124      Save memory by seeting the I/O buffer sizes dynamically instead of
 3125      using the maximum available value.
 3126      [Steve Henson]
 3127 
 3128   *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
 3129      in addition to the text details.
 3130      [Bodo Moeller]
 3131 
 3132   *) Very, very preliminary EXPERIMENTAL support for printing of general
 3133      ASN1 structures. This currently produces rather ugly output and doesn't
 3134      handle several customised structures at all.
 3135      [Steve Henson]
 3136 
 3137   *) Integrated support for PVK file format and some related formats such
 3138      as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
 3139      these in the 'rsa' and 'dsa' utilities.
 3140      [Steve Henson]
 3141 
 3142   *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
 3143      [Steve Henson]
 3144 
 3145   *) Remove the ancient ASN1_METHOD code. This was only ever used in one
 3146      place for the (very old) "NETSCAPE" format certificates which are now
 3147      handled using new ASN1 code equivalents.
 3148      [Steve Henson]
 3149 
 3150   *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
 3151      pointer and make the SSL_METHOD parameter in SSL_CTX_new,
 3152      SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
 3153      [Nils Larsch]
 3154 
 3155   *) Modify CRL distribution points extension code to print out previously
 3156      unsupported fields. Enhance extension setting code to allow setting of
 3157      all fields.
 3158      [Steve Henson]
 3159 
 3160   *) Add print and set support for Issuing Distribution Point CRL extension.
 3161      [Steve Henson]
 3162 
 3163   *) Change 'Configure' script to enable Camellia by default.
 3164      [NTT]
 3165 
 3166  Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
 3167 
 3168   *) When rejecting SSL/TLS records due to an incorrect version number, never
 3169      update s->server with a new major version number.  As of
 3170      - OpenSSL 0.9.8m if 'short' is a 16-bit type,
 3171      - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
 3172      the previous behavior could result in a read attempt at NULL when
 3173      receiving specific incorrect SSL/TLS records once record payload
 3174      protection is active.  (CVE-2010-0740)
 3175      [Bodo Moeller, Adam Langley <agl@chromium.org>]
 3176 
 3177   *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
 3178      could be crashed if the relevant tables were not present (e.g. chrooted).
 3179      [Tomas Hoger <thoger@redhat.com>]
 3180 
 3181  Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
 3182 
 3183   *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
 3184      [Martin Olsson, Neel Mehta]
 3185 
 3186   *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
 3187      accommodate for stack sorting, always a write lock!).
 3188      [Bodo Moeller]
 3189 
 3190   *) On some versions of WIN32 Heap32Next is very slow. This can cause
 3191      excessive delays in the RAND_poll(): over a minute. As a workaround
 3192      include a time check in the inner Heap32Next loop too.
 3193      [Steve Henson]
 3194 
 3195   *) The code that handled flushing of data in SSL/TLS originally used the
 3196      BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
 3197      the problem outlined in PR#1949. The fix suggested there however can
 3198      trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
 3199      of Apache). So instead simplify the code to flush unconditionally.
 3200      This should be fine since flushing with no data to flush is a no op.
 3201      [Steve Henson]
 3202 
 3203   *) Handle TLS versions 2.0 and later properly and correctly use the
 3204      highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
 3205      off ancient servers have a habit of sticking around for a while...
 3206      [Steve Henson]
 3207 
 3208   *) Modify compression code so it frees up structures without using the
 3209      ex_data callbacks. This works around a problem where some applications
 3210      call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
 3211      restarting) then use compression (e.g. SSL with compression) later.
 3212      This results in significant per-connection memory leaks and
 3213      has caused some security issues including CVE-2008-1678 and
 3214      CVE-2009-4355.
 3215      [Steve Henson]
 3216 
 3217   *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
 3218      change when encrypting or decrypting.
 3219      [Bodo Moeller]
 3220 
 3221   *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
 3222      connect and renegotiate with servers which do not support RI.
 3223      Until RI is more widely deployed this option is enabled by default.
 3224      [Steve Henson]
 3225 
 3226   *) Add "missing" ssl ctrls to clear options and mode.
 3227      [Steve Henson]
 3228 
 3229   *) If client attempts to renegotiate and doesn't support RI respond with
 3230      a no_renegotiation alert as required by RFC5746.  Some renegotiating
 3231      TLS clients will continue a connection gracefully when they receive
 3232      the alert. Unfortunately OpenSSL mishandled this alert and would hang
 3233      waiting for a server hello which it will never receive. Now we treat a
 3234      received no_renegotiation alert as a fatal error. This is because
 3235      applications requesting a renegotiation might well expect it to succeed
 3236      and would have no code in place to handle the server denying it so the
 3237      only safe thing to do is to terminate the connection.
 3238      [Steve Henson]
 3239 
 3240   *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
 3241      peer supports secure renegotiation and 0 otherwise. Print out peer
 3242      renegotiation support in s_client/s_server.
 3243      [Steve Henson]
 3244 
 3245   *) Replace the highly broken and deprecated SPKAC certification method with
 3246      the updated NID creation version. This should correctly handle UTF8.
 3247      [Steve Henson]
 3248 
 3249   *) Implement RFC5746. Re-enable renegotiation but require the extension
 3250      as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
 3251      turns out to be a bad idea. It has been replaced by
 3252      SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
 3253      SSL_CTX_set_options(). This is really not recommended unless you
 3254      know what you are doing.
 3255      [Eric Rescorla <ekr@networkresonance.com>, Ben Laurie, Steve Henson]
 3256 
 3257   *) Fixes to stateless session resumption handling. Use initial_ctx when
 3258      issuing and attempting to decrypt tickets in case it has changed during
 3259      servername handling. Use a non-zero length session ID when attempting
 3260      stateless session resumption: this makes it possible to determine if
 3261      a resumption has occurred immediately after receiving server hello
 3262      (several places in OpenSSL subtly assume this) instead of later in
 3263      the handshake.
 3264      [Steve Henson]
 3265 
 3266   *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
 3267      CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
 3268      fixes for a few places where the return code is not checked
 3269      correctly.
 3270      [Julia Lawall <julia@diku.dk>]
 3271 
 3272   *) Add --strict-warnings option to Configure script to include devteam
 3273      warnings in other configurations.
 3274      [Steve Henson]
 3275 
 3276   *) Add support for --libdir option and LIBDIR variable in makefiles. This
 3277      makes it possible to install openssl libraries in locations which
 3278      have names other than "lib", for example "/usr/lib64" which some
 3279      systems need.
 3280      [Steve Henson, based on patch from Jeremy Utley]
 3281 
 3282   *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
 3283      X690 8.9.12 and can produce some misleading textual output of OIDs.
 3284      [Steve Henson, reported by Dan Kaminsky]
 3285 
 3286   *) Delete MD2 from algorithm tables. This follows the recommendation in
 3287      several standards that it is not used in new applications due to
 3288      several cryptographic weaknesses. For binary compatibility reasons
 3289      the MD2 API is still compiled in by default.
 3290      [Steve Henson]
 3291 
 3292   *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
 3293      and restored.
 3294      [Steve Henson]
 3295 
 3296   *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
 3297      OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
 3298      clash.
 3299      [Guenter <lists@gknw.net>]
 3300 
 3301   *) Fix the server certificate chain building code to use X509_verify_cert(),
 3302      it used to have an ad-hoc builder which was unable to cope with anything
 3303      other than a simple chain.
 3304      [David Woodhouse <dwmw2@infradead.org>, Steve Henson]
 3305 
 3306   *) Don't check self signed certificate signatures in X509_verify_cert()
 3307      by default (a flag can override this): it just wastes time without
 3308      adding any security. As a useful side effect self signed root CAs
 3309      with non-FIPS digests are now usable in FIPS mode.
 3310      [Steve Henson]
 3311 
 3312   *) In dtls1_process_out_of_seq_message() the check if the current message
 3313      is already buffered was missing. For every new message was memory
 3314      allocated, allowing an attacker to perform an denial of service attack
 3315      with sending out of seq handshake messages until there is no memory
 3316      left. Additionally every future messege was buffered, even if the
 3317      sequence number made no sense and would be part of another handshake.
 3318      So only messages with sequence numbers less than 10 in advance will be
 3319      buffered.  (CVE-2009-1378)
 3320      [Robin Seggelmann, discovered by Daniel Mentz] 	
 3321 
 3322   *) Records are buffered if they arrive with a future epoch to be
 3323      processed after finishing the corresponding handshake. There is
 3324      currently no limitation to this buffer allowing an attacker to perform
 3325      a DOS attack with sending records with future epochs until there is no
 3326      memory left. This patch adds the pqueue_size() function to detemine
 3327      the size of a buffer and limits the record buffer to 100 entries.
 3328      (CVE-2009-1377)
 3329      [Robin Seggelmann, discovered by Daniel Mentz] 	
 3330 
 3331   *) Keep a copy of frag->msg_header.frag_len so it can be used after the
 3332      parent structure is freed.  (CVE-2009-1379)
 3333      [Daniel Mentz] 	
 3334 
 3335   *) Handle non-blocking I/O properly in SSL_shutdown() call.
 3336      [Darryl Miles <darryl-mailinglists@netbauds.net>]
 3337 
 3338   *) Add 2.5.4.* OIDs
 3339      [Ilya O. <vrghost@gmail.com>]
 3340 
 3341  Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
 3342 
 3343   *) Disable renegotiation completely - this fixes a severe security
 3344      problem (CVE-2009-3555) at the cost of breaking all
 3345      renegotiation. Renegotiation can be re-enabled by setting
 3346      SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION in s3->flags at
 3347      run-time. This is really not recommended unless you know what
 3348      you're doing.
 3349      [Ben Laurie]
 3350 
 3351  Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
 3352 
 3353   *) Don't set val to NULL when freeing up structures, it is freed up by
 3354      underlying code. If sizeof(void *) > sizeof(long) this can result in
 3355      zeroing past the valid field. (CVE-2009-0789)
 3356      [Paolo Ganci <Paolo.Ganci@AdNovum.CH>]
 3357 
 3358   *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
 3359      checked correctly. This would allow some invalid signed attributes to
 3360      appear to verify correctly. (CVE-2009-0591)
 3361      [Ivan Nestlerode <inestlerode@us.ibm.com>]
 3362 
 3363   *) Reject UniversalString and BMPString types with invalid lengths. This
 3364      prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
 3365      a legal length. (CVE-2009-0590)
 3366      [Steve Henson]
 3367 
 3368   *) Set S/MIME signing as the default purpose rather than setting it 
 3369      unconditionally. This allows applications to override it at the store
 3370      level.
 3371      [Steve Henson]
 3372 
 3373   *) Permit restricted recursion of ASN1 strings. This is needed in practice
 3374      to handle some structures.
 3375      [Steve Henson]
 3376 
 3377   *) Improve efficiency of mem_gets: don't search whole buffer each time
 3378      for a '\n'
 3379      [Jeremy Shapiro <jnshapir@us.ibm.com>]
 3380 
 3381   *) New -hex option for openssl rand.
 3382      [Matthieu Herrb]
 3383 
 3384   *) Print out UTF8String and NumericString when parsing ASN1.
 3385      [Steve Henson]
 3386 
 3387   *) Support NumericString type for name components.
 3388      [Steve Henson]
 3389 
 3390   *) Allow CC in the environment to override the automatically chosen
 3391      compiler. Note that nothing is done to ensure flags work with the
 3392      chosen compiler.
 3393      [Ben Laurie]
 3394 
 3395  Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
 3396 
 3397   *) Properly check EVP_VerifyFinal() and similar return values
 3398      (CVE-2008-5077).
 3399      [Ben Laurie, Bodo Moeller, Google Security Team]
 3400 
 3401   *) Enable TLS extensions by default.
 3402      [Ben Laurie]
 3403 
 3404   *) Allow the CHIL engine to be loaded, whether the application is
 3405      multithreaded or not. (This does not release the developer from the
 3406      obligation to set up the dynamic locking callbacks.)
 3407      [Sander Temme <sander@temme.net>]
 3408 
 3409   *) Use correct exit code if there is an error in dgst command.
 3410      [Steve Henson; problem pointed out by Roland Dirlewanger]
 3411 
 3412   *) Tweak Configure so that you need to say "experimental-jpake" to enable
 3413      JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
 3414      [Bodo Moeller]
 3415 
 3416   *) Add experimental JPAKE support, including demo authentication in
 3417      s_client and s_server.
 3418      [Ben Laurie]
 3419 
 3420   *) Set the comparison function in v3_addr_canonize().
 3421      [Rob Austein <sra@hactrn.net>]
 3422 
 3423   *) Add support for XMPP STARTTLS in s_client.
 3424      [Philip Paeps <philip@freebsd.org>]
 3425 
 3426   *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
 3427      to ensure that even with this option, only ciphersuites in the
 3428      server's preference list will be accepted.  (Note that the option
 3429      applies only when resuming a session, so the earlier behavior was
 3430      just about the algorithm choice for symmetric cryptography.)
 3431      [Bodo Moeller]
 3432 
 3433  Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
 3434 
 3435   *) Fix NULL pointer dereference if a DTLS server received
 3436      ChangeCipherSpec as first record (CVE-2009-1386).
 3437      [PR #1679]
 3438 
 3439   *) Fix a state transitition in s3_srvr.c and d1_srvr.c
 3440      (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
 3441      [Nagendra Modadugu]
 3442 
 3443   *) The fix in 0.9.8c that supposedly got rid of unsafe
 3444      double-checked locking was incomplete for RSA blinding,
 3445      addressing just one layer of what turns out to have been
 3446      doubly unsafe triple-checked locking.
 3447 
 3448      So now fix this for real by retiring the MONT_HELPER macro
 3449      in crypto/rsa/rsa_eay.c.
 3450 
 3451      [Bodo Moeller; problem pointed out by Marius Schilder]
 3452 
 3453   *) Various precautionary measures:
 3454 
 3455      - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
 3456 
 3457      - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
 3458        (NB: This would require knowledge of the secret session ticket key
 3459        to exploit, in which case you'd be SOL either way.)
 3460 
 3461      - Change bn_nist.c so that it will properly handle input BIGNUMs
 3462        outside the expected range.
 3463 
 3464      - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
 3465        builds.
 3466 
 3467      [Neel Mehta, Bodo Moeller]
 3468 
 3469   *) Allow engines to be "soft loaded" - i.e. optionally don't die if
 3470      the load fails. Useful for distros.
 3471      [Ben Laurie and the FreeBSD team]
 3472 
 3473   *) Add support for Local Machine Keyset attribute in PKCS#12 files.
 3474      [Steve Henson]
 3475 
 3476   *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
 3477      [Huang Ying]
 3478 
 3479   *) Expand ENGINE to support engine supplied SSL client certificate functions.
 3480 
 3481      This work was sponsored by Logica.
 3482      [Steve Henson]
 3483 
 3484   *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
 3485      keystores. Support for SSL/TLS client authentication too.
 3486      Not compiled unless enable-capieng specified to Configure.
 3487 
 3488      This work was sponsored by Logica.
 3489      [Steve Henson]
 3490 
 3491   *) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
 3492      ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
 3493      attribute creation routines such as certifcate requests and PKCS#12
 3494      files.
 3495      [Steve Henson]
 3496 
 3497  Changes between 0.9.8g and 0.9.8h  [28 May 2008]
 3498 
 3499   *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
 3500      handshake which could lead to a cilent crash as found using the
 3501      Codenomicon TLS test suite (CVE-2008-1672) 
 3502      [Steve Henson, Mark Cox]
 3503 
 3504   *) Fix double free in TLS server name extensions which could lead to
 3505      a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
 3506      [Joe Orton]
 3507 
 3508   *) Clear error queue in SSL_CTX_use_certificate_chain_file()
 3509 
 3510      Clear the error queue to ensure that error entries left from
 3511      older function calls do not interfere with the correct operation.
 3512      [Lutz Jaenicke, Erik de Castro Lopo]
 3513 
 3514   *) Remove root CA certificates of commercial CAs:
 3515 
 3516      The OpenSSL project does not recommend any specific CA and does not
 3517      have any policy with respect to including or excluding any CA.
 3518      Therefore it does not make any sense to ship an arbitrary selection
 3519      of root CA certificates with the OpenSSL software.
 3520      [Lutz Jaenicke]
 3521 
 3522   *) RSA OAEP patches to fix two separate invalid memory reads.
 3523      The first one involves inputs when 'lzero' is greater than
 3524      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
 3525      before the beginning of from). The second one involves inputs where
 3526      the 'db' section contains nothing but zeroes (there is a one-byte
 3527      invalid read after the end of 'db').
 3528      [Ivan Nestlerode <inestlerode@us.ibm.com>]
 3529 
 3530   *) Partial backport from 0.9.9-dev:
 3531 
 3532      Introduce bn_mul_mont (dedicated Montgomery multiplication
 3533      procedure) as a candidate for BIGNUM assembler implementation.
 3534      While 0.9.9-dev uses assembler for various architectures, only
 3535      x86_64 is available by default here in the 0.9.8 branch, and
 3536      32-bit x86 is available through a compile-time setting.
 3537 
 3538      To try the 32-bit x86 assembler implementation, use Configure
 3539      option "enable-montasm" (which exists only for this backport).
 3540 
 3541      As "enable-montasm" for 32-bit x86 disclaims code stability
 3542      anyway, in this constellation we activate additional code
 3543      backported from 0.9.9-dev for further performance improvements,
 3544      namely BN_from_montgomery_word.  (To enable this otherwise,
 3545      e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
 3546 
 3547      [Andy Polyakov (backport partially by Bodo Moeller)]
 3548 
 3549   *) Add TLS session ticket callback. This allows an application to set
 3550      TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
 3551      values. This is useful for key rollover for example where several key
 3552      sets may exist with different names.
 3553      [Steve Henson]
 3554 
 3555   *) Reverse ENGINE-internal logic for caching default ENGINE handles.
 3556      This was broken until now in 0.9.8 releases, such that the only way
 3557      a registered ENGINE could be used (assuming it initialises
 3558      successfully on the host) was to explicitly set it as the default
 3559      for the relevant algorithms. This is in contradiction with 0.9.7
 3560      behaviour and the documentation. With this fix, when an ENGINE is
 3561      registered into a given algorithm's table of implementations, the
 3562      'uptodate' flag is reset so that auto-discovery will be used next
 3563      time a new context for that algorithm attempts to select an
 3564      implementation.
 3565      [Ian Lister (tweaked by Geoff Thorpe)]
 3566 
 3567   *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
 3568      implemention in the following ways:
 3569 
 3570      Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
 3571      hard coded.
 3572 
 3573      Lack of BER streaming support means one pass streaming processing is
 3574      only supported if data is detached: setting the streaming flag is
 3575      ignored for embedded content.
 3576 
 3577      CMS support is disabled by default and must be explicitly enabled
 3578      with the enable-cms configuration option.
 3579      [Steve Henson]
 3580 
 3581   *) Update the GMP engine glue to do direct copies between BIGNUM and
 3582      mpz_t when openssl and GMP use the same limb size. Otherwise the
 3583      existing "conversion via a text string export" trick is still used.
 3584      [Paul Sheer <paulsheer@gmail.com>]
 3585 
 3586   *) Zlib compression BIO. This is a filter BIO which compressed and
 3587      uncompresses any data passed through it.
 3588      [Steve Henson]
 3589 
 3590   *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
 3591      RFC3394 compatible AES key wrapping.
 3592      [Steve Henson]
 3593 
 3594   *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
 3595      sets string data without copying. X509_ALGOR_set0() and
 3596      X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
 3597      data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
 3598      from an X509_ATTRIBUTE structure optionally checking it occurs only
 3599      once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
 3600      data.
 3601      [Steve Henson]
 3602 
 3603   *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
 3604      to get the expected BN_FLG_CONSTTIME behavior.
 3605      [Bodo Moeller (Google)]
 3606   
 3607   *) Netware support:
 3608 
 3609      - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
 3610      - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
 3611      - added some more tests to do_tests.pl
 3612      - fixed RunningProcess usage so that it works with newer LIBC NDKs too
 3613      - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
 3614      - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
 3615        netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
 3616      - various changes to netware.pl to enable gcc-cross builds on Win32
 3617        platform
 3618      - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
 3619      - various changes to fix missing prototype warnings
 3620      - fixed x86nasm.pl to create correct asm files for NASM COFF output
 3621      - added AES, WHIRLPOOL and CPUID assembler code to build files
 3622      - added missing AES assembler make rules to mk1mf.pl
 3623      - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
 3624      [Guenter Knauf <eflash@gmx.net>]
 3625 
 3626   *) Implement certificate status request TLS extension defined in RFC3546.
 3627      A client can set the appropriate parameters and receive the encoded
 3628      OCSP response via a callback. A server can query the supplied parameters
 3629      and set the encoded OCSP response in the callback. Add simplified examples
 3630      to s_client and s_server.
 3631      [Steve Henson]
 3632 
 3633  Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
 3634 
 3635   *) Fix various bugs:
 3636      + Binary incompatibility of ssl_ctx_st structure
 3637      + DTLS interoperation with non-compliant servers
 3638      + Don't call get_session_cb() without proposed session
 3639      + Fix ia64 assembler code
 3640      [Andy Polyakov, Steve Henson]
 3641 
 3642  Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
 3643 
 3644   *) DTLS Handshake overhaul. There were longstanding issues with
 3645      OpenSSL DTLS implementation, which were making it impossible for
 3646      RFC 4347 compliant client to communicate with OpenSSL server.
 3647      Unfortunately just fixing these incompatibilities would "cut off"
 3648      pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
 3649      server keeps tolerating non RFC compliant syntax. The opposite is
 3650      not true, 0.9.8f client can not communicate with earlier server.
 3651      This update even addresses CVE-2007-4995.
 3652      [Andy Polyakov]
 3653 
 3654   *) Changes to avoid need for function casts in OpenSSL: some compilers
 3655      (gcc 4.2 and later) reject their use.
 3656      [Kurt Roeckx <kurt@roeckx.be>, Peter Hartley <pdh@utter.chaos.org.uk>,
 3657       Steve Henson]
 3658   
 3659   *) Add RFC4507 support to OpenSSL. This includes the corrections in
 3660      RFC4507bis. The encrypted ticket format is an encrypted encoded
 3661      SSL_SESSION structure, that way new session features are automatically
 3662      supported.
 3663 
 3664      If a client application caches session in an SSL_SESSION structure
 3665      support is transparent because tickets are now stored in the encoded
 3666      SSL_SESSION.
 3667      
 3668      The SSL_CTX structure automatically generates keys for ticket
 3669      protection in servers so again support should be possible
 3670      with no application modification.
 3671 
 3672      If a client or server wishes to disable RFC4507 support then the option
 3673      SSL_OP_NO_TICKET can be set.
 3674 
 3675      Add a TLS extension debugging callback to allow the contents of any client
 3676      or server extensions to be examined.
 3677 
 3678      This work was sponsored by Google.
 3679      [Steve Henson]
 3680 
 3681   *) Add initial support for TLS extensions, specifically for the server_name
 3682      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
 3683      have new members for a host name.  The SSL data structure has an
 3684      additional member SSL_CTX *initial_ctx so that new sessions can be
 3685      stored in that context to allow for session resumption, even after the
 3686      SSL has been switched to a new SSL_CTX in reaction to a client's
 3687      server_name extension.
 3688 
 3689      New functions (subject to change):
 3690 
 3691          SSL_get_servername()
 3692          SSL_get_servername_type()
 3693          SSL_set_SSL_CTX()
 3694 
 3695      New CTRL codes and macros (subject to change):
 3696 
 3697          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
 3698                                  - SSL_CTX_set_tlsext_servername_callback()
 3699          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
 3700                                       - SSL_CTX_set_tlsext_servername_arg()
 3701          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
 3702 
 3703      openssl s_client has a new '-servername ...' option.
 3704 
 3705      openssl s_server has new options '-servername_host ...', '-cert2 ...',
 3706      '-key2 ...', '-servername_fatal' (subject to change).  This allows
 3707      testing the HostName extension for a specific single host name ('-cert'
 3708      and '-key' remain fallbacks for handshakes without HostName
 3709      negotiation).  If the unrecogninzed_name alert has to be sent, this by
 3710      default is a warning; it becomes fatal with the '-servername_fatal'
 3711      option.
 3712 
 3713      [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
 3714 
 3715   *) Add AES and SSE2 assembly language support to VC++ build.
 3716      [Steve Henson]
 3717 
 3718   *) Mitigate attack on final subtraction in Montgomery reduction.
 3719      [Andy Polyakov]
 3720 
 3721   *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
 3722      (which previously caused an internal error).
 3723      [Bodo Moeller]
 3724 
 3725   *) Squeeze another 10% out of IGE mode when in != out.
 3726      [Ben Laurie]
 3727 
 3728   *) AES IGE mode speedup.
 3729      [Dean Gaudet (Google)]
 3730 
 3731   *) Add the Korean symmetric 128-bit cipher SEED (see
 3732      http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
 3733      add SEED ciphersuites from RFC 4162:
 3734 
 3735         TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
 3736         TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"
 3737         TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"
 3738         TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
 3739 
 3740      To minimize changes between patchlevels in the OpenSSL 0.9.8
 3741      series, SEED remains excluded from compilation unless OpenSSL
 3742      is configured with 'enable-seed'.
 3743      [KISA, Bodo Moeller]
 3744 
 3745   *) Mitigate branch prediction attacks, which can be practical if a
 3746      single processor is shared, allowing a spy process to extract
 3747      information.  For detailed background information, see
 3748      http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
 3749      J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
 3750      and Necessary Software Countermeasures").  The core of the change
 3751      are new versions BN_div_no_branch() and
 3752      BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
 3753      respectively, which are slower, but avoid the security-relevant
 3754      conditional branches.  These are automatically called by BN_div()
 3755      and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
 3756      of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
 3757      remove a conditional branch.
 3758 
 3759      BN_FLG_CONSTTIME is the new name for the previous
 3760      BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
 3761      modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
 3762      in the exponent causes BN_mod_exp_mont() to use the alternative
 3763      implementation in BN_mod_exp_mont_consttime().)  The old name
 3764      remains as a deprecated alias.
 3765 
 3766      Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
 3767      RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
 3768      constant-time implementations for more than just exponentiation.
 3769      Here too the old name is kept as a deprecated alias.
 3770 
 3771      BN_BLINDING_new() will now use BN_dup() for the modulus so that
 3772      the BN_BLINDING structure gets an independent copy of the
 3773      modulus.  This means that the previous "BIGNUM *m" argument to
 3774      BN_BLINDING_new() and to BN_BLINDING_create_param() now
 3775      essentially becomes "const BIGNUM *m", although we can't actually
 3776      change this in the header file before 0.9.9.  It allows
 3777      RSA_setup_blinding() to use BN_with_flags() on the modulus to
 3778      enable BN_FLG_CONSTTIME.
 3779 
 3780      [Matthew D Wood (Intel Corp)]
 3781 
 3782   *) In the SSL/TLS server implementation, be strict about session ID
 3783      context matching (which matters if an application uses a single
 3784      external cache for different purposes).  Previously,
 3785      out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
 3786      set.  This did ensure strict client verification, but meant that,
 3787      with applications using a single external cache for quite
 3788      different requirements, clients could circumvent ciphersuite
 3789      restrictions for a given session ID context by starting a session
 3790      in a different context.
 3791      [Bodo Moeller]
 3792 
 3793   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
 3794      a ciphersuite string such as "DEFAULT:RSA" cannot enable
 3795      authentication-only ciphersuites.
 3796      [Bodo Moeller]
 3797 
 3798   *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
 3799      not complete and could lead to a possible single byte overflow
 3800      (CVE-2007-5135) [Ben Laurie]
 3801 
 3802  Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
 3803 
 3804   *) Since AES128 and AES256 (and similarly Camellia128 and
 3805      Camellia256) share a single mask bit in the logic of
 3806      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
 3807      kludge to work properly if AES128 is available and AES256 isn't
 3808      (or if Camellia128 is available and Camellia256 isn't).
 3809      [Victor Duchovni]
 3810 
 3811   *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
 3812      (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
 3813      When a point or a seed is encoded in a BIT STRING, we need to
 3814      prevent the removal of trailing zero bits to get the proper DER
 3815      encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
 3816      of a NamedBitList, for which trailing 0 bits need to be removed.)
 3817      [Bodo Moeller]
 3818 
 3819   *) Have SSL/TLS server implementation tolerate "mismatched" record
 3820      protocol version while receiving ClientHello even if the
 3821      ClientHello is fragmented.  (The server can't insist on the
 3822      particular protocol version it has chosen before the ServerHello
 3823      message has informed the client about his choice.)
 3824      [Bodo Moeller]
 3825 
 3826   *) Add RFC 3779 support.
 3827      [Rob Austein for ARIN, Ben Laurie]
 3828 
 3829   *) Load error codes if they are not already present instead of using a
 3830      static variable. This allows them to be cleanly unloaded and reloaded.
 3831      Improve header file function name parsing.
 3832      [Steve Henson]
 3833 
 3834   *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
 3835      or CAPABILITY handshake as required by RFCs.
 3836      [Goetz Babin-Ebell]
 3837 
 3838  Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
 3839 
 3840   *) Introduce limits to prevent malicious keys being able to
 3841      cause a denial of service.  (CVE-2006-2940)
 3842      [Steve Henson, Bodo Moeller]
 3843 
 3844   *) Fix ASN.1 parsing of certain invalid structures that can result
 3845      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
 3846 
 3847   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
 3848      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
 3849 
 3850   *) Fix SSL client code which could crash if connecting to a
 3851      malicious SSLv2 server.  (CVE-2006-4343)
 3852      [Tavis Ormandy and Will Drewry, Google Security Team]
 3853 
 3854   *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
 3855      match only those.  Before that, "AES256-SHA" would be interpreted
 3856      as a pattern and match "AES128-SHA" too (since AES128-SHA got
 3857      the same strength classification in 0.9.7h) as we currently only
 3858      have a single AES bit in the ciphersuite description bitmap.
 3859      That change, however, also applied to ciphersuite strings such as
 3860      "RC4-MD5" that intentionally matched multiple ciphersuites --
 3861      namely, SSL 2.0 ciphersuites in addition to the more common ones
 3862      from SSL 3.0/TLS 1.0.
 3863 
 3864      So we change the selection algorithm again: Naming an explicit
 3865      ciphersuite selects this one ciphersuite, and any other similar
 3866      ciphersuite (same bitmap) from *other* protocol versions.
 3867      Thus, "RC4-MD5" again will properly select both the SSL 2.0
 3868      ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
 3869 
 3870      Since SSL 2.0 does not have any ciphersuites for which the
 3871      128/256 bit distinction would be relevant, this works for now.
 3872      The proper fix will be to use different bits for AES128 and
 3873      AES256, which would have avoided the problems from the beginning;
 3874      however, bits are scarce, so we can only do this in a new release
 3875      (not just a patchlevel) when we can change the SSL_CIPHER
 3876      definition to split the single 'unsigned long mask' bitmap into
 3877      multiple values to extend the available space.
 3878 
 3879      [Bodo Moeller]
 3880 
 3881  Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
 3882 
 3883   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
 3884      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
 3885 
 3886   *) Add AES IGE and biIGE modes.
 3887      [Ben Laurie]
 3888 
 3889   *) Change the Unix randomness entropy gathering to use poll() when
 3890      possible instead of select(), since the latter has some
 3891      undesirable limitations.
 3892      [Darryl Miles via Richard Levitte and Bodo Moeller]
 3893 
 3894   *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
 3895      treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
 3896      cannot be implicitly activated as part of, e.g., the "AES" alias.
 3897      However, please upgrade to OpenSSL 0.9.9[-dev] for
 3898      non-experimental use of the ECC ciphersuites to get TLS extension
 3899      support, which is required for curve and point format negotiation
 3900      to avoid potential handshake problems.
 3901      [Bodo Moeller]
 3902 
 3903   *) Disable rogue ciphersuites:
 3904 
 3905       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
 3906       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
 3907       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
 3908 
 3909      The latter two were purportedly from
 3910      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
 3911      appear there.
 3912 
 3913      Also deactivate the remaining ciphersuites from
 3914      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
 3915      unofficial, and the ID has long expired.
 3916      [Bodo Moeller]
 3917 
 3918   *) Fix RSA blinding Heisenbug (problems sometimes occured on
 3919      dual-core machines) and other potential thread-safety issues.
 3920      [Bodo Moeller]
 3921 
 3922   *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
 3923      versions), which is now available for royalty-free use
 3924      (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
 3925      Also, add Camellia TLS ciphersuites from RFC 4132.
 3926 
 3927      To minimize changes between patchlevels in the OpenSSL 0.9.8
 3928      series, Camellia remains excluded from compilation unless OpenSSL
 3929      is configured with 'enable-camellia'.
 3930      [NTT]
 3931 
 3932   *) Disable the padding bug check when compression is in use. The padding
 3933      bug check assumes the first packet is of even length, this is not
 3934      necessarily true if compresssion is enabled and can result in false
 3935      positives causing handshake failure. The actual bug test is ancient
 3936      code so it is hoped that implementations will either have fixed it by
 3937      now or any which still have the bug do not support compression.
 3938      [Steve Henson]
 3939 
 3940  Changes between 0.9.8a and 0.9.8b  [04 May 2006]
 3941 
 3942   *) When applying a cipher rule check to see if string match is an explicit
 3943      cipher suite and only match that one cipher suite if it is.
 3944      [Steve Henson]
 3945 
 3946   *) Link in manifests for VC++ if needed.
 3947      [Austin Ziegler <halostatue@gmail.com>]
 3948 
 3949   *) Update support for ECC-based TLS ciphersuites according to
 3950      draft-ietf-tls-ecc-12.txt with proposed changes (but without
 3951      TLS extensions, which are supported starting with the 0.9.9
 3952      branch, not in the OpenSSL 0.9.8 branch).
 3953      [Douglas Stebila]
 3954 
 3955   *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
 3956      opaque EVP_CIPHER_CTX handling.
 3957      [Steve Henson]
 3958 
 3959   *) Fixes and enhancements to zlib compression code. We now only use
 3960      "zlib1.dll" and use the default __cdecl calling convention on Win32
 3961      to conform with the standards mentioned here:
 3962            http://www.zlib.net/DLL_FAQ.txt
 3963      Static zlib linking now works on Windows and the new --with-zlib-include
 3964      --with-zlib-lib options to Configure can be used to supply the location
 3965      of the headers and library. Gracefully handle case where zlib library
 3966      can't be loaded.
 3967      [Steve Henson]
 3968 
 3969   *) Several fixes and enhancements to the OID generation code. The old code
 3970      sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
 3971      handle numbers larger than ULONG_MAX, truncated printing and had a
 3972      non standard OBJ_obj2txt() behaviour.
 3973      [Steve Henson]
 3974 
 3975   *) Add support for building of engines under engine/ as shared libraries
 3976      under VC++ build system.
 3977      [Steve Henson]
 3978 
 3979   *) Corrected the numerous bugs in the Win32 path splitter in DSO.
 3980      Hopefully, we will not see any false combination of paths any more.
 3981      [Richard Levitte]
 3982 
 3983  Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
 3984 
 3985   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
 3986      (part of SSL_OP_ALL).  This option used to disable the
 3987      countermeasure against man-in-the-middle protocol-version
 3988      rollback in the SSL 2.0 server implementation, which is a bad
 3989      idea.  (CVE-2005-2969)
 3990 
 3991      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
 3992      for Information Security, National Institute of Advanced Industrial
 3993      Science and Technology [AIST], Japan)]
 3994 
 3995   *) Add two function to clear and return the verify parameter flags.
 3996      [Steve Henson]
 3997 
 3998   *) Keep cipherlists sorted in the source instead of sorting them at
 3999      runtime, thus removing the need for a lock.
 4000      [Nils Larsch]
 4001 
 4002   *) Avoid some small subgroup attacks in Diffie-Hellman.
 4003      [Nick Mathewson and Ben Laurie]
 4004 
 4005   *) Add functions for well-known primes.
 4006      [Nick Mathewson]
 4007 
 4008   *) Extended Windows CE support.
 4009      [Satoshi Nakamura and Andy Polyakov]
 4010 
 4011   *) Initialize SSL_METHOD structures at compile time instead of during
 4012      runtime, thus removing the need for a lock.
 4013      [Steve Henson]
 4014 
 4015   *) Make PKCS7_decrypt() work even if no certificate is supplied by
 4016      attempting to decrypt each encrypted key in turn. Add support to
 4017      smime utility.
 4018      [Steve Henson]
 4019 
 4020  Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
 4021 
 4022   [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
 4023   OpenSSL 0.9.8.]
 4024 
 4025   *) Add libcrypto.pc and libssl.pc for those who feel they need them.
 4026      [Richard Levitte]
 4027 
 4028   *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
 4029      key into the same file any more.
 4030      [Richard Levitte]
 4031 
 4032   *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
 4033      [Andy Polyakov]
 4034 
 4035   *) Add -utf8 command line and config file option to 'ca'.
 4036      [Stefan <stf@udoma.org]
 4037 
 4038   *) Removed the macro des_crypt(), as it seems to conflict with some
 4039      libraries.  Use DES_crypt().
 4040      [Richard Levitte]
 4041 
 4042   *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
 4043      involves renaming the source and generated shared-libs for
 4044      both. The engines will accept the corrected or legacy ids
 4045      ('ncipher' and '4758_cca' respectively) when binding. NB,
 4046      this only applies when building 'shared'.
 4047      [Corinna Vinschen <vinschen@redhat.com> and Geoff Thorpe]
 4048 
 4049   *) Add attribute functions to EVP_PKEY structure. Modify
 4050      PKCS12_create() to recognize a CSP name attribute and
 4051      use it. Make -CSP option work again in pkcs12 utility.
 4052      [Steve Henson]
 4053 
 4054   *) Add new functionality to the bn blinding code:
 4055      - automatic re-creation of the BN_BLINDING parameters after
 4056        a fixed number of uses (currently 32)
 4057      - add new function for parameter creation
 4058      - introduce flags to control the update behaviour of the
 4059        BN_BLINDING parameters
 4060      - hide BN_BLINDING structure
 4061      Add a second BN_BLINDING slot to the RSA structure to improve
 4062      performance when a single RSA object is shared among several
 4063      threads.
 4064      [Nils Larsch]
 4065 
 4066   *) Add support for DTLS.
 4067      [Nagendra Modadugu <nagendra@cs.stanford.edu> and Ben Laurie]
 4068 
 4069   *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
 4070      to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
 4071      [Walter Goulet]
 4072 
 4073   *) Remove buggy and incompletet DH cert support from
 4074      ssl/ssl_rsa.c and ssl/s3_both.c
 4075      [Nils Larsch]
 4076 
 4077   *) Use SHA-1 instead of MD5 as the default digest algorithm for
 4078      the apps/openssl applications.
 4079      [Nils Larsch]
 4080 
 4081   *) Compile clean with "-Wall -Wmissing-prototypes
 4082      -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
 4083      DEBUG_SAFESTACK must also be set.
 4084      [Ben Laurie]
 4085 
 4086   *) Change ./Configure so that certain algorithms can be disabled by default.
 4087      The new counterpiece to "no-xxx" is "enable-xxx".
 4088 
 4089      The patented RC5 and MDC2 algorithms will now be disabled unless
 4090      "enable-rc5" and "enable-mdc2", respectively, are specified.
 4091 
 4092      (IDEA remains enabled despite being patented.  This is because IDEA
 4093      is frequently required for interoperability, and there is no license
 4094      fee for non-commercial use.  As before, "no-idea" can be used to
 4095      avoid this algorithm.)
 4096 
 4097      [Bodo Moeller]
 4098 
 4099   *) Add processing of proxy certificates (see RFC 3820).  This work was
 4100      sponsored by KTH (The Royal Institute of Technology in Stockholm) and
 4101      EGEE (Enabling Grids for E-science in Europe).
 4102      [Richard Levitte]
 4103 
 4104   *) RC4 performance overhaul on modern architectures/implementations, such
 4105      as Intel P4, IA-64 and AMD64.
 4106      [Andy Polyakov]
 4107 
 4108   *) New utility extract-section.pl. This can be used specify an alternative
 4109      section number in a pod file instead of having to treat each file as
 4110      a separate case in Makefile. This can be done by adding two lines to the
 4111      pod file:
 4112 
 4113      =for comment openssl_section:XXX
 4114 
 4115      The blank line is mandatory.
 4116 
 4117      [Steve Henson]
 4118 
 4119   *) New arguments -certform, -keyform and -pass for s_client and s_server
 4120      to allow alternative format key and certificate files and passphrase
 4121      sources.
 4122      [Steve Henson]
 4123 
 4124   *) New structure X509_VERIFY_PARAM which combines current verify parameters,
 4125      update associated structures and add various utility functions.
 4126 
 4127      Add new policy related verify parameters, include policy checking in 
 4128      standard verify code. Enhance 'smime' application with extra parameters
 4129      to support policy checking and print out.
 4130      [Steve Henson]
 4131 
 4132   *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
 4133      Nehemiah processors. These extensions support AES encryption in hardware
 4134      as well as RNG (though RNG support is currently disabled).
 4135      [Michal Ludvig <michal@logix.cz>, with help from Andy Polyakov]
 4136 
 4137   *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
 4138      [Geoff Thorpe]
 4139 
 4140   *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
 4141      [Andy Polyakov and a number of other people]
 4142 
 4143   *) Improved PowerPC platform support. Most notably BIGNUM assembler
 4144      implementation contributed by IBM.
 4145      [Suresh Chari, Peter Waltenberg, Andy Polyakov]
 4146 
 4147   *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
 4148      exponent rather than 'unsigned long'. There is a corresponding change to
 4149      the new 'rsa_keygen' element of the RSA_METHOD structure.
 4150      [Jelte Jansen, Geoff Thorpe]
 4151 
 4152   *) Functionality for creating the initial serial number file is now
 4153      moved from CA.pl to the 'ca' utility with a new option -create_serial.
 4154 
 4155      (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
 4156      number file to 1, which is bound to cause problems.  To avoid
 4157      the problems while respecting compatibility between different 0.9.7
 4158      patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
 4159      CA.pl for serial number initialization.  With the new release 0.9.8,
 4160      we can fix the problem directly in the 'ca' utility.)
 4161      [Steve Henson]
 4162 
 4163   *) Reduced header interdepencies by declaring more opaque objects in
 4164      ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
 4165      give fewer recursive includes, which could break lazy source code - so
 4166      this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
 4167      developers should define this symbol when building and using openssl to
 4168      ensure they track the recommended behaviour, interfaces, [etc], but
 4169      backwards-compatible behaviour prevails when this isn't defined.
 4170      [Geoff Thorpe]
 4171 
 4172   *) New function X509_POLICY_NODE_print() which prints out policy nodes.
 4173      [Steve Henson]
 4174 
 4175   *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
 4176      This will generate a random key of the appropriate length based on the 
 4177      cipher context. The EVP_CIPHER can provide its own random key generation
 4178      routine to support keys of a specific form. This is used in the des and 
 4179      3des routines to generate a key of the correct parity. Update S/MIME
 4180      code to use new functions and hence generate correct parity DES keys.
 4181      Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
 4182      valid (weak or incorrect parity).
 4183      [Steve Henson]
 4184 
 4185   *) Add a local set of CRLs that can be used by X509_verify_cert() as well
 4186      as looking them up. This is useful when the verified structure may contain
 4187      CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
 4188      present unless the new PKCS7_NO_CRL flag is asserted.
 4189      [Steve Henson]
 4190 
 4191   *) Extend ASN1 oid configuration module. It now additionally accepts the
 4192      syntax:
 4193 
 4194      shortName = some long name, 1.2.3.4
 4195      [Steve Henson]
 4196 
 4197   *) Reimplemented the BN_CTX implementation. There is now no more static
 4198      limitation on the number of variables it can handle nor the depth of the
 4199      "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
 4200      information can now expand as required, and rather than having a single
 4201      static array of bignums, BN_CTX now uses a linked-list of such arrays
 4202      allowing it to expand on demand whilst maintaining the usefulness of
 4203      BN_CTX's "bundling".
 4204      [Geoff Thorpe]
 4205 
 4206   *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
 4207      to allow all RSA operations to function using a single BN_CTX.
 4208      [Geoff Thorpe]
 4209 
 4210   *) Preliminary support for certificate policy evaluation and checking. This
 4211      is initially intended to pass the tests outlined in "Conformance Testing
 4212      of Relying Party Client Certificate Path Processing Logic" v1.07.
 4213      [Steve Henson]
 4214 
 4215   *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
 4216      remained unused and not that useful. A variety of other little bignum
 4217      tweaks and fixes have also been made continuing on from the audit (see
 4218      below).
 4219      [Geoff Thorpe]
 4220 
 4221   *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
 4222      associated ASN1, EVP and SSL functions and old ASN1 macros.
 4223      [Richard Levitte]
 4224 
 4225   *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
 4226      and this should never fail. So the return value from the use of
 4227      BN_set_word() (which can fail due to needless expansion) is now deprecated;
 4228      if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
 4229      [Geoff Thorpe]
 4230 
 4231   *) BN_CTX_get() should return zero-valued bignums, providing the same
 4232      initialised value as BN_new().
 4233      [Geoff Thorpe, suggested by Ulf Möller]
 4234 
 4235   *) Support for inhibitAnyPolicy certificate extension.
 4236      [Steve Henson]
 4237 
 4238   *) An audit of the BIGNUM code is underway, for which debugging code is
 4239      enabled when BN_DEBUG is defined. This makes stricter enforcements on what
 4240      is considered valid when processing BIGNUMs, and causes execution to
 4241      assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
 4242      further steps are taken to deliberately pollute unused data in BIGNUM
 4243      structures to try and expose faulty code further on. For now, openssl will
 4244      (in its default mode of operation) continue to tolerate the inconsistent
 4245      forms that it has tolerated in the past, but authors and packagers should
 4246      consider trying openssl and their own applications when compiled with
 4247      these debugging symbols defined. It will help highlight potential bugs in
 4248      their own code, and will improve the test coverage for OpenSSL itself. At
 4249      some point, these tighter rules will become openssl's default to improve
 4250      maintainability, though the assert()s and other overheads will remain only
 4251      in debugging configurations. See bn.h for more details.
