Import of openssl-0.9.8, a feature release.
[dragonfly.git] / crypto / openssl-0.9 / CHANGES
CommitLineData
56276539
SS
1
2 OpenSSL CHANGES
3 _______________
4
5 Changes between 0.9.7h and 0.9.8 [05 Jul 2005]
6
7 *) Add libcrypto.pc and libssl.pc for those who feel they need them.
8 [Richard Levitte]
9
10 *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
11 key into the same file any more.
12 [Richard Levitte]
13
14 *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
15 [Andy Polyakov]
16
17 *) Add -utf8 command line and config file option to 'ca'.
18 [Stefan <stf@udoma.org]
19
20 *) Removed the macro des_crypt(), as it seems to conflict with some
21 libraries. Use DES_crypt().
22 [Richard Levitte]
23
24 *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
25 involves renaming the source and generated shared-libs for
26 both. The engines will accept the corrected or legacy ids
27 ('ncipher' and '4758_cca' respectively) when binding. NB,
28 this only applies when building 'shared'.
29 [Corinna Vinschen <vinschen@redhat.com> and Geoff Thorpe]
30
31 *) Add attribute functions to EVP_PKEY structure. Modify
32 PKCS12_create() to recognize a CSP name attribute and
33 use it. Make -CSP option work again in pkcs12 utility.
34 [Steve Henson]
35
36 *) Add new functionality to the bn blinding code:
37 - automatic re-creation of the BN_BLINDING parameters after
38 a fixed number of uses (currently 32)
39 - add new function for parameter creation
40 - introduce flags to control the update behaviour of the
41 BN_BLINDING parameters
42 - hide BN_BLINDING structure
43 Add a second BN_BLINDING slot to the RSA structure to improve
44 performance when a single RSA object is shared among several
45 threads.
46 [Nils Larsch]
47
48 *) Add support for DTLS.
49 [Nagendra Modadugu <nagendra@cs.stanford.edu> and Ben Laurie]
50
51 *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
52 to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
53 [Walter Goulet]
54
55 *) Remove buggy and incompletet DH cert support from
56 ssl/ssl_rsa.c and ssl/s3_both.c
57 [Nils Larsch]
58
59 *) Use SHA-1 instead of MD5 as the default digest algorithm for
60 the apps/openssl applications.
61 [Nils Larsch]
62
63 *) Compile clean with "-Wall -Wmissing-prototypes
64 -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
65 DEBUG_SAFESTACK must also be set.
66 [Ben Laurie]
67
68 *) Change ./Configure so that certain algorithms can be disabled by default.
69 The new counterpiece to "no-xxx" is "enable-xxx".
70
71 The patented RC5 and MDC2 algorithms will now be disabled unless
72 "enable-rc5" and "enable-mdc2", respectively, are specified.
73
74 (IDEA remains enabled despite being patented. This is because IDEA
75 is frequently required for interoperability, and there is no license
76 fee for non-commercial use. As before, "no-idea" can be used to
77 avoid this algorithm.)
78
79 [Bodo Moeller]
80
81 *) Add processing of proxy certificates (see RFC 3820). This work was
82 sponsored by KTH (The Royal Institute of Technology in Stockholm) and
83 EGEE (Enabling Grids for E-science in Europe).
84 [Richard Levitte]
85
86 *) RC4 performance overhaul on modern architectures/implementations, such
87 as Intel P4, IA-64 and AMD64.
88 [Andy Polyakov]
89
90 *) New utility extract-section.pl. This can be used specify an alternative
91 section number in a pod file instead of having to treat each file as
92 a separate case in Makefile. This can be done by adding two lines to the
93 pod file:
94
95 =for comment openssl_section:XXX
96
97 The blank line is mandatory.
98
99 [Steve Henson]
100
101 *) New arguments -certform, -keyform and -pass for s_client and s_server
102 to allow alternative format key and certificate files and passphrase
103 sources.
104 [Steve Henson]
105
106 *) New structure X509_VERIFY_PARAM which combines current verify parameters,
107 update associated structures and add various utility functions.
108
109 Add new policy related verify parameters, include policy checking in
110 standard verify code. Enhance 'smime' application with extra parameters
111 to support policy checking and print out.
112 [Steve Henson]
113
114 *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
115 Nehemiah processors. These extensions support AES encryption in hardware
116 as well as RNG (though RNG support is currently disabled).
117 [Michal Ludvig <michal@logix.cz>, with help from Andy Polyakov]
118
119 *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
120 [Geoff Thorpe]
121
122 *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
123 [Andy Polyakov and a number of other people]
124
125