 4252      [Geoff Thorpe, Nils Larsch, Ulf Möller]
 4253 
 4254   *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
 4255      that can only be obtained through BN_CTX_new() (which implicitly
 4256      initialises it). The presence of this function only made it possible
 4257      to overwrite an existing structure (and cause memory leaks).
 4258      [Geoff Thorpe]
 4259 
 4260   *) Because of the callback-based approach for implementing LHASH as a
 4261      template type, lh_insert() adds opaque objects to hash-tables and
 4262      lh_doall() or lh_doall_arg() are typically used with a destructor callback
 4263      to clean up those corresponding objects before destroying the hash table
 4264      (and losing the object pointers). So some over-zealous constifications in
 4265      LHASH have been relaxed so that lh_insert() does not take (nor store) the
 4266      objects as "const" and the lh_doall[_arg] callback wrappers are not
 4267      prototyped to have "const" restrictions on the object pointers they are
 4268      given (and so aren't required to cast them away any more).
 4269      [Geoff Thorpe]
 4270 
 4271   *) The tmdiff.h API was so ugly and minimal that our own timing utility
 4272      (speed) prefers to use its own implementation. The two implementations
 4273      haven't been consolidated as yet (volunteers?) but the tmdiff API has had
 4274      its object type properly exposed (MS_TM) instead of casting to/from "char
 4275      *". This may still change yet if someone realises MS_TM and "ms_time_***"
 4276      aren't necessarily the greatest nomenclatures - but this is what was used
 4277      internally to the implementation so I've used that for now.
 4278      [Geoff Thorpe]
 4279 
 4280   *) Ensure that deprecated functions do not get compiled when
 4281      OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
 4282      the self-tests were still using deprecated key-generation functions so
 4283      these have been updated also.
 4284      [Geoff Thorpe]
 4285 
 4286   *) Reorganise PKCS#7 code to separate the digest location functionality
 4287      into PKCS7_find_digest(), digest addtion into PKCS7_bio_add_digest().
 4288      New function PKCS7_set_digest() to set the digest type for PKCS#7
 4289      digestedData type. Add additional code to correctly generate the
 4290      digestedData type and add support for this type in PKCS7 initialization
 4291      functions.
 4292      [Steve Henson]
 4293 
 4294   *) New function PKCS7_set0_type_other() this initializes a PKCS7 
 4295      structure of type "other".
 4296      [Steve Henson]
 4297 
 4298   *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
 4299      sure the loop does correctly stop and breaking ("division by zero")
 4300      modulus operations are not performed. The (pre-generated) prime
 4301      table crypto/bn/bn_prime.h was already correct, but it could not be
 4302      re-generated on some platforms because of the "division by zero"
 4303      situation in the script.
 4304      [Ralf S. Engelschall]
 4305 
 4306   *) Update support for ECC-based TLS ciphersuites according to
 4307      draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
 4308      SHA-1 now is only used for "small" curves (where the
 4309      representation of a field element takes up to 24 bytes); for
 4310      larger curves, the field element resulting from ECDH is directly
 4311      used as premaster secret.
 4312      [Douglas Stebila (Sun Microsystems Laboratories)]
 4313 
 4314   *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
 4315      curve secp160r1 to the tests.
 4316      [Douglas Stebila (Sun Microsystems Laboratories)]
 4317 
 4318   *) Add the possibility to load symbols globally with DSO.
 4319      [Götz Babin-Ebell <babin-ebell@trustcenter.de> via Richard Levitte]
 4320 
 4321   *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
 4322      control of the error stack.
 4323      [Richard Levitte]
 4324 
 4325   *) Add support for STORE in ENGINE.
 4326      [Richard Levitte]
 4327 
 4328   *) Add the STORE type.  The intention is to provide a common interface
 4329      to certificate and key stores, be they simple file-based stores, or
 4330      HSM-type store, or LDAP stores, or...
 4331      NOTE: The code is currently UNTESTED and isn't really used anywhere.
 4332      [Richard Levitte]
 4333 
 4334   *) Add a generic structure called OPENSSL_ITEM.  This can be used to
 4335      pass a list of arguments to any function as well as provide a way
 4336      for a function to pass data back to the caller.
 4337      [Richard Levitte]
 4338 
 4339   *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
 4340      works like BUF_strdup() but can be used to duplicate a portion of
 4341      a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
 4342      a memory area.
 4343      [Richard Levitte]
 4344 
 4345   *) Add the function sk_find_ex() which works like sk_find(), but will
 4346      return an index to an element even if an exact match couldn't be
 4347      found.  The index is guaranteed to point at the element where the
 4348      searched-for key would be inserted to preserve sorting order.
 4349      [Richard Levitte]
 4350 
 4351   *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
 4352      takes an extra flags argument for optional functionality.  Currently,
 4353      the following flags are defined:
 4354 
 4355 	OBJ_BSEARCH_VALUE_ON_NOMATCH
 4356 	This one gets OBJ_bsearch_ex() to return a pointer to the first
 4357 	element where the comparing function returns a negative or zero
 4358 	number.
 4359 
 4360 	OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
 4361 	This one gets OBJ_bsearch_ex() to return a pointer to the first
 4362 	element where the comparing function returns zero.  This is useful
 4363 	if there are more than one element where the comparing function
 4364 	returns zero.
 4365      [Richard Levitte]
 4366 
 4367   *) Make it possible to create self-signed certificates with 'openssl ca'
 4368      in such a way that the self-signed certificate becomes part of the
 4369      CA database and uses the same mechanisms for serial number generation
 4370      as all other certificate signing.  The new flag '-selfsign' enables
 4371      this functionality.  Adapt CA.sh and CA.pl.in.
 4372      [Richard Levitte]
 4373 
 4374   *) Add functionality to check the public key of a certificate request
 4375      against a given private.  This is useful to check that a certificate
 4376      request can be signed by that key (self-signing).
 4377      [Richard Levitte]
 4378 
 4379   *) Make it possible to have multiple active certificates with the same
 4380      subject in the CA index file.  This is done only if the keyword
 4381      'unique_subject' is set to 'no' in the main CA section (default
 4382      if 'CA_default') of the configuration file.  The value is saved
 4383      with the database itself in a separate index attribute file,
 4384      named like the index file with '.attr' appended to the name.
 4385      [Richard Levitte]
 4386 
 4387   *) Generate muti valued AVAs using '+' notation in config files for
 4388      req and dirName.
 4389      [Steve Henson]
 4390 
 4391   *) Support for nameConstraints certificate extension.
 4392      [Steve Henson]
 4393 
 4394   *) Support for policyConstraints certificate extension.
 4395      [Steve Henson]
 4396 
 4397   *) Support for policyMappings certificate extension.
 4398      [Steve Henson]
 4399 
 4400   *) Make sure the default DSA_METHOD implementation only uses its
 4401      dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
 4402      and change its own handlers to be NULL so as to remove unnecessary
 4403      indirection. This lets alternative implementations fallback to the
 4404      default implementation more easily.
 4405      [Geoff Thorpe]
 4406 
 4407   *) Support for directoryName in GeneralName related extensions
 4408      in config files.
 4409      [Steve Henson]
 4410 
 4411   *) Make it possible to link applications using Makefile.shared.
 4412      Make that possible even when linking against static libraries!
 4413      [Richard Levitte]
 4414 
 4415   *) Support for single pass processing for S/MIME signing. This now
 4416      means that S/MIME signing can be done from a pipe, in addition
 4417      cleartext signing (multipart/signed type) is effectively streaming
 4418      and the signed data does not need to be all held in memory.
 4419 
 4420      This is done with a new flag PKCS7_STREAM. When this flag is set
 4421      PKCS7_sign() only initializes the PKCS7 structure and the actual signing
 4422      is done after the data is output (and digests calculated) in
 4423      SMIME_write_PKCS7().
 4424      [Steve Henson]
 4425 
 4426   *) Add full support for -rpath/-R, both in shared libraries and
 4427      applications, at least on the platforms where it's known how
 4428      to do it.
 4429      [Richard Levitte]
 4430 
 4431   *) In crypto/ec/ec_mult.c, implement fast point multiplication with
 4432      precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
 4433      will now compute a table of multiples of the generator that
 4434      makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
 4435      faster (notably in the case of a single point multiplication,
 4436      scalar * generator).
 4437      [Nils Larsch, Bodo Moeller]
 4438 
 4439   *) IPv6 support for certificate extensions. The various extensions
 4440      which use the IP:a.b.c.d can now take IPv6 addresses using the
 4441      formats of RFC1884 2.2 . IPv6 addresses are now also displayed
 4442      correctly.
 4443      [Steve Henson]
 4444 
 4445   *) Added an ENGINE that implements RSA by performing private key
 4446      exponentiations with the GMP library. The conversions to and from
 4447      GMP's mpz_t format aren't optimised nor are any montgomery forms
 4448      cached, and on x86 it appears OpenSSL's own performance has caught up.
 4449      However there are likely to be other architectures where GMP could
 4450      provide a boost. This ENGINE is not built in by default, but it can be
 4451      specified at Configure time and should be accompanied by the necessary
 4452      linker additions, eg;
 4453          ./config -DOPENSSL_USE_GMP -lgmp
 4454      [Geoff Thorpe]
 4455 
 4456   *) "openssl engine" will not display ENGINE/DSO load failure errors when
 4457      testing availability of engines with "-t" - the old behaviour is
 4458      produced by increasing the feature's verbosity with "-tt".
 4459      [Geoff Thorpe]
 4460 
 4461   *) ECDSA routines: under certain error conditions uninitialized BN objects
 4462      could be freed. Solution: make sure initialization is performed early
 4463      enough. (Reported and fix supplied by Nils Larsch <nla@trustcenter.de>
 4464      via PR#459)
 4465      [Lutz Jaenicke]
 4466 
 4467   *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
 4468      and DH_METHOD (eg. by ENGINE implementations) to override the normal
 4469      software implementations. For DSA and DH, parameter generation can
 4470      also be overriden by providing the appropriate method callbacks.
 4471      [Geoff Thorpe]
 4472 
 4473   *) Change the "progress" mechanism used in key-generation and
 4474      primality testing to functions that take a new BN_GENCB pointer in
 4475      place of callback/argument pairs. The new API functions have "_ex"
 4476      postfixes and the older functions are reimplemented as wrappers for
 4477      the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
 4478      declarations of the old functions to help (graceful) attempts to
 4479      migrate to the new functions. Also, the new key-generation API
 4480      functions operate on a caller-supplied key-structure and return
 4481      success/failure rather than returning a key or NULL - this is to
 4482      help make "keygen" another member function of RSA_METHOD etc.
 4483 
 4484      Example for using the new callback interface:
 4485 
 4486           int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
 4487           void *my_arg = ...;
 4488           BN_GENCB my_cb;
 4489 
 4490           BN_GENCB_set(&my_cb, my_callback, my_arg);
 4491 
 4492           return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
 4493           /* For the meaning of a, b in calls to my_callback(), see the
 4494            * documentation of the function that calls the callback.
 4495            * cb will point to my_cb; my_arg can be retrieved as cb->arg.
 4496            * my_callback should return 1 if it wants BN_is_prime_ex()
 4497            * to continue, or 0 to stop.
 4498            */
 4499 
 4500      [Geoff Thorpe]
 4501 
 4502   *) Change the ZLIB compression method to be stateful, and make it
 4503      available to TLS with the number defined in 
 4504      draft-ietf-tls-compression-04.txt.
 4505      [Richard Levitte]
 4506 
 4507   *) Add the ASN.1 structures and functions for CertificatePair, which
 4508      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
 4509 
 4510      CertificatePair ::= SEQUENCE {
 4511         forward		[0]	Certificate OPTIONAL,
 4512         reverse		[1]	Certificate OPTIONAL,
 4513         -- at least one of the pair shall be present -- }
 4514 
 4515      Also implement the PEM functions to read and write certificate
 4516      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
 4517 
 4518      This needed to be defined, mostly for the sake of the LDAP
 4519      attribute crossCertificatePair, but may prove useful elsewhere as
 4520      well.
 4521      [Richard Levitte]
 4522 
 4523   *) Make it possible to inhibit symlinking of shared libraries in
 4524      Makefile.shared, for Cygwin's sake.
 4525      [Richard Levitte]
 4526 
 4527   *) Extend the BIGNUM API by creating a function 
 4528           void BN_set_negative(BIGNUM *a, int neg);
 4529      and a macro that behave like
 4530           int  BN_is_negative(const BIGNUM *a);
 4531 
 4532      to avoid the need to access 'a->neg' directly in applications.
 4533      [Nils Larsch]
 4534 
 4535   *) Implement fast modular reduction for pseudo-Mersenne primes
 4536      used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
 4537      EC_GROUP_new_curve_GFp() will now automatically use this
 4538      if applicable.
 4539      [Nils Larsch <nla@trustcenter.de>]
 4540 
 4541   *) Add new lock type (CRYPTO_LOCK_BN).
 4542      [Bodo Moeller]
 4543 
 4544   *) Change the ENGINE framework to automatically load engines
 4545      dynamically from specific directories unless they could be
 4546      found to already be built in or loaded.  Move all the
 4547      current engines except for the cryptodev one to a new
 4548      directory engines/.
 4549      The engines in engines/ are built as shared libraries if
 4550      the "shared" options was given to ./Configure or ./config.
 4551      Otherwise, they are inserted in libcrypto.a.
 4552      /usr/local/ssl/engines is the default directory for dynamic
 4553      engines, but that can be overriden at configure time through
 4554      the usual use of --prefix and/or --openssldir, and at run
 4555      time with the environment variable OPENSSL_ENGINES.
 4556      [Geoff Thorpe and Richard Levitte]
 4557 
 4558   *) Add Makefile.shared, a helper makefile to build shared
 4559      libraries.  Addapt Makefile.org.
 4560      [Richard Levitte]
 4561 
 4562   *) Add version info to Win32 DLLs.
 4563      [Peter 'Luna' Runestig" <peter@runestig.com>]
 4564 
 4565   *) Add new 'medium level' PKCS#12 API. Certificates and keys
 4566      can be added using this API to created arbitrary PKCS#12
 4567      files while avoiding the low level API.
 4568 
 4569      New options to PKCS12_create(), key or cert can be NULL and
 4570      will then be omitted from the output file. The encryption
 4571      algorithm NIDs can be set to -1 for no encryption, the mac
 4572      iteration count can be set to 0 to omit the mac.
 4573 
 4574      Enhance pkcs12 utility by making the -nokeys and -nocerts
 4575      options work when creating a PKCS#12 file. New option -nomac
 4576      to omit the mac, NONE can be set for an encryption algorithm.
 4577      New code is modified to use the enhanced PKCS12_create()
 4578      instead of the low level API.
 4579      [Steve Henson]
 4580 
 4581   *) Extend ASN1 encoder to support indefinite length constructed
 4582      encoding. This can output sequences tags and octet strings in
 4583      this form. Modify pk7_asn1.c to support indefinite length
 4584      encoding. This is experimental and needs additional code to
 4585      be useful, such as an ASN1 bio and some enhanced streaming
 4586      PKCS#7 code.
 4587 
 4588      Extend template encode functionality so that tagging is passed
 4589      down to the template encoder.
 4590      [Steve Henson]
 4591 
 4592   *) Let 'openssl req' fail if an argument to '-newkey' is not
 4593      recognized instead of using RSA as a default.
 4594      [Bodo Moeller]
 4595 
 4596   *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
 4597      As these are not official, they are not included in "ALL";
 4598      the "ECCdraft" ciphersuite group alias can be used to select them.
 4599      [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
 4600 
 4601   *) Add ECDH engine support.
 4602      [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
 4603 
 4604   *) Add ECDH in new directory crypto/ecdh/.
 4605      [Douglas Stebila (Sun Microsystems Laboratories)]
 4606 
 4607   *) Let BN_rand_range() abort with an error after 100 iterations
 4608      without success (which indicates a broken PRNG).
 4609      [Bodo Moeller]
 4610 
 4611   *) Change BN_mod_sqrt() so that it verifies that the input value
 4612      is really the square of the return value.  (Previously,
 4613      BN_mod_sqrt would show GIGO behaviour.)
 4614      [Bodo Moeller]
 4615 
 4616   *) Add named elliptic curves over binary fields from X9.62, SECG,
 4617      and WAP/WTLS; add OIDs that were still missing.
 4618 
 4619      [Sheueling Chang Shantz and Douglas Stebila
 4620      (Sun Microsystems Laboratories)]
 4621 
 4622   *) Extend the EC library for elliptic curves over binary fields
 4623      (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
 4624      New EC_METHOD:
 4625 
 4626           EC_GF2m_simple_method
 4627 
 4628      New API functions:
 4629 
 4630           EC_GROUP_new_curve_GF2m
 4631           EC_GROUP_set_curve_GF2m
 4632           EC_GROUP_get_curve_GF2m
 4633           EC_POINT_set_affine_coordinates_GF2m
 4634           EC_POINT_get_affine_coordinates_GF2m
 4635           EC_POINT_set_compressed_coordinates_GF2m
 4636 
 4637      Point compression for binary fields is disabled by default for
 4638      patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
 4639      enable it).
 4640 
 4641      As binary polynomials are represented as BIGNUMs, various members
 4642      of the EC_GROUP and EC_POINT data structures can be shared
 4643      between the implementations for prime fields and binary fields;
 4644      the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
 4645      are essentially identical to their ..._GFp counterparts.
 4646      (For simplicity, the '..._GFp' prefix has been dropped from
 4647      various internal method names.)
 4648 
 4649      An internal 'field_div' method (similar to 'field_mul' and
 4650      'field_sqr') has been added; this is used only for binary fields.
 4651 
 4652      [Sheueling Chang Shantz and Douglas Stebila
 4653      (Sun Microsystems Laboratories)]
 4654 
 4655   *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
 4656      through methods ('mul', 'precompute_mult').
 4657 
 4658      The generic implementations (now internally called 'ec_wNAF_mul'
 4659      and 'ec_wNAF_precomputed_mult') remain the default if these
 4660      methods are undefined.
 4661 
 4662      [Sheueling Chang Shantz and Douglas Stebila
 4663      (Sun Microsystems Laboratories)]
 4664 
 4665   *) New function EC_GROUP_get_degree, which is defined through
 4666      EC_METHOD.  For curves over prime fields, this returns the bit
 4667      length of the modulus.
 4668 
 4669      [Sheueling Chang Shantz and Douglas Stebila
 4670      (Sun Microsystems Laboratories)]
 4671 
 4672   *) New functions EC_GROUP_dup, EC_POINT_dup.
 4673      (These simply call ..._new  and ..._copy).
 4674 
 4675      [Sheueling Chang Shantz and Douglas Stebila
 4676      (Sun Microsystems Laboratories)]
 4677 
 4678   *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
 4679      Polynomials are represented as BIGNUMs (where the sign bit is not
 4680      used) in the following functions [macros]:  
 4681 
 4682           BN_GF2m_add
 4683           BN_GF2m_sub             [= BN_GF2m_add]
 4684           BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
 4685           BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
 4686           BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
 4687           BN_GF2m_mod_inv
 4688           BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
 4689           BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
 4690           BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
 4691           BN_GF2m_cmp             [= BN_ucmp]
 4692 
 4693      (Note that only the 'mod' functions are actually for fields GF(2^m).
 4694      BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
 4695 
 4696      For some functions, an the irreducible polynomial defining a
 4697      field can be given as an 'unsigned int[]' with strictly
 4698      decreasing elements giving the indices of those bits that are set;
 4699      i.e., p[] represents the polynomial
 4700           f(t) = t^p[0] + t^p[1] + ... + t^p[k]
 4701      where
 4702           p[0] > p[1] > ... > p[k] = 0.
 4703      This applies to the following functions:
 4704 
 4705           BN_GF2m_mod_arr
 4706           BN_GF2m_mod_mul_arr
 4707           BN_GF2m_mod_sqr_arr
 4708           BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
 4709           BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
 4710           BN_GF2m_mod_exp_arr
 4711           BN_GF2m_mod_sqrt_arr
 4712           BN_GF2m_mod_solve_quad_arr
 4713           BN_GF2m_poly2arr
 4714           BN_GF2m_arr2poly
 4715 
 4716      Conversion can be performed by the following functions:
 4717 
 4718           BN_GF2m_poly2arr
 4719           BN_GF2m_arr2poly
 4720 
 4721      bntest.c has additional tests for binary polynomial arithmetic.
 4722 
 4723      Two implementations for BN_GF2m_mod_div() are available.
 4724      The default algorithm simply uses BN_GF2m_mod_inv() and
 4725      BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
 4726      if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
 4727      copyright notice in crypto/bn/bn_gf2m.c before enabling it).
 4728 
 4729      [Sheueling Chang Shantz and Douglas Stebila
 4730      (Sun Microsystems Laboratories)]
 4731 
 4732   *) Add new error code 'ERR_R_DISABLED' that can be used when some
 4733      functionality is disabled at compile-time.
 4734      [Douglas Stebila <douglas.stebila@sun.com>]
 4735 
 4736   *) Change default behaviour of 'openssl asn1parse' so that more
 4737      information is visible when viewing, e.g., a certificate:
 4738 
 4739      Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
 4740      mode the content of non-printable OCTET STRINGs is output in a
 4741      style similar to INTEGERs, but with '[HEX DUMP]' prepended to
 4742      avoid the appearance of a printable string.
 4743      [Nils Larsch <nla@trustcenter.de>]
 4744 
 4745   *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
 4746      functions
 4747           EC_GROUP_set_asn1_flag()
 4748           EC_GROUP_get_asn1_flag()
 4749           EC_GROUP_set_point_conversion_form()
 4750           EC_GROUP_get_point_conversion_form()
 4751      These control ASN1 encoding details:
 4752      - Curves (i.e., groups) are encoded explicitly unless asn1_flag
 4753        has been set to OPENSSL_EC_NAMED_CURVE.
 4754      - Points are encoded in uncompressed form by default; options for
 4755        asn1_for are as for point2oct, namely
 4756           POINT_CONVERSION_COMPRESSED
 4757           POINT_CONVERSION_UNCOMPRESSED
 4758           POINT_CONVERSION_HYBRID
 4759 
 4760      Also add 'seed' and 'seed_len' members to EC_GROUP with access
 4761      functions
 4762           EC_GROUP_set_seed()
 4763           EC_GROUP_get0_seed()
 4764           EC_GROUP_get_seed_len()
 4765      This is used only for ASN1 purposes (so far).
 4766      [Nils Larsch <nla@trustcenter.de>]
 4767 
 4768   *) Add 'field_type' member to EC_METHOD, which holds the NID
 4769      of the appropriate field type OID.  The new function
 4770      EC_METHOD_get_field_type() returns this value.
 4771      [Nils Larsch <nla@trustcenter.de>]
 4772 
 4773   *) Add functions 
 4774           EC_POINT_point2bn()
 4775           EC_POINT_bn2point()
 4776           EC_POINT_point2hex()
 4777           EC_POINT_hex2point()
 4778      providing useful interfaces to EC_POINT_point2oct() and
 4779      EC_POINT_oct2point().
 4780      [Nils Larsch <nla@trustcenter.de>]
 4781 
 4782   *) Change internals of the EC library so that the functions
 4783           EC_GROUP_set_generator()
 4784           EC_GROUP_get_generator()
 4785           EC_GROUP_get_order()
 4786           EC_GROUP_get_cofactor()
 4787      are implemented directly in crypto/ec/ec_lib.c and not dispatched
 4788      to methods, which would lead to unnecessary code duplication when
 4789      adding different types of curves.
 4790      [Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller]
 4791 
 4792   *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
 4793      arithmetic, and such that modified wNAFs are generated
 4794      (which avoid length expansion in many cases).
 4795      [Bodo Moeller]
 4796 
 4797   *) Add a function EC_GROUP_check_discriminant() (defined via
 4798      EC_METHOD) that verifies that the curve discriminant is non-zero.
 4799 
 4800      Add a function EC_GROUP_check() that makes some sanity tests
 4801      on a EC_GROUP, its generator and order.  This includes
 4802      EC_GROUP_check_discriminant().
 4803      [Nils Larsch <nla@trustcenter.de>]
 4804 
 4805   *) Add ECDSA in new directory crypto/ecdsa/.
 4806 
 4807      Add applications 'openssl ecparam' and 'openssl ecdsa'
 4808      (these are based on 'openssl dsaparam' and 'openssl dsa').
 4809 
 4810      ECDSA support is also included in various other files across the
 4811      library.  Most notably,
 4812      - 'openssl req' now has a '-newkey ecdsa:file' option;
 4813      - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
 4814      - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
 4815        d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
 4816        them suitable for ECDSA where domain parameters must be
 4817        extracted before the specific public key;
 4818      - ECDSA engine support has been added.
 4819      [Nils Larsch <nla@trustcenter.de>]
 4820 
 4821   *) Include some named elliptic curves, and add OIDs from X9.62,
 4822      SECG, and WAP/WTLS.  Each curve can be obtained from the new
 4823      function
 4824           EC_GROUP_new_by_curve_name(),
 4825      and the list of available named curves can be obtained with
 4826           EC_get_builtin_curves().
 4827      Also add a 'curve_name' member to EC_GROUP objects, which can be
 4828      accessed via
 4829          EC_GROUP_set_curve_name()
 4830          EC_GROUP_get_curve_name()
 4831      [Nils Larsch <larsch@trustcenter.de, Bodo Moeller]
 4832  
 4833   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
 4834      was actually never needed) and in BN_mul().  The removal in BN_mul()
 4835      required a small change in bn_mul_part_recursive() and the addition
 4836      of the functions bn_cmp_part_words(), bn_sub_part_words() and
 4837      bn_add_part_words(), which do the same thing as bn_cmp_words(),
 4838      bn_sub_words() and bn_add_words() except they take arrays with
 4839      differing sizes.
 4840      [Richard Levitte]
 4841 
 4842  Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
 4843 
 4844   *) Cleanse PEM buffers before freeing them since they may contain 
 4845      sensitive data.
 4846      [Benjamin Bennett <ben@psc.edu>]
 4847 
 4848   *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
 4849      a ciphersuite string such as "DEFAULT:RSA" cannot enable
 4850      authentication-only ciphersuites.
 4851      [Bodo Moeller]
 4852 
 4853   *) Since AES128 and AES256 share a single mask bit in the logic of
 4854      ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
 4855      kludge to work properly if AES128 is available and AES256 isn't.
 4856      [Victor Duchovni]
 4857 
 4858   *) Expand security boundary to match 1.1.1 module.
 4859      [Steve Henson]
 4860 
 4861   *) Remove redundant features: hash file source, editing of test vectors
 4862      modify fipsld to use external fips_premain.c signature.
 4863      [Steve Henson]
 4864 
 4865   *) New perl script mkfipsscr.pl to create shell scripts or batch files to
 4866      run algorithm test programs.
 4867      [Steve Henson]
 4868 
 4869   *) Make algorithm test programs more tolerant of whitespace.
 4870      [Steve Henson]
 4871 
 4872   *) Have SSL/TLS server implementation tolerate "mismatched" record
 4873      protocol version while receiving ClientHello even if the
 4874      ClientHello is fragmented.  (The server can't insist on the
 4875      particular protocol version it has chosen before the ServerHello
 4876      message has informed the client about his choice.)
 4877      [Bodo Moeller]
 4878 
 4879   *) Load error codes if they are not already present instead of using a
 4880      static variable. This allows them to be cleanly unloaded and reloaded.
 4881      [Steve Henson]
 4882 
 4883  Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
 4884 
 4885   *) Introduce limits to prevent malicious keys being able to
 4886      cause a denial of service.  (CVE-2006-2940)
 4887      [Steve Henson, Bodo Moeller]
 4888 
 4889   *) Fix ASN.1 parsing of certain invalid structures that can result
 4890      in a denial of service.  (CVE-2006-2937)  [Steve Henson]
 4891 
 4892   *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
 4893      (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
 4894 
 4895   *) Fix SSL client code which could crash if connecting to a
 4896      malicious SSLv2 server.  (CVE-2006-4343)
 4897      [Tavis Ormandy and Will Drewry, Google Security Team]
 4898 
 4899   *) Change ciphersuite string processing so that an explicit
 4900      ciphersuite selects this one ciphersuite (so that "AES256-SHA"
 4901      will no longer include "AES128-SHA"), and any other similar
 4902      ciphersuite (same bitmap) from *other* protocol versions (so that
 4903      "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
 4904      SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
 4905      changes from 0.9.8b and 0.9.8d.
 4906      [Bodo Moeller]
 4907 
 4908  Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
 4909 
 4910   *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
 4911      (CVE-2006-4339)  [Ben Laurie and Google Security Team]
 4912 
 4913   *) Change the Unix randomness entropy gathering to use poll() when
 4914      possible instead of select(), since the latter has some
 4915      undesirable limitations.
 4916      [Darryl Miles via Richard Levitte and Bodo Moeller]
 4917 
 4918   *) Disable rogue ciphersuites:
 4919 
 4920       - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
 4921       - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
 4922       - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
 4923 
 4924      The latter two were purportedly from
 4925      draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
 4926      appear there.
 4927 
 4928      Also deactive the remaining ciphersuites from
 4929      draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
 4930      unofficial, and the ID has long expired.
 4931      [Bodo Moeller]
 4932 
 4933   *) Fix RSA blinding Heisenbug (problems sometimes occured on
 4934      dual-core machines) and other potential thread-safety issues.
 4935      [Bodo Moeller]
 4936 
 4937  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
 4938 
 4939   *) Adapt fipsld and the build system to link against the validated FIPS
 4940      module in FIPS mode.
 4941      [Steve Henson]
 4942 
 4943   *) Fixes for VC++ 2005 build under Windows.
 4944      [Steve Henson]
 4945 
 4946   *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
 4947      from a Windows bash shell such as MSYS. It is autodetected from the
 4948      "config" script when run from a VC++ environment. Modify standard VC++
 4949      build to use fipscanister.o from the GNU make build. 
 4950      [Steve Henson]
 4951 
 4952  Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
 4953 
 4954   *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
 4955      The value now differs depending on if you build for FIPS or not.
 4956      BEWARE!  A program linked with a shared FIPSed libcrypto can't be
 4957      safely run with a non-FIPSed libcrypto, as it may crash because of
 4958      the difference induced by this change.
 4959      [Andy Polyakov]
 4960 
 4961  Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
 4962 
 4963   *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
 4964      (part of SSL_OP_ALL).  This option used to disable the
 4965      countermeasure against man-in-the-middle protocol-version
 4966      rollback in the SSL 2.0 server implementation, which is a bad
 4967      idea.  (CVE-2005-2969)
 4968 
 4969      [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
 4970      for Information Security, National Institute of Advanced Industrial
 4971      Science and Technology [AIST], Japan)]
 4972 
 4973   *) Minimal support for X9.31 signatures and PSS padding modes. This is
 4974      mainly for FIPS compliance and not fully integrated at this stage.
 4975      [Steve Henson]
 4976 
 4977   *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
 4978      the exponentiation using a fixed-length exponent.  (Otherwise,
 4979      the information leaked through timing could expose the secret key
 4980      after many signatures; cf. Bleichenbacher's attack on DSA with
 4981      biased k.)
 4982      [Bodo Moeller]
 4983 
 4984   *) Make a new fixed-window mod_exp implementation the default for
 4985      RSA, DSA, and DH private-key operations so that the sequence of
 4986      squares and multiplies and the memory access pattern are
 4987      independent of the particular secret key.  This will mitigate
 4988      cache-timing and potential related attacks.
 4989 
 4990      BN_mod_exp_mont_consttime() is the new exponentiation implementation,
 4991      and this is automatically used by BN_mod_exp_mont() if the new flag
 4992      BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
 4993      will use this BN flag for private exponents unless the flag
 4994      RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
 4995      DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
 4996 
 4997      [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
 4998 
 4999   *) Change the client implementation for SSLv23_method() and
 5000      SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
 5001      Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
 5002      (Previously, the SSL 2.0 backwards compatible Client Hello
 5003      message format would be used even with SSL_OP_NO_SSLv2.)
 5004      [Bodo Moeller]
 5005 
 5006   *) Add support for smime-type MIME parameter in S/MIME messages which some
 5007      clients need.
 5008      [Steve Henson]
 5009 
 5010   *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
 5011      a threadsafe manner. Modify rsa code to use new function and add calls
 5012      to dsa and dh code (which had race conditions before).
 5013      [Steve Henson]
 5014 
 5015   *) Include the fixed error library code in the C error file definitions
 5016      instead of fixing them up at runtime. This keeps the error code
 5017      structures constant.
 5018      [Steve Henson]
 5019 
 5020  Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
 5021 
 5022   [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
 5023   OpenSSL 0.9.8.]
 5024 
 5025   *) Fixes for newer kerberos headers. NB: the casts are needed because
 5026      the 'length' field is signed on one version and unsigned on another
 5027      with no (?) obvious way to tell the difference, without these VC++
 5028      complains. Also the "definition" of FAR (blank) is no longer included
 5029      nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
 5030      some needed definitions.
 5031      [Steve Henson]
 5032 
 5033   *) Undo Cygwin change.
 5034      [Ulf Möller]
 5035 
 5036   *) Added support for proxy certificates according to RFC 3820.
 5037      Because they may be a security thread to unaware applications,
 5038      they must be explicitely allowed in run-time.  See
 5039      docs/HOWTO/proxy_certificates.txt for further information.
 5040      [Richard Levitte]
 5041 
 5042  Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
 5043 
 5044   *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
 5045      server and client random values. Previously
 5046      (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
 5047      less random data when sizeof(time_t) > 4 (some 64 bit platforms).
 5048 
 5049      This change has negligible security impact because:
 5050 
 5051      1. Server and client random values still have 24 bytes of pseudo random
 5052         data.
 5053 
 5054      2. Server and client random values are sent in the clear in the initial
 5055         handshake.
 5056 
 5057      3. The master secret is derived using the premaster secret (48 bytes in
 5058         size for static RSA ciphersuites) as well as client server and random
 5059         values.
 5060 
 5061      The OpenSSL team would like to thank the UK NISCC for bringing this issue
 5062      to our attention. 
 5063 
 5064      [Stephen Henson, reported by UK NISCC]
 5065 
 5066   *) Use Windows randomness collection on Cygwin.
 5067      [Ulf Möller]
 5068 
 5069   *) Fix hang in EGD/PRNGD query when communication socket is closed
 5070      prematurely by EGD/PRNGD.
 5071      [Darren Tucker <dtucker@zip.com.au> via Lutz Jänicke, resolves #1014]
 5072 
 5073   *) Prompt for pass phrases when appropriate for PKCS12 input format.
 5074      [Steve Henson]
 5075 
 5076   *) Back-port of selected performance improvements from development
 5077      branch, as well as improved support for PowerPC platforms.
 5078      [Andy Polyakov]
 5079 
 5080   *) Add lots of checks for memory allocation failure, error codes to indicate
 5081      failure and freeing up memory if a failure occurs.
 5082      [Nauticus Networks SSL Team <openssl@nauticusnet.com>, Steve Henson]
 5083 
 5084   *) Add new -passin argument to dgst.
 5085      [Steve Henson]
 5086 
 5087   *) Perform some character comparisons of different types in X509_NAME_cmp:
 5088      this is needed for some certificates that reencode DNs into UTF8Strings
 5089      (in violation of RFC3280) and can't or wont issue name rollover
 5090      certificates.
 5091      [Steve Henson]
 5092 
 5093   *) Make an explicit check during certificate validation to see that
 5094      the CA setting in each certificate on the chain is correct.  As a
 5095      side effect always do the following basic checks on extensions,
 5096      not just when there's an associated purpose to the check:
 5097 
 5098       - if there is an unhandled critical extension (unless the user
 5099         has chosen to ignore this fault)
 5100       - if the path length has been exceeded (if one is set at all)
 5101       - that certain extensions fit the associated purpose (if one has
 5102         been given)
 5103      [Richard Levitte]
 5104 
 5105  Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
 5106 
 5107   *) Avoid a race condition when CRLs are checked in a multi threaded 
 5108      environment. This would happen due to the reordering of the revoked
 5109      entries during signature checking and serial number lookup. Now the
 5110      encoding is cached and the serial number sort performed under a lock.
 5111      Add new STACK function sk_is_sorted().
 5112      [Steve Henson]
 5113 
 5114   *) Add Delta CRL to the extension code.
 5115      [Steve Henson]
 5116 
 5117   *) Various fixes to s3_pkt.c so alerts are sent properly.
 5118      [David Holmes <d.holmes@f5.com>]
 5119 
 5120   *) Reduce the chances of duplicate issuer name and serial numbers (in
 5121      violation of RFC3280) using the OpenSSL certificate creation utilities.
 5122      This is done by creating a random 64 bit value for the initial serial
 5123      number when a serial number file is created or when a self signed
 5124      certificate is created using 'openssl req -x509'. The initial serial
 5125      number file is created using 'openssl x509 -next_serial' in CA.pl
 5126      rather than being initialized to 1.
 5127      [Steve Henson]
 5128 
 5129  Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
 5130 
 5131   *) Fix null-pointer assignment in do_change_cipher_spec() revealed           
 5132      by using the Codenomicon TLS Test Tool (CVE-2004-0079)                    
 5133      [Joe Orton, Steve Henson]   
 5134 
 5135   *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
 5136      (CVE-2004-0112)
 5137      [Joe Orton, Steve Henson]   
 5138 
 5139   *) Make it possible to have multiple active certificates with the same
 5140      subject in the CA index file.  This is done only if the keyword
 5141      'unique_subject' is set to 'no' in the main CA section (default
 5142      if 'CA_default') of the configuration file.  The value is saved
 5143      with the database itself in a separate index attribute file,
 5144      named like the index file with '.attr' appended to the name.
 5145      [Richard Levitte]
 5146 
 5147   *) X509 verify fixes. Disable broken certificate workarounds when 
 5148      X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
 5149      keyUsage extension present. Don't accept CRLs with unhandled critical
 5150      extensions: since verify currently doesn't process CRL extensions this
 5151      rejects a CRL with *any* critical extensions. Add new verify error codes
 5152      for these cases.
 5153      [Steve Henson]
 5154 
 5155   *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
 5156      A clarification of RFC2560 will require the use of OCTET STRINGs and 
 5157      some implementations cannot handle the current raw format. Since OpenSSL
 5158      copies and compares OCSP nonces as opaque blobs without any attempt at
 5159      parsing them this should not create any compatibility issues.
 5160      [Steve Henson]
 5161 
 5162   *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
 5163      calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
 5164      this HMAC (and other) operations are several times slower than OpenSSL
 5165      < 0.9.7.
 5166      [Steve Henson]
 5167 
 5168   *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
 5169      [Peter Sylvester <Peter.Sylvester@EdelWeb.fr>]
 5170 
 5171   *) Use the correct content when signing type "other".
 5172      [Steve Henson]
 5173 
 5174  Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
 5175 
 5176   *) Fix various bugs revealed by running the NISCC test suite:
 5177 
 5178      Stop out of bounds reads in the ASN1 code when presented with
 5179      invalid tags (CVE-2003-0543 and CVE-2003-0544).
 5180      
 5181      Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
 5182 
 5183      If verify callback ignores invalid public key errors don't try to check
 5184      certificate signature with the NULL public key.
 5185 
 5186      [Steve Henson]
 5187 
 5188   *) New -ignore_err option in ocsp application to stop the server
 5189      exiting on the first error in a request.
 5190      [Steve Henson]
 5191 
 5192   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
 5193      if the server requested one: as stated in TLS 1.0 and SSL 3.0
 5194      specifications.
 5195      [Steve Henson]
 5196 
 5197   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
 5198      extra data after the compression methods not only for TLS 1.0
 5199      but also for SSL 3.0 (as required by the specification).
 5200      [Bodo Moeller; problem pointed out by Matthias Loepfe]
 5201 
 5202   *) Change X509_certificate_type() to mark the key as exported/exportable
 5203      when it's 512 *bits* long, not 512 bytes.
 5204      [Richard Levitte]
 5205 
 5206   *) Change AES_cbc_encrypt() so it outputs exact multiple of
 5207      blocks during encryption.
 5208      [Richard Levitte]
 5209 
 5210   *) Various fixes to base64 BIO and non blocking I/O. On write 
 5211      flushes were not handled properly if the BIO retried. On read
 5212      data was not being buffered properly and had various logic bugs.
 5213      This also affects blocking I/O when the data being decoded is a
 5214      certain size.
 5215      [Steve Henson]
 5216 
 5217   *) Various S/MIME bugfixes and compatibility changes:
 5218      output correct application/pkcs7 MIME type if
 5219      PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
 5220      Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
 5221      of files as .eml work). Correctly handle very long lines in MIME
 5222      parser.
 5223      [Steve Henson]
 5224 
 5225  Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
 5226 
 5227   *) Countermeasure against the Klima-Pokorny-Rosa extension of
 5228      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
 5229      a protocol version number mismatch like a decryption error
 5230      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
 5231      [Bodo Moeller]
 5232 
 5233   *) Turn on RSA blinding by default in the default implementation
 5234      to avoid a timing attack. Applications that don't want it can call
 5235      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
 5236      They would be ill-advised to do so in most cases.
 5237      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
 5238 
 5239   *) Change RSA blinding code so that it works when the PRNG is not
 5240      seeded (in this case, the secret RSA exponent is abused as
 5241      an unpredictable seed -- if it is not unpredictable, there
 5242      is no point in blinding anyway).  Make RSA blinding thread-safe
 5243      by remembering the creator's thread ID in rsa->blinding and
 5244      having all other threads use local one-time blinding factors
 5245      (this requires more computation than sharing rsa->blinding, but
 5246      avoids excessive locking; and if an RSA object is not shared
 5247      between threads, blinding will still be very fast).
 5248      [Bodo Moeller]
 5249 
 5250   *) Fixed a typo bug that would cause ENGINE_set_default() to set an
 5251      ENGINE as defaults for all supported algorithms irrespective of
 5252      the 'flags' parameter. 'flags' is now honoured, so applications
 5253      should make sure they are passing it correctly.
 5254      [Geoff Thorpe]
 5255 
 5256   *) Target "mingw" now allows native Windows code to be generated in
 5257      the Cygwin environment as well as with the MinGW compiler.
 5258      [Ulf Moeller] 
 5259 
 5260  Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
 5261 
 5262   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
 5263      via timing by performing a MAC computation even if incorrrect
 5264      block cipher padding has been found.  This is a countermeasure
 5265      against active attacks where the attacker has to distinguish
 5266      between bad padding and a MAC verification error. (CVE-2003-0078)
 5267 
 5268      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
 5269      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
 5270      Martin Vuagnoux (EPFL, Ilion)]
 5271 
 5272   *) Make the no-err option work as intended.  The intention with no-err
 5273      is not to have the whole error stack handling routines removed from
 5274      libcrypto, it's only intended to remove all the function name and
 5275      reason texts, thereby removing some of the footprint that may not
 5276      be interesting if those errors aren't displayed anyway.
 5277 
 5278      NOTE: it's still possible for any application or module to have it's
 5279      own set of error texts inserted.  The routines are there, just not
 5280      used by default when no-err is given.
 5281      [Richard Levitte]
 5282 
 5283   *) Add support for FreeBSD on IA64.
 5284      [dirk.meyer@dinoex.sub.org via Richard Levitte, resolves #454]
 5285 
 5286   *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
 5287      Kerberos function mit_des_cbc_cksum().  Before this change,
 5288      the value returned by DES_cbc_cksum() was like the one from
 5289      mit_des_cbc_cksum(), except the bytes were swapped.
 5290      [Kevin Greaney <Kevin.Greaney@hp.com> and Richard Levitte]
 5291 
 5292   *) Allow an application to disable the automatic SSL chain building.
 5293      Before this a rather primitive chain build was always performed in
 5294      ssl3_output_cert_chain(): an application had no way to send the 
 5295      correct chain if the automatic operation produced an incorrect result.
 5296 
 5297      Now the chain builder is disabled if either:
 5298 
 5299      1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
 5300 
 5301      2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
 5302 
 5303      The reasoning behind this is that an application would not want the
 5304      auto chain building to take place if extra chain certificates are
 5305      present and it might also want a means of sending no additional
 5306      certificates (for example the chain has two certificates and the
 5307      root is omitted).
 5308      [Steve Henson]
 5309 
 5310   *) Add the possibility to build without the ENGINE framework.
 5311      [Steven Reddie <smr@essemer.com.au> via Richard Levitte]
 5312 
 5313   *) Under Win32 gmtime() can return NULL: check return value in
 5314      OPENSSL_gmtime(). Add error code for case where gmtime() fails.
 5315      [Steve Henson]
 5316 
 5317   *) DSA routines: under certain error conditions uninitialized BN objects
 5318      could be freed. Solution: make sure initialization is performed early
 5319      enough. (Reported and fix supplied by Ivan D Nestlerode <nestler@MIT.EDU>,
 5320      Nils Larsch <nla@trustcenter.de> via PR#459)
 5321      [Lutz Jaenicke]
 5322 
 5323   *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
 5324      checked on reconnect on the client side, therefore session resumption
 5325      could still fail with a "ssl session id is different" error. This
 5326      behaviour is masked when SSL_OP_ALL is used due to
 5327      SSL_OP_MICROSOFT_SESS_ID_BUG being set.
 5328      Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
 5329      followup to PR #377.
 5330      [Lutz Jaenicke]
 5331 
 5332   *) IA-32 assembler support enhancements: unified ELF targets, support
 5333      for SCO/Caldera platforms, fix for Cygwin shared build.
 5334      [Andy Polyakov]
 5335 
 5336   *) Add support for FreeBSD on sparc64.  As a consequence, support for
 5337      FreeBSD on non-x86 processors is separate from x86 processors on
 5338      the config script, much like the NetBSD support.
 5339      [Richard Levitte & Kris Kennaway <kris@obsecurity.org>]
 5340 
 5341  Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
 5342 
 5343   [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
 5344   OpenSSL 0.9.7.]
 5345 
 5346   *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
 5347      code (06) was taken as the first octet of the session ID and the last
 5348      octet was ignored consequently. As a result SSLv2 client side session
 5349      caching could not have worked due to the session ID mismatch between
 5350      client and server.
 5351      Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
 5352      PR #377.
 5353      [Lutz Jaenicke]
 5354 
 5355   *) Change the declaration of needed Kerberos libraries to use EX_LIBS
 5356      instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
 5357      removed entirely.
 5358      [Richard Levitte]
 5359 
 5360   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
 5361      seems that in spite of existing for more than a year, many application
 5362      author have done nothing to provide the necessary callbacks, which
 5363      means that this particular engine will not work properly anywhere.
 5364      This is a very unfortunate situation which forces us, in the name
 5365      of usability, to give the hw_ncipher.c a static lock, which is part
 5366      of libcrypto.
 5367      NOTE: This is for the 0.9.7 series ONLY.  This hack will never
 5368      appear in 0.9.8 or later.  We EXPECT application authors to have
 5369      dealt properly with this when 0.9.8 is released (unless we actually
 5370      make such changes in the libcrypto locking code that changes will
 5371      have to be made anyway).
 5372      [Richard Levitte]
 5373 
 5374   *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
 5375      octets have been read, EOF or an error occurs. Without this change
 5376      some truncated ASN1 structures will not produce an error.
 5377      [Steve Henson]
 5378 
 5379   *) Disable Heimdal support, since it hasn't been fully implemented.
 5380      Still give the possibility to force the use of Heimdal, but with
 5381      warnings and a request that patches get sent to openssl-dev.
 5382      [Richard Levitte]
 5383 
 5384   *) Add the VC-CE target, introduce the WINCE sysname, and add
 5385      INSTALL.WCE and appropriate conditionals to make it build.
 5386      [Steven Reddie <smr@essemer.com.au> via Richard Levitte]
 5387 
 5388   *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
 5389      cygssl-x.y.z.dll, where x, y and z are the major, minor and
 5390      edit numbers of the version.
 5391      [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
 5392 
 5393   *) Introduce safe string copy and catenation functions
 5394      (BUF_strlcpy() and BUF_strlcat()).
 5395      [Ben Laurie (CHATS) and Richard Levitte]
 5396 
 5397   *) Avoid using fixed-size buffers for one-line DNs.
 5398      [Ben Laurie (CHATS)]
 5399 
 5400   *) Add BUF_MEM_grow_clean() to avoid information leakage when
 5401      resizing buffers containing secrets, and use where appropriate.
 5402      [Ben Laurie (CHATS)]
 5403 
 5404   *) Avoid using fixed size buffers for configuration file location.
 5405      [Ben Laurie (CHATS)]
 5406 
 5407   *) Avoid filename truncation for various CA files.
 5408      [Ben Laurie (CHATS)]
 5409 
 5410   *) Use sizeof in preference to magic numbers.
 5411      [Ben Laurie (CHATS)]
 5412 
 5413   *) Avoid filename truncation in cert requests.
 5414      [Ben Laurie (CHATS)]
 5415 
 5416   *) Add assertions to check for (supposedly impossible) buffer
 5417      overflows.
 5418      [Ben Laurie (CHATS)]
 5419 
 5420   *) Don't cache truncated DNS entries in the local cache (this could
 5421      potentially lead to a spoofing attack).
 5422      [Ben Laurie (CHATS)]
 5423 
 5424   *) Fix various buffers to be large enough for hex/decimal
 5425      representations in a platform independent manner.
 5426      [Ben Laurie (CHATS)]
 5427 
 5428   *) Add CRYPTO_realloc_clean() to avoid information leakage when
 5429      resizing buffers containing secrets, and use where appropriate.
 5430      [Ben Laurie (CHATS)]
 5431 
 5432   *) Add BIO_indent() to avoid much slightly worrying code to do
 5433      indents.
 5434      [Ben Laurie (CHATS)]
 5435 
 5436   *) Convert sprintf()/BIO_puts() to BIO_printf().
 5437      [Ben Laurie (CHATS)]
 5438 
 5439   *) buffer_gets() could terminate with the buffer only half
 5440      full. Fixed.
 5441      [Ben Laurie (CHATS)]
 5442 
 5443   *) Add assertions to prevent user-supplied crypto functions from
 5444      overflowing internal buffers by having large block sizes, etc.
 5445      [Ben Laurie (CHATS)]
 5446 
 5447   *) New OPENSSL_assert() macro (similar to assert(), but enabled
 5448      unconditionally).
 5449      [Ben Laurie (CHATS)]
 5450 
 5451   *) Eliminate unused copy of key in RC4.
 5452      [Ben Laurie (CHATS)]
 5453 
 5454   *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
 5455      [Ben Laurie (CHATS)]
 5456 
 5457   *) Fix off-by-one error in EGD path.
 5458      [Ben Laurie (CHATS)]
 5459 
 5460   *) If RANDFILE path is too long, ignore instead of truncating.
 5461      [Ben Laurie (CHATS)]
 5462 
 5463   *) Eliminate unused and incorrectly sized X.509 structure
 5464      CBCParameter.
 5465      [Ben Laurie (CHATS)]
 5466 
 5467   *) Eliminate unused and dangerous function knumber().
 5468      [Ben Laurie (CHATS)]
 5469 
 5470   *) Eliminate unused and dangerous structure, KSSL_ERR.
 5471      [Ben Laurie (CHATS)]
 5472 
 5473   *) Protect against overlong session ID context length in an encoded
 5474      session object. Since these are local, this does not appear to be
 5475      exploitable.
 5476      [Ben Laurie (CHATS)]
 5477 
 5478   *) Change from security patch (see 0.9.6e below) that did not affect
 5479      the 0.9.6 release series:
 5480 
 5481      Remote buffer overflow in SSL3 protocol - an attacker could
 5482      supply an oversized master key in Kerberos-enabled versions.
 5483      (CVE-2002-0657)
 5484      [Ben Laurie (CHATS)]
 5485 
 5486   *) Change the SSL kerb5 codes to match RFC 2712.
 5487      [Richard Levitte]
 5488 
 5489   *) Make -nameopt work fully for req and add -reqopt switch.
 5490      [Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]
 5491 
 5492   *) The "block size" for block ciphers in CFB and OFB mode should be 1.
 5493      [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve@opera.com>]
 5494 
 5495   *) Make sure tests can be performed even if the corresponding algorithms
 5496      have been removed entirely.  This was also the last step to make
 5497      OpenSSL compilable with DJGPP under all reasonable conditions.
 5498      [Richard Levitte, Doug Kaufman <dkaufman@rahul.net>]
 5499 
 5500   *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
 5501      to allow version independent disabling of normally unselected ciphers,
 5502      which may be activated as a side-effect of selecting a single cipher.
 5503 
 5504      (E.g., cipher list string "RSA" enables ciphersuites that are left
 5505      out of "ALL" because they do not provide symmetric encryption.
 5506      "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
 5507      [Lutz Jaenicke, Bodo Moeller]
 5508 
 5509   *) Add appropriate support for separate platform-dependent build
 5510      directories.  The recommended way to make a platform-dependent
 5511      build directory is the following (tested on Linux), maybe with
 5512      some local tweaks:
 5513 
 5514 	# Place yourself outside of the OpenSSL source tree.  In
 5515 	# this example, the environment variable OPENSSL_SOURCE
 5516 	# is assumed to contain the absolute OpenSSL source directory.
 5517 	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
 5518 	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
 5519 	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
 5520 		mkdir -p `dirname $F`
 5521 		ln -s $OPENSSL_SOURCE/$F $F
 5522 	done
 5523 
 5524      To be absolutely sure not to disturb the source tree, a "make clean"
 5525      is a good thing.  If it isn't successfull, don't worry about it,
 5526      it probably means the source directory is very clean.
 5527      [Richard Levitte]
 5528 
 5529   *) Make sure any ENGINE control commands make local copies of string
 5530      pointers passed to them whenever necessary. Otherwise it is possible
 5531      the caller may have overwritten (or deallocated) the original string
 5532      data when a later ENGINE operation tries to use the stored values.
 5533      [Götz Babin-Ebell <babinebell@trustcenter.de>]
 5534 
 5535   *) Improve diagnostics in file reading and command-line digests.
 5536      [Ben Laurie aided and abetted by Solar Designer <solar@openwall.com>]
 5537 
 5538   *) Add AES modes CFB and OFB to the object database.  Correct an
 5539      error in AES-CFB decryption.
 5540      [Richard Levitte]
 5541 
 5542   *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
 5543      allows existing EVP_CIPHER_CTX structures to be reused after
 5544      calling EVP_*Final(). This behaviour is used by encryption
 5545      BIOs and some applications. This has the side effect that
 5546      applications must explicitly clean up cipher contexts with
 5547      EVP_CIPHER_CTX_cleanup() or they will leak memory.
 5548      [Steve Henson]
 5549 
 5550   *) Check the values of dna and dnb in bn_mul_recursive before calling
 5551      bn_mul_comba (a non zero value means the a or b arrays do not contain
 5552      n2 elements) and fallback to bn_mul_normal if either is not zero.
 5553      [Steve Henson]
 5554 
 5555   *) Fix escaping of non-ASCII characters when using the -subj option
 5556      of the "openssl req" command line tool. (Robert Joop <joop@fokus.gmd.de>)
 5557      [Lutz Jaenicke]
 5558 
 5559   *) Make object definitions compliant to LDAP (RFC2256): SN is the short
 5560      form for "surname", serialNumber has no short form.
 5561      Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
 5562      therefore remove "mail" short name for "internet 7".
 5563      The OID for unique identifiers in X509 certificates is
 5564      x500UniqueIdentifier, not uniqueIdentifier.
 5565      Some more OID additions. (Michael Bell <michael.bell@rz.hu-berlin.de>)
 5566      [Lutz Jaenicke]
 5567 
 5568   *) Add an "init" command to the ENGINE config module and auto initialize
 5569      ENGINEs. Without any "init" command the ENGINE will be initialized 
 5570      after all ctrl commands have been executed on it. If init=1 the 
 5571      ENGINE is initailized at that point (ctrls before that point are run
 5572      on the uninitialized ENGINE and after on the initialized one). If
 5573      init=0 then the ENGINE will not be iniatialized at all.
 5574      [Steve Henson]
 5575 
 5576   *) Fix the 'app_verify_callback' interface so that the user-defined
 5577      argument is actually passed to the callback: In the
 5578      SSL_CTX_set_cert_verify_callback() prototype, the callback
 5579      declaration has been changed from
 5580           int (*cb)()
 5581      into
 5582           int (*cb)(X509_STORE_CTX *,void *);
 5583      in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
 5584           i=s->ctx->app_verify_callback(&ctx)
 5585      has been changed into
 5586           i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
 5587 
 5588      To update applications using SSL_CTX_set_cert_verify_callback(),
 5589      a dummy argument can be added to their callback functions.
 5590      [D. K. Smetters <smetters@parc.xerox.com>]
 5591 
 5592   *) Added the '4758cca' ENGINE to support IBM 4758 cards.
 5593      [Maurice Gittens <maurice@gittens.nl>, touchups by Geoff Thorpe]
 5594 
 5595   *) Add and OPENSSL_LOAD_CONF define which will cause
 5596      OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
 5597      This allows older applications to transparently support certain
 5598      OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
 5599      Two new functions OPENSSL_add_all_algorithms_noconf() which will never
 5600      load the config file and OPENSSL_add_all_algorithms_conf() which will
 5601      always load it have also been added.
 5602      [Steve Henson]
 5603 
 5604   *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
 5605      Adjust NIDs and EVP layer.
 5606      [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]
 5607 
 5608   *) Config modules support in openssl utility.
 5609 
 5610      Most commands now load modules from the config file,
 5611      though in a few (such as version) this isn't done 
 5612      because it couldn't be used for anything.
 5613 
 5614      In the case of ca and req the config file used is
 5615      the same as the utility itself: that is the -config
 5616      command line option can be used to specify an
 5617      alternative file.
 5618      [Steve Henson]
 5619 
 5620   *) Move default behaviour from OPENSSL_config(). If appname is NULL
 5621      use "openssl_conf" if filename is NULL use default openssl config file.
 5622      [Steve Henson]
 5623 
 5624   *) Add an argument to OPENSSL_config() to allow the use of an alternative
 5625      config section name. Add a new flag to tolerate a missing config file
 5626      and move code to CONF_modules_load_file().
 5627      [Steve Henson]
 5628 
 5629   *) Support for crypto accelerator cards from Accelerated Encryption
 5630      Processing, www.aep.ie.  (Use engine 'aep')
 5631      The support was copied from 0.9.6c [engine] and adapted/corrected
 5632      to work with the new engine framework.
 5633      [AEP Inc. and Richard Levitte]
 5634 
 5635   *) Support for SureWare crypto accelerator cards from Baltimore
 5636      Technologies.  (Use engine 'sureware')
 5637      The support was copied from 0.9.6c [engine] and adapted
 5638      to work with the new engine framework.
 5639      [Richard Levitte]
 5640 
 5641   *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
 5642      make the newer ENGINE framework commands for the CHIL engine work.
 5643      [Toomas Kiisk <vix@cyber.ee> and Richard Levitte]
 5644 
 5645   *) Make it possible to produce shared libraries on ReliantUNIX.
 5646      [Robert Dahlem <Robert.Dahlem@ffm2.siemens.de> via Richard Levitte]
 5647 
 5648   *) Add the configuration target debug-linux-ppro.
 5649      Make 'openssl rsa' use the general key loading routines
 5650      implemented in apps.c, and make those routines able to
 5651      handle the key format FORMAT_NETSCAPE and the variant
 5652      FORMAT_IISSGC.
 5653      [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
 5654 
 5655  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
 5656      [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
 5657 
 5658   *) Add -keyform to rsautl, and document -engine.
 5659      [Richard Levitte, inspired by Toomas Kiisk <vix@cyber.ee>]
 5660 
 5661   *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
 5662      BIO_R_NO_SUCH_FILE error code rather than the generic
 5663      ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
 5664      [Ben Laurie]
 5665 
 5666   *) Add new functions
 5667           ERR_peek_last_error
 5668           ERR_peek_last_error_line
 5669           ERR_peek_last_error_line_data.
 5670      These are similar to
 5671           ERR_peek_error
 5672           ERR_peek_error_line
 5673           ERR_peek_error_line_data,
 5674      but report on the latest error recorded rather than the first one
 5675      still in the error queue.
 5676      [Ben Laurie, Bodo Moeller]
 5677         
 5678   *) default_algorithms option in ENGINE config module. This allows things
 5679      like:
 5680      default_algorithms = ALL
 5681      default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
 5682      [Steve Henson]
 5683 
 5684   *) Prelminary ENGINE config module.
 5685      [Steve Henson]
 5686 
 5687   *) New experimental application configuration code.
 5688      [Steve Henson]
 5689 
 5690   *) Change the AES code to follow the same name structure as all other
 5691      symmetric ciphers, and behave the same way.  Move everything to
 5692      the directory crypto/aes, thereby obsoleting crypto/rijndael.
 5693      [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]
 5694 
 5695   *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
 5696      [Ben Laurie and Theo de Raadt]
 5697 
 5698   *) Add option to output public keys in req command.
 5699      [Massimiliano Pala madwolf@openca.org]
 5700 
 5701   *) Use wNAFs in EC_POINTs_mul() for improved efficiency
 5702      (up to about 10% better than before for P-192 and P-224).
 5703      [Bodo Moeller]
 5704 
 5705   *) New functions/macros
 5706 
 5707           SSL_CTX_set_msg_callback(ctx, cb)
 5708           SSL_CTX_set_msg_callback_arg(ctx, arg)
 5709           SSL_set_msg_callback(ssl, cb)
 5710           SSL_set_msg_callback_arg(ssl, arg)
 5711 
 5712      to request calling a callback function
 5713 
 5714           void cb(int write_p, int version, int content_type,
 5715                   const void *buf, size_t len, SSL *ssl, void *arg)
 5716 
 5717      whenever a protocol message has been completely received
 5718      (write_p == 0) or sent (write_p == 1).  Here 'version' is the
 5719      protocol version  according to which the SSL library interprets
 5720      the current protocol message (SSL2_VERSION, SSL3_VERSION, or
 5721      TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
 5722      the content type as defined in the SSL 3.0/TLS 1.0 protocol
 5723      specification (change_cipher_spec(20), alert(21), handshake(22)).
 5724      'buf' and 'len' point to the actual message, 'ssl' to the
 5725      SSL object, and 'arg' is the application-defined value set by
 5726      SSL[_CTX]_set_msg_callback_arg().
 5727 
 5728      'openssl s_client' and 'openssl s_server' have new '-msg' options
 5729      to enable a callback that displays all protocol messages.
 5730      [Bodo Moeller]
 5731 
 5732   *) Change the shared library support so shared libraries are built as
 5733      soon as the corresponding static library is finished, and thereby get
 5734      openssl and the test programs linked against the shared library.
 5735      This still only happens when the keyword "shard" has been given to
 5736      the configuration scripts.
 5737 
 5738      NOTE: shared library support is still an experimental thing, and
 5739      backward binary compatibility is still not guaranteed.
 5740      ["Maciej W. Rozycki" <macro@ds2.pg.gda.pl> and Richard Levitte]
 5741 
 5742   *) Add support for Subject Information Access extension.
 5743      [Peter Sylvester <Peter.Sylvester@EdelWeb.fr>]
 5744 
 5745   *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
 5746      additional bytes when new memory had to be allocated, not just
 5747      when reusing an existing buffer.
 5748      [Bodo Moeller]
 5749 
 5750   *) New command line and configuration option 'utf8' for the req command.
 5751      This allows field values to be specified as UTF8 strings.
 5752      [Steve Henson]
 5753 
 5754   *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
 5755      runs for the former and machine-readable output for the latter.
 5756      [Ben Laurie]
 5757 
 5758   *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
 5759      of the e-mail address in the DN (i.e., it will go into a certificate
 5760      extension only).  The new configuration file option 'email_in_dn = no'
 5761      has the same effect.
 5762      [Massimiliano Pala madwolf@openca.org]
 5763 
 5764   *) Change all functions with names starting with des_ to be starting
 5765      with DES_ instead.  Add wrappers that are compatible with libdes,
 5766      but are named _ossl_old_des_*.  Finally, add macros that map the
 5767      des_* symbols to the corresponding _ossl_old_des_* if libdes
 5768      compatibility is desired.  If OpenSSL 0.9.6c compatibility is
 5769      desired, the des_* symbols will be mapped to DES_*, with one
 5770      exception.
 5771 
 5772      Since we provide two compatibility mappings, the user needs to
 5773      define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
 5774      compatibility is desired.  The default (i.e., when that macro
 5775      isn't defined) is OpenSSL 0.9.6c compatibility.
 5776 
 5777      There are also macros that enable and disable the support of old
 5778      des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
 5779      and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
 5780      are defined, the default will apply: to support the old des routines.
 5781 
 5782      In either case, one must include openssl/des.h to get the correct
 5783      definitions.  Do not try to just include openssl/des_old.h, that
 5784      won't work.
 5785 
 5786      NOTE: This is a major break of an old API into a new one.  Software
 5787      authors are encouraged to switch to the DES_ style functions.  Some
 5788      time in the future, des_old.h and the libdes compatibility functions
 5789      will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
 5790      default), and then completely removed.
 5791      [Richard Levitte]
 5792 
 5793   *) Test for certificates which contain unsupported critical extensions.
 5794      If such a certificate is found during a verify operation it is 
 5795      rejected by default: this behaviour can be overridden by either
 5796      handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
 5797      by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
 5798      X509_supported_extension() has also been added which returns 1 if a
 5799      particular extension is supported.
 5800      [Steve Henson]
 5801 
 5802   *) Modify the behaviour of EVP cipher functions in similar way to digests
 5803      to retain compatibility with existing code.
 5804      [Steve Henson]
 5805 
 5806   *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
 5807      compatibility with existing code. In particular the 'ctx' parameter does
 5808      not have to be to be initialized before the call to EVP_DigestInit() and
 5809      it is tidied up after a call to EVP_DigestFinal(). New function
 5810      EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
 5811      EVP_MD_CTX_copy() changed to not require the destination to be
 5812      initialized valid and new function EVP_MD_CTX_copy_ex() added which
 5813      requires the destination to be valid.
 5814 
 5815      Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
 5816      EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
 5817      [Steve Henson]
 5818 
 5819   *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
 5820      so that complete 'Handshake' protocol structures are kept in memory
 5821      instead of overwriting 'msg_type' and 'length' with 'body' data.
 5822      [Bodo Moeller]
 5823 
 5824   *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
 5825      [Massimo Santin via Richard Levitte]
 5826 
 5827   *) Major restructuring to the underlying ENGINE code. This includes
 5828      reduction of linker bloat, separation of pure "ENGINE" manipulation
 5829      (initialisation, etc) from functionality dealing with implementations
 5830      of specific crypto iterfaces. This change also introduces integrated
 5831      support for symmetric ciphers and digest implementations - so ENGINEs
 5832      can now accelerate these by providing EVP_CIPHER and EVP_MD
 5833      implementations of their own. This is detailed in crypto/engine/README
 5834      as it couldn't be adequately described here. However, there are a few
 5835      API changes worth noting - some RSA, DSA, DH, and RAND functions that
 5836      were changed in the original introduction of ENGINE code have now
 5837      reverted back - the hooking from this code to ENGINE is now a good
 5838      deal more passive and at run-time, operations deal directly with
 5839      RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
 5840      dereferencing through an ENGINE pointer any more. Also, the ENGINE
 5841      functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
 5842      they were not being used by the framework as there is no concept of a
 5843      BIGNUM_METHOD and they could not be generalised to the new
 5844      'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
 5845      ENGINE_cpy() has been removed as it cannot be consistently defined in
 5846      the new code.
 5847      [Geoff Thorpe]
 5848 
 5849   *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
 5850      [Steve Henson]
 5851 
 5852   *) Change mkdef.pl to sort symbols that get the same entry number,
 5853      and make sure the automatically generated functions ERR_load_*
 5854      become part of libeay.num as well.
 5855      [Richard Levitte]
 5856 
 5857   *) New function SSL_renegotiate_pending().  This returns true once
 5858      renegotiation has been requested (either SSL_renegotiate() call
 5859      or HelloRequest/ClientHello receveived from the peer) and becomes
 5860      false once a handshake has been completed.
 5861      (For servers, SSL_renegotiate() followed by SSL_do_handshake()
 5862      sends a HelloRequest, but does not ensure that a handshake takes
 5863      place.  SSL_renegotiate_pending() is useful for checking if the
 5864      client has followed the request.)
 5865      [Bodo Moeller]
 5866 
 5867   *) New SSL option SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION.
 5868      By default, clients may request session resumption even during
 5869      renegotiation (if session ID contexts permit); with this option,
 5870      session resumption is possible only in the first handshake.
 5871 
 5872      SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
 5873      more bits available for options that should not be part of
 5874      SSL_OP_ALL (such as SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION).
 5875      [Bodo Moeller]
 5876 
 5877   *) Add some demos for certificate and certificate request creation.
 5878      [Steve Henson]
 5879 
 5880   *) Make maximum certificate chain size accepted from the peer application
 5881      settable (SSL*_get/set_max_cert_list()), as proposed by
 5882      "Douglas E. Engert" <deengert@anl.gov>.
 5883      [Lutz Jaenicke]
 5884 
 5885   *) Add support for shared libraries for Unixware-7
 5886      (Boyd Lynn Gerber <gerberb@zenez.com>).
 5887      [Lutz Jaenicke]
 5888 
 5889   *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
 5890      be done prior to destruction. Use this to unload error strings from
 5891      ENGINEs that load their own error strings. NB: This adds two new API
 5892      functions to "get" and "set" this destroy handler in an ENGINE.
 5893      [Geoff Thorpe]
 5894 
 5895   *) Alter all existing ENGINE implementations (except "openssl" and
 5896      "openbsd") to dynamically instantiate their own error strings. This
 5897      makes them more flexible to be built both as statically-linked ENGINEs
 5898      and self-contained shared-libraries loadable via the "dynamic" ENGINE.
 5899      Also, add stub code to each that makes building them as self-contained
 5900      shared-libraries easier (see README.ENGINE).
 5901      [Geoff Thorpe]
 5902 
 5903   *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
 5904      implementations into applications that are completely implemented in
 5905      self-contained shared-libraries. The "dynamic" ENGINE exposes control
 5906      commands that can be used to configure what shared-library to load and
 5907      to control aspects of the way it is handled. Also, made an update to
 5908      the README.ENGINE file that brings its information up-to-date and
 5909      provides some information and instructions on the "dynamic" ENGINE
 5910      (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
 5911      [Geoff Thorpe]
 5912 
 5913   *) Make it possible to unload ranges of ERR strings with a new
 5914      "ERR_unload_strings" function.
 5915      [Geoff Thorpe]
 5916 
 5917   *) Add a copy() function to EVP_MD.
 5918      [Ben Laurie]
 5919 
 5920   *) Make EVP_MD routines take a context pointer instead of just the
 5921      md_data void pointer.
 5922      [Ben Laurie]
 5923 
 5924   *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
 5925      that the digest can only process a single chunk of data
 5926      (typically because it is provided by a piece of
 5927      hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
 5928      is only going to provide a single chunk of data, and hence the
 5929      framework needn't accumulate the data for oneshot drivers.
 5930      [Ben Laurie]
 5931 
 5932   *) As with "ERR", make it possible to replace the underlying "ex_data"
 5933      functions. This change also alters the storage and management of global
 5934      ex_data state - it's now all inside ex_data.c and all "class" code (eg.
 5935      RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
 5936      index counters. The API functions that use this state have been changed
 5937      to take a "class_index" rather than pointers to the class's local STACK
 5938      and counter, and there is now an API function to dynamically create new
 5939      classes. This centralisation allows us to (a) plug a lot of the
 5940      thread-safety problems that existed, and (b) makes it possible to clean
 5941      up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
 5942      such data would previously have always leaked in application code and
 5943      workarounds were in place to make the memory debugging turn a blind eye
 5944      to it. Application code that doesn't use this new function will still
 5945      leak as before, but their memory debugging output will announce it now
 5946      rather than letting it slide.
 5947 
 5948      Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
 5949      induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
 5950      has a return value to indicate success or failure.
 5951      [Geoff Thorpe]
 5952 
 5953   *) Make it possible to replace the underlying "ERR" functions such that the
 5954      global state (2 LHASH tables and 2 locks) is only used by the "default"
 5955      implementation. This change also adds two functions to "get" and "set"
 5956      the implementation prior to it being automatically set the first time
 5957      any other ERR function takes place. Ie. an application can call "get",
 5958      pass the return value to a module it has just loaded, and that module
 5959      can call its own "set" function using that value. This means the
 5960      module's "ERR" operations will use (and modify) the error state in the
 5961      application and not in its own statically linked copy of OpenSSL code.
 5962      [Geoff Thorpe]
 5963 
 5964   *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
 5965      reference counts. This performs normal REF_PRINT/REF_CHECK macros on
 5966      the operation, and provides a more encapsulated way for external code
 5967      (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
 5968      to use these functions rather than manually incrementing the counts.
 5969 
 5970      Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
 5971      [Geoff Thorpe]
 5972 
 5973   *) Add EVP test program.
 5974      [Ben Laurie]
 5975 
 5976   *) Add symmetric cipher support to ENGINE. Expect the API to change!
 5977      [Ben Laurie]
 5978 
 5979   *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
 5980      X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
 5981      X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
 5982      These allow a CRL to be built without having to access X509_CRL fields
 5983      directly. Modify 'ca' application to use new functions.
 5984      [Steve Henson]
 5985 
 5986   *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
 5987      bug workarounds. Rollback attack detection is a security feature.
 5988      The problem will only arise on OpenSSL servers when TLSv1 is not
 5989      available (sslv3_server_method() or SSL_OP_NO_TLSv1).
 5990      Software authors not wanting to support TLSv1 will have special reasons
 5991      for their choice and can explicitly enable this option.
 5992      [Bodo Moeller, Lutz Jaenicke]
 5993 
 5994   *) Rationalise EVP so it can be extended: don't include a union of
 5995      cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
 5996      (similar to those existing for EVP_CIPHER_CTX).
 5997      Usage example:
 5998 
 5999          EVP_MD_CTX md;
 6000 
 6001          EVP_MD_CTX_init(&md);             /* new function call */
 6002          EVP_DigestInit(&md, EVP_sha1());
 6003          EVP_DigestUpdate(&md, in, len);
 6004          EVP_DigestFinal(&md, out, NULL);
 6005          EVP_MD_CTX_cleanup(&md);          /* new function call */
 6006 
 6007      [Ben Laurie]
 6008 
 6009   *) Make DES key schedule conform to the usual scheme, as well as
 6010      correcting its structure. This means that calls to DES functions
 6011      now have to pass a pointer to a des_key_schedule instead of a
 6012      plain des_key_schedule (which was actually always a pointer
 6013      anyway): E.g.,
 6014 
 6015          des_key_schedule ks;
 6016 
 6017 	 des_set_key_checked(..., &ks);
 6018 	 des_ncbc_encrypt(..., &ks, ...);
 6019 
 6020      (Note that a later change renames 'des_...' into 'DES_...'.)
 6021      [Ben Laurie]
 6022 
 6023   *) Initial reduction of linker bloat: the use of some functions, such as
 6024      PEM causes large amounts of unused functions to be linked in due to
 6025      poor organisation. For example pem_all.c contains every PEM function
 6026      which has a knock on effect of linking in large amounts of (unused)
 6027      ASN1 code. Grouping together similar functions and splitting unrelated
 6028      functions prevents this.
 6029      [Steve Henson]
 6030 
 6031   *) Cleanup of EVP macros.
 6032      [Ben Laurie]
 6033 
 6034   *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
 6035      correct _ecb suffix.
 6036      [Ben Laurie]
 6037 
 6038   *) Add initial OCSP responder support to ocsp application. The
 6039      revocation information is handled using the text based index
 6040      use by the ca application. The responder can either handle
 6041      requests generated internally, supplied in files (for example
 6042      via a CGI script) or using an internal minimal server.
 6043      [Steve Henson]
 6044 
 6045   *) Add configuration choices to get zlib compression for TLS.
 6046      [Richard Levitte]
 6047 
 6048   *) Changes to Kerberos SSL for RFC 2712 compliance:
 6049      1.  Implemented real KerberosWrapper, instead of just using
 6050          KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw@sxw.org.uk>]
 6051      2.  Implemented optional authenticator field of KerberosWrapper.
 6052 
 6053      Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
 6054      and authenticator structs; see crypto/krb5/.
 6055 
 6056      Generalized Kerberos calls to support multiple Kerberos libraries.
 6057      [Vern Staats <staatsvr@asc.hpc.mil>,
 6058       Jeffrey Altman <jaltman@columbia.edu>
 6059       via Richard Levitte]
 6060 
 6061   *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
 6062      already does with RSA. testdsa.h now has 'priv_key/pub_key'
 6063      values for each of the key sizes rather than having just
 6064      parameters (and 'speed' generating keys each time).
 6065      [Geoff Thorpe]
 6066 
 6067   *) Speed up EVP routines.
 6068      Before:
 6069 encrypt
 6070 type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
 6071 des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
 6072 des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
 6073 des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
 6074 decrypt
 6075 des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
 6076 des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
 6077 des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
 6078      After:
 6079 encrypt
 6080 des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
 6081 decrypt
 6082 des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
 6083      [Ben Laurie]
 6084 
 6085   *) Added the OS2-EMX target.
 6086      ["Brian Havard" <brianh@kheldar.apana.org.au> and Richard Levitte]
 6087 
 6088   *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
 6089      to support NCONF routines in extension code. New function CONF_set_nconf()
 6090      to allow functions which take an NCONF to also handle the old LHASH
 6091      structure: this means that the old CONF compatible routines can be
 6092      retained (in particular wrt extensions) without having to duplicate the
 6093      code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
 6094      [Steve Henson]
 6095 
 6096   *) Enhance the general user interface with mechanisms for inner control
 6097      and with possibilities to have yes/no kind of prompts.
 6098      [Richard Levitte]
 6099 
 6100   *) Change all calls to low level digest routines in the library and
 6101      applications to use EVP. Add missing calls to HMAC_cleanup() and
 6102      don't assume HMAC_CTX can be copied using memcpy().
 6103      [Verdon Walker <VWalker@novell.com>, Steve Henson]
 6104 
 6105   *) Add the possibility to control engines through control names but with
 6106      arbitrary arguments instead of just a string.
 6107      Change the key loaders to take a UI_METHOD instead of a callback
 6108      function pointer.  NOTE: this breaks binary compatibility with earlier
 6109      versions of OpenSSL [engine].
 6110      Adapt the nCipher code for these new conditions and add a card insertion
 6111      callback.
 6112      [Richard Levitte]
 6113 
 6114   *) Enhance the general user interface with mechanisms to better support
 6115      dialog box interfaces, application-defined prompts, the possibility
 6116      to use defaults (for example default passwords from somewhere else)
 6117      and interrupts/cancellations.
 6118      [Richard Levitte]
 6119 
 6120   *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
 6121      attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
 6122      [Steve Henson]
 6123 
 6124   *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
 6125      tidy up some unnecessarily weird code in 'sk_new()').
 6126      [Geoff, reported by Diego Tartara <dtartara@novamens.com>]
 6127 
 6128   *) Change the key loading routines for ENGINEs to use the same kind
 6129      callback (pem_password_cb) as all other routines that need this
 6130      kind of callback.
 6131      [Richard Levitte]
 6132 
 6133   *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
 6134      256 bit (=32 byte) keys. Of course seeding with more entropy bytes
 6135      than this minimum value is recommended.
 6136      [Lutz Jaenicke]
 6137 
 6138   *) New random seeder for OpenVMS, using the system process statistics
 6139      that are easily reachable.
 6140      [Richard Levitte]
 6141 
 6142   *) Windows apparently can't transparently handle global
 6143      variables defined in DLLs. Initialisations such as:
 6144 
 6145         const ASN1_ITEM *it = &ASN1_INTEGER_it;
 6146 
 6147      wont compile. This is used by the any applications that need to
 6148      declare their own ASN1 modules. This was fixed by adding the option
 6149      EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
 6150      needed for static libraries under Win32.
 6151      [Steve Henson]
 6152 
 6153   *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
 6154      setting of purpose and trust fields. New X509_STORE trust and
 6155      purpose functions and tidy up setting in other SSL functions.
 6156      [Steve Henson]
 6157 
 6158   *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
 6159      structure. These are inherited by X509_STORE_CTX when it is 
 6160      initialised. This allows various defaults to be set in the
 6161      X509_STORE structure (such as flags for CRL checking and custom
 6162      purpose or trust settings) for functions which only use X509_STORE_CTX
 6163      internally such as S/MIME.
 6164 
 6165      Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
 6166      trust settings if they are not set in X509_STORE. This allows X509_STORE
 6167      purposes and trust (in S/MIME for example) to override any set by default.
 6168 
 6169      Add command line options for CRL checking to smime, s_client and s_server
 6170      applications.
 6171      [Steve Henson]
 6172 
 6173   *) Initial CRL based revocation checking. If the CRL checking flag(s)
 6174      are set then the CRL is looked up in the X509_STORE structure and
 6175      its validity and signature checked, then if the certificate is found
 6176      in the CRL the verify fails with a revoked error.
 6177 
 6178      Various new CRL related callbacks added to X509_STORE_CTX structure.
 6179 
 6180      Command line options added to 'verify' application to support this.
 6181 
 6182      This needs some additional work, such as being able to handle multiple
 6183      CRLs with different times, extension based lookup (rather than just
 6184      by subject name) and ultimately more complete V2 CRL extension
 6185      handling.
 6186      [Steve Henson]
 6187 
 6188   *) Add a general user interface API (crypto/ui/).  This is designed
 6189      to replace things like des_read_password and friends (backward
 6190      compatibility functions using this new API are provided).
 6191      The purpose is to remove prompting functions from the DES code
 6192      section as well as provide for prompting through dialog boxes in
 6193      a window system and the like.
 6194      [Richard Levitte]
 6195 
 6196   *) Add "ex_data" support to ENGINE so implementations can add state at a
 6197      per-structure level rather than having to store it globally.
 6198      [Geoff]
 6199 
 6200   *) Make it possible for ENGINE structures to be copied when retrieved by
 6201      ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
 6202      This causes the "original" ENGINE structure to act like a template,
 6203      analogous to the RSA vs. RSA_METHOD type of separation. Because of this
 6204      operational state can be localised to each ENGINE structure, despite the
 6205      fact they all share the same "methods". New ENGINE structures returned in
 6206      this case have no functional references and the return value is the single
 6207      structural reference. This matches the single structural reference returned
 6208      by ENGINE_by_id() normally, when it is incremented on the pre-existing
 6209      ENGINE structure.
 6210      [Geoff]
 6211 
 6212   *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
 6213      needs to match any other type at all we need to manually clear the
 6214      tag cache.
 6215      [Steve Henson]
 6216 
 6217   *) Changes to the "openssl engine" utility to include;
 6218      - verbosity levels ('-v', '-vv', and '-vvv') that provide information
 6219        about an ENGINE's available control commands.
 6220      - executing control commands from command line arguments using the
 6221        '-pre' and '-post' switches. '-post' is only used if '-t' is
 6222        specified and the ENGINE is successfully initialised. The syntax for
 6223        the individual commands are colon-separated, for example;
 6224 	 openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
 6225      [Geoff]
 6226 
 6227   *) New dynamic control command support for ENGINEs. ENGINEs can now
 6228      declare their own commands (numbers), names (strings), descriptions,
 6229      and input types for run-time discovery by calling applications. A
 6230      subset of these commands are implicitly classed as "executable"
 6231      depending on their input type, and only these can be invoked through
 6232      the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
 6233      can be based on user input, config files, etc). The distinction is
 6234      that "executable" commands cannot return anything other than a boolean
 6235      result and can only support numeric or string input, whereas some
 6236      discoverable commands may only be for direct use through
 6237      ENGINE_ctrl(), eg. supporting the exchange of binary data, function
 6238      pointers, or other custom uses. The "executable" commands are to
 6239      support parameterisations of ENGINE behaviour that can be
 6240      unambiguously defined by ENGINEs and used consistently across any
 6241      OpenSSL-based application. Commands have been added to all the
 6242      existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
 6243      control over shared-library paths without source code alterations.
 6244      [Geoff]
 6245 
 6246   *) Changed all ENGINE implementations to dynamically allocate their
 6247      ENGINEs rather than declaring them statically. Apart from this being
 6248      necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
 6249      this also allows the implementations to compile without using the
 6250      internal engine_int.h header.
 6251      [Geoff]
 6252 
 6253   *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
 6254      'const' value. Any code that should be able to modify a RAND_METHOD
 6255      should already have non-const pointers to it (ie. they should only
 6256      modify their own ones).
 6257      [Geoff]
 6258 
 6259   *) Made a variety of little tweaks to the ENGINE code.
 6260      - "atalla" and "ubsec" string definitions were moved from header files
 6261        to C code. "nuron" string definitions were placed in variables
 6262        rather than hard-coded - allowing parameterisation of these values
 6263        later on via ctrl() commands.
 6264      - Removed unused "#if 0"'d code.
 6265      - Fixed engine list iteration code so it uses ENGINE_free() to release
 6266        structural references.
 6267      - Constified the RAND_METHOD element of ENGINE structures.
 6268      - Constified various get/set functions as appropriate and added
 6269        missing functions (including a catch-all ENGINE_cpy that duplicates
 6270        all ENGINE values onto a new ENGINE except reference counts/state).
 6271      - Removed NULL parameter checks in get/set functions. Setting a method
 6272        or function to NULL is a way of cancelling out a previously set
 6273        value.  Passing a NULL ENGINE parameter is just plain stupid anyway
 6274        and doesn't justify the extra error symbols and code.
 6275      - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
 6276        flags from engine_int.h to engine.h.
 6277      - Changed prototypes for ENGINE handler functions (init(), finish(),
 6278        ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
 6279      [Geoff]
 6280 
 6281   *) Implement binary inversion algorithm for BN_mod_inverse in addition
 6282      to the algorithm using long division.  The binary algorithm can be
 6283      used only if the modulus is odd.  On 32-bit systems, it is faster
 6284      only for relatively small moduli (roughly 20-30% for 128-bit moduli,
 6285      roughly 5-15% for 256-bit moduli), so we use it only for moduli
 6286      up to 450 bits.  In 64-bit environments, the binary algorithm
 6287      appears to be advantageous for much longer moduli; here we use it
 6288      for moduli up to 2048 bits.
 6289      [Bodo Moeller]
 6290 
 6291   *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
 6292      could not support the combine flag in choice fields.
 6293      [Steve Henson]
 6294 
 6295   *) Add a 'copy_extensions' option to the 'ca' utility. This copies
 6296      extensions from a certificate request to the certificate.
 6297      [Steve Henson]
 6298 
 6299   *) Allow multiple 'certopt' and 'nameopt' options to be separated
 6300      by commas. Add 'namopt' and 'certopt' options to the 'ca' config
 6301      file: this allows the display of the certificate about to be
 6302      signed to be customised, to allow certain fields to be included
 6303      or excluded and extension details. The old system didn't display
 6304      multicharacter strings properly, omitted fields not in the policy
 6305      and couldn't display additional details such as extensions.
 6306      [Steve Henson]
 6307 
 6308   *) Function EC_POINTs_mul for multiple scalar multiplication
 6309      of an arbitrary number of elliptic curve points
 6310           \sum scalars[i]*points[i],
 6311      optionally including the generator defined for the EC_GROUP:
 6312           scalar*generator +  \sum scalars[i]*points[i].
 6313 
 6314      EC_POINT_mul is a simple wrapper function for the typical case
 6315      that the point list has just one item (besides the optional
 6316      generator).
 6317      [Bodo Moeller]
 6318 
 6319   *) First EC_METHODs for curves over GF(p):
 6320 
 6321      EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
 6322      operations and provides various method functions that can also
 6323      operate with faster implementations of modular arithmetic.     
 6324 
 6325      EC_GFp_mont_method() reuses most functions that are part of
 6326      EC_GFp_simple_method, but uses Montgomery arithmetic.
 6327 
 6328      [Bodo Moeller; point addition and point doubling
 6329      implementation directly derived from source code provided by
 6330      Lenka Fibikova <fibikova@exp-math.uni-essen.de>]
 6331 
 6332   *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
 6333      crypto/ec/ec_lib.c):
 6334 
 6335      Curves are EC_GROUP objects (with an optional group generator)
 6336      based on EC_METHODs that are built into the library.
 6337 
 6338      Points are EC_POINT objects based on EC_GROUP objects.
 6339 
 6340      Most of the framework would be able to handle curves over arbitrary
 6341      finite fields, but as there are no obvious types for fields other
 6342      than GF(p), some functions are limited to that for now.
 6343      [Bodo Moeller]
 6344 
 6345   *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
 6346      that the file contains a complete HTTP response.
 6347      [Richard Levitte]
 6348 
 6349   *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
 6350      change the def and num file printf format specifier from "%-40sXXX"
 6351      to "%-39s XXX". The latter will always guarantee a space after the
 6352      field while the former will cause them to run together if the field
 6353      is 40 of more characters long.
 6354      [Steve Henson]
 6355 
 6356   *) Constify the cipher and digest 'method' functions and structures
 6357      and modify related functions to take constant EVP_MD and EVP_CIPHER
 6358      pointers.
 6359      [Steve Henson]
 6360 
 6361   *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
 6362      in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
 6363      [Bodo Moeller]
 6364 
 6365   *) Modify EVP_Digest*() routines so they now return values. Although the
 6366      internal software routines can never fail additional hardware versions
 6367      might.
 6368      [Steve Henson]
 6369 
 6370   *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
 6371 
 6372      Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
 6373      (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
 6374 
 6375      ASN1 error codes
 6376           ERR_R_NESTED_ASN1_ERROR
 6377           ...
 6378           ERR_R_MISSING_ASN1_EOS
 6379      were 4 .. 9, conflicting with
 6380           ERR_LIB_RSA (= ERR_R_RSA_LIB)
 6381           ...
 6382           ERR_LIB_PEM (= ERR_R_PEM_LIB).
 6383      They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
 6384 
 6385      Add new error code 'ERR_R_INTERNAL_ERROR'.
 6386      [Bodo Moeller]
 6387 
 6388   *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
 6389      suffices.
 6390      [Bodo Moeller]
 6391 
 6392   *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
 6393      sets the subject name for a new request or supersedes the
 6394      subject name in a given request. Formats that can be parsed are
 6395           'CN=Some Name, OU=myOU, C=IT'
 6396      and
 6397           'CN=Some Name/OU=myOU/C=IT'.
 6398 
 6399      Add options '-batch' and '-verbose' to 'openssl req'.
 6400      [Massimiliano Pala <madwolf@hackmasters.net>]
 6401 
 6402   *) Introduce the possibility to access global variables through
 6403      functions on platform were that's the best way to handle exporting
 6404      global variables in shared libraries.  To enable this functionality,
 6405      one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
 6406      "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
 6407      is normally done by Configure or something similar).
 6408 
 6409      To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
 6410      in the source file (foo.c) like this:
 6411 
 6412 	OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
 6413 	OPENSSL_IMPLEMENT_GLOBAL(double,bar);
 6414 
 6415      To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
 6416      and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
 6417 
 6418 	OPENSSL_DECLARE_GLOBAL(int,foo);
 6419 	#define foo OPENSSL_GLOBAL_REF(foo)
 6420 	OPENSSL_DECLARE_GLOBAL(double,bar);
 6421 	#define bar OPENSSL_GLOBAL_REF(bar)
 6422 
 6423      The #defines are very important, and therefore so is including the
 6424      header file everywhere where the defined globals are used.
 6425 
 6426      The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
 6427      of ASN.1 items, but that structure is a bit different.
 6428 
 6429      The largest change is in util/mkdef.pl which has been enhanced with
 6430      better and easier to understand logic to choose which symbols should
 6431      go into the Windows .def files as well as a number of fixes and code
 6432      cleanup (among others, algorithm keywords are now sorted
 6433      lexicographically to avoid constant rewrites).
 6434      [Richard Levitte]
 6435 
 6436   *) In BN_div() keep a copy of the sign of 'num' before writing the
 6437      result to 'rm' because if rm==num the value will be overwritten
 6438      and produce the wrong result if 'num' is negative: this caused
 6439      problems with BN_mod() and BN_nnmod().
 6440      [Steve Henson]
 6441 
 6442   *) Function OCSP_request_verify(). This checks the signature on an
 6443      OCSP request and verifies the signer certificate. The signer
 6444      certificate is just checked for a generic purpose and OCSP request
 6445      trust settings.
 6446      [Steve Henson]
 6447 
 6448   *) Add OCSP_check_validity() function to check the validity of OCSP
 6449      responses. OCSP responses are prepared in real time and may only
 6450      be a few seconds old. Simply checking that the current time lies
 6451      between thisUpdate and nextUpdate max reject otherwise valid responses
 6452      caused by either OCSP responder or client clock inaccuracy. Instead
 6453      we allow thisUpdate and nextUpdate to fall within a certain period of
 6454      the current time. The age of the response can also optionally be
 6455      checked. Two new options -validity_period and -status_age added to
 6456      ocsp utility.
 6457      [Steve Henson]
 6458 
 6459   *) If signature or public key algorithm is unrecognized print out its
 6460      OID rather that just UNKNOWN.
 6461      [Steve Henson]
 6462 
 6463   *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
 6464      OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
 6465      ID to be generated from the issuer certificate alone which can then be
 6466      passed to OCSP_id_issuer_cmp().
 6467      [Steve Henson]
 6468 
 6469   *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
 6470      ASN1 modules to export functions returning ASN1_ITEM pointers
 6471      instead of the ASN1_ITEM structures themselves. This adds several
 6472      new macros which allow the underlying ASN1 function/structure to
 6473      be accessed transparently. As a result code should not use ASN1_ITEM
 6474      references directly (such as &X509_it) but instead use the relevant
 6475      macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
 6476      use of the new ASN1 code on platforms where exporting structures
 6477      is problematical (for example in shared libraries) but exporting
 6478      functions returning pointers to structures is not.
 6479      [Steve Henson]
 6480 
 6481   *) Add support for overriding the generation of SSL/TLS session IDs.
 6482      These callbacks can be registered either in an SSL_CTX or per SSL.
 6483      The purpose of this is to allow applications to control, if they wish,
 6484      the arbitrary values chosen for use as session IDs, particularly as it
 6485      can be useful for session caching in multiple-server environments. A
 6486      command-line switch for testing this (and any client code that wishes
 6487      to use such a feature) has been added to "s_server".
 6488      [Geoff Thorpe, Lutz Jaenicke]
 6489 
 6490   *) Modify mkdef.pl to recognise and parse preprocessor conditionals
 6491      of the form '#if defined(...) || defined(...) || ...' and
 6492      '#if !defined(...) && !defined(...) && ...'.  This also avoids
 6493      the growing number of special cases it was previously handling.
 6494      [Richard Levitte]
 6495 
 6496   *) Make all configuration macros available for application by making
 6497      sure they are available in opensslconf.h, by giving them names starting
 6498      with "OPENSSL_" to avoid conflicts with other packages and by making
 6499      sure e_os2.h will cover all platform-specific cases together with
 6500      opensslconf.h.
 6501      Additionally, it is now possible to define configuration/platform-
 6502      specific names (called "system identities").  In the C code, these
 6503      are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
 6504      macro with the name beginning with "OPENSSL_SYS_", which is determined
 6505      from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
 6506      what is available.
 6507      [Richard Levitte]
 6508 
 6509   *) New option -set_serial to 'req' and 'x509' this allows the serial
 6510      number to use to be specified on the command line. Previously self
 6511      signed certificates were hard coded with serial number 0 and the 
 6512      CA options of 'x509' had to use a serial number in a file which was
 6513      auto incremented.
 6514      [Steve Henson]
 6515 
 6516   *) New options to 'ca' utility to support V2 CRL entry extensions.
 6517      Currently CRL reason, invalidity date and hold instruction are
 6518      supported. Add new CRL extensions to V3 code and some new objects.
 6519      [Steve Henson]
 6520 
 6521   *) New function EVP_CIPHER_CTX_set_padding() this is used to
 6522      disable standard block padding (aka PKCS#5 padding) in the EVP
 6523      API, which was previously mandatory. This means that the data is
 6524      not padded in any way and so the total length much be a multiple
 6525      of the block size, otherwise an error occurs.
 6526      [Steve Henson]
 6527 
 6528   *) Initial (incomplete) OCSP SSL support.
 6529      [Steve Henson]
 6530 
 6531   *) New function OCSP_parse_url(). This splits up a URL into its host,
 6532      port and path components: primarily to parse OCSP URLs. New -url
 6533      option to ocsp utility.
 6534      [Steve Henson]
 6535 
 6536   *) New nonce behavior. The return value of OCSP_check_nonce() now 
 6537      reflects the various checks performed. Applications can decide
 6538      whether to tolerate certain situations such as an absent nonce
 6539      in a response when one was present in a request: the ocsp application
 6540      just prints out a warning. New function OCSP_add1_basic_nonce()
 6541      this is to allow responders to include a nonce in a response even if
 6542      the request is nonce-less.
 6543      [Steve Henson]
 6544 
 6545   *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
 6546      skipped when using openssl x509 multiple times on a single input file,
 6547      e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
 6548      [Bodo Moeller]
 6549 
 6550   *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
 6551      set string type: to handle setting ASN1_TIME structures. Fix ca
 6552      utility to correctly initialize revocation date of CRLs.
 6553      [Steve Henson]
 6554 
 6555   *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
 6556      the clients preferred ciphersuites and rather use its own preferences.
 6557      Should help to work around M$ SGC (Server Gated Cryptography) bug in
 6558      Internet Explorer by ensuring unchanged hash method during stepup.
 6559      (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
 6560      [Lutz Jaenicke]
 6561 
 6562   *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
 6563      to aes and add a new 'exist' option to print out symbols that don't
 6564      appear to exist.
 6565      [Steve Henson]
 6566 
 6567   *) Additional options to ocsp utility to allow flags to be set and
 6568      additional certificates supplied.
 6569      [Steve Henson]
 6570 
 6571   *) Add the option -VAfile to 'openssl ocsp', so the user can give the
 6572      OCSP client a number of certificate to only verify the response
 6573      signature against.
 6574      [Richard Levitte]
 6575 
 6576   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
 6577      handle the new API. Currently only ECB, CBC modes supported. Add new
 6578      AES OIDs.
 6579 
 6580      Add TLS AES ciphersuites as described in RFC3268, "Advanced
 6581      Encryption Standard (AES) Ciphersuites for Transport Layer
 6582      Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
 6583      not enabled by default and were not part of the "ALL" ciphersuite
 6584      alias because they were not yet official; they could be
 6585      explicitly requested by specifying the "AESdraft" ciphersuite
 6586      group alias.  In the final release of OpenSSL 0.9.7, the group
 6587      alias is called "AES" and is part of "ALL".)
 6588      [Ben Laurie, Steve  Henson, Bodo Moeller]
 6589 
 6590   *) New function OCSP_copy_nonce() to copy nonce value (if present) from
 6591      request to response.
 6592      [Steve Henson]
 6593 
 6594   *) Functions for OCSP responders. OCSP_request_onereq_count(),
 6595      OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
 6596      extract information from a certificate request. OCSP_response_create()
 6597      creates a response and optionally adds a basic response structure.
 6598      OCSP_basic_add1_status() adds a complete single response to a basic
 6599      response and returns the OCSP_SINGLERESP structure just added (to allow
 6600      extensions to be included for example). OCSP_basic_add1_cert() adds a
 6601      certificate to a basic response and OCSP_basic_sign() signs a basic
 6602      response with various flags. New helper functions ASN1_TIME_check()
 6603      (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
 6604      (converts ASN1_TIME to GeneralizedTime).
 6605      [Steve Henson]
 6606 
 6607   *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
 6608      in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
 6609      structure from a certificate. X509_pubkey_digest() digests the public_key
 6610      contents: this is used in various key identifiers. 
 6611      [Steve Henson]
 6612 
 6613   *) Make sk_sort() tolerate a NULL argument.
 6614      [Steve Henson reported by Massimiliano Pala <madwolf@comune.modena.it>]
 6615 
 6616   *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
 6617      passed by the function are trusted implicitly. If any of them signed the
 6618      response then it is assumed to be valid and is not verified.
 6619      [Steve Henson]
 6620 
 6621   *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
 6622      to data. This was previously part of the PKCS7 ASN1 code. This
 6623      was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
 6624      [Steve Henson, reported by Kenneth R. Robinette
 6625 				<support@securenetterm.com>]
 6626 
 6627   *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
 6628      routines: without these tracing memory leaks is very painful.
 6629      Fix leaks in PKCS12 and PKCS7 routines.
 6630      [Steve Henson]
 6631 
 6632   *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
 6633      Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
 6634      effectively meant GeneralizedTime would never be used. Now it
 6635      is initialised to -1 but X509_time_adj() now has to check the value
 6636      and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
 6637      V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
 6638      [Steve Henson, reported by Kenneth R. Robinette
 6639 				<support@securenetterm.com>]
 6640 
 6641   *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
 6642      result in a zero length in the ASN1_INTEGER structure which was
 6643      not consistent with the structure when d2i_ASN1_INTEGER() was used
 6644      and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
 6645      to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
 6646      where it did not print out a minus for negative ASN1_INTEGER.
 6647      [Steve Henson]
 6648 
 6649   *) Add summary printout to ocsp utility. The various functions which
 6650      convert status values to strings have been renamed to:
 6651      OCSP_response_status_str(), OCSP_cert_status_str() and
 6652      OCSP_crl_reason_str() and are no longer static. New options
 6653      to verify nonce values and to disable verification. OCSP response
 6654      printout format cleaned up.
 6655      [Steve Henson]
 6656 
 6657   *) Add additional OCSP certificate checks. These are those specified
 6658      in RFC2560. This consists of two separate checks: the CA of the
 6659      certificate being checked must either be the OCSP signer certificate
 6660      or the issuer of the OCSP signer certificate. In the latter case the
 6661      OCSP signer certificate must contain the OCSP signing extended key
 6662      usage. This check is performed by attempting to match the OCSP
 6663      signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
 6664      in the OCSP_CERTID structures of the response.
 6665      [Steve Henson]
 6666 
 6667   *) Initial OCSP certificate verification added to OCSP_basic_verify()
 6668      and related routines. This uses the standard OpenSSL certificate
 6669      verify routines to perform initial checks (just CA validity) and
 6670      to obtain the certificate chain. Then additional checks will be
 6671      performed on the chain. Currently the root CA is checked to see
 6672      if it is explicitly trusted for OCSP signing. This is used to set
 6673      a root CA as a global signing root: that is any certificate that
 6674      chains to that CA is an acceptable OCSP signing certificate.
 6675      [Steve Henson]
 6676 
 6677   *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
 6678      extensions from a separate configuration file.
 6679      As when reading extensions from the main configuration file,
 6680      the '-extensions ...' option may be used for specifying the
 6681      section to use.
 6682      [Massimiliano Pala <madwolf@comune.modena.it>]
 6683 
 6684   *) New OCSP utility. Allows OCSP requests to be generated or
 6685      read. The request can be sent to a responder and the output
 6686      parsed, outputed or printed in text form. Not complete yet:
 6687      still needs to check the OCSP response validity.
 6688      [Steve Henson]
 6689 
 6690   *) New subcommands for 'openssl ca':
 6691      'openssl ca -status <serial>' prints the status of the cert with
 6692      the given serial number (according to the index file).
 6693      'openssl ca -updatedb' updates the expiry status of certificates
 6694      in the index file.
 6695      [Massimiliano Pala <madwolf@comune.modena.it>]
 6696 
 6697   *) New '-newreq-nodes' command option to CA.pl.  This is like
 6698      '-newreq', but calls 'openssl req' with the '-nodes' option
 6699      so that the resulting key is not encrypted.
 6700      [Damien Miller <djm@mindrot.org>]
 6701 
 6702   *) New configuration for the GNU Hurd.
 6703      [Jonathan Bartlett <johnnyb@wolfram.com> via Richard Levitte]
 6704 
 6705   *) Initial code to implement OCSP basic response verify. This
 6706      is currently incomplete. Currently just finds the signer's
 6707      certificate and verifies the signature on the response.
 6708      [Steve Henson]
 6709 
 6710   *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
 6711      value of OPENSSLDIR.  This is available via the new '-d' option
 6712      to 'openssl version', and is also included in 'openssl version -a'.
 6713      [Bodo Moeller]
 6714 
 6715   *) Allowing defining memory allocation callbacks that will be given
 6716      file name and line number information in additional arguments
 6717      (a const char* and an int).  The basic functionality remains, as
 6718      well as the original possibility to just replace malloc(),
 6719      realloc() and free() by functions that do not know about these
 6720      additional arguments.  To register and find out the current
 6721      settings for extended allocation functions, the following
 6722      functions are provided:
 6723 
 6724 	CRYPTO_set_mem_ex_functions
 6725 	CRYPTO_set_locked_mem_ex_functions
 6726 	CRYPTO_get_mem_ex_functions
 6727 	CRYPTO_get_locked_mem_ex_functions
 6728 
 6729      These work the same way as CRYPTO_set_mem_functions and friends.
 6730      CRYPTO_get_[locked_]mem_functions now writes 0 where such an
 6731      extended allocation function is enabled.
 6732      Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
 6733      a conventional allocation function is enabled.
 6734      [Richard Levitte, Bodo Moeller]
 6735 
 6736   *) Finish off removing the remaining LHASH function pointer casts.
 6737      There should no longer be any prototype-casting required when using
 6738      the LHASH abstraction, and any casts that remain are "bugs". See
 6739      the callback types and macros at the head of lhash.h for details
 6740      (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
 6741      [Geoff Thorpe]
 6742 
 6743   *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
 6744      If /dev/[u]random devices are not available or do not return enough
 6745      entropy, EGD style sockets (served by EGD or PRNGD) will automatically
 6746      be queried.
 6747      The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
 6748      /etc/entropy will be queried once each in this sequence, quering stops
 6749      when enough entropy was collected without querying more sockets.
 6750      [Lutz Jaenicke]
 6751 
 6752   *) Change the Unix RAND_poll() variant to be able to poll several
 6753      random devices, as specified by DEVRANDOM, until a sufficient amount
 6754      of data has been collected.   We spend at most 10 ms on each file
 6755      (select timeout) and read in non-blocking mode.  DEVRANDOM now
 6756      defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
 6757      (previously it was just the string "/dev/urandom"), so on typical
 6758      platforms the 10 ms delay will never occur.
 6759      Also separate out the Unix variant to its own file, rand_unix.c.
 6760      For VMS, there's a currently-empty rand_vms.c.
 6761      [Richard Levitte]
 6762 
 6763   *) Move OCSP client related routines to ocsp_cl.c. These
 6764      provide utility functions which an application needing
 6765      to issue a request to an OCSP responder and analyse the
 6766      response will typically need: as opposed to those which an
 6767      OCSP responder itself would need which will be added later.
 6768 
 6769      OCSP_request_sign() signs an OCSP request with an API similar
 6770      to PKCS7_sign(). OCSP_response_status() returns status of OCSP
 6771      response. OCSP_response_get1_basic() extracts basic response
 6772      from response. OCSP_resp_find_status(): finds and extracts status
 6773      information from an OCSP_CERTID structure (which will be created
 6774      when the request structure is built). These are built from lower
 6775      level functions which work on OCSP_SINGLERESP structures but
 6776      wont normally be used unless the application wishes to examine
 6777      extensions in the OCSP response for example.
 6778 
 6779      Replace nonce routines with a pair of functions.
 6780      OCSP_request_add1_nonce() adds a nonce value and optionally
 6781      generates a random value. OCSP_check_nonce() checks the
 6782      validity of the nonce in an OCSP response.
 6783      [Steve Henson]
 6784 
 6785   *) Change function OCSP_request_add() to OCSP_request_add0_id().
 6786      This doesn't copy the supplied OCSP_CERTID and avoids the
 6787      need to free up the newly created id. Change return type
 6788      to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
 6789      This can then be used to add extensions to the request.
 6790      Deleted OCSP_request_new(), since most of its functionality
 6791      is now in OCSP_REQUEST_new() (and the case insensitive name
 6792      clash) apart from the ability to set the request name which
 6793      will be added elsewhere.
 6794      [Steve Henson]
 6795 
 6796   *) Update OCSP API. Remove obsolete extensions argument from
 6797      various functions. Extensions are now handled using the new
 6798      OCSP extension code. New simple OCSP HTTP function which 
 6799      can be used to send requests and parse the response.
 6800      [Steve Henson]
 6801 
 6802   *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
 6803      ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
 6804      uses the special reorder version of SET OF to sort the attributes
 6805      and reorder them to match the encoded order. This resolves a long
 6806      standing problem: a verify on a PKCS7 structure just after signing
 6807      it used to fail because the attribute order did not match the
 6808      encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
 6809      it uses the received order. This is necessary to tolerate some broken
 6810      software that does not order SET OF. This is handled by encoding
 6811      as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
 6812      to produce the required SET OF.
 6813      [Steve Henson]
 6814 
 6815   *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
 6816      OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
 6817      files to get correct declarations of the ASN.1 item variables.
 6818      [Richard Levitte]
 6819 
 6820   *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
 6821      PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
 6822      asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
 6823      NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
 6824      New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
 6825      ASN1_ITEM and no wrapper functions.
 6826      [Steve Henson]
 6827 
 6828   *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
 6829      replace the old function pointer based I/O routines. Change most of
 6830      the *_d2i_bio() and *_d2i_fp() functions to use these.
 6831      [Steve Henson]
 6832 
 6833   *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
 6834      lines, recognice more "algorithms" that can be deselected, and make
 6835      it complain about algorithm deselection that isn't recognised.
 6836      [Richard Levitte]
 6837 
 6838   *) New ASN1 functions to handle dup, sign, verify, digest, pack and
 6839      unpack operations in terms of ASN1_ITEM. Modify existing wrappers
 6840      to use new functions. Add NO_ASN1_OLD which can be set to remove
 6841      some old style ASN1 functions: this can be used to determine if old
 6842      code will still work when these eventually go away.
 6843      [Steve Henson]
 6844 
 6845   *) New extension functions for OCSP structures, these follow the
 6846      same conventions as certificates and CRLs.
 6847      [Steve Henson]
 6848 
 6849   *) New function X509V3_add1_i2d(). This automatically encodes and
 6850      adds an extension. Its behaviour can be customised with various
 6851      flags to append, replace or delete. Various wrappers added for
 6852      certifcates and CRLs.
 6853      [Steve Henson]
 6854 
 6855   *) Fix to avoid calling the underlying ASN1 print routine when
 6856      an extension cannot be parsed. Correct a typo in the
 6857      OCSP_SERVICELOC extension. Tidy up print OCSP format.
 6858      [Steve Henson]
 6859 
 6860   *) Make mkdef.pl parse some of the ASN1 macros and add apropriate
 6861      entries for variables.
 6862      [Steve Henson]
 6863 
 6864   *) Add functionality to apps/openssl.c for detecting locking
 6865      problems: As the program is single-threaded, all we have
 6866      to do is register a locking callback using an array for
 6867      storing which locks are currently held by the program.
 6868      [Bodo Moeller]
 6869 
 6870   *) Use a lock around the call to CRYPTO_get_ex_new_index() in
 6871      SSL_get_ex_data_X509_STORE_idx(), which is used in
 6872      ssl_verify_cert_chain() and thus can be called at any time
 6873      during TLS/SSL handshakes so that thread-safety is essential.
 6874      Unfortunately, the ex_data design is not at all suited
 6875      for multi-threaded use, so it probably should be abolished.
 6876      [Bodo Moeller]
 6877 
 6878   *) Added Broadcom "ubsec" ENGINE to OpenSSL.
 6879      [Broadcom, tweaked and integrated by Geoff Thorpe]
 6880 
 6881   *) Move common extension printing code to new function
 6882      X509V3_print_extensions(). Reorganise OCSP print routines and
 6883      implement some needed OCSP ASN1 functions. Add OCSP extensions.
 6884      [Steve Henson]
 6885 
 6886   *) New function X509_signature_print() to remove duplication in some
 6887      print routines.
 6888      [Steve Henson]
 6889 
 6890   *) Add a special meaning when SET OF and SEQUENCE OF flags are both
 6891      set (this was treated exactly the same as SET OF previously). This
 6892      is used to reorder the STACK representing the structure to match the
 6893      encoding. This will be used to get round a problem where a PKCS7
 6894      structure which was signed could not be verified because the STACK
 6895      order did not reflect the encoded order.
 6896      [Steve Henson]
 6897 
 6898   *) Reimplement the OCSP ASN1 module using the new code.
 6899      [Steve Henson]
 6900 
 6901   *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
 6902      for its ASN1 operations. The old style function pointers still exist
 6903      for now but they will eventually go away.
 6904      [Steve Henson]
 6905 
 6906   *) Merge in replacement ASN1 code from the ASN1 branch. This almost
 6907      completely replaces the old ASN1 functionality with a table driven
 6908      encoder and decoder which interprets an ASN1_ITEM structure describing
 6909      the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
 6910      largely maintained. Almost all of the old asn1_mac.h macro based ASN1
 6911      has also been converted to the new form.
 6912      [Steve Henson]
 6913 
 6914   *) Change BN_mod_exp_recp so that negative moduli are tolerated
 6915      (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
 6916      so that BN_mod_exp_mont and BN_mod_exp_mont_word work
 6917      for negative moduli.
 6918      [Bodo Moeller]
 6919 
 6920   *) Fix BN_uadd and BN_usub: Always return non-negative results instead
 6921      of not touching the result's sign bit.
 6922      [Bodo Moeller]
 6923 
 6924   *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
 6925      set.
 6926      [Bodo Moeller]
 6927 
 6928   *) Changed the LHASH code to use prototypes for callbacks, and created
 6929      macros to declare and implement thin (optionally static) functions
 6930      that provide type-safety and avoid function pointer casting for the
 6931      type-specific callbacks.
 6932      [Geoff Thorpe]
 6933 
 6934   *) Added Kerberos Cipher Suites to be used with TLS, as written in
 6935      RFC 2712.
 6936      [Veers Staats <staatsvr@asc.hpc.mil>,
 6937       Jeffrey Altman <jaltman@columbia.edu>, via Richard Levitte]
 6938 
 6939   *) Reformat the FAQ so the different questions and answers can be divided
 6940      in sections depending on the subject.
 6941      [Richard Levitte]
 6942 
 6943   *) Have the zlib compression code load ZLIB.DLL dynamically under
 6944      Windows.
 6945      [Richard Levitte]
 6946 
 6947   *) New function BN_mod_sqrt for computing square roots modulo a prime
 6948      (using the probabilistic Tonelli-Shanks algorithm unless
 6949      p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
 6950      be handled deterministically).
 6951      [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
 6952 
 6953   *) Make BN_mod_inverse faster by explicitly handling small quotients
 6954      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
 6955      512 bits], about 30% for larger ones [1024 or 2048 bits].)
 6956      [Bodo Moeller]
 6957 
 6958   *) New function BN_kronecker.
 6959      [Bodo Moeller]
 6960 
 6961   *) Fix BN_gcd so that it works on negative inputs; the result is
 6962      positive unless both parameters are zero.
 6963      Previously something reasonably close to an infinite loop was
 6964      possible because numbers could be growing instead of shrinking
 6965      in the implementation of Euclid's algorithm.
 6966      [Bodo Moeller]
 6967 
 6968   *) Fix BN_is_word() and BN_is_one() macros to take into account the
 6969      sign of the number in question.
 6970 
 6971      Fix BN_is_word(a,w) to work correctly for w == 0.
 6972 
 6973      The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
 6974      because its test if the absolute value of 'a' equals 'w'.
 6975      Note that BN_abs_is_word does *not* handle w == 0 reliably;
 6976      it exists mostly for use in the implementations of BN_is_zero(),
 6977      BN_is_one(), and BN_is_word().
 6978      [Bodo Moeller]
 6979 
 6980   *) New function BN_swap.
 6981      [Bodo Moeller]
 6982 
 6983   *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
 6984      the exponentiation functions are more likely to produce reasonable
 6985      results on negative inputs.
 6986      [Bodo Moeller]
 6987 
 6988   *) Change BN_mod_mul so that the result is always non-negative.
 6989      Previously, it could be negative if one of the factors was negative;
 6990      I don't think anyone really wanted that behaviour.
 6991      [Bodo Moeller]
 6992 
 6993   *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
 6994      (except for exponentiation, which stays in crypto/bn/bn_exp.c,
 6995      and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
 6996      and add new functions:
 6997 
 6998           BN_nnmod
 6999           BN_mod_sqr
 7000           BN_mod_add
 7001           BN_mod_add_quick
 7002           BN_mod_sub
 7003           BN_mod_sub_quick
 7004           BN_mod_lshift1
 7005           BN_mod_lshift1_quick
 7006           BN_mod_lshift
 7007           BN_mod_lshift_quick
 7008 
 7009      These functions always generate non-negative results.
 7010 
 7011      BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
 7012      such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
 7013 
 7014      BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
 7015      BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
 7016      be reduced modulo  m.
 7017      [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
 7018 
 7019 #if 0
 7020      The following entry accidentily appeared in the CHANGES file
 7021      distributed with OpenSSL 0.9.7.  The modifications described in
 7022      it do *not* apply to OpenSSL 0.9.7.
 7023 
 7024   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
 7025      was actually never needed) and in BN_mul().  The removal in BN_mul()
 7026      required a small change in bn_mul_part_recursive() and the addition
 7027      of the functions bn_cmp_part_words(), bn_sub_part_words() and
 7028      bn_add_part_words(), which do the same thing as bn_cmp_words(),
 7029      bn_sub_words() and bn_add_words() except they take arrays with
 7030      differing sizes.
 7031      [Richard Levitte]
 7032 #endif
 7033 
 7034   *) In 'openssl passwd', verify passwords read from the terminal
 7035      unless the '-salt' option is used (which usually means that
 7036      verification would just waste user's time since the resulting
 7037      hash is going to be compared with some given password hash)
 7038      or the new '-noverify' option is used.
 7039 
 7040      This is an incompatible change, but it does not affect
 7041      non-interactive use of 'openssl passwd' (passwords on the command
 7042      line, '-stdin' option, '-in ...' option) and thus should not
 7043      cause any problems.
 7044      [Bodo Moeller]
 7045 
 7046   *) Remove all references to RSAref, since there's no more need for it.
 7047      [Richard Levitte]
 7048 
 7049   *) Make DSO load along a path given through an environment variable
 7050      (SHLIB_PATH) with shl_load().
 7051      [Richard Levitte]
 7052 
 7053   *) Constify the ENGINE code as a result of BIGNUM constification.
 7054      Also constify the RSA code and most things related to it.  In a
 7055      few places, most notable in the depth of the ASN.1 code, ugly
 7056      casts back to non-const were required (to be solved at a later
 7057      time)
 7058      [Richard Levitte]
 7059 
 7060   *) Make it so the openssl application has all engines loaded by default.
 7061      [Richard Levitte]
 7062 
 7063   *) Constify the BIGNUM routines a little more.
 7064      [Richard Levitte]
 7065 
 7066   *) Add the following functions:
 7067 
 7068 	ENGINE_load_cswift()
 7069 	ENGINE_load_chil()
 7070 	ENGINE_load_atalla()
 7071 	ENGINE_load_nuron()
 7072 	ENGINE_load_builtin_engines()
 7073 
 7074      That way, an application can itself choose if external engines that
 7075      are built-in in OpenSSL shall ever be used or not.  The benefit is
 7076      that applications won't have to be linked with libdl or other dso
 7077      libraries unless it's really needed.
 7078 
 7079      Changed 'openssl engine' to load all engines on demand.
 7080      Changed the engine header files to avoid the duplication of some
 7081      declarations (they differed!).
 7082      [Richard Levitte]
 7083 
 7084   *) 'openssl engine' can now list capabilities.
 7085      [Richard Levitte]
 7086 
 7087   *) Better error reporting in 'openssl engine'.
 7088      [Richard Levitte]
 7089 
 7090   *) Never call load_dh_param(NULL) in s_server.
 7091      [Bodo Moeller]
 7092 
 7093   *) Add engine application.  It can currently list engines by name and
 7094      identity, and test if they are actually available.
 7095      [Richard Levitte]
 7096 
 7097   *) Improve RPM specification file by forcing symbolic linking and making
 7098      sure the installed documentation is also owned by root.root.
 7099      [Damien Miller <djm@mindrot.org>]
 7100 
 7101   *) Give the OpenSSL applications more possibilities to make use of
 7102      keys (public as well as private) handled by engines.
 7103      [Richard Levitte]
 7104 
 7105   *) Add OCSP code that comes from CertCo.
 7106      [Richard Levitte]
 7107 
 7108   *) Add VMS support for the Rijndael code.
 7109      [Richard Levitte]
 7110 
 7111   *) Added untested support for Nuron crypto accelerator.
 7112      [Ben Laurie]
 7113 
 7114   *) Add support for external cryptographic devices.  This code was
 7115      previously distributed separately as the "engine" branch.
 7116      [Geoff Thorpe, Richard Levitte]
 7117 
 7118   *) Rework the filename-translation in the DSO code. It is now possible to
 7119      have far greater control over how a "name" is turned into a filename
 7120      depending on the operating environment and any oddities about the
 7121      different shared library filenames on each system.
 7122      [Geoff Thorpe]
 7123 
 7124   *) Support threads on FreeBSD-elf in Configure.
 7125      [Richard Levitte]
 7126 
 7127   *) Fix for SHA1 assembly problem with MASM: it produces
 7128      warnings about corrupt line number information when assembling
 7129      with debugging information. This is caused by the overlapping
 7130      of two sections.
 7131      [Bernd Matthes <mainbug@celocom.de>, Steve Henson]
 7132 
 7133   *) NCONF changes.
 7134      NCONF_get_number() has no error checking at all.  As a replacement,
 7135      NCONF_get_number_e() is defined (_e for "error checking") and is
 7136      promoted strongly.  The old NCONF_get_number is kept around for
 7137      binary backward compatibility.
 7138      Make it possible for methods to load from something other than a BIO,
 7139      by providing a function pointer that is given a name instead of a BIO.
 7140      For example, this could be used to load configuration data from an
 7141      LDAP server.
 7142      [Richard Levitte]
 7143 
 7144   *) Fix for non blocking accept BIOs. Added new I/O special reason
 7145      BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
 7146      with non blocking I/O was not possible because no retry code was
 7147      implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
 7148      this case.
 7149      [Steve Henson]
 7150 
 7151   *) Added the beginnings of Rijndael support.
 7152      [Ben Laurie]
 7153 
 7154   *) Fix for bug in DirectoryString mask setting. Add support for
 7155      X509_NAME_print_ex() in 'req' and X509_print_ex() function
 7156      to allow certificate printing to more controllable, additional
 7157      'certopt' option to 'x509' to allow new printing options to be
 7158      set.
 7159      [Steve Henson]
 7160 
 7161   *) Clean old EAY MD5 hack from e_os.h.
 7162      [Richard Levitte]
 7163 
 7164  Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
 7165 
 7166   *) Fix null-pointer assignment in do_change_cipher_spec() revealed
 7167      by using the Codenomicon TLS Test Tool (CVE-2004-0079)
 7168      [Joe Orton, Steve Henson]
 7169 
 7170  Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
 7171 
 7172   *) Fix additional bug revealed by the NISCC test suite:
 7173 
 7174      Stop bug triggering large recursion when presented with
 7175      certain ASN.1 tags (CVE-2003-0851)
 7176      [Steve Henson]
 7177 
 7178  Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
 7179 
 7180   *) Fix various bugs revealed by running the NISCC test suite:
 7181 
 7182      Stop out of bounds reads in the ASN1 code when presented with
 7183      invalid tags (CVE-2003-0543 and CVE-2003-0544).
 7184      
 7185      If verify callback ignores invalid public key errors don't try to check
 7186      certificate signature with the NULL public key.
 7187 
 7188      [Steve Henson]
 7189 
 7190   *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
 7191      if the server requested one: as stated in TLS 1.0 and SSL 3.0
 7192      specifications.
 7193      [Steve Henson]
 7194 
 7195   *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
 7196      extra data after the compression methods not only for TLS 1.0
 7197      but also for SSL 3.0 (as required by the specification).
 7198      [Bodo Moeller; problem pointed out by Matthias Loepfe]
 7199 
 7200   *) Change X509_certificate_type() to mark the key as exported/exportable
 7201      when it's 512 *bits* long, not 512 bytes.
 7202      [Richard Levitte]
 7203 
 7204  Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
 7205 
 7206   *) Countermeasure against the Klima-Pokorny-Rosa extension of
 7207      Bleichbacher's attack on PKCS #1 v1.5 padding: treat
 7208      a protocol version number mismatch like a decryption error
 7209      in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
 7210      [Bodo Moeller]
 7211 
 7212   *) Turn on RSA blinding by default in the default implementation
 7213      to avoid a timing attack. Applications that don't want it can call
 7214      RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
 7215      They would be ill-advised to do so in most cases.
 7216      [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
 7217 
 7218   *) Change RSA blinding code so that it works when the PRNG is not
 7219      seeded (in this case, the secret RSA exponent is abused as
 7220      an unpredictable seed -- if it is not unpredictable, there
 7221      is no point in blinding anyway).  Make RSA blinding thread-safe
 7222      by remembering the creator's thread ID in rsa->blinding and
 7223      having all other threads use local one-time blinding factors
 7224      (this requires more computation than sharing rsa->blinding, but
 7225      avoids excessive locking; and if an RSA object is not shared
 7226      between threads, blinding will still be very fast).
 7227      [Bodo Moeller]
 7228 
 7229  Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
 7230 
 7231   *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
 7232      via timing by performing a MAC computation even if incorrrect
 7233      block cipher padding has been found.  This is a countermeasure
 7234      against active attacks where the attacker has to distinguish
 7235      between bad padding and a MAC verification error. (CVE-2003-0078)
 7236 
 7237      [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
 7238      Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
 7239      Martin Vuagnoux (EPFL, Ilion)]
 7240 
 7241  Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
 7242 
 7243   *) New function OPENSSL_cleanse(), which is used to cleanse a section of
 7244      memory from it's contents.  This is done with a counter that will
 7245      place alternating values in each byte.  This can be used to solve
 7246      two issues: 1) the removal of calls to memset() by highly optimizing
 7247      compilers, and 2) cleansing with other values than 0, since those can
 7248      be read through on certain media, for example a swap space on disk.
 7249      [Geoff Thorpe]
 7250 
 7251   *) Bugfix: client side session caching did not work with external caching,
 7252      because the session->cipher setting was not restored when reloading
 7253      from the external cache. This problem was masked, when
 7254      SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
 7255      (Found by Steve Haslam <steve@araqnid.ddts.net>.)
 7256      [Lutz Jaenicke]
 7257 
 7258   *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
 7259      length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
 7260      [Zeev Lieber <zeev-l@yahoo.com>]
 7261 
 7262   *) Undo an undocumented change introduced in 0.9.6e which caused
 7263      repeated calls to OpenSSL_add_all_ciphers() and 
 7264      OpenSSL_add_all_digests() to be ignored, even after calling
 7265      EVP_cleanup().
 7266      [Richard Levitte]
 7267 
 7268   *) Change the default configuration reader to deal with last line not
 7269      being properly terminated.
 7270      [Richard Levitte]
 7271 
 7272   *) Change X509_NAME_cmp() so it applies the special rules on handling
 7273      DN values that are of type PrintableString, as well as RDNs of type
 7274      emailAddress where the value has the type ia5String.
 7275      [stefank@valicert.com via Richard Levitte]
 7276 
 7277   *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
 7278      the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
 7279      doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
 7280      the bitwise-OR of the two for use by the majority of applications
 7281      wanting this behaviour, and update the docs. The documented
 7282      behaviour and actual behaviour were inconsistent and had been
 7283      changing anyway, so this is more a bug-fix than a behavioural
 7284      change.
 7285      [Geoff Thorpe, diagnosed by Nadav Har'El]
 7286 
 7287   *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
 7288      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
 7289      [Bodo Moeller]
 7290 
 7291   *) Fix initialization code race conditions in
 7292         SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
 7293         SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
 7294         SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
 7295         TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
 7296         ssl2_get_cipher_by_char(),
 7297         ssl3_get_cipher_by_char().
 7298      [Patrick McCormick <patrick@tellme.com>, Bodo Moeller]
 7299 
 7300   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
 7301      the cached sessions are flushed, as the remove_cb() might use ex_data
 7302      contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com>
 7303      (see [openssl.org #212]).
 7304      [Geoff Thorpe, Lutz Jaenicke]
 7305 
 7306   *) Fix typo in OBJ_txt2obj which incorrectly passed the content
 7307      length, instead of the encoding length to d2i_ASN1_OBJECT.
 7308      [Steve Henson]
 7309 
 7310  Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
 7311 
 7312   *) [In 0.9.6g-engine release:]
 7313      Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
 7314      [Lynn Gazis <lgazis@rainbow.com>]
 7315 
 7316  Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
 7317 
 7318   *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
 7319      and get fix the header length calculation.
 7320      [Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
 7321 	Alon Kantor <alonk@checkpoint.com> (and others),
 7322 	Steve Henson]
 7323 
 7324   *) Use proper error handling instead of 'assertions' in buffer
 7325      overflow checks added in 0.9.6e.  This prevents DoS (the
 7326      assertions could call abort()).
 7327      [Arne Ansper <arne@ats.cyber.ee>, Bodo Moeller]
 7328 
 7329  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
 7330 
 7331   *) Add various sanity checks to asn1_get_length() to reject
 7332      the ASN1 length bytes if they exceed sizeof(long), will appear
 7333      negative or the content length exceeds the length of the
 7334      supplied buffer.
 7335      [Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]
 7336 
 7337   *) Fix cipher selection routines: ciphers without encryption had no flags
 7338      for the cipher strength set and where therefore not handled correctly
 7339      by the selection routines (PR #130).
 7340      [Lutz Jaenicke]
 7341 
 7342   *) Fix EVP_dsa_sha macro.
 7343      [Nils Larsch]
 7344 
 7345   *) New option
 7346           SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
 7347      for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
 7348      that was added in OpenSSL 0.9.6d.
 7349 
 7350      As the countermeasure turned out to be incompatible with some
 7351      broken SSL implementations, the new option is part of SSL_OP_ALL.
 7352      SSL_OP_ALL is usually employed when compatibility with weird SSL
 7353      implementations is desired (e.g. '-bugs' option to 's_client' and
 7354      's_server'), so the new option is automatically set in many
 7355      applications.
 7356      [Bodo Moeller]
 7357 
 7358   *) Changes in security patch:
 7359 
 7360      Changes marked "(CHATS)" were sponsored by the Defense Advanced
 7361      Research Projects Agency (DARPA) and Air Force Research Laboratory,
 7362      Air Force Materiel Command, USAF, under agreement number
 7363      F30602-01-2-0537.
 7364 
 7365   *) Add various sanity checks to asn1_get_length() to reject
 7366      the ASN1 length bytes if they exceed sizeof(long), will appear
 7367      negative or the content length exceeds the length of the
 7368      supplied buffer. (CVE-2002-0659)
 7369      [Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]
 7370 
 7371   *) Assertions for various potential buffer overflows, not known to
 7372      happen in practice.
 7373      [Ben Laurie (CHATS)]
 7374 
 7375   *) Various temporary buffers to hold ASCII versions of integers were
 7376      too small for 64 bit platforms. (CVE-2002-0655)
 7377      [Matthew Byng-Maddick <mbm@aldigital.co.uk> and Ben Laurie (CHATS)>
 7378 
 7379   *) Remote buffer overflow in SSL3 protocol - an attacker could
 7380      supply an oversized session ID to a client. (CVE-2002-0656)
 7381      [Ben Laurie (CHATS)]
 7382 
 7383   *) Remote buffer overflow in SSL2 protocol - an attacker could
 7384      supply an oversized client master key. (CVE-2002-0656)
 7385      [Ben Laurie (CHATS)]
 7386 
 7387  Changes between 0.9.6c and 0.9.6d  [9 May 2002]
 7388 
 7389   *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
 7390      encoded as NULL) with id-dsa-with-sha1.
 7391      [Nils Larsch <nla@trustcenter.de>; problem pointed out by Bodo Moeller]
 7392 
 7393   *) Check various X509_...() return values in apps/req.c.
 7394      [Nils Larsch <nla@trustcenter.de>]
 7395 
 7396   *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
 7397      an end-of-file condition would erronously be flagged, when the CRLF
 7398      was just at the end of a processed block. The bug was discovered when
 7399      processing data through a buffering memory BIO handing the data to a
 7400      BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
 7401      <ptsekov@syntrex.com> and Nedelcho Stanev.
 7402      [Lutz Jaenicke]
 7403 
 7404   *) Implement a countermeasure against a vulnerability recently found
 7405      in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
 7406      before application data chunks to avoid the use of known IVs
 7407      with data potentially chosen by the attacker.
 7408      [Bodo Moeller]
 7409 
 7410   *) Fix length checks in ssl3_get_client_hello().
 7411      [Bodo Moeller]
 7412 
 7413   *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
 7414      to prevent ssl3_read_internal() from incorrectly assuming that
 7415      ssl3_read_bytes() found application data while handshake
 7416      processing was enabled when in fact s->s3->in_read_app_data was
 7417      merely automatically cleared during the initial handshake.
 7418      [Bodo Moeller; problem pointed out by Arne Ansper <arne@ats.cyber.ee>]
 7419 
 7420   *) Fix object definitions for Private and Enterprise: they were not
 7421      recognized in their shortname (=lowercase) representation. Extend
 7422      obj_dat.pl to issue an error when using undefined keywords instead
 7423      of silently ignoring the problem (Svenning Sorensen
 7424      <sss@sss.dnsalias.net>).
 7425      [Lutz Jaenicke]
 7426 
 7427   *) Fix DH_generate_parameters() so that it works for 'non-standard'
 7428      generators, i.e. generators other than 2 and 5.  (Previously, the
 7429      code did not properly initialise the 'add' and 'rem' values to
 7430      BN_generate_prime().)
 7431 
 7432      In the new general case, we do not insist that 'generator' is
 7433      actually a primitive root: This requirement is rather pointless;
 7434      a generator of the order-q subgroup is just as good, if not
 7435      better.
 7436      [Bodo Moeller]
 7437  
 7438   *) Map new X509 verification errors to alerts. Discovered and submitted by
 7439      Tom Wu <tom@arcot.com>.
 7440      [Lutz Jaenicke]
 7441 
 7442   *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
 7443      returning non-zero before the data has been completely received
 7444      when using non-blocking I/O.
 7445      [Bodo Moeller; problem pointed out by John Hughes]
 7446 
 7447   *) Some of the ciphers missed the strength entry (SSL_LOW etc).
 7448      [Ben Laurie, Lutz Jaenicke]
 7449 
 7450   *) Fix bug in SSL_clear(): bad sessions were not removed (found by
 7451      Yoram Zahavi <YoramZ@gilian.com>).
 7452      [Lutz Jaenicke]
 7453 
 7454   *) Add information about CygWin 1.3 and on, and preserve proper
 7455      configuration for the versions before that.
 7456      [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
 7457 
 7458   *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
 7459      check whether we deal with a copy of a session and do not delete from
 7460      the cache in this case. Problem reported by "Izhar Shoshani Levi"
 7461      <izhar@checkpoint.com>.
 7462      [Lutz Jaenicke]
 7463 
 7464   *) Do not store session data into the internal session cache, if it
 7465      is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
 7466      flag is set). Proposed by Aslam <aslam@funk.com>.
 7467      [Lutz Jaenicke]
 7468 
 7469   *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
 7470      value is 0.
 7471      [Richard Levitte]
 7472 
 7473   *) [In 0.9.6d-engine release:]
 7474      Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
 7475      [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
 7476 
 7477   *) Add the configuration target linux-s390x.
 7478      [Neale Ferguson <Neale.Ferguson@SoftwareAG-USA.com> via Richard Levitte]
 7479 
 7480   *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
 7481      ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
 7482      variable as an indication that a ClientHello message has been
 7483      received.  As the flag value will be lost between multiple
 7484      invocations of ssl3_accept when using non-blocking I/O, the
 7485      function may not be aware that a handshake has actually taken
 7486      place, thus preventing a new session from being added to the
 7487      session cache.
 7488 
 7489      To avoid this problem, we now set s->new_session to 2 instead of
 7490      using a local variable.
 7491      [Lutz Jaenicke, Bodo Moeller]
 7492 
 7493   *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
 7494      if the SSL_R_LENGTH_MISMATCH error is detected.
 7495      [Geoff Thorpe, Bodo Moeller]
 7496 
 7497   *) New 'shared_ldflag' column in Configure platform table.
 7498      [Richard Levitte]
 7499 
 7500   *) Fix EVP_CIPHER_mode macro.
 7501      ["Dan S. Camper" <dan@bti.net>]
 7502 
 7503   *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
 7504      type, we must throw them away by setting rr->length to 0.
 7505      [D P Chang <dpc@qualys.com>]
 7506 
 7507  Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
 7508 
 7509   *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
 7510      <Dominikus.Scherkl@biodata.com>.  (The previous implementation
 7511      worked incorrectly for those cases where  range = 10..._2  and
 7512      3*range  is two bits longer than  range.)
 7513      [Bodo Moeller]
 7514 
 7515   *) Only add signing time to PKCS7 structures if it is not already
 7516      present.
 7517      [Steve Henson]
 7518 
 7519   *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
 7520      OBJ_ld_ce should be OBJ_id_ce.
 7521      Also some ip-pda OIDs in crypto/objects/objects.txt were
 7522      incorrect (cf. RFC 3039).
 7523      [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
 7524 
 7525   *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
 7526      returns early because it has nothing to do.
 7527      [Andy Schneider <andy.schneider@bjss.co.uk>]
 7528 
 7529   *) [In 0.9.6c-engine release:]
 7530      Fix mutex callback return values in crypto/engine/hw_ncipher.c.
 7531      [Andy Schneider <andy.schneider@bjss.co.uk>]
 7532 
 7533   *) [In 0.9.6c-engine release:]
 7534      Add support for Cryptographic Appliance's keyserver technology.
 7535      (Use engine 'keyclient')
 7536      [Cryptographic Appliances and Geoff Thorpe]
 7537 
 7538   *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
 7539      is called via tools/c89.sh because arguments have to be
 7540      rearranged (all '-L' options must appear before the first object
 7541      modules).
 7542      [Richard Shapiro <rshapiro@abinitio.com>]
 7543 
 7544   *) [In 0.9.6c-engine release:]
 7545      Add support for Broadcom crypto accelerator cards, backported
 7546      from 0.9.7.
 7547      [Broadcom, Nalin Dahyabhai <nalin@redhat.com>, Mark Cox]
 7548 
 7549   *) [In 0.9.6c-engine release:]
 7550      Add support for SureWare crypto accelerator cards from 
 7551      Baltimore Technologies.  (Use engine 'sureware')
 7552      [Baltimore Technologies and Mark Cox]
 7553 
 7554   *) [In 0.9.6c-engine release:]
 7555      Add support for crypto accelerator cards from Accelerated
 7556      Encryption Processing, www.aep.ie.  (Use engine 'aep')
 7557      [AEP Inc. and Mark Cox]
 7558 
 7559   *) Add a configuration entry for gcc on UnixWare.
 7560      [Gary Benson <gbenson@redhat.com>]
 7561 
 7562   *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
 7563      messages are stored in a single piece (fixed-length part and
 7564      variable-length part combined) and fix various bugs found on the way.
 7565      [Bodo Moeller]
 7566 
 7567   *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
 7568      instead.  BIO_gethostbyname() does not know what timeouts are
 7569      appropriate, so entries would stay in cache even when they have
 7570      become invalid.
 7571      [Bodo Moeller; problem pointed out by Rich Salz <rsalz@zolera.com>
 7572 
 7573   *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
 7574      faced with a pathologically small ClientHello fragment that does
 7575      not contain client_version: Instead of aborting with an error,
 7576      simply choose the highest available protocol version (i.e.,
 7577      TLS 1.0 unless it is disabled).  In practice, ClientHello
 7578      messages are never sent like this, but this change gives us
 7579      strictly correct behaviour at least for TLS.
 7580      [Bodo Moeller]
 7581 
 7582   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
 7583      never resets s->method to s->ctx->method when called from within
 7584      one of the SSL handshake functions.
 7585      [Bodo Moeller; problem pointed out by Niko Baric]
 7586 
 7587   *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
 7588      (sent using the client's version number) if client_version is
 7589      smaller than the protocol version in use.  Also change
 7590      ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
 7591      the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
 7592      the client will at least see that alert.
 7593      [Bodo Moeller]
 7594 
 7595   *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
 7596      correctly.
 7597      [Bodo Moeller]
 7598 
 7599   *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
 7600      client receives HelloRequest while in a handshake.
 7601      [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider@bjss.co.uk>]
 7602 
 7603   *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
 7604      should end in 'break', not 'goto end' which circuments various
 7605      cleanups done in state SSL_ST_OK.   But session related stuff
 7606      must be disabled for SSL_ST_OK in the case that we just sent a
 7607      HelloRequest.
 7608 
 7609      Also avoid some overhead by not calling ssl_init_wbio_buffer()
 7610      before just sending a HelloRequest.
 7611      [Bodo Moeller, Eric Rescorla <ekr@rtfm.com>]
 7612 
 7613   *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
 7614      reveal whether illegal block cipher padding was found or a MAC
 7615      verification error occured.  (Neither SSLerr() codes nor alerts
 7616      are directly visible to potential attackers, but the information
 7617      may leak via logfiles.)
 7618 
 7619      Similar changes are not required for the SSL 2.0 implementation
 7620      because the number of padding bytes is sent in clear for SSL 2.0,
 7621      and the extra bytes are just ignored.  However ssl/s2_pkt.c
 7622      failed to verify that the purported number of padding bytes is in
 7623      the legal range.
 7624      [Bodo Moeller]
 7625 
 7626   *) Add OpenUNIX-8 support including shared libraries
 7627      (Boyd Lynn Gerber <gerberb@zenez.com>).
 7628      [Lutz Jaenicke]
 7629 
 7630   *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
 7631      'wristwatch attack' using huge encoding parameters (cf.
 7632      James H. Manger's CRYPTO 2001 paper).  Note that the
 7633      RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
 7634      encoding parameters and hence was not vulnerable.
 7635      [Bodo Moeller]
 7636 
 7637   *) BN_sqr() bug fix.
 7638      [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]
 7639 
 7640   *) Rabin-Miller test analyses assume uniformly distributed witnesses,
 7641      so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
 7642      followed by modular reduction.
 7643      [Bodo Moeller; pointed out by Adam Young <AYoung1@NCSUS.JNJ.COM>]
 7644 
 7645   *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
 7646      equivalent based on BN_pseudo_rand() instead of BN_rand().
 7647      [Bodo Moeller]
 7648 
 7649   *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
 7650      This function was broken, as the check for a new client hello message
 7651      to handle SGC did not allow these large messages.
 7652      (Tracked down by "Douglas E. Engert" <deengert@anl.gov>.)
 7653      [Lutz Jaenicke]
 7654 
 7655   *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
 7656      [Lutz Jaenicke]
 7657 
 7658   *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
 7659      for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton@netopia.com>).
 7660      [Lutz Jaenicke]
 7661 
 7662   *) Rework the configuration and shared library support for Tru64 Unix.
 7663      The configuration part makes use of modern compiler features and
 7664      still retains old compiler behavior for those that run older versions
 7665      of the OS.  The shared library support part includes a variant that
 7666      uses the RPATH feature, and is available through the special
 7667      configuration target "alpha-cc-rpath", which will never be selected
 7668      automatically.
 7669      [Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
 7670 
 7671   *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
 7672      with the same message size as in ssl3_get_certificate_request().
 7673      Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
 7674      messages might inadvertently be reject as too long.
 7675      [Petr Lampa <lampa@fee.vutbr.cz>]
 7676 
 7677   *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
 7678      [Andy Polyakov]
 7679 
 7680   *) Modified SSL library such that the verify_callback that has been set
 7681      specificly for an SSL object with SSL_set_verify() is actually being
 7682      used. Before the change, a verify_callback set with this function was
 7683      ignored and the verify_callback() set in the SSL_CTX at the time of
 7684      the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
 7685      to allow the necessary settings.
 7686      [Lutz Jaenicke]
 7687 
 7688   *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
 7689      explicitly to NULL, as at least on Solaris 8 this seems not always to be
 7690      done automatically (in contradiction to the requirements of the C
 7691      standard). This made problems when used from OpenSSH.
 7692      [Lutz Jaenicke]
 7693 
 7694   *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
 7695      dh->length and always used
 7696 
 7697           BN_rand_range(priv_key, dh->p).
 7698 
 7699      BN_rand_range() is not necessary for Diffie-Hellman, and this
 7700      specific range makes Diffie-Hellman unnecessarily inefficient if
 7701      dh->length (recommended exponent length) is much smaller than the
 7702      length of dh->p.  We could use BN_rand_range() if the order of
 7703      the subgroup was stored in the DH structure, but we only have
 7704      dh->length.
 7705 
 7706      So switch back to
 7707 
 7708           BN_rand(priv_key, l, ...)
 7709 
 7710      where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
 7711      otherwise.
 7712      [Bodo Moeller]
 7713 
 7714   *) In
 7715 
 7716           RSA_eay_public_encrypt
 7717           RSA_eay_private_decrypt
 7718           RSA_eay_private_encrypt (signing)
 7719           RSA_eay_public_decrypt (signature verification)
 7720 
 7721      (default implementations for RSA_public_encrypt,
 7722      RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
 7723      always reject numbers >= n.
 7724      [Bodo Moeller]
 7725 
 7726   *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
 7727      to synchronize access to 'locking_thread'.  This is necessary on
 7728      systems where access to 'locking_thread' (an 'unsigned long'
 7729      variable) is not atomic.
 7730      [Bodo Moeller]
 7731 
 7732   *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
 7733      *before* setting the 'crypto_lock_rand' flag.  The previous code had
 7734      a race condition if 0 is a valid thread ID.
 7735      [Travis Vitek <vitek@roguewave.com>]
 7736 
 7737   *) Add support for shared libraries under Irix.
 7738      [Albert Chin-A-Young <china@thewrittenword.com>]
 7739 
 7740   *) Add configuration option to build on Linux on both big-endian and
 7741      little-endian MIPS.
 7742      [Ralf Baechle <ralf@uni-koblenz.de>]
 7743 
 7744   *) Add the possibility to create shared libraries on HP-UX.
 7745      [Richard Levitte]
 7746 
 7747  Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
 7748 
 7749   *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
 7750      to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
 7751      Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com>:
 7752      PRNG state recovery was possible based on the output of
 7753      one PRNG request appropriately sized to gain knowledge on
 7754      'md' followed by enough consecutive 1-byte PRNG requests
 7755      to traverse all of 'state'.
 7756 
 7757      1. When updating 'md_local' (the current thread's copy of 'md')
 7758         during PRNG output generation, hash all of the previous
 7759         'md_local' value, not just the half used for PRNG output.
 7760 
 7761      2. Make the number of bytes from 'state' included into the hash
 7762         independent from the number of PRNG bytes requested.
 7763 
 7764      The first measure alone would be sufficient to avoid
 7765      Markku-Juhani's attack.  (Actually it had never occurred
 7766      to me that the half of 'md_local' used for chaining was the
 7767      half from which PRNG output bytes were taken -- I had always
 7768      assumed that the secret half would be used.)  The second
 7769      measure makes sure that additional data from 'state' is never
 7770      mixed into 'md_local' in small portions; this heuristically
 7771      further strengthens the PRNG.
 7772      [Bodo Moeller]
 7773 
 7774   *) Fix crypto/bn/asm/mips3.s.
 7775      [Andy Polyakov]
 7776 
 7777   *) When only the key is given to "enc", the IV is undefined. Print out
 7778      an error message in this case.
 7779      [Lutz Jaenicke]
 7780 
 7781   *) Handle special case when X509_NAME is empty in X509 printing routines.
 7782      [Steve Henson]
 7783 
 7784   *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
 7785      positive and less than q.
 7786      [Bodo Moeller]
 7787 
 7788   *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
 7789      used: it isn't thread safe and the add_lock_callback should handle
 7790      that itself.
 7791      [Paul Rose <Paul.Rose@bridge.com>]
 7792 
 7793   *) Verify that incoming data obeys the block size in
 7794      ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
 7795      [Bodo Moeller]
 7796 
 7797   *) Fix OAEP check.
 7798      [Ulf Möller, Bodo Möller]
 7799 
 7800   *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
 7801      RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
 7802      when fixing the server behaviour for backwards-compatible 'client
 7803      hello' messages.  (Note that the attack is impractical against
 7804      SSL 3.0 and TLS 1.0 anyway because length and version checking
 7805      means that the probability of guessing a valid ciphertext is
 7806      around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
 7807      paper.)
 7808 
 7809      Before 0.9.5, the countermeasure (hide the error by generating a
 7810      random 'decryption result') did not work properly because
 7811      ERR_clear_error() was missing, meaning that SSL_get_error() would
 7812      detect the supposedly ignored error.
 7813 
 7814      Both problems are now fixed.
 7815      [Bodo Moeller]
 7816 
 7817   *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
 7818      (previously it was 1024).
 7819      [Bodo Moeller]
 7820 
 7821   *) Fix for compatibility mode trust settings: ignore trust settings
 7822      unless some valid trust or reject settings are present.
 7823      [Steve Henson]
 7824 
 7825   *) Fix for blowfish EVP: its a variable length cipher.
 7826      [Steve Henson]
 7827 
 7828   *) Fix various bugs related to DSA S/MIME verification. Handle missing
 7829      parameters in DSA public key structures and return an error in the
 7830      DSA routines if parameters are absent.
 7831      [Steve Henson]
 7832 
 7833   *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
 7834      in the current directory if neither $RANDFILE nor $HOME was set.
 7835      RAND_file_name() in 0.9.6a returned NULL in this case.  This has
 7836      caused some confusion to Windows users who haven't defined $HOME.
 7837      Thus RAND_file_name() is changed again: e_os.h can define a
 7838      DEFAULT_HOME, which will be used if $HOME is not set.
 7839      For Windows, we use "C:"; on other platforms, we still require
 7840      environment variables.
 7841 
 7842   *) Move 'if (!initialized) RAND_poll()' into regions protected by
 7843      CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
 7844      having multiple threads call RAND_poll() concurrently.
 7845      [Bodo Moeller]
 7846 
 7847   *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
 7848      combination of a flag and a thread ID variable.
 7849      Otherwise while one thread is in ssleay_rand_bytes (which sets the
 7850      flag), *other* threads can enter ssleay_add_bytes without obeying
 7851      the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
 7852      that they do not hold after the first thread unsets add_do_not_lock).
 7853      [Bodo Moeller]
 7854 
 7855   *) Change bctest again: '-x' expressions are not available in all
 7856      versions of 'test'.
 7857      [Bodo Moeller]
 7858 
 7859  Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
 7860 
 7861   *) Fix a couple of memory leaks in PKCS7_dataDecode()
 7862      [Steve Henson, reported by Heyun Zheng <hzheng@atdsprint.com>]
 7863 
 7864   *) Change Configure and Makefiles to provide EXE_EXT, which will contain
 7865      the default extension for executables, if any.  Also, make the perl
 7866      scripts that use symlink() to test if it really exists and use "cp"
 7867      if it doesn't.  All this made OpenSSL compilable and installable in
 7868      CygWin.
 7869      [Richard Levitte]
 7870 
 7871   *) Fix for asn1_GetSequence() for indefinite length constructed data.
 7872      If SEQUENCE is length is indefinite just set c->slen to the total
 7873      amount of data available.
 7874      [Steve Henson, reported by shige@FreeBSD.org]
 7875      [This change does not apply to 0.9.7.]
 7876 
 7877   *) Change bctest to avoid here-documents inside command substitution
 7878      (workaround for FreeBSD /bin/sh bug).
 7879      For compatibility with Ultrix, avoid shell functions (introduced
 7880      in the bctest version that searches along $PATH).
 7881      [Bodo Moeller]
 7882 
 7883   *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
 7884      with des_encrypt() defined on some operating systems, like Solaris
 7885      and UnixWare.
 7886      [Richard Levitte]
 7887 
 7888   *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
 7889      On the Importance of Eliminating Errors in Cryptographic
 7890      Computations, J. Cryptology 14 (2001) 2, 101-119,
 7891      http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
 7892      [Ulf Moeller]
 7893   
 7894   *) MIPS assembler BIGNUM division bug fix. 
 7895      [Andy Polyakov]
 7896 
 7897   *) Disabled incorrect Alpha assembler code.
 7898      [Richard Levitte]
 7899 
 7900   *) Fix PKCS#7 decode routines so they correctly update the length
 7901      after reading an EOC for the EXPLICIT tag.
 7902      [Steve Henson]
 7903      [This change does not apply to 0.9.7.]
 7904 
 7905   *) Fix bug in PKCS#12 key generation routines. This was triggered
 7906      if a 3DES key was generated with a 0 initial byte. Include
 7907      PKCS12_BROKEN_KEYGEN compilation option to retain the old
 7908      (but broken) behaviour.
 7909      [Steve Henson]
 7910 
 7911   *) Enhance bctest to search for a working bc along $PATH and print
 7912      it when found.
 7913      [Tim Rice <tim@multitalents.net> via Richard Levitte]
 7914 
 7915   *) Fix memory leaks in err.c: free err_data string if necessary;
 7916      don't write to the wrong index in ERR_set_error_data.
 7917      [Bodo Moeller]
 7918 
 7919   *) Implement ssl23_peek (analogous to ssl23_read), which previously
 7920      did not exist.
 7921      [Bodo Moeller]
 7922 
 7923   *) Replace rdtsc with _emit statements for VC++ version 5.
 7924      [Jeremy Cooper <jeremy@baymoo.org>]
 7925 
 7926   *) Make it possible to reuse SSLv2 sessions.
 7927      [Richard Levitte]
 7928 
 7929   *) In copy_email() check for >= 0 as a return value for
 7930      X509_NAME_get_index_by_NID() since 0 is a valid index.
 7931      [Steve Henson reported by Massimiliano Pala <madwolf@opensca.org>]
 7932 
 7933   *) Avoid coredump with unsupported or invalid public keys by checking if
 7934      X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
 7935      PKCS7_verify() fails with non detached data.
 7936      [Steve Henson]
 7937 
 7938   *) Don't use getenv in library functions when run as setuid/setgid.
 7939      New function OPENSSL_issetugid().
 7940      [Ulf Moeller]
 7941 
 7942   *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
 7943      due to incorrect handling of multi-threading:
 7944 
 7945      1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
 7946 
 7947      2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
 7948 
 7949      3. Count how many times MemCheck_off() has been called so that
 7950         nested use can be treated correctly.  This also avoids 
 7951         inband-signalling in the previous code (which relied on the
 7952         assumption that thread ID 0 is impossible).
 7953      [Bodo Moeller]
 7954 
 7955   *) Add "-rand" option also to s_client and s_server.
 7956      [Lutz Jaenicke]
 7957 
 7958   *) Fix CPU detection on Irix 6.x.
 7959      [Kurt Hockenbury <khockenb@stevens-tech.edu> and
 7960       "Bruce W. Forsberg" <bruce.forsberg@baesystems.com>]
 7961 
 7962   *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
 7963      was empty.
 7964      [Steve Henson]
 7965      [This change does not apply to 0.9.7.]
 7966 
 7967   *) Use the cached encoding of an X509_NAME structure rather than
 7968      copying it. This is apparently the reason for the libsafe "errors"
 7969      but the code is actually correct.
 7970      [Steve Henson]
 7971 
 7972   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
 7973      Bleichenbacher's DSA attack.
 7974      Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
 7975      to be set and top=0 forces the highest bit to be set; top=-1 is new
 7976      and leaves the highest bit random.
 7977      [Ulf Moeller, Bodo Moeller]
 7978 
 7979   *) In the NCONF_...-based implementations for CONF_... queries
 7980      (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
 7981      a temporary CONF structure with the data component set to NULL
 7982      (which gives segmentation faults in lh_retrieve).
 7983      Instead, use NULL for the CONF pointer in CONF_get_string and
 7984      CONF_get_number (which may use environment variables) and directly
 7985      return NULL from CONF_get_section.
 7986      [Bodo Moeller]
 7987 
 7988   *) Fix potential buffer overrun for EBCDIC.
 7989      [Ulf Moeller]
 7990 
 7991   *) Tolerate nonRepudiation as being valid for S/MIME signing and certSign
 7992      keyUsage if basicConstraints absent for a CA.
 7993      [Steve Henson]
 7994 
 7995   *) Make SMIME_write_PKCS7() write mail header values with a format that
 7996      is more generally accepted (no spaces before the semicolon), since
 7997      some programs can't parse those values properly otherwise.  Also make
 7998      sure BIO's that break lines after each write do not create invalid
 7999      headers.
 8000      [Richard Levitte]
 8001 
 8002   *) Make the CRL encoding routines work with empty SEQUENCE OF. The
 8003      macros previously used would not encode an empty SEQUENCE OF
 8004      and break the signature.
 8005      [Steve Henson]
 8006      [This change does not apply to 0.9.7.]
 8007 
 8008   *) Zero the premaster secret after deriving the master secret in
 8009      DH ciphersuites.
 8010      [Steve Henson]
 8011 
 8012   *) Add some EVP_add_digest_alias registrations (as found in
 8013      OpenSSL_add_all_digests()) to SSL_library_init()
 8014      aka OpenSSL_add_ssl_algorithms().  This provides improved
 8015      compatibility with peers using X.509 certificates
 8016      with unconventional AlgorithmIdentifier OIDs.
 8017      [Bodo Moeller]
 8018 
 8019   *) Fix for Irix with NO_ASM.
 8020      ["Bruce W. Forsberg" <bruce.forsberg@baesystems.com>]
 8021 
 8022   *) ./config script fixes.
 8023      [Ulf Moeller, Richard Levitte]
 8024 
 8025   *) Fix 'openssl passwd -1'.
 8026      [Bodo Moeller]
 8027 
 8028   *) Change PKCS12_key_gen_asc() so it can cope with non null
 8029      terminated strings whose length is passed in the passlen
 8030      parameter, for example from PEM callbacks. This was done
 8031      by adding an extra length parameter to asc2uni().
 8032      [Steve Henson, reported by <oddissey@samsung.co.kr>]
 8033 
 8034   *) Fix C code generated by 'openssl dsaparam -C': If a BN_bin2bn
 8035      call failed, free the DSA structure.
 8036      [Bodo Moeller]
 8037 
 8038   *) Fix to uni2asc() to cope with zero length Unicode strings.
 8039      These are present in some PKCS#12 files.
 8040      [Steve Henson]
 8041 
 8042   *) Increase s2->wbuf allocation by one byte in ssl2_new (ssl/s2_lib.c).
 8043      Otherwise do_ssl_write (ssl/s2_pkt.c) will write beyond buffer limits
 8044      when writing a 32767 byte record.
 8045      [Bodo Moeller; problem reported by Eric Day <eday@concentric.net>]
 8046 
 8047   *) In RSA_eay_public_{en,ed}crypt and RSA_eay_mod_exp (rsa_eay.c),
 8048      obtain lock CRYPTO_LOCK_RSA before setting rsa->_method_mod_{n,p,q}.
 8049 
 8050      (RSA objects have a reference count access to which is protected
 8051      by CRYPTO_LOCK_RSA [see rsa_lib.c, s3_srvr.c, ssl_cert.c, ssl_rsa.c],
 8052      so they are meant to be shared between threads.)
 8053      [Bodo Moeller, Geoff Thorpe; original patch submitted by
 8054      "Reddie, Steven" <Steven.Reddie@ca.com>]
 8055 
 8056   *) Fix a deadlock in CRYPTO_mem_leaks().
 8057      [Bodo Moeller]
 8058 
 8059   *) Use better test patterns in bntest.
 8060      [Ulf Möller]
 8061 
 8062   *) rand_win.c fix for Borland C.
 8063      [Ulf Möller]
 8064  
 8065   *) BN_rshift bugfix for n == 0.
 8066      [Bodo Moeller]
 8067 
 8068   *) Add a 'bctest' script that checks for some known 'bc' bugs
 8069      so that 'make test' does not abort just because 'bc' is broken.
 8070      [Bodo Moeller]
 8071 
 8072   *) Store verify_result within SSL_SESSION also for client side to
 8073      avoid potential security hole. (Re-used sessions on the client side
 8074      always resulted in verify_result==X509_V_OK, not using the original
 8075      result of the server certificate verification.)
 8076      [Lutz Jaenicke]
 8077 
 8078   *) Fix ssl3_pending: If the record in s->s3->rrec is not of type
 8079      SSL3_RT_APPLICATION_DATA, return 0.
 8080      Similarly, change ssl2_pending to return 0 if SSL_in_init(s) is true.
 8081      [Bodo Moeller]
 8082 
 8083   *) Fix SSL_peek:
 8084      Both ssl2_peek and ssl3_peek, which were totally broken in earlier
 8085      releases, have been re-implemented by renaming the previous
 8086      implementations of ssl2_read and ssl3_read to ssl2_read_internal
 8087      and ssl3_read_internal, respectively, and adding 'peek' parameters
 8088      to them.  The new ssl[23]_{read,peek} functions are calls to
 8089      ssl[23]_read_internal with the 'peek' flag set appropriately.
 8090      A 'peek' parameter has also been added to ssl3_read_bytes, which
 8091      does the actual work for ssl3_read_internal.
 8092      [Bodo Moeller]
 8093 
 8094   *) Initialise "ex_data" member of RSA/DSA/DH structures prior to calling
 8095      the method-specific "init()" handler. Also clean up ex_data after
 8096      calling the method-specific "finish()" handler. Previously, this was
 8097      happening the other way round.
 8098      [Geoff Thorpe]
 8099 
 8100   *) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
 8101      The previous value, 12, was not always sufficient for BN_mod_exp().
 8102      [Bodo Moeller]
 8103 
 8104   *) Make sure that shared libraries get the internal name engine with
 8105      the full version number and not just 0.  This should mark the
 8106      shared libraries as not backward compatible.  Of course, this should
 8107      be changed again when we can guarantee backward binary compatibility.
 8108      [Richard Levitte]
 8109 
 8110   *) Fix typo in get_cert_by_subject() in by_dir.c
 8111      [Jean-Marc Desperrier <jean-marc.desperrier@certplus.com>]
 8112 
 8113   *) Rework the system to generate shared libraries:
 8114 
 8115      - Make note of the expected extension for the shared libraries and
 8116        if there is a need for symbolic links from for example libcrypto.so.0
 8117        to libcrypto.so.0.9.7.  There is extended info in Configure for
 8118        that.
 8119 
 8120      - Make as few rebuilds of the shared libraries as possible.
 8121 
 8122      - Still avoid linking the OpenSSL programs with the shared libraries.
 8123 
 8124      - When installing, install the shared libraries separately from the
 8125        static ones.
 8126      [Richard Levitte]
 8127 
 8128   *) Fix SSL_CTX_set_read_ahead macro to actually use its argument.
 8129 
 8130      Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
 8131      and not in SSL_clear because the latter is also used by the
 8132      accept/connect functions; previously, the settings made by
 8133      SSL_set_read_ahead would be lost during the handshake.
 8134      [Bodo Moeller; problems reported by Anders Gertz <gertz@epact.se>]     
 8135 
 8136   *) Correct util/mkdef.pl to be selective about disabled algorithms.
 8137      Previously, it would create entries for disableed algorithms no
 8138      matter what.
 8139      [Richard Levitte]
 8140 
 8141   *) Added several new manual pages for SSL_* function.
 8142      [Lutz Jaenicke]
 8143 
 8144  Changes between 0.9.5a and 0.9.6  [24 Sep 2000]
 8145 
 8146   *) In ssl23_get_client_hello, generate an error message when faced
 8147      with an initial SSL 3.0/TLS record that is too small to contain the
 8148      first two bytes of the ClientHello message, i.e. client_version.
 8149      (Note that this is a pathologic case that probably has never happened
 8150      in real life.)  The previous approach was to use the version number
 8151      from the record header as a substitute; but our protocol choice
 8152      should not depend on that one because it is not authenticated
 8153      by the Finished messages.
 8154      [Bodo Moeller]
 8155 
 8156   *) More robust randomness gathering functions for Windows.
 8157      [Jeffrey Altman <jaltman@columbia.edu>]
 8158 
 8159   *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
 8160      not set then we don't setup the error code for issuer check errors
 8161      to avoid possibly overwriting other errors which the callback does
 8162      handle. If an application does set the flag then we assume it knows
 8163      what it is doing and can handle the new informational codes
 8164      appropriately.
 8165      [Steve Henson]
 8166 
 8167   *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
 8168      a general "ANY" type, as such it should be able to decode anything
 8169      including tagged types. However it didn't check the class so it would
 8170      wrongly interpret tagged types in the same way as their universal
 8171      counterpart and unknown types were just rejected. Changed so that the
 8172      tagged and unknown types are handled in the same way as a SEQUENCE:
 8173      that is the encoding is stored intact. There is also a new type
 8174      "V_ASN1_OTHER" which is used when the class is not universal, in this
 8175      case we have no idea what the actual type is so we just lump them all
 8176      together.
 8177      [Steve Henson]
 8178 
 8179   *) On VMS, stdout may very well lead to a file that is written to
 8180      in a record-oriented fashion.  That means that every write() will
 8181      write a separate record, which will be read separately by the
 8182      programs trying to read from it.  This can be very confusing.
 8183 
 8184      The solution is to put a BIO filter in the way that will buffer
 8185      text until a linefeed is reached, and then write everything a
 8186      line at a time, so every record written will be an actual line,
 8187      not chunks of lines and not (usually doesn't happen, but I've
 8188      seen it once) several lines in one record.  BIO_f_linebuffer() is
 8189      the answer.
 8190 
 8191      Currently, it's a VMS-only method, because that's where it has
 8192      been tested well enough.
 8193      [Richard Levitte]
 8194 
 8195   *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
 8196      it can return incorrect results.
 8197      (Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
 8198      but it was in 0.9.6-beta[12].)
 8199      [Bodo Moeller]
 8200 
 8201   *) Disable the check for content being present when verifying detached
 8202      signatures in pk7_smime.c. Some versions of Netscape (wrongly)
 8203      include zero length content when signing messages.
 8204      [Steve Henson]
 8205 
 8206   *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
 8207      BIO_ctrl (for BIO pairs).
 8208      [Bodo Möller]
 8209 
 8210   *) Add DSO method for VMS.
 8211      [Richard Levitte]
 8212 
 8213   *) Bug fix: Montgomery multiplication could produce results with the
 8214      wrong sign.
 8215      [Ulf Möller]
 8216 
 8217   *) Add RPM specification openssl.spec and modify it to build three
 8218      packages.  The default package contains applications, application
 8219      documentation and run-time libraries.  The devel package contains
 8220      include files, static libraries and function documentation.  The
 8221      doc package contains the contents of the doc directory.  The original
 8222      openssl.spec was provided by Damien Miller <djm@mindrot.org>.
 8223      [Richard Levitte]
 8224      
 8225   *) Add a large number of documentation files for many SSL routines.
 8226      [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
 8227 
 8228   *) Add a configuration entry for Sony News 4.
 8229      [NAKAJI Hiroyuki <nakaji@tutrp.tut.ac.jp>]
 8230 
 8231   *) Don't set the two most significant bits to one when generating a
 8232      random number < q in the DSA library.
 8233      [Ulf Möller]
 8234 
 8235   *) New SSL API mode 'SSL_MODE_AUTO_RETRY'.  This disables the default
 8236      behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if
 8237      the underlying transport is blocking) if a handshake took place.
 8238      (The default behaviour is needed by applications such as s_client
 8239      and s_server that use select() to determine when to use SSL_read;
 8240      but for applications that know in advance when to expect data, it
 8241      just makes things more complicated.)
 8242      [Bodo Moeller]
 8243 
 8244   *) Add RAND_egd_bytes(), which gives control over the number of bytes read
 8245      from EGD.
 8246      [Ben Laurie]
 8247 
 8248   *) Add a few more EBCDIC conditionals that make `req' and `x509'
 8249      work better on such systems.
 8250      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
 8251 
 8252   *) Add two demo programs for PKCS12_parse() and PKCS12_create().
 8253      Update PKCS12_parse() so it copies the friendlyName and the
 8254      keyid to the certificates aux info.
 8255      [Steve Henson]
 8256 
 8257   *) Fix bug in PKCS7_verify() which caused an infinite loop
 8258      if there was more than one signature.
 8259      [Sven Uszpelkat <su@celocom.de>]
 8260 
 8261   *) Major change in util/mkdef.pl to include extra information
 8262      about each symbol, as well as presentig variables as well
 8263      as functions.  This change means that there's n more need
 8264      to rebuild the .num files when some algorithms are excluded.
 8265      [Richard Levitte]
 8266 
 8267   *) Allow the verify time to be set by an application,
 8268      rather than always using the current time.
 8269      [Steve Henson]
 8270   
 8271   *) Phase 2 verify code reorganisation. The certificate
 8272      verify code now looks up an issuer certificate by a
 8273      number of criteria: subject name, authority key id
 8274      and key usage. It also verifies self signed certificates
 8275      by the same criteria. The main comparison function is
 8276      X509_check_issued() which performs these checks.
 8277  
 8278      Lot of changes were necessary in order to support this
 8279      without completely rewriting the lookup code.
 8280  
 8281      Authority and subject key identifier are now cached.
 8282  
 8283      The LHASH 'certs' is X509_STORE has now been replaced
 8284      by a STACK_OF(X509_OBJECT). This is mainly because an
 8285      LHASH can't store or retrieve multiple objects with
 8286      the same hash value.
 8287 
 8288      As a result various functions (which were all internal
 8289      use only) have changed to handle the new X509_STORE
 8290      structure. This will break anything that messed round
 8291      with X509_STORE internally.
 8292  
 8293      The functions X509_STORE_add_cert() now checks for an
 8294      exact match, rather than just subject name.
 8295  
 8296      The X509_STORE API doesn't directly support the retrieval
 8297      of multiple certificates matching a given criteria, however
 8298      this can be worked round by performing a lookup first
 8299      (which will fill the cache with candidate certificates)
 8300      and then examining the cache for matches. This is probably
 8301      the best we can do without throwing out X509_LOOKUP
 8302      entirely (maybe later...).
 8303  
 8304      The X509_VERIFY_CTX structure has been enhanced considerably.
 8305  
 8306      All certificate lookup operations now go via a get_issuer()
 8307      callback. Although this currently uses an X509_STORE it
 8308      can be replaced by custom lookups. This is a simple way
 8309      to bypass the X509_STORE hackery necessary to make this
 8310      work and makes it possible to use more efficient techniques
 8311      in future. A very simple version which uses a simple
 8312      STACK for its trusted certificate store is also provided
 8313      using X509_STORE_CTX_trusted_stack().
 8314  
 8315      The verify_cb() and verify() callbacks now have equivalents
 8316      in the X509_STORE_CTX structure.
 8317  
 8318      X509_STORE_CTX also has a 'flags' field which can be used
 8319      to customise the verify behaviour.
 8320      [Steve Henson]
 8321  
 8322   *) Add new PKCS#7 signing option PKCS7_NOSMIMECAP which 
 8323      excludes S/MIME capabilities.
 8324      [Steve Henson]
 8325 
 8326   *) When a certificate request is read in keep a copy of the
 8327      original encoding of the signed data and use it when outputing
 8328      again. Signatures then use the original encoding rather than
 8329      a decoded, encoded version which may cause problems if the
 8330      request is improperly encoded.
 8331      [Steve Henson]
 8332 
 8333   *) For consistency with other BIO_puts implementations, call
 8334      buffer_write(b, ...) directly in buffer_puts instead of calling
 8335      BIO_write(b, ...).
 8336 
 8337      In BIO_puts, increment b->num_write as in BIO_write.
 8338      [Peter.Sylvester@EdelWeb.fr]
 8339 
 8340   *) Fix BN_mul_word for the case where the word is 0. (We have to use
 8341      BN_zero, we may not return a BIGNUM with an array consisting of
 8342      words set to zero.)
 8343      [Bodo Moeller]
 8344 
 8345   *) Avoid calling abort() from within the library when problems are
 8346      detected, except if preprocessor symbols have been defined
 8347      (such as REF_CHECK, BN_DEBUG etc.).
 8348      [Bodo Moeller]
 8349 
 8350   *) New openssl application 'rsautl'. This utility can be
 8351      used for low level RSA operations. DER public key
 8352      BIO/fp routines also added.
 8353      [Steve Henson]
 8354 
 8355   *) New Configure entry and patches for compiling on QNX 4.
 8356      [Andreas Schneider <andreas@ds3.etech.fh-hamburg.de>]
 8357 
 8358   *) A demo state-machine implementation was sponsored by
 8359      Nuron (http://www.nuron.com/) and is now available in
 8360      demos/state_machine.
 8361      [Ben Laurie]
 8362 
 8363   *) New options added to the 'dgst' utility for signature
 8364      generation and verification.
 8365      [Steve Henson]
 8366 
 8367   *) Unrecognized PKCS#7 content types are now handled via a
 8368      catch all ASN1_TYPE structure. This allows unsupported
 8369      types to be stored as a "blob" and an application can
 8370      encode and decode it manually.
 8371      [Steve Henson]
 8372 
 8373   *) Fix various signed/unsigned issues to make a_strex.c
 8374      compile under VC++.
 8375      [Oscar Jacobsson <oscar.jacobsson@celocom.com>]
 8376 
 8377   *) ASN1 fixes. i2d_ASN1_OBJECT was not returning the correct
 8378      length if passed a buffer. ASN1_INTEGER_to_BN failed
 8379      if passed a NULL BN and its argument was negative.
 8380      [Steve Henson, pointed out by Sven Heiberg <sven@tartu.cyber.ee>]
 8381 
 8382   *) Modification to PKCS#7 encoding routines to output definite
 8383      length encoding. Since currently the whole structures are in
 8384      memory there's not real point in using indefinite length 
 8385      constructed encoding. However if OpenSSL is compiled with
 8386      the flag PKCS7_INDEFINITE_ENCODING the old form is used.
 8387      [Steve Henson]
 8388 
 8389   *) Added BIO_vprintf() and BIO_vsnprintf().
 8390      [Richard Levitte]
 8391 
 8392   *) Added more prefixes to parse for in the the strings written
 8393      through a logging bio, to cover all the levels that are available
 8394      through syslog.  The prefixes are now:
 8395 
 8396 	PANIC, EMERG, EMR	=>	LOG_EMERG
 8397 	ALERT, ALR		=>	LOG_ALERT
 8398 	CRIT, CRI		=>	LOG_CRIT
 8399 	ERROR, ERR		=>	LOG_ERR
 8400 	WARNING, WARN, WAR	=>	LOG_WARNING
 8401 	NOTICE, NOTE, NOT	=>	LOG_NOTICE
 8402 	INFO, INF		=>	LOG_INFO
 8403 	DEBUG, DBG		=>	LOG_DEBUG
 8404 
 8405      and as before, if none of those prefixes are present at the
 8406      beginning of the string, LOG_ERR is chosen.
 8407 
 8408      On Win32, the LOG_* levels are mapped according to this:
 8409 
 8410 	LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR	=> EVENTLOG_ERROR_TYPE
 8411 	LOG_WARNING				=> EVENTLOG_WARNING_TYPE
 8412 	LOG_NOTICE, LOG_INFO, LOG_DEBUG		=> EVENTLOG_INFORMATION_TYPE
 8413 
 8414      [Richard Levitte]
 8415 
 8416   *) Made it possible to reconfigure with just the configuration
 8417      argument "reconf" or "reconfigure".  The command line arguments
 8418      are stored in Makefile.ssl in the variable CONFIGURE_ARGS,
 8419      and are retrieved from there when reconfiguring.
 8420      [Richard Levitte]
 8421 
 8422   *) MD4 implemented.
 8423      [Assar Westerlund <assar@sics.se>, Richard Levitte]
 8424 
 8425   *) Add the arguments -CAfile and -CApath to the pkcs12 utility.
 8426      [Richard Levitte]
 8427 
 8428   *) The obj_dat.pl script was messing up the sorting of object
 8429      names. The reason was that it compared the quoted version
 8430      of strings as a result "OCSP" > "OCSP Signing" because
 8431      " > SPACE. Changed script to store unquoted versions of
 8432      names and add quotes on output. It was also omitting some
 8433      names from the lookup table if they were given a default
 8434      value (that is if SN is missing it is given the same
 8435      value as LN and vice versa), these are now added on the
 8436      grounds that if an object has a name we should be able to
 8437      look it up. Finally added warning output when duplicate
 8438      short or long names are found.
 8439      [Steve Henson]
 8440 
 8441   *) Changes needed for Tandem NSK.
 8442      [Scott Uroff <scott@xypro.com>]
 8443 
 8444   *) Fix SSL 2.0 rollback checking: Due to an off-by-one error in
 8445      RSA_padding_check_SSLv23(), special padding was never detected
 8446      and thus the SSL 3.0/TLS 1.0 countermeasure against protocol
 8447      version rollback attacks was not effective.
 8448 
 8449      In s23_clnt.c, don't use special rollback-attack detection padding
 8450      (RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the
 8451      client; similarly, in s23_srvr.c, don't do the rollback check if
 8452      SSL 2.0 is the only protocol enabled in the server.
 8453      [Bodo Moeller]
 8454 
 8455   *) Make it possible to get hexdumps of unprintable data with 'openssl
 8456      asn1parse'.  By implication, the functions ASN1_parse_dump() and
 8457      BIO_dump_indent() are added.
 8458      [Richard Levitte]
 8459 
 8460   *) New functions ASN1_STRING_print_ex() and X509_NAME_print_ex()
 8461      these print out strings and name structures based on various
 8462      flags including RFC2253 support and proper handling of
 8463      multibyte characters. Added options to the 'x509' utility 
 8464      to allow the various flags to be set.
 8465      [Steve Henson]
 8466 
 8467   *) Various fixes to use ASN1_TIME instead of ASN1_UTCTIME.
 8468      Also change the functions X509_cmp_current_time() and
 8469      X509_gmtime_adj() work with an ASN1_TIME structure,
 8470      this will enable certificates using GeneralizedTime in validity
 8471      dates to be checked.
 8472      [Steve Henson]
 8473 
 8474   *) Make the NEG_PUBKEY_BUG code (which tolerates invalid
 8475      negative public key encodings) on by default,
 8476      NO_NEG_PUBKEY_BUG can be set to disable it.
 8477      [Steve Henson]
 8478 
 8479   *) New function c2i_ASN1_OBJECT() which acts on ASN1_OBJECT
 8480      content octets. An i2c_ASN1_OBJECT is unnecessary because
 8481      the encoding can be trivially obtained from the structure.
 8482      [Steve Henson]
 8483 
 8484   *) crypto/err.c locking bugfix: Use write locks (CRYPTO_w_[un]lock),
 8485      not read locks (CRYPTO_r_[un]lock).
 8486      [Bodo Moeller]
 8487 
 8488   *) A first attempt at creating official support for shared
 8489      libraries through configuration.  I've kept it so the
 8490      default is static libraries only, and the OpenSSL programs
 8491      are always statically linked for now, but there are
 8492      preparations for dynamic linking in place.
 8493      This has been tested on Linux and Tru64.
 8494      [Richard Levitte]
 8495 
 8496   *) Randomness polling function for Win9x, as described in:
 8497      Peter Gutmann, Software Generation of Practically Strong
 8498      Random Numbers.
 8499      [Ulf Möller]
 8500 
 8501   *) Fix so PRNG is seeded in req if using an already existing
 8502      DSA key.
 8503      [Steve Henson]
 8504 
 8505   *) New options to smime application. -inform and -outform
 8506      allow alternative formats for the S/MIME message including
 8507      PEM and DER. The -content option allows the content to be
 8508      specified separately. This should allow things like Netscape
 8509      form signing output easier to verify.
 8510      [Steve Henson]
 8511 
 8512   *) Fix the ASN1 encoding of tags using the 'long form'.
 8513      [Steve Henson]
 8514 
 8515   *) New ASN1 functions, i2c_* and c2i_* for INTEGER and BIT
 8516      STRING types. These convert content octets to and from the
 8517      underlying type. The actual tag and length octets are
 8518      already assumed to have been read in and checked. These
 8519      are needed because all other string types have virtually
 8520      identical handling apart from the tag. By having versions
 8521      of the ASN1 functions that just operate on content octets
 8522      IMPLICIT tagging can be handled properly. It also allows
 8523      the ASN1_ENUMERATED code to be cut down because ASN1_ENUMERATED
 8524      and ASN1_INTEGER are identical apart from the tag.
 8525      [Steve Henson]
 8526 
 8527   *) Change the handling of OID objects as follows:
 8528 
 8529      - New object identifiers are inserted in objects.txt, following
 8530        the syntax given in objects.README.
 8531      - objects.pl is used to process obj_mac.num and create a new
 8532        obj_mac.h.
 8533      - obj_dat.pl is used to create a new obj_dat.h, using the data in
 8534        obj_mac.h.
 8535 
 8536      This is currently kind of a hack, and the perl code in objects.pl
 8537      isn't very elegant, but it works as I intended.  The simplest way
 8538      to check that it worked correctly is to look in obj_dat.h and
 8539      check the array nid_objs and make sure the objects haven't moved
 8540      around (this is important!).  Additions are OK, as well as
 8541      consistent name changes. 
 8542      [Richard Levitte]
 8543 
 8544   *) Add BSD-style MD5-based passwords to 'openssl passwd' (option '-1').
 8545      [Bodo Moeller]
 8546 
 8547   *) Addition of the command line parameter '-rand file' to 'openssl req'.
 8548      The given file adds to whatever has already been seeded into the
 8549      random pool through the RANDFILE configuration file option or
 8550      environment variable, or the default random state file.
 8551      [Richard Levitte]
 8552 
 8553   *) mkstack.pl now sorts each macro group into lexical order.
 8554      Previously the output order depended on the order the files
 8555      appeared in the directory, resulting in needless rewriting
 8556      of safestack.h .
 8557      [Steve Henson]
 8558 
 8559   *) Patches to make OpenSSL compile under Win32 again. Mostly
 8560      work arounds for the VC++ problem that it treats func() as
 8561      func(void). Also stripped out the parts of mkdef.pl that
 8562      added extra typesafe functions: these no longer exist.
 8563      [Steve Henson]
 8564 
 8565   *) Reorganisation of the stack code. The macros are now all 
 8566      collected in safestack.h . Each macro is defined in terms of
 8567      a "stack macro" of the form SKM_<name>(type, a, b). The 
 8568      DEBUG_SAFESTACK is now handled in terms of function casts,
 8569      this has the advantage of retaining type safety without the
 8570      use of additional functions. If DEBUG_SAFESTACK is not defined
 8571      then the non typesafe macros are used instead. Also modified the
 8572      mkstack.pl script to handle the new form. Needs testing to see
 8573      if which (if any) compilers it chokes and maybe make DEBUG_SAFESTACK
 8574      the default if no major problems. Similar behaviour for ASN1_SET_OF
 8575      and PKCS12_STACK_OF.
 8576      [Steve Henson]
 8577 
 8578   *) When some versions of IIS use the 'NET' form of private key the
 8579      key derivation algorithm is different. Normally MD5(password) is
 8580      used as a 128 bit RC4 key. In the modified case
 8581      MD5(MD5(password) + "SGCKEYSALT")  is used insted. Added some
 8582      new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same
 8583      as the old Netscape_RSA functions except they have an additional
 8584      'sgckey' parameter which uses the modified algorithm. Also added
 8585      an -sgckey command line option to the rsa utility. Thanks to 
 8586      Adrian Peck <bertie@ncipher.com> for posting details of the modified
 8587      algorithm to openssl-dev.
 8588      [Steve Henson]
 8589 
 8590   *) The evp_local.h macros were using 'c.##kname' which resulted in
 8591      invalid expansion on some systems (SCO 5.0.5 for example).
 8592      Corrected to 'c.kname'.
 8593      [Phillip Porch <root@theporch.com>]
 8594 
 8595   *) New X509_get1_email() and X509_REQ_get1_email() functions that return
 8596      a STACK of email addresses from a certificate or request, these look
 8597      in the subject name and the subject alternative name extensions and 
 8598      omit any duplicate addresses.
 8599      [Steve Henson]
 8600 
 8601   *) Re-implement BN_mod_exp2_mont using independent (and larger) windows.
 8602      This makes DSA verification about 2 % faster.
 8603      [Bodo Moeller]
 8604 
 8605   *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5
 8606      (meaning that now 2^5 values will be precomputed, which is only 4 KB
 8607      plus overhead for 1024 bit moduli).
 8608      This makes exponentiations about 0.5 % faster for 1024 bit
 8609      exponents (as measured by "openssl speed rsa2048").
 8610      [Bodo Moeller]
 8611 
 8612   *) Rename memory handling macros to avoid conflicts with other
 8613      software:
 8614           Malloc         =>  OPENSSL_malloc
 8615           Malloc_locked  =>  OPENSSL_malloc_locked
 8616           Realloc        =>  OPENSSL_realloc
 8617           Free           =>  OPENSSL_free
 8618      [Richard Levitte]
 8619 
 8620   *) New function BN_mod_exp_mont_word for small bases (roughly 15%
 8621      faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange).
 8622      [Bodo Moeller]
 8623 
 8624   *) CygWin32 support.
 8625      [John Jarvie <jjarvie@newsguy.com>]
 8626 
 8627   *) The type-safe stack code has been rejigged. It is now only compiled
 8628      in when OpenSSL is configured with the DEBUG_SAFESTACK option and
 8629      by default all type-specific stack functions are "#define"d back to
 8630      standard stack functions. This results in more streamlined output
 8631      but retains the type-safety checking possibilities of the original
 8632      approach.
 8633      [Geoff Thorpe]
 8634 
 8635   *) The STACK code has been cleaned up, and certain type declarations
 8636      that didn't make a lot of sense have been brought in line. This has
 8637      also involved a cleanup of sorts in safestack.h to more correctly
 8638      map type-safe stack functions onto their plain stack counterparts.
 8639      This work has also resulted in a variety of "const"ifications of
 8640      lots of the code, especially "_cmp" operations which should normally
 8641      be prototyped with "const" parameters anyway.
 8642      [Geoff Thorpe]
 8643 
 8644   *) When generating bytes for the first time in md_rand.c, 'stir the pool'
 8645      by seeding with STATE_SIZE dummy bytes (with zero entropy count).
 8646      (The PRNG state consists of two parts, the large pool 'state' and 'md',
 8647      where all of 'md' is used each time the PRNG is used, but 'state'
 8648      is used only indexed by a cyclic counter. As entropy may not be
 8649      well distributed from the beginning, 'md' is important as a
 8650      chaining variable. However, the output function chains only half
 8651      of 'md', i.e. 80 bits.  ssleay_rand_add, on the other hand, chains
 8652      all of 'md', and seeding with STATE_SIZE dummy bytes will result
 8653      in all of 'state' being rewritten, with the new values depending
 8654      on virtually all of 'md'.  This overcomes the 80 bit limitation.)
 8655      [Bodo Moeller]
 8656 
 8657   *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when
 8658      the handshake is continued after ssl_verify_cert_chain();
 8659      otherwise, if SSL_VERIFY_NONE is set, remaining error codes
 8660      can lead to 'unexplainable' connection aborts later.
 8661      [Bodo Moeller; problem tracked down by Lutz Jaenicke]
 8662 
 8663   *) Major EVP API cipher revision.
 8664      Add hooks for extra EVP features. This allows various cipher
 8665      parameters to be set in the EVP interface. Support added for variable
 8666      key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and
 8667      setting of RC2 and RC5 parameters.
 8668 
 8669      Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length
 8670      ciphers.
 8671 
 8672      Remove lots of duplicated code from the EVP library. For example *every*
 8673      cipher init() function handles the 'iv' in the same way according to the
 8674      cipher mode. They also all do nothing if the 'key' parameter is NULL and
 8675      for CFB and OFB modes they zero ctx->num.
 8676 
 8677      New functionality allows removal of S/MIME code RC2 hack.
 8678 
 8679      Most of the routines have the same form and so can be declared in terms
 8680      of macros.
 8681 
 8682      By shifting this to the top level EVP_CipherInit() it can be removed from
 8683      all individual ciphers. If the cipher wants to handle IVs or keys
 8684      differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT
 8685      flags.
 8686 
 8687      Change lots of functions like EVP_EncryptUpdate() to now return a
 8688      value: although software versions of the algorithms cannot fail
 8689      any installed hardware versions can.
 8690      [Steve Henson]
 8691 
 8692   *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if
 8693      this option is set, tolerate broken clients that send the negotiated
 8694      protocol version number instead of the requested protocol version
 8695      number.
 8696      [Bodo Moeller]
 8697 
 8698   *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag;
 8699      i.e. non-zero for export ciphersuites, zero otherwise.
 8700      Previous versions had this flag inverted, inconsistent with
 8701      rsa_tmp_cb (..._TMP_RSA_CB).
 8702      [Bodo Moeller; problem reported by Amit Chopra]
 8703 
 8704   *) Add missing DSA library text string. Work around for some IIS
 8705      key files with invalid SEQUENCE encoding.
 8706      [Steve Henson]
 8707 
 8708   *) Add a document (doc/standards.txt) that list all kinds of standards
 8709      and so on that are implemented in OpenSSL.
 8710      [Richard Levitte]
 8711 
 8712   *) Enhance c_rehash script. Old version would mishandle certificates
 8713      with the same subject name hash and wouldn't handle CRLs at all.
 8714      Added -fingerprint option to crl utility, to support new c_rehash
 8715      features.
 8716      [Steve Henson]
 8717 
 8718   *) Eliminate non-ANSI declarations in crypto.h and stack.h.
 8719      [Ulf Möller]
 8720 
 8721   *) Fix for SSL server purpose checking. Server checking was
 8722      rejecting certificates which had extended key usage present
 8723      but no ssl client purpose.
 8724      [Steve Henson, reported by Rene Grosser <grosser@hisolutions.com>]
 8725 
 8726   *) Make PKCS#12 code work with no password. The PKCS#12 spec
 8727      is a little unclear about how a blank password is handled.
 8728      Since the password in encoded as a BMPString with terminating
 8729      double NULL a zero length password would end up as just the
 8730      double NULL. However no password at all is different and is
 8731      handled differently in the PKCS#12 key generation code. NS
 8732      treats a blank password as zero length. MSIE treats it as no
 8733      password on export: but it will try both on import. We now do
 8734      the same: PKCS12_parse() tries zero length and no password if
 8735      the password is set to "" or NULL (NULL is now a valid password:
 8736      it wasn't before) as does the pkcs12 application.
 8737      [Steve Henson]
 8738 
 8739   *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use
 8740      perror when PEM_read_bio_X509_REQ fails, the error message must
 8741      be obtained from the error queue.
 8742      [Bodo Moeller]
 8743 
 8744   *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing
 8745      it in ERR_remove_state if appropriate, and change ERR_get_state
 8746      accordingly to avoid race conditions (this is necessary because
 8747      thread_hash is no longer constant once set).
 8748      [Bodo Moeller]
 8749 
 8750   *) Bugfix for linux-elf makefile.one.
 8751      [Ulf Möller]
 8752 
 8753   *) RSA_get_default_method() will now cause a default
 8754      RSA_METHOD to be chosen if one doesn't exist already.
 8755      Previously this was only set during a call to RSA_new()
 8756      or RSA_new_method(NULL) meaning it was possible for
 8757      RSA_get_default_method() to return NULL.
 8758      [Geoff Thorpe]
 8759 
 8760   *) Added native name translation to the existing DSO code
 8761      that will convert (if the flag to do so is set) filenames
 8762      that are sufficiently small and have no path information
 8763      into a canonical native form. Eg. "blah" converted to
 8764      "libblah.so" or "blah.dll" etc.
 8765      [Geoff Thorpe]
 8766 
 8767   *) New function ERR_error_string_n(e, buf, len) which is like
 8768      ERR_error_string(e, buf), but writes at most 'len' bytes
 8769      including the 0 terminator.  For ERR_error_string_n, 'buf'
 8770      may not be NULL.
 8771      [Damien Miller <djm@mindrot.org>, Bodo Moeller]
 8772 
 8773   *) CONF library reworked to become more general.  A new CONF
 8774      configuration file reader "class" is implemented as well as a
 8775      new functions (NCONF_*, for "New CONF") to handle it.  The now
 8776      old CONF_* functions are still there, but are reimplemented to
 8777      work in terms of the new functions.  Also, a set of functions
 8778      to handle the internal storage of the configuration data is
 8779      provided to make it easier to write new configuration file
 8780      reader "classes" (I can definitely see something reading a
 8781      configuration file in XML format, for example), called _CONF_*,
 8782      or "the configuration storage API"...
 8783 
 8784      The new configuration file reading functions are:
 8785 
 8786         NCONF_new, NCONF_free, NCONF_load, NCONF_load_fp, NCONF_load_bio,
 8787         NCONF_get_section, NCONF_get_string, NCONF_get_numbre
 8788 
 8789         NCONF_default, NCONF_WIN32
 8790 
 8791         NCONF_dump_fp, NCONF_dump_bio
 8792 
 8793      NCONF_default and NCONF_WIN32 are method (or "class") choosers,
 8794      NCONF_new creates a new CONF object.  This works in the same way
 8795      as other interfaces in OpenSSL, like the BIO interface.
 8796      NCONF_dump_* dump the internal storage of the configuration file,
 8797      which is useful for debugging.  All other functions take the same
 8798      arguments as the old CONF_* functions wth the exception of the
 8799      first that must be a `CONF *' instead of a `LHASH *'.
 8800 
 8801      To make it easer to use the new classes with the old CONF_* functions,
 8802      the function CONF_set_default_method is provided.
 8803      [Richard Levitte]
 8804 
 8805   *) Add '-tls1' option to 'openssl ciphers', which was already
 8806      mentioned in the documentation but had not been implemented.
 8807      (This option is not yet really useful because even the additional
 8808      experimental TLS 1.0 ciphers are currently treated as SSL 3.0 ciphers.)
 8809      [Bodo Moeller]
 8810 
 8811   *) Initial DSO code added into libcrypto for letting OpenSSL (and
 8812      OpenSSL-based applications) load shared libraries and bind to
 8813      them in a portable way.
 8814      [Geoff Thorpe, with contributions from Richard Levitte]
 8815 
 8816  Changes between 0.9.5 and 0.9.5a  [1 Apr 2000]
 8817 
 8818   *) Make sure _lrotl and _lrotr are only used with MSVC.
 8819 
 8820   *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status
 8821      (the default implementation of RAND_status).
 8822 
 8823   *) Rename openssl x509 option '-crlext', which was added in 0.9.5,
 8824      to '-clrext' (= clear extensions), as intended and documented.
 8825      [Bodo Moeller; inconsistency pointed out by Michael Attili
 8826      <attili@amaxo.com>]
 8827 
 8828   *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length
 8829      was larger than the MD block size.      
 8830      [Steve Henson, pointed out by Yost William <YostW@tce.com>]
 8831 
 8832   *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument
 8833      fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set()
 8834      using the passed key: if the passed key was a private key the result
 8835      of X509_print(), for example, would be to print out all the private key
 8836      components.
 8837      [Steve Henson]
 8838 
 8839   *) des_quad_cksum() byte order bug fix.
 8840      [Ulf Möller, using the problem description in krb4-0.9.7, where
 8841       the solution is attributed to Derrick J Brashear <shadow@DEMENTIA.ORG>]
 8842 
 8843   *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly
 8844      discouraged.
 8845      [Steve Henson, pointed out by Brian Korver <briank@cs.stanford.edu>]
 8846 
 8847   *) For easily testing in shell scripts whether some command
 8848      'openssl XXX' exists, the new pseudo-command 'openssl no-XXX'
 8849      returns with exit code 0 iff no command of the given name is available.
 8850      'no-XXX' is printed in this case, 'XXX' otherwise.  In both cases,
 8851      the output goes to stdout and nothing is printed to stderr.
 8852      Additional arguments are always ignored.
 8853 
 8854      Since for each cipher there is a command of the same name,
 8855      the 'no-cipher' compilation switches can be tested this way.
 8856 
 8857      ('openssl no-XXX' is not able to detect pseudo-commands such
 8858      as 'quit', 'list-XXX-commands', or 'no-XXX' itself.)
 8859      [Bodo Moeller]
 8860 
 8861   *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration.
 8862      [Bodo Moeller]
 8863 
 8864   *) For SSL_[CTX_]set_tmp_dh, don't create a DH key if SSL_OP_SINGLE_DH_USE
 8865      is set; it will be thrown away anyway because each handshake creates
 8866      its own key.
 8867      ssl_cert_dup, which is used by SSL_new, now copies DH keys in addition
 8868      to parameters -- in previous versions (since OpenSSL 0.9.3) the
 8869      'default key' from SSL_CTX_set_tmp_dh would always be lost, meanining
 8870      you effectivly got SSL_OP_SINGLE_DH_USE when using this macro.
 8871      [Bodo Moeller]
 8872 
 8873   *) New s_client option -ign_eof: EOF at stdin is ignored, and
 8874      'Q' and 'R' lose their special meanings (quit/renegotiate).
 8875      This is part of what -quiet does; unlike -quiet, -ign_eof
 8876      does not suppress any output.
 8877      [Richard Levitte]
 8878 
 8879   *) Add compatibility options to the purpose and trust code. The
 8880      purpose X509_PURPOSE_ANY is "any purpose" which automatically
 8881      accepts a certificate or CA, this was the previous behaviour,
 8882      with all the associated security issues.
 8883 
 8884      X509_TRUST_COMPAT is the old trust behaviour: only and
 8885      automatically trust self signed roots in certificate store. A
 8886      new trust setting X509_TRUST_DEFAULT is used to specify that
 8887      a purpose has no associated trust setting and it should instead
 8888      use the value in the default purpose.
 8889      [Steve Henson]
 8890 
 8891   *) Fix the PKCS#8 DSA private key code so it decodes keys again
 8892      and fix a memory leak.
 8893      [Steve Henson]
 8894 
 8895   *) In util/mkerr.pl (which implements 'make errors'), preserve
 8896      reason strings from the previous version of the .c file, as
 8897      the default to have only downcase letters (and digits) in
 8898      automatically generated reasons codes is not always appropriate.
 8899      [Bodo Moeller]
 8900 
 8901   *) In ERR_load_ERR_strings(), build an ERR_LIB_SYS error reason table
 8902      using strerror.  Previously, ERR_reason_error_string() returned
 8903      library names as reason strings for SYSerr; but SYSerr is a special
 8904      case where small numbers are errno values, not library numbers.
 8905      [Bodo Moeller]
 8906 
 8907   *) Add '-dsaparam' option to 'openssl dhparam' application.  This
 8908      converts DSA parameters into DH parameters. (When creating parameters,
 8909      DSA_generate_parameters is used.)
 8910      [Bodo Moeller]
 8911 
 8912   *) Include 'length' (recommended exponent length) in C code generated
 8913      by 'openssl dhparam -C'.
 8914      [Bodo Moeller]
 8915 
 8916   *) The second argument to set_label in perlasm was already being used
 8917      so couldn't be used as a "file scope" flag. Moved to third argument
 8918      which was free.
 8919      [Steve Henson]
 8920 
 8921   *) In PEM_ASN1_write_bio and some other functions, use RAND_pseudo_bytes
 8922      instead of RAND_bytes for encryption IVs and salts.
 8923      [Bodo Moeller]
 8924 
 8925   *) Include RAND_status() into RAND_METHOD instead of implementing
 8926      it only for md_rand.c  Otherwise replacing the PRNG by calling
 8927      RAND_set_rand_method would be impossible.
 8928      [Bodo Moeller]
 8929 
 8930   *) Don't let DSA_generate_key() enter an infinite loop if the random
 8931      number generation fails.
 8932      [Bodo Moeller]
 8933 
 8934   *) New 'rand' application for creating pseudo-random output.
 8935      [Bodo Moeller]
 8936 
 8937   *) Added configuration support for Linux/IA64
 8938      [Rolf Haberrecker <rolf@suse.de>]
 8939 
 8940   *) Assembler module support for Mingw32.
 8941      [Ulf Möller]
 8942 
 8943   *) Shared library support for HPUX (in shlib/).
 8944      [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE> and Anonymous]
 8945 
 8946   *) Shared library support for Solaris gcc.
 8947      [Lutz Behnke <behnke@trustcenter.de>]
 8948 
 8949  Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
 8950 
 8951   *) PKCS7_encrypt() was adding text MIME headers twice because they
 8952      were added manually and by SMIME_crlf_copy().
 8953      [Steve Henson]
 8954 
 8955   *) In bntest.c don't call BN_rand with zero bits argument.
 8956      [Steve Henson, pointed out by Andrew W. Gray <agray@iconsinc.com>]
 8957 
 8958   *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
 8959      case was implemented. This caused BN_div_recp() to fail occasionally.
 8960      [Ulf Möller]
 8961 
 8962   *) Add an optional second argument to the set_label() in the perl
 8963      assembly language builder. If this argument exists and is set
 8964      to 1 it signals that the assembler should use a symbol whose 
 8965      scope is the entire file, not just the current function. This
 8966      is needed with MASM which uses the format label:: for this scope.
 8967      [Steve Henson, pointed out by Peter Runestig <peter@runestig.com>]
 8968 
 8969   *) Change the ASN1 types so they are typedefs by default. Before
 8970      almost all types were #define'd to ASN1_STRING which was causing
 8971      STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
 8972      for example.
 8973      [Steve Henson]
 8974 
 8975   *) Change names of new functions to the new get1/get0 naming
 8976      convention: After 'get1', the caller owns a reference count
 8977      and has to call ..._free; 'get0' returns a pointer to some
 8978      data structure without incrementing reference counters.
 8979      (Some of the existing 'get' functions increment a reference
 8980      counter, some don't.)
 8981      Similarly, 'set1' and 'add1' functions increase reference
 8982      counters or duplicate objects.
 8983      [Steve Henson]
 8984 
 8985   *) Allow for the possibility of temp RSA key generation failure:
 8986      the code used to assume it always worked and crashed on failure.
 8987      [Steve Henson]
 8988 
 8989   *) Fix potential buffer overrun problem in BIO_printf().
 8990      [Ulf Möller, using public domain code by Patrick Powell; problem
 8991       pointed out by David Sacerdote <das33@cornell.edu>]
 8992 
 8993   *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
 8994      RAND_egd() and RAND_status().  In the command line application,
 8995      the EGD socket can be specified like a seed file using RANDFILE
 8996      or -rand.
 8997      [Ulf Möller]
 8998 
 8999   *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
 9000      Some CAs (e.g. Verisign) distribute certificates in this form.
 9001      [Steve Henson]
 9002 
 9003   *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
 9004      list to exclude them. This means that no special compilation option
 9005      is needed to use anonymous DH: it just needs to be included in the
 9006      cipher list.
 9007      [Steve Henson]
 9008 
 9009   *) Change the EVP_MD_CTX_type macro so its meaning consistent with
 9010      EVP_MD_type. The old functionality is available in a new macro called
 9011      EVP_MD_md(). Change code that uses it and update docs.
 9012      [Steve Henson]
 9013 
 9014   *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
 9015      where the 'void *' argument is replaced by a function pointer argument.
 9016      Previously 'void *' was abused to point to functions, which works on
 9017      many platforms, but is not correct.  As these functions are usually
 9018      called by macros defined in OpenSSL header files, most source code
 9019      should work without changes.
 9020      [Richard Levitte]
 9021 
 9022   *) <openssl/opensslconf.h> (which is created by Configure) now contains
 9023      sections with information on -D... compiler switches used for
 9024      compiling the library so that applications can see them.  To enable
 9025      one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
 9026      must be defined.  E.g.,
 9027         #define OPENSSL_ALGORITHM_DEFINES
 9028         #include <openssl/opensslconf.h>
 9029      defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
 9030      [Richard Levitte, Ulf and Bodo Möller]
 9031 
 9032   *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
 9033      record layer.
 9034      [Bodo Moeller]
 9035 
 9036   *) Change the 'other' type in certificate aux info to a STACK_OF
 9037      X509_ALGOR. Although not an AlgorithmIdentifier as such it has
 9038      the required ASN1 format: arbitrary types determined by an OID.
 9039      [Steve Henson]
 9040 
 9041   *) Add some PEM_write_X509_REQ_NEW() functions and a command line
 9042      argument to 'req'. This is not because the function is newer or
 9043      better than others it just uses the work 'NEW' in the certificate
 9044      request header lines. Some software needs this.
 9045      [Steve Henson]
 9046 
 9047   *) Reorganise password command line arguments: now passwords can be
 9048      obtained from various sources. Delete the PEM_cb function and make
 9049      it the default behaviour: i.e. if the callback is NULL and the
 9050      usrdata argument is not NULL interpret it as a null terminated pass
 9051      phrase. If usrdata and the callback are NULL then the pass phrase
 9052      is prompted for as usual.
 9053      [Steve Henson]
 9054 
 9055   *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
 9056      the support is automatically enabled. The resulting binaries will
 9057      autodetect the card and use it if present.
 9058      [Ben Laurie and Compaq Inc.]
 9059 
 9060   *) Work around for Netscape hang bug. This sends certificate request
 9061      and server done in one record. Since this is perfectly legal in the
 9062      SSL/TLS protocol it isn't a "bug" option and is on by default. See
 9063      the bugs/SSLv3 entry for more info.
 9064      [Steve Henson]
 9065 
 9066   *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
 9067      [Andy Polyakov]
 9068 
 9069   *) Add -rand argument to smime and pkcs12 applications and read/write
 9070      of seed file.
 9071      [Steve Henson]
 9072 
 9073   *) New 'passwd' tool for crypt(3) and apr1 password hashes.
 9074      [Bodo Moeller]
 9075 
 9076   *) Add command line password options to the remaining applications.
 9077      [Steve Henson]
 9078 
 9079   *) Bug fix for BN_div_recp() for numerators with an even number of
 9080      bits.
 9081      [Ulf Möller]
 9082 
 9083   *) More tests in bntest.c, and changed test_bn output.
 9084      [Ulf Möller]
 9085 
 9086   *) ./config recognizes MacOS X now.
 9087      [Andy Polyakov]
 9088 
 9089   *) Bug fix for BN_div() when the first words of num and divsor are
 9090      equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
 9091      [Ulf Möller]
 9092 
 9093   *) Add support for various broken PKCS#8 formats, and command line
 9094      options to produce them.
 9095      [Steve Henson]
 9096 
 9097   *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
 9098      get temporary BIGNUMs from a BN_CTX.
 9099      [Ulf Möller]
 9100 
 9101   *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
 9102      for p == 0.
 9103      [Ulf Möller]
 9104 
 9105   *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
 9106      include a #define from the old name to the new. The original intent
 9107      was that statically linked binaries could for example just call
 9108      SSLeay_add_all_ciphers() to just add ciphers to the table and not
 9109      link with digests. This never worked becayse SSLeay_add_all_digests()
 9110      and SSLeay_add_all_ciphers() were in the same source file so calling
 9111      one would link with the other. They are now in separate source files.
 9112      [Steve Henson]
 9113 
 9114   *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
 9115      [Steve Henson]
 9116 
 9117   *) Use a less unusual form of the Miller-Rabin primality test (it used
 9118      a binary algorithm for exponentiation integrated into the Miller-Rabin
 9119      loop, our standard modexp algorithms are faster).
 9120      [Bodo Moeller]
 9121 
 9122   *) Support for the EBCDIC character set completed.
 9123      [Martin Kraemer <Martin.Kraemer@Mch.SNI.De>]
 9124 
 9125   *) Source code cleanups: use const where appropriate, eliminate casts,
 9126      use void * instead of char * in lhash.
 9127      [Ulf Möller] 
 9128 
 9129   *) Bugfix: ssl3_send_server_key_exchange was not restartable
 9130      (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
 9131      this the server could overwrite ephemeral keys that the client
 9132      has already seen).
 9133      [Bodo Moeller]
 9134 
 9135   *) Turn DSA_is_prime into a macro that calls BN_is_prime,
 9136      using 50 iterations of the Rabin-Miller test.
 9137 
 9138      DSA_generate_parameters now uses BN_is_prime_fasttest (with 50
 9139      iterations of the Rabin-Miller test as required by the appendix
 9140      to FIPS PUB 186[-1]) instead of DSA_is_prime.
 9141      As BN_is_prime_fasttest includes trial division, DSA parameter
 9142      generation becomes much faster.
 9143 
 9144      This implies a change for the callback functions in DSA_is_prime
 9145      and DSA_generate_parameters: The callback function is called once
 9146      for each positive witness in the Rabin-Miller test, not just
 9147      occasionally in the inner loop; and the parameters to the
 9148      callback function now provide an iteration count for the outer
 9149      loop rather than for the current invocation of the inner loop.
 9150      DSA_generate_parameters additionally can call the callback
 9151      function with an 'iteration count' of -1, meaning that a
 9152      candidate has passed the trial division test (when q is generated 
 9153      from an application-provided seed, trial division is skipped).
 9154      [Bodo Moeller]
 9155 
 9156   *) New function BN_is_prime_fasttest that optionally does trial
 9157      division before starting the Rabin-Miller test and has
 9158      an additional BN_CTX * argument (whereas BN_is_prime always
 9159      has to allocate at least one BN_CTX).
 9160      'callback(1, -1, cb_arg)' is called when a number has passed the
 9161      trial division stage.
 9162      [Bodo Moeller]
 9163 
 9164   *) Fix for bug in CRL encoding. The validity dates weren't being handled
 9165      as ASN1_TIME.
 9166      [Steve Henson]
 9167 
 9168   *) New -pkcs12 option to CA.pl script to write out a PKCS#12 file.
 9169      [Steve Henson]
 9170 
 9171   *) New function BN_pseudo_rand().
 9172      [Ulf Möller]
 9173 
 9174   *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable)
 9175      bignum version of BN_from_montgomery() with the working code from
 9176      SSLeay 0.9.0 (the word based version is faster anyway), and clean up
 9177      the comments.
 9178      [Ulf Möller]
 9179 
 9180   *) Avoid a race condition in s2_clnt.c (function get_server_hello) that
 9181      made it impossible to use the same SSL_SESSION data structure in
 9182      SSL2 clients in multiple threads.
 9183      [Bodo Moeller]
 9184 
 9185   *) The return value of RAND_load_file() no longer counts bytes obtained
 9186      by stat().  RAND_load_file(..., -1) is new and uses the complete file
 9187      to seed the PRNG (previously an explicit byte count was required).
 9188      [Ulf Möller, Bodo Möller]
 9189 
 9190   *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes
 9191      used (char *) instead of (void *) and had casts all over the place.
 9192      [Steve Henson]
 9193 
 9194   *) Make BN_generate_prime() return NULL on error if ret!=NULL.
 9195      [Ulf Möller]
 9196 
 9197   *) Retain source code compatibility for BN_prime_checks macro:
 9198      BN_is_prime(..., BN_prime_checks, ...) now uses
 9199      BN_prime_checks_for_size to determine the appropriate number of
 9200      Rabin-Miller iterations.
 9201      [Ulf Möller]
 9202 
 9203   *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to
 9204      DH_CHECK_P_NOT_SAFE_PRIME.
 9205      (Check if this is true? OpenPGP calls them "strong".)
 9206      [Ulf Möller]
 9207 
 9208   *) Merge the functionality of "dh" and "gendh" programs into a new program
 9209      "dhparam". The old programs are retained for now but will handle DH keys
 9210      (instead of parameters) in future.
 9211      [Steve Henson]
 9212 
 9213   *) Make the ciphers, s_server and s_client programs check the return values
 9214      when a new cipher list is set.
 9215      [Steve Henson]
 9216 
 9217   *) Enhance the SSL/TLS cipher mechanism to correctly handle the TLS 56bit
 9218      ciphers. Before when the 56bit ciphers were enabled the sorting was
 9219      wrong.
 9220 
 9221      The syntax for the cipher sorting has been extended to support sorting by
 9222      cipher-strength (using the strength_bits hard coded in the tables).
 9223      The new command is "@STRENGTH" (see also doc/apps/ciphers.pod).
 9224 
 9225      Fix a bug in the cipher-command parser: when supplying a cipher command
 9226      string with an "undefined" symbol (neither command nor alphanumeric
 9227      [A-Za-z0-9], ssl_set_cipher_list used to hang in an endless loop. Now
 9228      an error is flagged.
 9229 
 9230      Due to the strength-sorting extension, the code of the
 9231      ssl_create_cipher_list() function was completely rearranged. I hope that
 9232      the readability was also increased :-)
 9233      [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
 9234 
 9235   *) Minor change to 'x509' utility. The -CAcreateserial option now uses 1
 9236      for the first serial number and places 2 in the serial number file. This
 9237      avoids problems when the root CA is created with serial number zero and
 9238      the first user certificate has the same issuer name and serial number
 9239      as the root CA.
 9240      [Steve Henson]
 9241 
 9242   *) Fixes to X509_ATTRIBUTE utilities, change the 'req' program so it uses
 9243      the new code. Add documentation for this stuff.
 9244      [Steve Henson]
 9245 
 9246   *) Changes to X509_ATTRIBUTE utilities. These have been renamed from
 9247      X509_*() to X509at_*() on the grounds that they don't handle X509
 9248      structures and behave in an analagous way to the X509v3 functions:
 9249      they shouldn't be called directly but wrapper functions should be used
 9250      instead.
 9251 
 9252      So we also now have some wrapper functions that call the X509at functions
 9253      when passed certificate requests. (TO DO: similar things can be done with
 9254      PKCS#7 signed and unsigned attributes, PKCS#12 attributes and a few other
 9255      things. Some of these need some d2i or i2d and print functionality
 9256      because they handle more complex structures.)
 9257      [Steve Henson]
 9258 
 9259   *) Add missing #ifndefs that caused missing symbols when building libssl
 9260      as a shared library without RSA.  Use #ifndef NO_SSL2 instead of
 9261      NO_RSA in ssl/s2*.c. 
 9262      [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller]
 9263 
 9264   *) Precautions against using the PRNG uninitialized: RAND_bytes() now
 9265      has a return value which indicates the quality of the random data
 9266      (1 = ok, 0 = not seeded).  Also an error is recorded on the thread's
 9267      error queue. New function RAND_pseudo_bytes() generates output that is
 9268      guaranteed to be unique but not unpredictable. RAND_add is like
 9269      RAND_seed, but takes an extra argument for an entropy estimate
 9270      (RAND_seed always assumes full entropy).
 9271      [Ulf Möller]
 9272 
 9273   *) Do more iterations of Rabin-Miller probable prime test (specifically,
 9274      3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes
 9275      instead of only 2 for all lengths; see BN_prime_checks_for_size definition
 9276      in crypto/bn/bn_prime.c for the complete table).  This guarantees a
 9277      false-positive rate of at most 2^-80 for random input.
 9278      [Bodo Moeller]
 9279 
 9280   *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs.
 9281      [Bodo Moeller]
 9282 
 9283   *) New function X509_CTX_rget_chain() (renamed to X509_CTX_get1_chain
 9284      in the 0.9.5 release), this returns the chain
 9285      from an X509_CTX structure with a dup of the stack and all
 9286      the X509 reference counts upped: so the stack will exist
 9287      after X509_CTX_cleanup() has been called. Modify pkcs12.c
 9288      to use this.
 9289 
 9290      Also make SSL_SESSION_print() print out the verify return
 9291      code.
 9292      [Steve Henson]
 9293 
 9294   *) Add manpage for the pkcs12 command. Also change the default
 9295      behaviour so MAC iteration counts are used unless the new
 9296      -nomaciter option is used. This improves file security and
 9297      only older versions of MSIE (4.0 for example) need it.
 9298      [Steve Henson]
 9299 
 9300   *) Honor the no-xxx Configure options when creating .DEF files.
 9301      [Ulf Möller]
 9302 
 9303   *) Add PKCS#10 attributes to field table: challengePassword, 
 9304      unstructuredName and unstructuredAddress. These are taken from
 9305      draft PKCS#9 v2.0 but are compatible with v1.2 provided no 
 9306      international characters are used.
 9307 
 9308      More changes to X509_ATTRIBUTE code: allow the setting of types
 9309      based on strings. Remove the 'loc' parameter when adding
 9310      attributes because these will be a SET OF encoding which is sorted
 9311      in ASN1 order.
 9312      [Steve Henson]
 9313 
 9314   *) Initial changes to the 'req' utility to allow request generation
 9315      automation. This will allow an application to just generate a template
 9316      file containing all the field values and have req construct the
 9317      request.
 9318 
 9319      Initial support for X509_ATTRIBUTE handling. Stacks of these are
 9320      used all over the place including certificate requests and PKCS#7
 9321      structures. They are currently handled manually where necessary with
 9322      some primitive wrappers for PKCS#7. The new functions behave in a
 9323      manner analogous to the X509 extension functions: they allow
 9324      attributes to be looked up by NID and added.
 9325 
 9326      Later something similar to the X509V3 code would be desirable to
 9327      automatically handle the encoding, decoding and printing of the
 9328      more complex types. The string types like challengePassword can
 9329      be handled by the string table functions.
 9330 
 9331      Also modified the multi byte string table handling. Now there is
 9332      a 'global mask' which masks out certain types. The table itself
 9333      can use the flag STABLE_NO_MASK to ignore the mask setting: this
 9334      is useful when for example there is only one permissible type
 9335      (as in countryName) and using the mask might result in no valid
 9336      types at all.
 9337      [Steve Henson]
 9338 
 9339   *) Clean up 'Finished' handling, and add functions SSL_get_finished and
 9340      SSL_get_peer_finished to allow applications to obtain the latest
 9341      Finished messages sent to the peer or expected from the peer,
 9342      respectively.  (SSL_get_peer_finished is usually the Finished message
 9343      actually received from the peer, otherwise the protocol will be aborted.)
 9344 
 9345      As the Finished message are message digests of the complete handshake
 9346      (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
 9347      be used for external authentication procedures when the authentication
 9348      provided by SSL/TLS is not desired or is not enough.
 9349      [Bodo Moeller]
 9350 
 9351   *) Enhanced support for Alpha Linux is added. Now ./config checks if
 9352      the host supports BWX extension and if Compaq C is present on the
 9353      $PATH. Just exploiting of the BWX extension results in 20-30%
 9354      performance kick for some algorithms, e.g. DES and RC4 to mention
 9355      a couple. Compaq C in turn generates ~20% faster code for MD5 and
 9356      SHA1.
 9357      [Andy Polyakov]
 9358 
 9359   *) Add support for MS "fast SGC". This is arguably a violation of the
 9360      SSL3/TLS protocol. Netscape SGC does two handshakes: the first with
 9361      weak crypto and after checking the certificate is SGC a second one
 9362      with strong crypto. MS SGC stops the first handshake after receiving
 9363      the server certificate message and sends a second client hello. Since
 9364      a server will typically do all the time consuming operations before
 9365      expecting any further messages from the client (server key exchange
 9366      is the most expensive) there is little difference between the two.
 9367 
 9368      To get OpenSSL to support MS SGC we have to permit a second client
 9369      hello message after we have sent server done. In addition we have to
 9370      reset the MAC if we do get this second client hello.
 9371      [Steve Henson]
 9372 
 9373   *) Add a function 'd2i_AutoPrivateKey()' this will automatically decide
 9374      if a DER encoded private key is RSA or DSA traditional format. Changed
 9375      d2i_PrivateKey_bio() to use it. This is only needed for the "traditional"
 9376      format DER encoded private key. Newer code should use PKCS#8 format which
 9377      has the key type encoded in the ASN1 structure. Added DER private key
 9378      support to pkcs8 application.
 9379      [Steve Henson]
 9380 
 9381   *) SSL 3/TLS 1 servers now don't request certificates when an anonymous
 9382      ciphersuites has been selected (as required by the SSL 3/TLS 1
 9383      specifications).  Exception: When SSL_VERIFY_FAIL_IF_NO_PEER_CERT
 9384      is set, we interpret this as a request to violate the specification
 9385      (the worst that can happen is a handshake failure, and 'correct'
 9386      behaviour would result in a handshake failure anyway).
 9387      [Bodo Moeller]
 9388 
 9389   *) In SSL_CTX_add_session, take into account that there might be multiple
 9390      SSL_SESSION structures with the same session ID (e.g. when two threads
 9391      concurrently obtain them from an external cache).
 9392      The internal cache can handle only one SSL_SESSION with a given ID,
 9393      so if there's a conflict, we now throw out the old one to achieve
 9394      consistency.
 9395      [Bodo Moeller]
 9396 
 9397   *) Add OIDs for idea and blowfish in CBC mode. This will allow both
 9398      to be used in PKCS#5 v2.0 and S/MIME.  Also add checking to
 9399      some routines that use cipher OIDs: some ciphers do not have OIDs
 9400      defined and so they cannot be used for S/MIME and PKCS#5 v2.0 for
 9401      example.
 9402      [Steve Henson]
 9403 
 9404   *) Simplify the trust setting structure and code. Now we just have
 9405      two sequences of OIDs for trusted and rejected settings. These will
 9406      typically have values the same as the extended key usage extension
 9407      and any application specific purposes.
 9408 
 9409      The trust checking code now has a default behaviour: it will just
 9410      check for an object with the same NID as the passed id. Functions can
 9411      be provided to override either the default behaviour or the behaviour
 9412      for a given id. SSL client, server and email already have functions
 9413      in place for compatibility: they check the NID and also return "trusted"
 9414      if the certificate is self signed.
 9415      [Steve Henson]
 9416 
 9417   *) Add d2i,i2d bio/fp functions for PrivateKey: these convert the
 9418      traditional format into an EVP_PKEY structure.
 9419      [Steve Henson]
 9420 
 9421   *) Add a password callback function PEM_cb() which either prompts for
 9422      a password if usr_data is NULL or otherwise assumes it is a null
 9423      terminated password. Allow passwords to be passed on command line
 9424      environment or config files in a few more utilities.
 9425      [Steve Henson]
 9426 
 9427   *) Add a bunch of DER and PEM functions to handle PKCS#8 format private
 9428      keys. Add some short names for PKCS#8 PBE algorithms and allow them
 9429      to be specified on the command line for the pkcs8 and pkcs12 utilities.
 9430      Update documentation.
 9431      [Steve Henson]
 9432 
 9433   *) Support for ASN1 "NULL" type. This could be handled before by using
 9434      ASN1_TYPE but there wasn't any function that would try to read a NULL
 9435      and produce an error if it couldn't. For compatibility we also have
 9436      ASN1_NULL_new() and ASN1_NULL_free() functions but these are faked and
 9437      don't allocate anything because they don't need to.
 9438      [Steve Henson]
 9439 
 9440   *) Initial support for MacOS is now provided. Examine INSTALL.MacOS
 9441      for details.
 9442      [Andy Polyakov, Roy Woods <roy@centicsystems.ca>]
 9443 
 9444   *) Rebuild of the memory allocation routines used by OpenSSL code and
 9445      possibly others as well.  The purpose is to make an interface that
 9446      provide hooks so anyone can build a separate set of allocation and
 9447      deallocation routines to be used by OpenSSL, for example memory
 9448      pool implementations, or something else, which was previously hard
 9449      since Malloc(), Realloc() and Free() were defined as macros having
 9450      the values malloc, realloc and free, respectively (except for Win32
 9451      compilations).  The same is provided for memory debugging code.
 9452      OpenSSL already comes with functionality to find memory leaks, but
 9453      this gives people a chance to debug other memory problems.
 9454 
 9455      With these changes, a new set of functions and macros have appeared:
 9456 
 9457        CRYPTO_set_mem_debug_functions()	        [F]
 9458        CRYPTO_get_mem_debug_functions()         [F]
 9459        CRYPTO_dbg_set_options()	                [F]
 9460        CRYPTO_dbg_get_options()                 [F]
 9461        CRYPTO_malloc_debug_init()               [M]
 9462 
 9463      The memory debug functions are NULL by default, unless the library
 9464      is compiled with CRYPTO_MDEBUG or friends is defined.  If someone
 9465      wants to debug memory anyway, CRYPTO_malloc_debug_init() (which
 9466      gives the standard debugging functions that come with OpenSSL) or
 9467      CRYPTO_set_mem_debug_functions() (tells OpenSSL to use functions
 9468      provided by the library user) must be used.  When the standard
 9469      debugging functions are used, CRYPTO_dbg_set_options can be used to
 9470      request additional information:
 9471      CRYPTO_dbg_set_options(V_CYRPTO_MDEBUG_xxx) corresponds to setting
 9472      the CRYPTO_MDEBUG_xxx macro when compiling the library.   
 9473 
 9474      Also, things like CRYPTO_set_mem_functions will always give the
 9475      expected result (the new set of functions is used for allocation
 9476      and deallocation) at all times, regardless of platform and compiler
 9477      options.
 9478 
 9479      To finish it up, some functions that were never use in any other
 9480      way than through macros have a new API and new semantic:
 9481 
 9482        CRYPTO_dbg_malloc()
 9483        CRYPTO_dbg_realloc()
 9484        CRYPTO_dbg_free()
 9485 
 9486      All macros of value have retained their old syntax.
 9487      [Richard Levitte and Bodo Moeller]
 9488 
 9489   *) Some S/MIME fixes. The OID for SMIMECapabilities was wrong, the
 9490      ordering of SMIMECapabilities wasn't in "strength order" and there
 9491      was a missing NULL in the AlgorithmIdentifier for the SHA1 signature
 9492      algorithm.
 9493      [Steve Henson]
 9494 
 9495   *) Some ASN1 types with illegal zero length encoding (INTEGER,
 9496      ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines.
 9497      [Frans Heymans <fheymans@isaserver.be>, modified by Steve Henson]
 9498 
 9499   *) Merge in my S/MIME library for OpenSSL. This provides a simple
 9500      S/MIME API on top of the PKCS#7 code, a MIME parser (with enough
 9501      functionality to handle multipart/signed properly) and a utility
 9502      called 'smime' to call all this stuff. This is based on code I
 9503      originally wrote for Celo who have kindly allowed it to be
 9504      included in OpenSSL.
 9505      [Steve Henson]
 9506 
 9507   *) Add variants des_set_key_checked and des_set_key_unchecked of
 9508      des_set_key (aka des_key_sched).  Global variable des_check_key
 9509      decides which of these is called by des_set_key; this way
 9510      des_check_key behaves as it always did, but applications and
 9511      the library itself, which was buggy for des_check_key == 1,
 9512      have a cleaner way to pick the version they need.
 9513      [Bodo Moeller]
 9514 
 9515   *) New function PKCS12_newpass() which changes the password of a
 9516      PKCS12 structure.
 9517      [Steve Henson]
 9518 
 9519   *) Modify X509_TRUST and X509_PURPOSE so it also uses a static and
 9520      dynamic mix. In both cases the ids can be used as an index into the
 9521      table. Also modified the X509_TRUST_add() and X509_PURPOSE_add()
 9522      functions so they accept a list of the field values and the
 9523      application doesn't need to directly manipulate the X509_TRUST
 9524      structure.
 9525      [Steve Henson]
 9526 
 9527   *) Modify the ASN1_STRING_TABLE stuff so it also uses bsearch and doesn't
 9528      need initialising.
 9529      [Steve Henson]
 9530 
 9531   *) Modify the way the V3 extension code looks up extensions. This now
 9532      works in a similar way to the object code: we have some "standard"
 9533      extensions in a static table which is searched with OBJ_bsearch()
 9534      and the application can add dynamic ones if needed. The file
 9535      crypto/x509v3/ext_dat.h now has the info: this file needs to be
 9536      updated whenever a new extension is added to the core code and kept
 9537      in ext_nid order. There is a simple program 'tabtest.c' which checks
 9538      this. New extensions are not added too often so this file can readily
 9539      be maintained manually.
 9540 
 9541      There are two big advantages in doing things this way. The extensions
 9542      can be looked up immediately and no longer need to be "added" using
 9543      X509V3_add_standard_extensions(): this function now does nothing.
 9544      [Side note: I get *lots* of email saying the extension code doesn't
 9545       work because people forget to call this function]
 9546      Also no dynamic allocation is done unless new extensions are added:
 9547      so if we don't add custom extensions there is no need to call
 9548      X509V3_EXT_cleanup().
 9549      [Steve Henson]
 9550 
 9551   *) Modify enc utility's salting as follows: make salting the default. Add a
 9552      magic header, so unsalted files fail gracefully instead of just decrypting
 9553      to garbage. This is because not salting is a big security hole, so people
 9554      should be discouraged from doing it.
 9555      [Ben Laurie]
 9556 
 9557   *) Fixes and enhancements to the 'x509' utility. It allowed a message
 9558      digest to be passed on the command line but it only used this
 9559      parameter when signing a certificate. Modified so all relevant
 9560      operations are affected by the digest parameter including the
 9561      -fingerprint and -x509toreq options. Also -x509toreq choked if a
 9562      DSA key was used because it didn't fix the digest.
 9563      [Steve Henson]
 9564 
 9565   *) Initial certificate chain verify code. Currently tests the untrusted
 9566      certificates for consistency with the verify purpose (which is set
 9567      when the X509_STORE_CTX structure is set up) and checks the pathlength.
 9568 
 9569      There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour:
 9570      this is because it will reject chains with invalid extensions whereas
 9571      every previous version of OpenSSL and SSLeay made no checks at all.
 9572 
 9573      Trust code: checks the root CA for the relevant trust settings. Trust
 9574      settings have an initial value consistent with the verify purpose: e.g.
 9575      if the verify purpose is for SSL client use it expects the CA to be
 9576      trusted for SSL client use. However the default value can be changed to
 9577      permit custom trust settings: one example of this would be to only trust
 9578      certificates from a specific "secure" set of CAs.
 9579 
 9580      Also added X509_STORE_CTX_new() and X509_STORE_CTX_free() functions
 9581      which should be used for version portability: especially since the
 9582      verify structure is likely to change more often now.
 9583 
 9584      SSL integration. Add purpose and trust to SSL_CTX and SSL and functions
 9585      to set them. If not set then assume SSL clients will verify SSL servers
 9586      and vice versa.
 9587 
 9588      Two new options to the verify program: -untrusted allows a set of
 9589      untrusted certificates to be passed in and -purpose which sets the
 9590      intended purpose of the certificate. If a purpose is set then the
 9591      new chain verify code is used to check extension consistency.
 9592      [Steve Henson]
 9593 
 9594   *) Support for the authority information access extension.
 9595      [Steve Henson]
 9596 
 9597   *) Modify RSA and DSA PEM read routines to transparently handle
 9598      PKCS#8 format private keys. New *_PUBKEY_* functions that handle
 9599      public keys in a format compatible with certificate
 9600      SubjectPublicKeyInfo structures. Unfortunately there were already
 9601      functions called *_PublicKey_* which used various odd formats so
 9602      these are retained for compatibility: however the DSA variants were
 9603      never in a public release so they have been deleted. Changed dsa/rsa
 9604      utilities to handle the new format: note no releases ever handled public
 9605      keys so we should be OK.
 9606 
 9607      The primary motivation for this change is to avoid the same fiasco
 9608      that dogs private keys: there are several incompatible private key
 9609      formats some of which are standard and some OpenSSL specific and
 9610      require various evil hacks to allow partial transparent handling and
 9611      even then it doesn't work with DER formats. Given the option anything
 9612      other than PKCS#8 should be dumped: but the other formats have to
 9613      stay in the name of compatibility.
 9614 
 9615      With public keys and the benefit of hindsight one standard format 
 9616      is used which works with EVP_PKEY, RSA or DSA structures: though
 9617      it clearly returns an error if you try to read the wrong kind of key.
 9618 
 9619      Added a -pubkey option to the 'x509' utility to output the public key.
 9620      Also rename the EVP_PKEY_get_*() to EVP_PKEY_rget_*()
 9621      (renamed to EVP_PKEY_get1_*() in the OpenSSL 0.9.5 release) and add
 9622      EVP_PKEY_rset_*() functions (renamed to EVP_PKEY_set1_*())
 9623      that do the same as the EVP_PKEY_assign_*() except they up the
 9624      reference count of the added key (they don't "swallow" the
 9625      supplied key).
 9626      [Steve Henson]
 9627 
 9628   *) Fixes to crypto/x509/by_file.c the code to read in certificates and
 9629      CRLs would fail if the file contained no certificates or no CRLs:
 9630      added a new function to read in both types and return the number
 9631      read: this means that if none are read it will be an error. The
 9632      DER versions of the certificate and CRL reader would always fail
 9633      because it isn't possible to mix certificates and CRLs in DER format
 9634      without choking one or the other routine. Changed this to just read
 9635      a certificate: this is the best we can do. Also modified the code
 9636      in apps/verify.c to take notice of return codes: it was previously
 9637      attempting to read in certificates from NULL pointers and ignoring
 9638      any errors: this is one reason why the cert and CRL reader seemed
 9639      to work. It doesn't check return codes from the default certificate
 9640      routines: these may well fail if the certificates aren't installed.
 9641      [Steve Henson]
 9642 
 9643   *) Code to support otherName option in GeneralName.
 9644      [Steve Henson]
 9645 
 9646   *) First update to verify code. Change the verify utility
 9647      so it warns if it is passed a self signed certificate:
 9648      for consistency with the normal behaviour. X509_verify
 9649      has been modified to it will now verify a self signed
 9650      certificate if *exactly* the same certificate appears
 9651      in the store: it was previously impossible to trust a
 9652      single self signed certificate. This means that:
 9653      openssl verify ss.pem
 9654      now gives a warning about a self signed certificate but
 9655      openssl verify -CAfile ss.pem ss.pem
 9656      is OK.
 9657      [Steve Henson]
 9658 
 9659   *) For servers, store verify_result in SSL_SESSION data structure
 9660      (and add it to external session representation).
 9661      This is needed when client certificate verifications fails,
 9662      but an application-provided verification callback (set by
 9663      SSL_CTX_set_cert_verify_callback) allows accepting the session
 9664      anyway (i.e. leaves x509_store_ctx->error != X509_V_OK
 9665      but returns 1): When the session is reused, we have to set
 9666      ssl->verify_result to the appropriate error code to avoid
 9667      security holes.
 9668      [Bodo Moeller, problem pointed out by Lutz Jaenicke]
 9669 
 9670   *) Fix a bug in the new PKCS#7 code: it didn't consider the
 9671      case in PKCS7_dataInit() where the signed PKCS7 structure
 9672      didn't contain any existing data because it was being created.
 9673      [Po-Cheng Chen <pocheng@nst.com.tw>, slightly modified by Steve Henson]
 9674 
 9675   *) Add a salt to the key derivation routines in enc.c. This
 9676      forms the first 8 bytes of the encrypted file. Also add a
 9677      -S option to allow a salt to be input on the command line.
 9678      [Steve Henson]
 9679 
 9680   *) New function X509_cmp(). Oddly enough there wasn't a function
 9681      to compare two certificates. We do this by working out the SHA1
 9682      hash and comparing that. X509_cmp() will be needed by the trust
 9683      code.
 9684      [Steve Henson]
 9685 
 9686   *) SSL_get1_session() is like SSL_get_session(), but increments
 9687      the reference count in the SSL_SESSION returned.
 9688      [Geoff Thorpe <geoff@eu.c2.net>]
 9689 
 9690   *) Fix for 'req': it was adding a null to request attributes.
 9691      Also change the X509_LOOKUP and X509_INFO code to handle
 9692      certificate auxiliary information.
 9693      [Steve Henson]
 9694 
 9695   *) Add support for 40 and 64 bit RC2 and RC4 algorithms: document
 9696      the 'enc' command.
 9697      [Steve Henson]
 9698 
 9699   *) Add the possibility to add extra information to the memory leak
 9700      detecting output, to form tracebacks, showing from where each
 9701      allocation was originated: CRYPTO_push_info("constant string") adds
 9702      the string plus current file name and line number to a per-thread
 9703      stack, CRYPTO_pop_info() does the obvious, CRYPTO_remove_all_info()
 9704      is like calling CYRPTO_pop_info() until the stack is empty.
 9705      Also updated memory leak detection code to be multi-thread-safe.
 9706      [Richard Levitte]
 9707 
 9708   *) Add options -text and -noout to pkcs7 utility and delete the
 9709      encryption options which never did anything. Update docs.
 9710      [Steve Henson]
 9711 
 9712   *) Add options to some of the utilities to allow the pass phrase
 9713      to be included on either the command line (not recommended on
 9714      OSes like Unix) or read from the environment. Update the
 9715      manpages and fix a few bugs.
 9716      [Steve Henson]
 9717 
 9718   *) Add a few manpages for some of the openssl commands.
 9719      [Steve Henson]
 9720 
 9721   *) Fix the -revoke option in ca. It was freeing up memory twice,
 9722      leaking and not finding already revoked certificates.
 9723      [Steve Henson]
 9724 
 9725   *) Extensive changes to support certificate auxiliary information.
 9726      This involves the use of X509_CERT_AUX structure and X509_AUX
 9727      functions. An X509_AUX function such as PEM_read_X509_AUX()
 9728      can still read in a certificate file in the usual way but it
 9729      will also read in any additional "auxiliary information". By
 9730      doing things this way a fair degree of compatibility can be
 9731      retained: existing certificates can have this information added
 9732      using the new 'x509' options. 
 9733 
 9734      Current auxiliary information includes an "alias" and some trust
 9735      settings. The trust settings will ultimately be used in enhanced
 9736      certificate chain verification routines: currently a certificate
 9737      can only be trusted if it is self signed and then it is trusted
 9738      for all purposes.
 9739      [Steve Henson]
 9740 
 9741   *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD).
 9742      The problem was that one of the replacement routines had not been working
 9743      since SSLeay releases.  For now the offending routine has been replaced
 9744      with non-optimised assembler.  Even so, this now gives around 95%
 9745      performance improvement for 1024 bit RSA signs.
 9746      [Mark Cox]
 9747 
 9748   *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2 
 9749      handling. Most clients have the effective key size in bits equal to
 9750      the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key.
 9751      A few however don't do this and instead use the size of the decrypted key
 9752      to determine the RC2 key length and the AlgorithmIdentifier to determine
 9753      the effective key length. In this case the effective key length can still
 9754      be 40 bits but the key length can be 168 bits for example. This is fixed
 9755      by manually forcing an RC2 key into the EVP_PKEY structure because the
 9756      EVP code can't currently handle unusual RC2 key sizes: it always assumes
 9757      the key length and effective key length are equal.
 9758      [Steve Henson]
 9759 
 9760   *) Add a bunch of functions that should simplify the creation of 
 9761      X509_NAME structures. Now you should be able to do:
 9762      X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC, "Steve", -1, -1, 0);
 9763      and have it automatically work out the correct field type and fill in
 9764      the structures. The more adventurous can try:
 9765      X509_NAME_add_entry_by_txt(nm, field, MBSTRING_UTF8, str, -1, -1, 0);
 9766      and it will (hopefully) work out the correct multibyte encoding.
 9767      [Steve Henson]
 9768 
 9769   *) Change the 'req' utility to use the new field handling and multibyte
 9770      copy routines. Before the DN field creation was handled in an ad hoc
 9771      way in req, ca, and x509 which was rather broken and didn't support
 9772      BMPStrings or UTF8Strings. Since some software doesn't implement
 9773      BMPStrings or UTF8Strings yet, they can be enabled using the config file
 9774      using the dirstring_type option. See the new comment in the default
 9775      openssl.cnf for more info.
 9776      [Steve Henson]
 9777 
 9778   *) Make crypto/rand/md_rand.c more robust:
 9779      - Assure unique random numbers after fork().
 9780      - Make sure that concurrent threads access the global counter and
 9781        md serializably so that we never lose entropy in them
 9782        or use exactly the same state in multiple threads.
 9783        Access to the large state is not always serializable because
 9784        the additional locking could be a performance killer, and
 9785        md should be large enough anyway.
 9786      [Bodo Moeller]
 9787 
 9788   *) New file apps/app_rand.c with commonly needed functionality
 9789      for handling the random seed file.
 9790 
 9791      Use the random seed file in some applications that previously did not:
 9792           ca,
 9793           dsaparam -genkey (which also ignored its '-rand' option), 
 9794           s_client,
 9795           s_server,
 9796           x509 (when signing).
 9797      Except on systems with /dev/urandom, it is crucial to have a random
 9798      seed file at least for key creation, DSA signing, and for DH exchanges;
 9799      for RSA signatures we could do without one.
 9800 
 9801      gendh and gendsa (unlike genrsa) used to read only the first byte
 9802      of each file listed in the '-rand' option.  The function as previously
 9803      found in genrsa is now in app_rand.c and is used by all programs
 9804      that support '-rand'.
 9805      [Bodo Moeller]
 9806 
 9807   *) In RAND_write_file, use mode 0600 for creating files;
 9808      don't just chmod when it may be too late.
 9809      [Bodo Moeller]
 9810 
 9811   *) Report an error from X509_STORE_load_locations
 9812      when X509_LOOKUP_load_file or X509_LOOKUP_add_dir failed.
 9813      [Bill Perry]
 9814 
 9815   *) New function ASN1_mbstring_copy() this copies a string in either
 9816      ASCII, Unicode, Universal (4 bytes per character) or UTF8 format
 9817      into an ASN1_STRING type. A mask of permissible types is passed
 9818      and it chooses the "minimal" type to use or an error if not type
 9819      is suitable.
 9820      [Steve Henson]
 9821 
 9822   *) Add function equivalents to the various macros in asn1.h. The old
 9823      macros are retained with an M_ prefix. Code inside the library can
 9824      use the M_ macros. External code (including the openssl utility)
 9825      should *NOT* in order to be "shared library friendly".
 9826      [Steve Henson]
 9827 
 9828   *) Add various functions that can check a certificate's extensions
 9829      to see if it usable for various purposes such as SSL client,
 9830      server or S/MIME and CAs of these types. This is currently 
 9831      VERY EXPERIMENTAL but will ultimately be used for certificate chain
 9832      verification. Also added a -purpose flag to x509 utility to
 9833      print out all the purposes.
 9834      [Steve Henson]
 9835 
 9836   *) Add a CRYPTO_EX_DATA to X509 certificate structure and associated
 9837      functions.
 9838      [Steve Henson]
 9839 
 9840   *) New X509V3_{X509,CRL,REVOKED}_get_d2i() functions. These will search
 9841      for, obtain and decode and extension and obtain its critical flag.
 9842      This allows all the necessary extension code to be handled in a
 9843      single function call.
 9844      [Steve Henson]
 9845 
 9846   *) RC4 tune-up featuring 30-40% performance improvement on most RISC
 9847      platforms. See crypto/rc4/rc4_enc.c for further details.
 9848      [Andy Polyakov]
 9849 
 9850   *) New -noout option to asn1parse. This causes no output to be produced
 9851      its main use is when combined with -strparse and -out to extract data
 9852      from a file (which may not be in ASN.1 format).
 9853      [Steve Henson]
 9854 
 9855   *) Fix for pkcs12 program. It was hashing an invalid certificate pointer
 9856      when producing the local key id.
 9857      [Richard Levitte <levitte@stacken.kth.se>]
 9858 
 9859   *) New option -dhparam in s_server. This allows a DH parameter file to be
 9860      stated explicitly. If it is not stated then it tries the first server
 9861      certificate file. The previous behaviour hard coded the filename
 9862      "server.pem".
 9863      [Steve Henson]
 9864 
 9865   *) Add -pubin and -pubout options to the rsa and dsa commands. These allow
 9866      a public key to be input or output. For example:
 9867      openssl rsa -in key.pem -pubout -out pubkey.pem
 9868      Also added necessary DSA public key functions to handle this.
 9869      [Steve Henson]
 9870 
 9871   *) Fix so PKCS7_dataVerify() doesn't crash if no certificates are contained
 9872      in the message. This was handled by allowing
 9873      X509_find_by_issuer_and_serial() to tolerate a NULL passed to it.
 9874      [Steve Henson, reported by Sampo Kellomaki <sampo@mail.neuronio.pt>]
 9875 
 9876   *) Fix for bug in d2i_ASN1_bytes(): other ASN1 functions add an extra null
 9877      to the end of the strings whereas this didn't. This would cause problems
 9878      if strings read with d2i_ASN1_bytes() were later modified.
 9879      [Steve Henson, reported by Arne Ansper <arne@ats.cyber.ee>]
 9880 
 9881   *) Fix for base64 decode bug. When a base64 bio reads only one line of
 9882      data and it contains EOF it will end up returning an error. This is
 9883      caused by input 46 bytes long. The cause is due to the way base64
 9884      BIOs find the start of base64 encoded data. They do this by trying a
 9885      trial decode on each line until they find one that works. When they
 9886      do a flag is set and it starts again knowing it can pass all the
 9887      data directly through the decoder. Unfortunately it doesn't reset
 9888      the context it uses. This means that if EOF is reached an attempt
 9889      is made to pass two EOFs through the context and this causes the
 9890      resulting error. This can also cause other problems as well. As is
 9891      usual with these problems it takes *ages* to find and the fix is
 9892      trivial: move one line.
 9893      [Steve Henson, reported by ian@uns.ns.ac.yu (Ivan Nejgebauer) ]
 9894 
 9895   *) Ugly workaround to get s_client and s_server working under Windows. The
 9896      old code wouldn't work because it needed to select() on sockets and the
 9897      tty (for keypresses and to see if data could be written). Win32 only
 9898      supports select() on sockets so we select() with a 1s timeout on the
 9899      sockets and then see if any characters are waiting to be read, if none
 9900      are present then we retry, we also assume we can always write data to
 9901      the tty. This isn't nice because the code then blocks until we've
 9902      received a complete line of data and it is effectively polling the
 9903      keyboard at 1s intervals: however it's quite a bit better than not
 9904      working at all :-) A dedicated Windows application might handle this
 9905      with an event loop for example.
 9906      [Steve Henson]
 9907 
 9908   *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign
 9909      and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions
 9910      will be called when RSA_sign() and RSA_verify() are used. This is useful
 9911      if rsa_pub_dec() and rsa_priv_enc() equivalents are not available.
 9912      For this to work properly RSA_public_decrypt() and RSA_private_encrypt()
 9913      should *not* be used: RSA_sign() and RSA_verify() must be used instead.
 9914      This necessitated the support of an extra signature type NID_md5_sha1
 9915      for SSL signatures and modifications to the SSL library to use it instead
 9916      of calling RSA_public_decrypt() and RSA_private_encrypt().
 9917      [Steve Henson]
 9918 
 9919   *) Add new -verify -CAfile and -CApath options to the crl program, these
 9920      will lookup a CRL issuers certificate and verify the signature in a
 9921      similar way to the verify program. Tidy up the crl program so it
 9922      no longer accesses structures directly. Make the ASN1 CRL parsing a bit
 9923      less strict. It will now permit CRL extensions even if it is not
 9924      a V2 CRL: this will allow it to tolerate some broken CRLs.
 9925      [Steve Henson]
 9926 
 9927   *) Initialize all non-automatic variables each time one of the openssl
 9928      sub-programs is started (this is necessary as they may be started
 9929      multiple times from the "OpenSSL>" prompt).
 9930      [Lennart Bang, Bodo Moeller]
 9931 
 9932   *) Preliminary compilation option RSA_NULL which disables RSA crypto without
 9933      removing all other RSA functionality (this is what NO_RSA does). This
 9934      is so (for example) those in the US can disable those operations covered
 9935      by the RSA patent while allowing storage and parsing of RSA keys and RSA
 9936      key generation.
 9937      [Steve Henson]
 9938 
 9939   *) Non-copying interface to BIO pairs.
 9940      (still largely untested)
 9941      [Bodo Moeller]
 9942 
 9943   *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive
 9944      ASCII string. This was handled independently in various places before.
 9945      [Steve Henson]
 9946 
 9947   *) New functions UTF8_getc() and UTF8_putc() that parse and generate
 9948      UTF8 strings a character at a time.
 9949      [Steve Henson]
 9950 
 9951   *) Use client_version from client hello to select the protocol
 9952      (s23_srvr.c) and for RSA client key exchange verification
 9953      (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications.
 9954      [Bodo Moeller]
 9955 
 9956   *) Add various utility functions to handle SPKACs, these were previously
 9957      handled by poking round in the structure internals. Added new function
 9958      NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
 9959      print, verify and generate SPKACs. Based on an original idea from
 9960      Massimiliano Pala <madwolf@comune.modena.it> but extensively modified.
 9961      [Steve Henson]
 9962 
 9963   *) RIPEMD160 is operational on all platforms and is back in 'make test'.
 9964      [Andy Polyakov]
 9965 
 9966   *) Allow the config file extension section to be overwritten on the
 9967      command line. Based on an original idea from Massimiliano Pala
 9968      <madwolf@comune.modena.it>. The new option is called -extensions
 9969      and can be applied to ca, req and x509. Also -reqexts to override
 9970      the request extensions in req and -crlexts to override the crl extensions
 9971      in ca.
 9972      [Steve Henson]
 9973 
 9974   *) Add new feature to the SPKAC handling in ca.  Now you can include
 9975      the same field multiple times by preceding it by "XXXX." for example:
 9976      1.OU="Unit name 1"
 9977      2.OU="Unit name 2"
 9978      this is the same syntax as used in the req config file.
 9979      [Steve Henson]
 9980 
 9981   *) Allow certificate extensions to be added to certificate requests. These
 9982      are specified in a 'req_extensions' option of the req section of the
 9983      config file. They can be printed out with the -text option to req but
 9984      are otherwise ignored at present.
 9985      [Steve Henson]
 9986 
 9987   *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first
 9988      data read consists of only the final block it would not decrypted because
 9989      EVP_CipherUpdate() would correctly report zero bytes had been decrypted.
 9990      A misplaced 'break' also meant the decrypted final block might not be
 9991      copied until the next read.
 9992      [Steve Henson]
 9993 
 9994   *) Initial support for DH_METHOD. Again based on RSA_METHOD. Also added
 9995      a few extra parameters to the DH structure: these will be useful if
 9996      for example we want the value of 'q' or implement X9.42 DH.
 9997      [Steve Henson]
 9998 
 9999   *) Initial support for DSA_METHOD. This is based on the RSA_METHOD and
10000      provides hooks that allow the default DSA functions or functions on a
10001      "per key" basis to be replaced. This allows hardware acceleration and
10002      hardware key storage to be handled without major modification to the
10003      library. Also added low level modexp hooks and CRYPTO_EX structure and 
10004      associated functions.
10005      [Steve Henson]
10006 
10007   *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
10008      as "read only": it can't be written to and the buffer it points to will
10009      not be freed. Reading from a read only BIO is much more efficient than
10010      a normal memory BIO. This was added because there are several times when
10011      an area of memory needs to be read from a BIO. The previous method was
10012      to create a memory BIO and write the data to it, this results in two
10013      copies of the data and an O(n^2) reading algorithm. There is a new
10014      function BIO_new_mem_buf() which creates a read only memory BIO from
10015      an area of memory. Also modified the PKCS#7 routines to use read only
10016      memory BIOs.
10017      [Steve Henson]
10018 
10019   *) Bugfix: ssl23_get_client_hello did not work properly when called in
10020      state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
10021      a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
10022      but a retry condition occured while trying to read the rest.
10023      [Bodo Moeller]
10024 
10025   *) The PKCS7_ENC_CONTENT_new() function was setting the content type as
10026      NID_pkcs7_encrypted by default: this was wrong since this should almost
10027      always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle
10028      the encrypted data type: this is a more sensible place to put it and it
10029      allows the PKCS#12 code to be tidied up that duplicated this
10030      functionality.
10031      [Steve Henson]
10032 
10033   *) Changed obj_dat.pl script so it takes its input and output files on
10034      the command line. This should avoid shell escape redirection problems
10035      under Win32.
10036      [Steve Henson]
10037 
10038   *) Initial support for certificate extension requests, these are included
10039      in things like Xenroll certificate requests. Included functions to allow
10040      extensions to be obtained and added.
10041      [Steve Henson]
10042 
10043   *) -crlf option to s_client and s_server for sending newlines as
10044      CRLF (as required by many protocols).
10045      [Bodo Moeller]
10046 
10047  Changes between 0.9.3a and 0.9.4  [09 Aug 1999]
10048   
10049   *) Install libRSAglue.a when OpenSSL is built with RSAref.
10050      [Ralf S. Engelschall]
10051 
10052   *) A few more ``#ifndef NO_FP_API / #endif'' pairs for consistency.
10053      [Andrija Antonijevic <TheAntony2@bigfoot.com>]
10054 
10055   *) Fix -startdate and -enddate (which was missing) arguments to 'ca'
10056      program.
10057      [Steve Henson]
10058 
10059   *) New function DSA_dup_DH, which duplicates DSA parameters/keys as
10060      DH parameters/keys (q is lost during that conversion, but the resulting
10061      DH parameters contain its length).
10062 
10063      For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is
10064      much faster than DH_generate_parameters (which creates parameters
10065      where p = 2*q + 1), and also the smaller q makes DH computations
10066      much more efficient (160-bit exponentiation instead of 1024-bit
10067      exponentiation); so this provides a convenient way to support DHE
10068      ciphersuites in SSL/TLS servers (see ssl/ssltest.c).  It is of
10069      utter importance to use
10070          SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
10071      or
10072          SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
10073      when such DH parameters are used, because otherwise small subgroup
10074      attacks may become possible!
10075      [Bodo Moeller]
10076 
10077   *) Avoid memory leak in i2d_DHparams.
10078      [Bodo Moeller]
10079 
10080   *) Allow the -k option to be used more than once in the enc program:
10081      this allows the same encrypted message to be read by multiple recipients.
10082      [Steve Henson]
10083 
10084   *) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts
10085      an ASN1_OBJECT to a text string. If the "no_name" parameter is set then
10086      it will always use the numerical form of the OID, even if it has a short
10087      or long name.
10088      [Steve Henson]
10089 
10090   *) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp
10091      method only got called if p,q,dmp1,dmq1,iqmp components were present,
10092      otherwise bn_mod_exp was called. In the case of hardware keys for example
10093      no private key components need be present and it might store extra data
10094      in the RSA structure, which cannot be accessed from bn_mod_exp.
10095      By setting RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for
10096      private key operations.
10097      [Steve Henson]
10098 
10099   *) Added support for SPARC Linux.
10100      [Andy Polyakov]
10101 
10102   *) pem_password_cb function type incompatibly changed from
10103           typedef int pem_password_cb(char *buf, int size, int rwflag);
10104      to
10105           ....(char *buf, int size, int rwflag, void *userdata);
10106      so that applications can pass data to their callbacks:
10107      The PEM[_ASN1]_{read,write}... functions and macros now take an
10108      additional void * argument, which is just handed through whenever
10109      the password callback is called.
10110      [Damien Miller <dmiller@ilogic.com.au>; tiny changes by Bodo Moeller]
10111 
10112      New function SSL_CTX_set_default_passwd_cb_userdata.
10113 
10114      Compatibility note: As many C implementations push function arguments
10115      onto the stack in reverse order, the new library version is likely to
10116      interoperate with programs that have been compiled with the old
10117      pem_password_cb definition (PEM_whatever takes some data that
10118      happens to be on the stack as its last argument, and the callback
10119      just ignores this garbage); but there is no guarantee whatsoever that
10120      this will work.
10121 
10122   *) The -DPLATFORM="\"$(PLATFORM)\"" definition and the similar -DCFLAGS=...
10123      (both in crypto/Makefile.ssl for use by crypto/cversion.c) caused
10124      problems not only on Windows, but also on some Unix platforms.
10125      To avoid problematic command lines, these definitions are now in an
10126      auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl
10127      for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds).
10128      [Bodo Moeller]
10129 
10130   *) MIPS III/IV assembler module is reimplemented.
10131      [Andy Polyakov]
10132 
10133   *) More DES library cleanups: remove references to srand/rand and
10134      delete an unused file.
10135      [Ulf Möller]
10136 
10137   *) Add support for the the free Netwide assembler (NASM) under Win32,
10138      since not many people have MASM (ml) and it can be hard to obtain.
10139      This is currently experimental but it seems to work OK and pass all
10140      the tests. Check out INSTALL.W32 for info.
10141      [Steve Henson]
10142 
10143   *) Fix memory leaks in s3_clnt.c: All non-anonymous SSL3/TLS1 connections
10144      without temporary keys kept an extra copy of the server key,
10145      and connections with temporary keys did not free everything in case
10146      of an error.
10147      [Bodo Moeller]
10148 
10149   *) New function RSA_check_key and new openssl rsa option -check
10150      for verifying the consistency of RSA keys.
10151      [Ulf Moeller, Bodo Moeller]
10152 
10153   *) Various changes to make Win32 compile work: 
10154      1. Casts to avoid "loss of data" warnings in p5_crpt2.c
10155      2. Change unsigned int to int in b_dump.c to avoid "signed/unsigned
10156         comparison" warnings.
10157      3. Add sk_<TYPE>_sort to DEF file generator and do make update.
10158      [Steve Henson]
10159 
10160   *) Add a debugging option to PKCS#5 v2 key generation function: when
10161      you #define DEBUG_PKCS5V2 passwords, salts, iteration counts and
10162      derived keys are printed to stderr.
10163      [Steve Henson]
10164 
10165   *) Copy the flags in ASN1_STRING_dup().
10166      [Roman E. Pavlov <pre@mo.msk.ru>]
10167 
10168   *) The x509 application mishandled signing requests containing DSA
10169      keys when the signing key was also DSA and the parameters didn't match.
10170 
10171      It was supposed to omit the parameters when they matched the signing key:
10172      the verifying software was then supposed to automatically use the CA's
10173      parameters if they were absent from the end user certificate.
10174 
10175      Omitting parameters is no longer recommended. The test was also
10176      the wrong way round! This was probably due to unusual behaviour in
10177      EVP_cmp_parameters() which returns 1 if the parameters match. 
10178      This meant that parameters were omitted when they *didn't* match and
10179      the certificate was useless. Certificates signed with 'ca' didn't have
10180      this bug.
10181      [Steve Henson, reported by Doug Erickson <Doug.Erickson@Part.NET>]
10182 
10183   *) Memory leak checking (-DCRYPTO_MDEBUG) had some problems.
10184      The interface is as follows:
10185      Applications can use
10186          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON) aka MemCheck_start(),
10187          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF) aka MemCheck_stop();
10188      "off" is now the default.
10189      The library internally uses
10190          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE) aka MemCheck_off(),
10191          CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE) aka MemCheck_on()
10192      to disable memory-checking temporarily.
10193 
10194      Some inconsistent states that previously were possible (and were
10195      even the default) are now avoided.
10196 
10197      -DCRYPTO_MDEBUG_TIME is new and additionally stores the current time
10198      with each memory chunk allocated; this is occasionally more helpful
10199      than just having a counter.
10200 
10201      -DCRYPTO_MDEBUG_THREAD is also new and adds the thread ID.
10202 
10203      -DCRYPTO_MDEBUG_ALL enables all of the above, plus any future
10204      extensions.
10205      [Bodo Moeller]
10206 
10207   *) Introduce "mode" for SSL structures (with defaults in SSL_CTX),
10208      which largely parallels "options", but is for changing API behaviour,
10209      whereas "options" are about protocol behaviour.
10210      Initial "mode" flags are:
10211 
10212      SSL_MODE_ENABLE_PARTIAL_WRITE   Allow SSL_write to report success when
10213                                      a single record has been written.
10214      SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER  Don't insist that SSL_write
10215                                      retries use the same buffer location.
10216                                      (But all of the contents must be
10217                                      copied!)
10218      [Bodo Moeller]
10219 
10220   *) Bugfix: SSL_set_options ignored its parameter, only SSL_CTX_set_options
10221      worked.
10222 
10223   *) Fix problems with no-hmac etc.
10224      [Ulf Möller, pointed out by Brian Wellington <bwelling@tislabs.com>]
10225 
10226   *) New functions RSA_get_default_method(), RSA_set_method() and
10227      RSA_get_method(). These allows replacement of RSA_METHODs without having
10228      to mess around with the internals of an RSA structure.
10229      [Steve Henson]
10230 
10231   *) Fix memory leaks in DSA_do_sign and DSA_is_prime.
10232      Also really enable memory leak checks in openssl.c and in some
10233      test programs.
10234      [Chad C. Mulligan, Bodo Moeller]
10235 
10236   *) Fix a bug in d2i_ASN1_INTEGER() and i2d_ASN1_INTEGER() which can mess
10237      up the length of negative integers. This has now been simplified to just
10238      store the length when it is first determined and use it later, rather
10239      than trying to keep track of where data is copied and updating it to
10240      point to the end.
10241      [Steve Henson, reported by Brien Wheeler
10242       <bwheeler@authentica-security.com>]
10243 
10244   *) Add a new function PKCS7_signatureVerify. This allows the verification
10245      of a PKCS#7 signature but with the signing certificate passed to the
10246      function itself. This contrasts with PKCS7_dataVerify which assumes the
10247      certificate is present in the PKCS#7 structure. This isn't always the
10248      case: certificates can be omitted from a PKCS#7 structure and be
10249      distributed by "out of band" means (such as a certificate database).
10250      [Steve Henson]
10251 
10252   *) Complete the PEM_* macros with DECLARE_PEM versions to replace the
10253      function prototypes in pem.h, also change util/mkdef.pl to add the
10254      necessary function names. 
10255      [Steve Henson]
10256 
10257   *) mk1mf.pl (used by Windows builds) did not properly read the
10258      options set by Configure in the top level Makefile, and Configure
10259      was not even able to write more than one option correctly.
10260      Fixed, now "no-idea no-rc5 -DCRYPTO_MDEBUG" etc. works as intended.
10261      [Bodo Moeller]
10262 
10263   *) New functions CONF_load_bio() and CONF_load_fp() to allow a config
10264      file to be loaded from a BIO or FILE pointer. The BIO version will
10265      for example allow memory BIOs to contain config info.
10266      [Steve Henson]
10267 
10268   *) New function "CRYPTO_num_locks" that returns CRYPTO_NUM_LOCKS.
10269      Whoever hopes to achieve shared-library compatibility across versions
10270      must use this, not the compile-time macro.
10271      (Exercise 0.9.4: Which is the minimum library version required by
10272      such programs?)
10273      Note: All this applies only to multi-threaded programs, others don't
10274      need locks.
10275      [Bodo Moeller]
10276 
10277   *) Add missing case to s3_clnt.c state machine -- one of the new SSL tests
10278      through a BIO pair triggered the default case, i.e.
10279      SSLerr(...,SSL_R_UNKNOWN_STATE).
10280      [Bodo Moeller]
10281 
10282   *) New "BIO pair" concept (crypto/bio/bss_bio.c) so that applications
10283      can use the SSL library even if none of the specific BIOs is
10284      appropriate.
10285      [Bodo Moeller]
10286 
10287   *) Fix a bug in i2d_DSAPublicKey() which meant it returned the wrong value
10288      for the encoded length.
10289      [Jeon KyoungHo <khjeon@sds.samsung.co.kr>]
10290 
10291   *) Add initial documentation of the X509V3 functions.
10292      [Steve Henson]
10293 
10294   *) Add a new pair of functions PEM_write_PKCS8PrivateKey() and 
10295      PEM_write_bio_PKCS8PrivateKey() that are equivalent to
10296      PEM_write_PrivateKey() and PEM_write_bio_PrivateKey() but use the more
10297      secure PKCS#8 private key format with a high iteration count.
10298      [Steve Henson]
10299 
10300   *) Fix determination of Perl interpreter: A perl or perl5
10301      _directory_ in $PATH was also accepted as the interpreter.
10302      [Ralf S. Engelschall]
10303 
10304   *) Fix demos/sign/sign.c: well there wasn't anything strictly speaking
10305      wrong with it but it was very old and did things like calling
10306      PEM_ASN1_read() directly and used MD5 for the hash not to mention some
10307      unusual formatting.
10308      [Steve Henson]
10309 
10310   *) Fix demos/selfsign.c: it used obsolete and deleted functions, changed
10311      to use the new extension code.
10312      [Steve Henson]
10313 
10314   *) Implement the PEM_read/PEM_write functions in crypto/pem/pem_all.c
10315      with macros. This should make it easier to change their form, add extra
10316      arguments etc. Fix a few PEM prototypes which didn't have cipher as a
10317      constant.
10318      [Steve Henson]
10319 
10320   *) Add to configuration table a new entry that can specify an alternative
10321      name for unistd.h (for pre-POSIX systems); we need this for NeXTstep,
10322      according to Mark Crispin <MRC@Panda.COM>.
10323      [Bodo Moeller]
10324 
10325 #if 0
10326   *) DES CBC did not update the IV. Weird.
10327      [Ben Laurie]
10328 #else
10329      des_cbc_encrypt does not update the IV, but des_ncbc_encrypt does.
10330      Changing the behaviour of the former might break existing programs --
10331      where IV updating is needed, des_ncbc_encrypt can be used.
10332 #endif
10333 
10334   *) When bntest is run from "make test" it drives bc to check its
10335      calculations, as well as internally checking them. If an internal check
10336      fails, it needs to cause bc to give a non-zero result or make test carries
10337      on without noticing the failure. Fixed.
10338      [Ben Laurie]
10339 
10340   *) DES library cleanups.
10341      [Ulf Möller]
10342 
10343   *) Add support for PKCS#5 v2.0 PBE algorithms. This will permit PKCS#8 to be
10344      used with any cipher unlike PKCS#5 v1.5 which can at most handle 64 bit
10345      ciphers. NOTE: although the key derivation function has been verified
10346      against some published test vectors it has not been extensively tested
10347      yet. Added a -v2 "cipher" option to pkcs8 application to allow the use
10348      of v2.0.
10349      [Steve Henson]
10350 
10351   *) Instead of "mkdir -p", which is not fully portable, use new
10352      Perl script "util/mkdir-p.pl".
10353      [Bodo Moeller]
10354 
10355   *) Rewrite the way password based encryption (PBE) is handled. It used to
10356      assume that the ASN1 AlgorithmIdentifier parameter was a PBEParameter
10357      structure. This was true for the PKCS#5 v1.5 and PKCS#12 PBE algorithms
10358      but doesn't apply to PKCS#5 v2.0 where it can be something else. Now
10359      the 'parameter' field of the AlgorithmIdentifier is passed to the
10360      underlying key generation function so it must do its own ASN1 parsing.
10361      This has also changed the EVP_PBE_CipherInit() function which now has a
10362      'parameter' argument instead of literal salt and iteration count values
10363      and the function EVP_PBE_ALGOR_CipherInit() has been deleted.
10364      [Steve Henson]
10365 
10366   *) Support for PKCS#5 v1.5 compatible password based encryption algorithms
10367      and PKCS#8 functionality. New 'pkcs8' application linked to openssl.
10368      Needed to change the PEM_STRING_EVP_PKEY value which was just "PRIVATE
10369      KEY" because this clashed with PKCS#8 unencrypted string. Since this
10370      value was just used as a "magic string" and not used directly its
10371      value doesn't matter.
10372      [Steve Henson]
10373 
10374   *) Introduce some semblance of const correctness to BN. Shame C doesn't
10375      support mutable.
10376      [Ben Laurie]
10377 
10378   *) "linux-sparc64" configuration (ultrapenguin).
10379      [Ray Miller <ray.miller@oucs.ox.ac.uk>]
10380      "linux-sparc" configuration.
10381      [Christian Forster <fo@hawo.stw.uni-erlangen.de>]
10382 
10383   *) config now generates no-xxx options for missing ciphers.
10384      [Ulf Möller]
10385 
10386   *) Support the EBCDIC character set (work in progress).
10387      File ebcdic.c not yet included because it has a different license.
10388      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
10389 
10390   *) Support BS2000/OSD-POSIX.
10391      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
10392 
10393   *) Make callbacks for key generation use void * instead of char *.
10394      [Ben Laurie]
10395 
10396   *) Make S/MIME samples compile (not yet tested).
10397      [Ben Laurie]
10398 
10399   *) Additional typesafe stacks.
10400      [Ben Laurie]
10401 
10402   *) New configuration variants "bsdi-elf-gcc" (BSD/OS 4.x).
10403      [Bodo Moeller]
10404 
10405 
10406  Changes between 0.9.3 and 0.9.3a  [29 May 1999]
10407 
10408   *) New configuration variant "sco5-gcc".
10409 
10410   *) Updated some demos.
10411      [Sean O Riordain, Wade Scholine]
10412 
10413   *) Add missing BIO_free at exit of pkcs12 application.
10414      [Wu Zhigang]
10415 
10416   *) Fix memory leak in conf.c.
10417      [Steve Henson]
10418 
10419   *) Updates for Win32 to assembler version of MD5.
10420      [Steve Henson]
10421 
10422   *) Set #! path to perl in apps/der_chop to where we found it
10423      instead of using a fixed path.
10424      [Bodo Moeller]
10425 
10426   *) SHA library changes for irix64-mips4-cc.
10427      [Andy Polyakov]
10428 
10429   *) Improvements for VMS support.
10430      [Richard Levitte]
10431 
10432 
10433  Changes between 0.9.2b and 0.9.3  [24 May 1999]
10434 
10435   *) Bignum library bug fix. IRIX 6 passes "make test" now!
10436      This also avoids the problems with SC4.2 and unpatched SC5.  
10437      [Andy Polyakov <appro@fy.chalmers.se>]
10438 
10439   *) New functions sk_num, sk_value and sk_set to replace the previous macros.
10440      These are required because of the typesafe stack would otherwise break 
10441      existing code. If old code used a structure member which used to be STACK
10442      and is now STACK_OF (for example cert in a PKCS7_SIGNED structure) with
10443      sk_num or sk_value it would produce an error because the num, data members
10444      are not present in STACK_OF. Now it just produces a warning. sk_set
10445      replaces the old method of assigning a value to sk_value
10446      (e.g. sk_value(x, i) = y) which the library used in a few cases. Any code
10447      that does this will no longer work (and should use sk_set instead) but
10448      this could be regarded as a "questionable" behaviour anyway.
10449      [Steve Henson]
10450 
10451   *) Fix most of the other PKCS#7 bugs. The "experimental" code can now
10452      correctly handle encrypted S/MIME data.
10453      [Steve Henson]
10454 
10455   *) Change type of various DES function arguments from des_cblock
10456      (which means, in function argument declarations, pointer to char)
10457      to des_cblock * (meaning pointer to array with 8 char elements),
10458      which allows the compiler to do more typechecking; it was like
10459      that back in SSLeay, but with lots of ugly casts.
10460 
10461      Introduce new type const_des_cblock.
10462      [Bodo Moeller]
10463 
10464   *) Reorganise the PKCS#7 library and get rid of some of the more obvious
10465      problems: find RecipientInfo structure that matches recipient certificate
10466      and initialise the ASN1 structures properly based on passed cipher.
10467      [Steve Henson]
10468 
10469   *) Belatedly make the BN tests actually check the results.
10470      [Ben Laurie]
10471 
10472   *) Fix the encoding and decoding of negative ASN1 INTEGERS and conversion
10473      to and from BNs: it was completely broken. New compilation option
10474      NEG_PUBKEY_BUG to allow for some broken certificates that encode public
10475      key elements as negative integers.
10476      [Steve Henson]
10477 
10478   *) Reorganize and speed up MD5.
10479      [Andy Polyakov <appro@fy.chalmers.se>]
10480 
10481   *) VMS support.
10482      [Richard Levitte <richard@levitte.org>]
10483 
10484   *) New option -out to asn1parse to allow the parsed structure to be
10485      output to a file. This is most useful when combined with the -strparse
10486      option to examine the output of things like OCTET STRINGS.
10487      [Steve Henson]
10488 
10489   *) Make SSL library a little more fool-proof by not requiring any longer
10490      that SSL_set_{accept,connect}_state be called before
10491      SSL_{accept,connect} may be used (SSL_set_..._state is omitted
10492      in many applications because usually everything *appeared* to work as
10493      intended anyway -- now it really works as intended).
10494      [Bodo Moeller]
10495 
10496   *) Move openssl.cnf out of lib/.
10497      [Ulf Möller]
10498 
10499   *) Fix various things to let OpenSSL even pass ``egcc -pipe -O2 -Wall
10500      -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes
10501      -Wmissing-declarations -Wnested-externs -Winline'' with EGCS 1.1.2+ 
10502      [Ralf S. Engelschall]
10503 
10504   *) Various fixes to the EVP and PKCS#7 code. It may now be able to
10505      handle PKCS#7 enveloped data properly.
10506      [Sebastian Akerman <sak@parallelconsulting.com>, modified by Steve]
10507 
10508   *) Create a duplicate of the SSL_CTX's CERT in SSL_new instead of
10509      copying pointers.  The cert_st handling is changed by this in
10510      various ways (and thus what used to be known as ctx->default_cert
10511      is now called ctx->cert, since we don't resort to s->ctx->[default_]cert
10512      any longer when s->cert does not give us what we need).
10513      ssl_cert_instantiate becomes obsolete by this change.
10514      As soon as we've got the new code right (possibly it already is?),
10515      we have solved a couple of bugs of the earlier code where s->cert
10516      was used as if it could not have been shared with other SSL structures.
10517 
10518      Note that using the SSL API in certain dirty ways now will result
10519      in different behaviour than observed with earlier library versions:
10520      Changing settings for an SSL_CTX *ctx after having done s = SSL_new(ctx)
10521      does not influence s as it used to.
10522      
10523      In order to clean up things more thoroughly, inside SSL_SESSION
10524      we don't use CERT any longer, but a new structure SESS_CERT
10525      that holds per-session data (if available); currently, this is
10526      the peer's certificate chain and, for clients, the server's certificate
10527      and temporary key.  CERT holds only those values that can have
10528      meaningful defaults in an SSL_CTX.
10529      [Bodo Moeller]
10530 
10531   *) New function X509V3_EXT_i2d() to create an X509_EXTENSION structure
10532      from the internal representation. Various PKCS#7 fixes: remove some
10533      evil casts and set the enc_dig_alg field properly based on the signing
10534      key type.
10535      [Steve Henson]
10536 
10537   *) Allow PKCS#12 password to be set from the command line or the
10538      environment. Let 'ca' get its config file name from the environment
10539      variables "OPENSSL_CONF" or "SSLEAY_CONF" (for consistency with 'req'
10540      and 'x509').
10541      [Steve Henson]
10542 
10543   *) Allow certificate policies extension to use an IA5STRING for the
10544      organization field. This is contrary to the PKIX definition but
10545      VeriSign uses it and IE5 only recognises this form. Document 'x509'
10546      extension option.
10547      [Steve Henson]
10548 
10549   *) Add PEDANTIC compiler flag to allow compilation with gcc -pedantic,
10550      without disallowing inline assembler and the like for non-pedantic builds.
10551      [Ben Laurie]
10552 
10553   *) Support Borland C++ builder.
10554      [Janez Jere <jj@void.si>, modified by Ulf Möller]
10555 
10556   *) Support Mingw32.
10557      [Ulf Möller]
10558 
10559   *) SHA-1 cleanups and performance enhancements.
10560      [Andy Polyakov <appro@fy.chalmers.se>]
10561 
10562   *) Sparc v8plus assembler for the bignum library.
10563      [Andy Polyakov <appro@fy.chalmers.se>]
10564 
10565   *) Accept any -xxx and +xxx compiler options in Configure.
10566      [Ulf Möller]
10567 
10568   *) Update HPUX configuration.
10569      [Anonymous]
10570   
10571   *) Add missing sk_<type>_unshift() function to safestack.h
10572      [Ralf S. Engelschall]
10573 
10574   *) New function SSL_CTX_use_certificate_chain_file that sets the
10575      "extra_cert"s in addition to the certificate.  (This makes sense
10576      only for "PEM" format files, as chains as a whole are not
10577      DER-encoded.)
10578      [Bodo Moeller]
10579 
10580   *) Support verify_depth from the SSL API.
10581      x509_vfy.c had what can be considered an off-by-one-error:
10582      Its depth (which was not part of the external interface)
10583      was actually counting the number of certificates in a chain;
10584      now it really counts the depth.
10585      [Bodo Moeller]
10586 
10587   *) Bugfix in crypto/x509/x509_cmp.c: The SSLerr macro was used
10588      instead of X509err, which often resulted in confusing error
10589      messages since the error codes are not globally unique
10590      (e.g. an alleged error in ssl3_accept when a certificate
10591      didn't match the private key).
10592 
10593   *) New function SSL_CTX_set_session_id_context that allows to set a default
10594      value (so that you don't need SSL_set_session_id_context for each
10595      connection using the SSL_CTX).
10596      [Bodo Moeller]
10597 
10598   *) OAEP decoding bug fix.
10599      [Ulf Möller]
10600 
10601   *) Support INSTALL_PREFIX for package builders, as proposed by
10602      David Harris.
10603      [Bodo Moeller]
10604 
10605   *) New Configure options "threads" and "no-threads".  For systems
10606      where the proper compiler options are known (currently Solaris
10607      and Linux), "threads" is the default.
10608      [Bodo Moeller]
10609 
10610   *) New script util/mklink.pl as a faster substitute for util/mklink.sh.
10611      [Bodo Moeller]
10612 
10613   *) Install various scripts to $(OPENSSLDIR)/misc, not to
10614      $(INSTALLTOP)/bin -- they shouldn't clutter directories
10615      such as /usr/local/bin.
10616      [Bodo Moeller]
10617 
10618   *) "make linux-shared" to build shared libraries.
10619      [Niels Poppe <niels@netbox.org>]
10620 
10621   *) New Configure option no-<cipher> (rsa, idea, rc5, ...).
10622      [Ulf Möller]
10623 
10624   *) Add the PKCS#12 API documentation to openssl.txt. Preliminary support for
10625      extension adding in x509 utility.
10626      [Steve Henson]
10627 
10628   *) Remove NOPROTO sections and error code comments.
10629      [Ulf Möller]
10630 
10631   *) Partial rewrite of the DEF file generator to now parse the ANSI
10632      prototypes.
10633      [Steve Henson]
10634 
10635   *) New Configure options --prefix=DIR and --openssldir=DIR.
10636      [Ulf Möller]
10637 
10638   *) Complete rewrite of the error code script(s). It is all now handled
10639      by one script at the top level which handles error code gathering,
10640      header rewriting and C source file generation. It should be much better
10641      than the old method: it now uses a modified version of Ulf's parser to
10642      read the ANSI prototypes in all header files (thus the old K&R definitions
10643      aren't needed for error creation any more) and do a better job of
10644      translating function codes into names. The old 'ASN1 error code imbedded
10645      in a comment' is no longer necessary and it doesn't use .err files which
10646      have now been deleted. Also the error code call doesn't have to appear all
10647      on one line (which resulted in some large lines...).
10648      [Steve Henson]
10649 
10650   *) Change #include filenames from <foo.h> to <openssl/foo.h>.
10651      [Bodo Moeller]
10652 
10653   *) Change behaviour of ssl2_read when facing length-0 packets: Don't return
10654      0 (which usually indicates a closed connection), but continue reading.
10655      [Bodo Moeller]
10656 
10657   *) Fix some race conditions.
10658      [Bodo Moeller]
10659 
10660   *) Add support for CRL distribution points extension. Add Certificate
10661      Policies and CRL distribution points documentation.
10662      [Steve Henson]
10663 
10664   *) Move the autogenerated header file parts to crypto/opensslconf.h.
10665      [Ulf Möller]
10666 
10667   *) Fix new 56-bit DES export ciphersuites: they were using 7 bytes instead of
10668      8 of keying material. Merlin has also confirmed interop with this fix
10669      between OpenSSL and Baltimore C/SSL 2.0 and J/SSL 2.0.
10670      [Merlin Hughes <merlin@baltimore.ie>]
10671 
10672   *) Fix lots of warnings.
10673      [Richard Levitte <levitte@stacken.kth.se>]
10674  
10675   *) In add_cert_dir() in crypto/x509/by_dir.c, break out of the loop if
10676      the directory spec didn't end with a LIST_SEPARATOR_CHAR.
10677      [Richard Levitte <levitte@stacken.kth.se>]
10678  
10679   *) Fix problems with sizeof(long) == 8.
10680      [Andy Polyakov <appro@fy.chalmers.se>]
10681 
10682   *) Change functions to ANSI C.
10683      [Ulf Möller]
10684 
10685   *) Fix typos in error codes.
10686      [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>, Ulf Möller]
10687 
10688   *) Remove defunct assembler files from Configure.
10689      [Ulf Möller]
10690 
10691   *) SPARC v8 assembler BIGNUM implementation.
10692      [Andy Polyakov <appro@fy.chalmers.se>]
10693 
10694   *) Support for Certificate Policies extension: both print and set.
10695      Various additions to support the r2i method this uses.
10696      [Steve Henson]
10697 
10698   *) A lot of constification, and fix a bug in X509_NAME_oneline() that could
10699      return a const string when you are expecting an allocated buffer.
10700      [Ben Laurie]
10701 
10702   *) Add support for ASN1 types UTF8String and VISIBLESTRING, also the CHOICE
10703      types DirectoryString and DisplayText.
10704      [Steve Henson]
10705 
10706   *) Add code to allow r2i extensions to access the configuration database,
10707      add an LHASH database driver and add several ctx helper functions.
10708      [Steve Henson]
10709 
10710   *) Fix an evil bug in bn_expand2() which caused various BN functions to
10711      fail when they extended the size of a BIGNUM.
10712      [Steve Henson]
10713 
10714   *) Various utility functions to handle SXNet extension. Modify mkdef.pl to
10715      support typesafe stack.
10716      [Steve Henson]
10717 
10718   *) Fix typo in SSL_[gs]et_options().
10719      [Nils Frostberg <nils@medcom.se>]
10720 
10721   *) Delete various functions and files that belonged to the (now obsolete)
10722      old X509V3 handling code.
10723      [Steve Henson]
10724 
10725   *) New Configure option "rsaref".
10726      [Ulf Möller]
10727 
10728   *) Don't auto-generate pem.h.
10729      [Bodo Moeller]
10730 
10731   *) Introduce type-safe ASN.1 SETs.
10732      [Ben Laurie]
10733 
10734   *) Convert various additional casted stacks to type-safe STACK_OF() variants.
10735      [Ben Laurie, Ralf S. Engelschall, Steve Henson]
10736 
10737   *) Introduce type-safe STACKs. This will almost certainly break lots of code
10738      that links with OpenSSL (well at least cause lots of warnings), but fear
10739      not: the conversion is trivial, and it eliminates loads of evil casts. A
10740      few STACKed things have been converted already. Feel free to convert more.
10741      In the fullness of time, I'll do away with the STACK type altogether.
10742      [Ben Laurie]
10743 
10744   *) Add `openssl ca -revoke <certfile>' facility which revokes a certificate
10745      specified in <certfile> by updating the entry in the index.txt file.
10746      This way one no longer has to edit the index.txt file manually for
10747      revoking a certificate. The -revoke option does the gory details now.
10748      [Massimiliano Pala <madwolf@openca.org>, Ralf S. Engelschall]
10749 
10750   *) Fix `openssl crl -noout -text' combination where `-noout' killed the
10751      `-text' option at all and this way the `-noout -text' combination was
10752      inconsistent in `openssl crl' with the friends in `openssl x509|rsa|dsa'.
10753      [Ralf S. Engelschall]
10754 
10755   *) Make sure a corresponding plain text error message exists for the
10756      X509_V_ERR_CERT_REVOKED/23 error number which can occur when a
10757      verify callback function determined that a certificate was revoked.
10758      [Ralf S. Engelschall]
10759 
10760   *) Bugfix: In test/testenc, don't test "openssl <cipher>" for
10761      ciphers that were excluded, e.g. by -DNO_IDEA.  Also, test
10762      all available cipers including rc5, which was forgotten until now.
10763      In order to let the testing shell script know which algorithms
10764      are available, a new (up to now undocumented) command
10765      "openssl list-cipher-commands" is used.
10766      [Bodo Moeller]
10767 
10768   *) Bugfix: s_client occasionally would sleep in select() when
10769      it should have checked SSL_pending() first.
10770      [Bodo Moeller]
10771 
10772   *) New functions DSA_do_sign and DSA_do_verify to provide access to
10773      the raw DSA values prior to ASN.1 encoding.
10774      [Ulf Möller]
10775 
10776   *) Tweaks to Configure
10777      [Niels Poppe <niels@netbox.org>]
10778 
10779   *) Add support for PKCS#5 v2.0 ASN1 PBES2 structures. No other support,
10780      yet...
10781      [Steve Henson]
10782 
10783   *) New variables $(RANLIB) and $(PERL) in the Makefiles.
10784      [Ulf Möller]
10785 
10786   *) New config option to avoid instructions that are illegal on the 80386.
10787      The default code is faster, but requires at least a 486.
10788      [Ulf Möller]
10789   
10790   *) Got rid of old SSL2_CLIENT_VERSION (inconsistently used) and
10791      SSL2_SERVER_VERSION (not used at all) macros, which are now the
10792      same as SSL2_VERSION anyway.
10793      [Bodo Moeller]
10794 
10795   *) New "-showcerts" option for s_client.
10796      [Bodo Moeller]
10797 
10798   *) Still more PKCS#12 integration. Add pkcs12 application to openssl
10799      application. Various cleanups and fixes.
10800      [Steve Henson]
10801 
10802   *) More PKCS#12 integration. Add new pkcs12 directory with Makefile.ssl and
10803      modify error routines to work internally. Add error codes and PBE init
10804      to library startup routines.
10805      [Steve Henson]
10806 
10807   *) Further PKCS#12 integration. Added password based encryption, PKCS#8 and
10808      packing functions to asn1 and evp. Changed function names and error
10809      codes along the way.
10810      [Steve Henson]
10811 
10812   *) PKCS12 integration: and so it begins... First of several patches to
10813      slowly integrate PKCS#12 functionality into OpenSSL. Add PKCS#12
10814      objects to objects.h
10815      [Steve Henson]
10816 
10817   *) Add a new 'indent' option to some X509V3 extension code. Initial ASN1
10818      and display support for Thawte strong extranet extension.
10819      [Steve Henson]
10820 
10821   *) Add LinuxPPC support.
10822      [Jeff Dubrule <igor@pobox.org>]
10823 
10824   *) Get rid of redundant BN file bn_mulw.c, and rename bn_div64 to
10825      bn_div_words in alpha.s.
10826      [Hannes Reinecke <H.Reinecke@hw.ac.uk> and Ben Laurie]
10827 
10828   *) Make sure the RSA OAEP test is skipped under -DRSAref because
10829      OAEP isn't supported when OpenSSL is built with RSAref.
10830      [Ulf Moeller <ulf@fitug.de>]
10831 
10832   *) Move definitions of IS_SET/IS_SEQUENCE inside crypto/asn1/asn1.h 
10833      so they no longer are missing under -DNOPROTO. 
10834      [Soren S. Jorvang <soren@t.dk>]
10835 
10836 
10837  Changes between 0.9.1c and 0.9.2b  [22 Mar 1999]
10838 
10839   *) Make SSL_get_peer_cert_chain() work in servers. Unfortunately, it still
10840      doesn't work when the session is reused. Coming soon!
10841      [Ben Laurie]
10842 
10843   *) Fix a security hole, that allows sessions to be reused in the wrong
10844      context thus bypassing client cert protection! All software that uses
10845      client certs and session caches in multiple contexts NEEDS PATCHING to
10846      allow session reuse! A fuller solution is in the works.
10847      [Ben Laurie, problem pointed out by Holger Reif, Bodo Moeller (and ???)]
10848 
10849   *) Some more source tree cleanups (removed obsolete files
10850      crypto/bf/asm/bf586.pl, test/test.txt and crypto/sha/asm/f.s; changed
10851      permission on "config" script to be executable) and a fix for the INSTALL
10852      document.
10853      [Ulf Moeller <ulf@fitug.de>]
10854 
10855   *) Remove some legacy and erroneous uses of malloc, free instead of
10856      Malloc, Free.
10857      [Lennart Bang <lob@netstream.se>, with minor changes by Steve]
10858 
10859   *) Make rsa_oaep_test return non-zero on error.
10860      [Ulf Moeller <ulf@fitug.de>]
10861 
10862   *) Add support for native Solaris shared libraries. Configure
10863      solaris-sparc-sc4-pic, make, then run shlib/solaris-sc4.sh. It'd be nice
10864      if someone would make that last step automatic.
10865      [Matthias Loepfe <Matthias.Loepfe@AdNovum.CH>]
10866 
10867   *) ctx_size was not built with the right compiler during "make links". Fixed.
10868      [Ben Laurie]
10869 
10870   *) Change the meaning of 'ALL' in the cipher list. It now means "everything
10871      except NULL ciphers". This means the default cipher list will no longer
10872      enable NULL ciphers. They need to be specifically enabled e.g. with
10873      the string "DEFAULT:eNULL".
10874      [Steve Henson]
10875 
10876   *) Fix to RSA private encryption routines: if p < q then it would
10877      occasionally produce an invalid result. This will only happen with
10878      externally generated keys because OpenSSL (and SSLeay) ensure p > q.
10879      [Steve Henson]
10880 
10881   *) Be less restrictive and allow also `perl util/perlpath.pl
10882      /path/to/bin/perl' in addition to `perl util/perlpath.pl /path/to/bin',
10883      because this way one can also use an interpreter named `perl5' (which is
10884      usually the name of Perl 5.xxx on platforms where an Perl 4.x is still
10885      installed as `perl').
10886      [Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
10887 
10888   *) Let util/clean-depend.pl work also with older Perl 5.00x versions.
10889      [Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
10890 
10891   *) Fix Makefile.org so CC,CFLAG etc are passed to 'make links' add
10892      advapi32.lib to Win32 build and change the pem test comparision
10893      to fc.exe (thanks to Ulrich Kroener <kroneru@yahoo.com> for the
10894      suggestion). Fix misplaced ASNI prototypes and declarations in evp.h
10895      and crypto/des/ede_cbcm_enc.c.
10896      [Steve Henson]
10897 
10898   *) DES quad checksum was broken on big-endian architectures. Fixed.
10899      [Ben Laurie]
10900 
10901   *) Comment out two functions in bio.h that aren't implemented. Fix up the
10902      Win32 test batch file so it (might) work again. The Win32 test batch file
10903      is horrible: I feel ill....
10904      [Steve Henson]
10905 
10906   *) Move various #ifdefs around so NO_SYSLOG, NO_DIRENT etc are now selected
10907      in e_os.h. Audit of header files to check ANSI and non ANSI
10908      sections: 10 functions were absent from non ANSI section and not exported
10909      from Windows DLLs. Fixed up libeay.num for new functions.
10910      [Steve Henson]
10911 
10912   *) Make `openssl version' output lines consistent.
10913      [Ralf S. Engelschall]
10914 
10915   *) Fix Win32 symbol export lists for BIO functions: Added
10916      BIO_get_ex_new_index, BIO_get_ex_num, BIO_get_ex_data and BIO_set_ex_data
10917      to ms/libeay{16,32}.def.
10918      [Ralf S. Engelschall]
10919 
10920   *) Second round of fixing the OpenSSL perl/ stuff. It now at least compiled
10921      fine under Unix and passes some trivial tests I've now added. But the
10922      whole stuff is horribly incomplete, so a README.1ST with a disclaimer was
10923      added to make sure no one expects that this stuff really works in the
10924      OpenSSL 0.9.2 release.  Additionally I've started to clean the XS sources
10925      up and fixed a few little bugs and inconsistencies in OpenSSL.{pm,xs} and
10926      openssl_bio.xs.
10927      [Ralf S. Engelschall]
10928 
10929   *) Fix the generation of two part addresses in perl.
10930      [Kenji Miyake <kenji@miyake.org>, integrated by Ben Laurie]
10931 
10932   *) Add config entry for Linux on MIPS.
10933      [John Tobey <jtobey@channel1.com>]
10934 
10935   *) Make links whenever Configure is run, unless we are on Windoze.
10936      [Ben Laurie]
10937 
10938   *) Permit extensions to be added to CRLs using crl_section in openssl.cnf.
10939      Currently only issuerAltName and AuthorityKeyIdentifier make any sense
10940      in CRLs.
10941      [Steve Henson]
10942 
10943   *) Add a useful kludge to allow package maintainers to specify compiler and
10944      other platforms details on the command line without having to patch the
10945      Configure script everytime: One now can use ``perl Configure
10946      <id>:<details>'', i.e. platform ids are allowed to have details appended
10947      to them (seperated by colons). This is treated as there would be a static
10948      pre-configured entry in Configure's %table under key <id> with value
10949      <details> and ``perl Configure <id>'' is called.  So, when you want to
10950      perform a quick test-compile under FreeBSD 3.1 with pgcc and without
10951      assembler stuff you can use ``perl Configure "FreeBSD-elf:pgcc:-O6:::"''
10952      now, which overrides the FreeBSD-elf entry on-the-fly.
10953      [Ralf S. Engelschall]
10954 
10955   *) Disable new TLS1 ciphersuites by default: they aren't official yet.
10956      [Ben Laurie]
10957 
10958   *) Allow DSO flags like -fpic, -fPIC, -KPIC etc. to be specified
10959      on the `perl Configure ...' command line. This way one can compile
10960      OpenSSL libraries with Position Independent Code (PIC) which is needed
10961      for linking it into DSOs.
10962      [Ralf S. Engelschall]
10963 
10964   *) Remarkably, export ciphers were totally broken and no-one had noticed!
10965      Fixed.
10966      [Ben Laurie]
10967 
10968   *) Cleaned up the LICENSE document: The official contact for any license
10969      questions now is the OpenSSL core team under openssl-core@openssl.org.
10970      And add a paragraph about the dual-license situation to make sure people
10971      recognize that _BOTH_ the OpenSSL license _AND_ the SSLeay license apply
10972      to the OpenSSL toolkit.
10973      [Ralf S. Engelschall]
10974 
10975   *) General source tree makefile cleanups: Made `making xxx in yyy...'
10976      display consistent in the source tree and replaced `/bin/rm' by `rm'.
10977      Additonally cleaned up the `make links' target: Remove unnecessary
10978      semicolons, subsequent redundant removes, inline point.sh into mklink.sh
10979      to speed processing and no longer clutter the display with confusing
10980      stuff. Instead only the actually done links are displayed.
10981      [Ralf S. Engelschall]
10982 
10983   *) Permit null encryption ciphersuites, used for authentication only. It used
10984      to be necessary to set the preprocessor define SSL_ALLOW_ENULL to do this.
10985      It is now necessary to set SSL_FORBID_ENULL to prevent the use of null
10986      encryption.
10987      [Ben Laurie]
10988 
10989   *) Add a bunch of fixes to the PKCS#7 stuff. It used to sometimes reorder
10990      signed attributes when verifying signatures (this would break them), 
10991      the detached data encoding was wrong and public keys obtained using
10992      X509_get_pubkey() weren't freed.
10993      [Steve Henson]
10994 
10995   *) Add text documentation for the BUFFER functions. Also added a work around
10996      to a Win95 console bug. This was triggered by the password read stuff: the
10997      last character typed gets carried over to the next fread(). If you were 
10998      generating a new cert request using 'req' for example then the last
10999      character of the passphrase would be CR which would then enter the first
11000      field as blank.
11001      [Steve Henson]
11002 
11003   *) Added the new `Includes OpenSSL Cryptography Software' button as
11004      doc/openssl_button.{gif,html} which is similar in style to the old SSLeay
11005      button and can be used by applications based on OpenSSL to show the
11006      relationship to the OpenSSL project.  
11007      [Ralf S. Engelschall]
11008 
11009   *) Remove confusing variables in function signatures in files
11010      ssl/ssl_lib.c and ssl/ssl.h.
11011      [Lennart Bong <lob@kulthea.stacken.kth.se>]
11012 
11013   *) Don't install bss_file.c under PREFIX/include/
11014      [Lennart Bong <lob@kulthea.stacken.kth.se>]
11015 
11016   *) Get the Win32 compile working again. Modify mkdef.pl so it can handle
11017      functions that return function pointers and has support for NT specific
11018      stuff. Fix mk1mf.pl and VC-32.pl to support NT differences also. Various
11019      #ifdef WIN32 and WINNTs sprinkled about the place and some changes from
11020      unsigned to signed types: this was killing the Win32 compile.
11021      [Steve Henson]
11022 
11023   *) Add new certificate file to stack functions,
11024      SSL_add_dir_cert_subjects_to_stack() and
11025      SSL_add_file_cert_subjects_to_stack().  These largely supplant
11026      SSL_load_client_CA_file(), and can be used to add multiple certs easily
11027      to a stack (usually this is then handed to SSL_CTX_set_client_CA_list()).
11028      This means that Apache-SSL and similar packages don't have to mess around
11029      to add as many CAs as they want to the preferred list.
11030      [Ben Laurie]
11031 
11032   *) Experiment with doxygen documentation. Currently only partially applied to
11033      ssl/ssl_lib.c.
11034      See http://www.stack.nl/~dimitri/doxygen/index.html, and run doxygen with
11035      openssl.doxy as the configuration file.
11036      [Ben Laurie]
11037   
11038   *) Get rid of remaining C++-style comments which strict C compilers hate.
11039      [Ralf S. Engelschall, pointed out by Carlos Amengual]
11040 
11041   *) Changed BN_RECURSION in bn_mont.c to BN_RECURSION_MONT so it is not
11042      compiled in by default: it has problems with large keys.
11043      [Steve Henson]
11044 
11045   *) Add a bunch of SSL_xxx() functions for configuring the temporary RSA and
11046      DH private keys and/or callback functions which directly correspond to
11047      their SSL_CTX_xxx() counterparts but work on a per-connection basis. This
11048      is needed for applications which have to configure certificates on a
11049      per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis
11050      (e.g. s_server). 
11051         For the RSA certificate situation is makes no difference, but
11052      for the DSA certificate situation this fixes the "no shared cipher"
11053      problem where the OpenSSL cipher selection procedure failed because the
11054      temporary keys were not overtaken from the context and the API provided
11055      no way to reconfigure them. 
11056         The new functions now let applications reconfigure the stuff and they
11057      are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh,
11058      SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback.  Additionally a new
11059      non-public-API function ssl_cert_instantiate() is used as a helper
11060      function and also to reduce code redundancy inside ssl_rsa.c.
11061      [Ralf S. Engelschall]
11062 
11063   *) Move s_server -dcert and -dkey options out of the undocumented feature
11064      area because they are useful for the DSA situation and should be
11065      recognized by the users.
11066      [Ralf S. Engelschall]
11067 
11068   *) Fix the cipher decision scheme for export ciphers: the export bits are
11069      *not* within SSL_MKEY_MASK or SSL_AUTH_MASK, they are within
11070      SSL_EXP_MASK.  So, the original variable has to be used instead of the
11071      already masked variable.
11072      [Richard Levitte <levitte@stacken.kth.se>]
11073 
11074   *) Fix 'port' variable from `int' to `unsigned int' in crypto/bio/b_sock.c
11075      [Richard Levitte <levitte@stacken.kth.se>]
11076 
11077   *) Change type of another md_len variable in pk7_doit.c:PKCS7_dataFinal()
11078      from `int' to `unsigned int' because it's a length and initialized by
11079      EVP_DigestFinal() which expects an `unsigned int *'.
11080      [Richard Levitte <levitte@stacken.kth.se>]
11081 
11082   *) Don't hard-code path to Perl interpreter on shebang line of Configure
11083      script. Instead use the usual Shell->Perl transition trick.
11084      [Ralf S. Engelschall]
11085 
11086   *) Make `openssl x509 -noout -modulus' functional also for DSA certificates
11087      (in addition to RSA certificates) to match the behaviour of `openssl dsa
11088      -noout -modulus' as it's already the case for `openssl rsa -noout
11089      -modulus'.  For RSA the -modulus is the real "modulus" while for DSA
11090      currently the public key is printed (a decision which was already done by
11091      `openssl dsa -modulus' in the past) which serves a similar purpose.
11092      Additionally the NO_RSA no longer completely removes the whole -modulus
11093      option; it now only avoids using the RSA stuff. Same applies to NO_DSA
11094      now, too.
11095      [Ralf S.  Engelschall]
11096 
11097   *) Add Arne Ansper's reliable BIO - this is an encrypted, block-digested
11098      BIO. See the source (crypto/evp/bio_ok.c) for more info.
11099      [Arne Ansper <arne@ats.cyber.ee>]
11100 
11101   *) Dump the old yucky req code that tried (and failed) to allow raw OIDs
11102      to be added. Now both 'req' and 'ca' can use new objects defined in the
11103      config file.
11104      [Steve Henson]
11105 
11106   *) Add cool BIO that does syslog (or event log on NT).
11107      [Arne Ansper <arne@ats.cyber.ee>, integrated by Ben Laurie]
11108 
11109   *) Add support for new TLS ciphersuites, TLS_RSA_EXPORT56_WITH_RC4_56_MD5,
11110      TLS_RSA_EXPORT56_WITH_RC2_CBC_56_MD5 and
11111      TLS_RSA_EXPORT56_WITH_DES_CBC_SHA, as specified in "56-bit Export Cipher
11112      Suites For TLS", draft-ietf-tls-56-bit-ciphersuites-00.txt.
11113      [Ben Laurie]
11114 
11115   *) Add preliminary config info for new extension code.
11116      [Steve Henson]
11117 
11118   *) Make RSA_NO_PADDING really use no padding.
11119      [Ulf Moeller <ulf@fitug.de>]
11120 
11121   *) Generate errors when private/public key check is done.
11122      [Ben Laurie]
11123 
11124   *) Overhaul for 'crl' utility. New function X509_CRL_print. Partial support
11125      for some CRL extensions and new objects added.
11126      [Steve Henson]
11127 
11128   *) Really fix the ASN1 IMPLICIT bug this time... Partial support for private
11129      key usage extension and fuller support for authority key id.
11130      [Steve Henson]
11131 
11132   *) Add OAEP encryption for the OpenSSL crypto library. OAEP is the improved
11133      padding method for RSA, which is recommended for new applications in PKCS
11134      #1 v2.0 (RFC 2437, October 1998).
11135      OAEP (Optimal Asymmetric Encryption Padding) has better theoretical
11136      foundations than the ad-hoc padding used in PKCS #1 v1.5. It is secure
11137      against Bleichbacher's attack on RSA.
11138      [Ulf Moeller <ulf@fitug.de>, reformatted, corrected and integrated by
11139       Ben Laurie]
11140 
11141   *) Updates to the new SSL compression code
11142      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
11143 
11144   *) Fix so that the version number in the master secret, when passed
11145      via RSA, checks that if TLS was proposed, but we roll back to SSLv3
11146      (because the server will not accept higher), that the version number
11147      is 0x03,0x01, not 0x03,0x00
11148      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
11149 
11150   *) Run extensive memory leak checks on SSL apps. Fixed *lots* of memory
11151      leaks in ssl/ relating to new X509_get_pubkey() behaviour. Also fixes
11152      in apps/ and an unrelated leak in crypto/dsa/dsa_vrf.c
11153      [Steve Henson]
11154 
11155   *) Support for RAW extensions where an arbitrary extension can be
11156      created by including its DER encoding. See apps/openssl.cnf for
11157      an example.
11158      [Steve Henson]
11159 
11160   *) Make sure latest Perl versions don't interpret some generated C array
11161      code as Perl array code in the crypto/err/err_genc.pl script.
11162      [Lars Weber <3weber@informatik.uni-hamburg.de>]
11163 
11164   *) Modify ms/do_ms.bat to not generate assembly language makefiles since
11165      not many people have the assembler. Various Win32 compilation fixes and
11166      update to the INSTALL.W32 file with (hopefully) more accurate Win32
11167      build instructions.
11168      [Steve Henson]
11169 
11170   *) Modify configure script 'Configure' to automatically create crypto/date.h
11171      file under Win32 and also build pem.h from pem.org. New script
11172      util/mkfiles.pl to create the MINFO file on environments that can't do a
11173      'make files': perl util/mkfiles.pl >MINFO should work.
11174      [Steve Henson]
11175 
11176   *) Major rework of DES function declarations, in the pursuit of correctness
11177      and purity. As a result, many evil casts evaporated, and some weirdness,
11178      too. You may find this causes warnings in your code. Zapping your evil
11179      casts will probably fix them. Mostly.
11180      [Ben Laurie]
11181 
11182   *) Fix for a typo in asn1.h. Bug fix to object creation script
11183      obj_dat.pl. It considered a zero in an object definition to mean
11184      "end of object": none of the objects in objects.h have any zeros
11185      so it wasn't spotted.
11186      [Steve Henson, reported by Erwann ABALEA <eabalea@certplus.com>]
11187 
11188   *) Add support for Triple DES Cipher Block Chaining with Output Feedback
11189      Masking (CBCM). In the absence of test vectors, the best I have been able
11190      to do is check that the decrypt undoes the encrypt, so far. Send me test
11191      vectors if you have them.
11192      [Ben Laurie]
11193 
11194   *) Correct calculation of key length for export ciphers (too much space was
11195      allocated for null ciphers). This has not been tested!
11196      [Ben Laurie]
11197 
11198   *) Modifications to the mkdef.pl for Win32 DEF file creation. The usage
11199      message is now correct (it understands "crypto" and "ssl" on its
11200      command line). There is also now an "update" option. This will update
11201      the util/ssleay.num and util/libeay.num files with any new functions.
11202      If you do a: 
11203      perl util/mkdef.pl crypto ssl update
11204      it will update them.
11205      [Steve Henson]
11206 
11207   *) Overhauled the Perl interface (perl/*):
11208      - ported BN stuff to OpenSSL's different BN library
11209      - made the perl/ source tree CVS-aware
11210      - renamed the package from SSLeay to OpenSSL (the files still contain
11211        their history because I've copied them in the repository)
11212      - removed obsolete files (the test scripts will be replaced
11213        by better Test::Harness variants in the future)
11214      [Ralf S. Engelschall]
11215 
11216   *) First cut for a very conservative source tree cleanup:
11217      1. merge various obsolete readme texts into doc/ssleay.txt
11218      where we collect the old documents and readme texts.
11219      2. remove the first part of files where I'm already sure that we no
11220      longer need them because of three reasons: either they are just temporary
11221      files which were left by Eric or they are preserved original files where
11222      I've verified that the diff is also available in the CVS via "cvs diff
11223      -rSSLeay_0_8_1b" or they were renamed (as it was definitely the case for
11224      the crypto/md/ stuff).
11225      [Ralf S. Engelschall]
11226 
11227   *) More extension code. Incomplete support for subject and issuer alt
11228      name, issuer and authority key id. Change the i2v function parameters
11229      and add an extra 'crl' parameter in the X509V3_CTX structure: guess
11230      what that's for :-) Fix to ASN1 macro which messed up
11231      IMPLICIT tag and add f_enum.c which adds a2i, i2a for ENUMERATED.
11232      [Steve Henson]
11233 
11234   *) Preliminary support for ENUMERATED type. This is largely copied from the
11235      INTEGER code.
11236      [Steve Henson]
11237 
11238   *) Add new function, EVP_MD_CTX_copy() to replace frequent use of memcpy.
11239      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
11240 
11241   *) Make sure `make rehash' target really finds the `openssl' program.
11242      [Ralf S. Engelschall, Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
11243 
11244   *) Squeeze another 7% of speed out of MD5 assembler, at least on a P2. I'd
11245      like to hear about it if this slows down other processors.
11246      [Ben Laurie]
11247 
11248   *) Add CygWin32 platform information to Configure script.
11249      [Alan Batie <batie@aahz.jf.intel.com>]
11250 
11251   *) Fixed ms/32all.bat script: `no_asm' -> `no-asm'
11252      [Rainer W. Gerling <gerling@mpg-gv.mpg.de>]
11253   
11254   *) New program nseq to manipulate netscape certificate sequences
11255      [Steve Henson]
11256 
11257   *) Modify crl2pkcs7 so it supports multiple -certfile arguments. Fix a
11258      few typos.
11259      [Steve Henson]
11260 
11261   *) Fixes to BN code.  Previously the default was to define BN_RECURSION
11262      but the BN code had some problems that would cause failures when
11263      doing certificate verification and some other functions.
11264      [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
11265 
11266   *) Add ASN1 and PEM code to support netscape certificate sequences.
11267      [Steve Henson]
11268 
11269   *) Add ASN1 and PEM code to support netscape certificate sequences.
11270      [Steve Henson]
11271 
11272   *) Add several PKIX and private extended key usage OIDs.
11273      [Steve Henson]
11274 
11275   *) Modify the 'ca' program to handle the new extension code. Modify
11276      openssl.cnf for new extension format, add comments.
11277      [Steve Henson]
11278 
11279   *) More X509 V3 changes. Fix typo in v3_bitstr.c. Add support to 'req'
11280      and add a sample to openssl.cnf so req -x509 now adds appropriate
11281      CA extensions.
11282      [Steve Henson]
11283 
11284   *) Continued X509 V3 changes. Add to other makefiles, integrate with the
11285      error code, add initial support to X509_print() and x509 application.
11286      [Steve Henson]
11287 
11288   *) Takes a deep breath and start addding X509 V3 extension support code. Add
11289      files in crypto/x509v3. Move original stuff to crypto/x509v3/old. All this
11290      stuff is currently isolated and isn't even compiled yet.
11291      [Steve Henson]
11292 
11293   *) Continuing patches for GeneralizedTime. Fix up certificate and CRL
11294      ASN1 to use ASN1_TIME and modify print routines to use ASN1_TIME_print.
11295      Removed the versions check from X509 routines when loading extensions:
11296      this allows certain broken certificates that don't set the version
11297      properly to be processed.
11298      [Steve Henson]
11299 
11300   *) Deal with irritating shit to do with dependencies, in YAAHW (Yet Another
11301      Ad Hoc Way) - Makefile.ssls now all contain local dependencies, which
11302      can still be regenerated with "make depend".
11303      [Ben Laurie]
11304 
11305   *) Spelling mistake in C version of CAST-128.
11306      [Ben Laurie, reported by Jeremy Hylton <jeremy@cnri.reston.va.us>]
11307 
11308   *) Changes to the error generation code. The perl script err-code.pl 
11309      now reads in the old error codes and retains the old numbers, only
11310      adding new ones if necessary. It also only changes the .err files if new
11311      codes are added. The makefiles have been modified to only insert errors
11312      when needed (to avoid needlessly modifying header files). This is done
11313      by only inserting errors if the .err file is newer than the auto generated
11314      C file. To rebuild all the error codes from scratch (the old behaviour)
11315      either modify crypto/Makefile.ssl to pass the -regen flag to err_code.pl
11316      or delete all the .err files.
11317      [Steve Henson]
11318 
11319   *) CAST-128 was incorrectly implemented for short keys. The C version has
11320      been fixed, but is untested. The assembler versions are also fixed, but
11321      new assembler HAS NOT BEEN GENERATED FOR WIN32 - the Makefile needs fixing
11322      to regenerate it if needed.
11323      [Ben Laurie, reported (with fix for C version) by Jun-ichiro itojun
11324       Hagino <itojun@kame.net>]
11325 
11326   *) File was opened incorrectly in randfile.c.
11327      [Ulf Möller <ulf@fitug.de>]
11328 
11329   *) Beginning of support for GeneralizedTime. d2i, i2d, check and print
11330      functions. Also ASN1_TIME suite which is a CHOICE of UTCTime or
11331      GeneralizedTime. ASN1_TIME is the proper type used in certificates et
11332      al: it's just almost always a UTCTime. Note this patch adds new error
11333      codes so do a "make errors" if there are problems.
11334      [Steve Henson]
11335 
11336   *) Correct Linux 1 recognition in config.
11337      [Ulf Möller <ulf@fitug.de>]
11338 
11339   *) Remove pointless MD5 hash when using DSA keys in ca.
11340      [Anonymous <nobody@replay.com>]
11341 
11342   *) Generate an error if given an empty string as a cert directory. Also
11343      generate an error if handed NULL (previously returned 0 to indicate an
11344      error, but didn't set one).
11345      [Ben Laurie, reported by Anonymous <nobody@replay.com>]
11346 
11347   *) Add prototypes to SSL methods. Make SSL_write's buffer const, at last.
11348      [Ben Laurie]
11349 
11350   *) Fix the dummy function BN_ref_mod_exp() in rsaref.c to have the correct
11351      parameters. This was causing a warning which killed off the Win32 compile.
11352      [Steve Henson]
11353 
11354   *) Remove C++ style comments from crypto/bn/bn_local.h.
11355      [Neil Costigan <neil.costigan@celocom.com>]
11356 
11357   *) The function OBJ_txt2nid was broken. It was supposed to return a nid
11358      based on a text string, looking up short and long names and finally
11359      "dot" format. The "dot" format stuff didn't work. Added new function
11360      OBJ_txt2obj to do the same but return an ASN1_OBJECT and rewrote 
11361      OBJ_txt2nid to use it. OBJ_txt2obj can also return objects even if the
11362      OID is not part of the table.
11363      [Steve Henson]
11364 
11365   *) Add prototypes to X509 lookup/verify methods, fixing a bug in
11366      X509_LOOKUP_by_alias().
11367      [Ben Laurie]
11368 
11369   *) Sort openssl functions by name.
11370      [Ben Laurie]
11371 
11372   *) Get the gendsa program working (hopefully) and add it to app list. Remove
11373      encryption from sample DSA keys (in case anyone is interested the password
11374      was "1234").
11375      [Steve Henson]
11376 
11377   *) Make _all_ *_free functions accept a NULL pointer.
11378      [Frans Heymans <fheymans@isaserver.be>]
11379 
11380   *) If a DH key is generated in s3_srvr.c, don't blow it by trying to use
11381      NULL pointers.
11382      [Anonymous <nobody@replay.com>]
11383 
11384   *) s_server should send the CAfile as acceptable CAs, not its own cert.
11385      [Bodo Moeller <3moeller@informatik.uni-hamburg.de>]
11386 
11387   *) Don't blow it for numeric -newkey arguments to apps/req.
11388      [Bodo Moeller <3moeller@informatik.uni-hamburg.de>]
11389 
11390   *) Temp key "for export" tests were wrong in s3_srvr.c.
11391      [Anonymous <nobody@replay.com>]
11392 
11393   *) Add prototype for temp key callback functions
11394      SSL_CTX_set_tmp_{rsa,dh}_callback().
11395      [Ben Laurie]
11396 
11397   *) Make DH_free() tolerate being passed a NULL pointer (like RSA_free() and
11398      DSA_free()). Make X509_PUBKEY_set() check for errors in d2i_PublicKey().
11399      [Steve Henson]
11400 
11401   *) X509_name_add_entry() freed the wrong thing after an error.
11402      [Arne Ansper <arne@ats.cyber.ee>]
11403 
11404   *) rsa_eay.c would attempt to free a NULL context.
11405      [Arne Ansper <arne@ats.cyber.ee>]
11406 
11407   *) BIO_s_socket() had a broken should_retry() on Windoze.
11408      [Arne Ansper <arne@ats.cyber.ee>]
11409 
11410   *) BIO_f_buffer() didn't pass on BIO_CTRL_FLUSH.
11411      [Arne Ansper <arne@ats.cyber.ee>]
11412 
11413   *) Make sure the already existing X509_STORE->depth variable is initialized
11414      in X509_STORE_new(), but document the fact that this variable is still
11415      unused in the certificate verification process.
11416      [Ralf S. Engelschall]
11417 
11418   *) Fix the various library and apps files to free up pkeys obtained from
11419      X509_PUBKEY_get() et al. Also allow x509.c to handle netscape extensions.
11420      [Steve Henson]
11421 
11422   *) Fix reference counting in X509_PUBKEY_get(). This makes
11423      demos/maurice/example2.c work, amongst others, probably.
11424      [Steve Henson and Ben Laurie]
11425 
11426   *) First cut of a cleanup for apps/. First the `ssleay' program is now named
11427      `openssl' and second, the shortcut symlinks for the `openssl <command>'
11428      are no longer created. This way we have a single and consistent command
11429      line interface `openssl <command>', similar to `cvs <command>'.
11430      [Ralf S. Engelschall, Paul Sutton and Ben Laurie]
11431 
11432   *) ca.c: move test for DSA keys inside #ifndef NO_DSA. Make pubkey
11433      BIT STRING wrapper always have zero unused bits.
11434      [Steve Henson]
11435 
11436   *) Add CA.pl, perl version of CA.sh, add extended key usage OID.
11437      [Steve Henson]
11438 
11439   *) Make the top-level INSTALL documentation easier to understand.
11440      [Paul Sutton]
11441 
11442   *) Makefiles updated to exit if an error occurs in a sub-directory
11443      make (including if user presses ^C) [Paul Sutton]
11444 
11445   *) Make Montgomery context stuff explicit in RSA data structure.
11446      [Ben Laurie]
11447 
11448   *) Fix build order of pem and err to allow for generated pem.h.
11449      [Ben Laurie]
11450 
11451   *) Fix renumbering bug in X509_NAME_delete_entry().
11452      [Ben Laurie]
11453 
11454   *) Enhanced the err-ins.pl script so it makes the error library number 
11455      global and can add a library name. This is needed for external ASN1 and
11456      other error libraries.
11457      [Steve Henson]
11458 
11459   *) Fixed sk_insert which never worked properly.
11460      [Steve Henson]
11461 
11462   *) Fix ASN1 macros so they can handle indefinite length construted 
11463      EXPLICIT tags. Some non standard certificates use these: they can now
11464      be read in.
11465      [Steve Henson]
11466 
11467   *) Merged the various old/obsolete SSLeay documentation files (doc/xxx.doc)
11468      into a single doc/ssleay.txt bundle. This way the information is still
11469      preserved but no longer messes up this directory. Now it's new room for
11470      the new set of documenation files.
11471      [Ralf S. Engelschall]
11472 
11473   *) SETs were incorrectly DER encoded. This was a major pain, because they
11474      shared code with SEQUENCEs, which aren't coded the same. This means that
11475      almost everything to do with SETs or SEQUENCEs has either changed name or
11476      number of arguments.
11477      [Ben Laurie, based on a partial fix by GP Jayan <gp@nsj.co.jp>]
11478 
11479   *) Fix test data to work with the above.
11480      [Ben Laurie]
11481 
11482   *) Fix the RSA header declarations that hid a bug I fixed in 0.9.0b but
11483      was already fixed by Eric for 0.9.1 it seems.
11484      [Ben Laurie - pointed out by Ulf Möller <ulf@fitug.de>]
11485 
11486   *) Autodetect FreeBSD3.
11487      [Ben Laurie]
11488 
11489   *) Fix various bugs in Configure. This affects the following platforms:
11490      nextstep
11491      ncr-scde
11492      unixware-2.0
11493      unixware-2.0-pentium
11494      sco5-cc.
11495      [Ben Laurie]
11496 
11497   *) Eliminate generated files from CVS. Reorder tests to regenerate files
11498      before they are needed.
11499      [Ben Laurie]
11500 
11501   *) Generate Makefile.ssl from Makefile.org (to keep CVS happy)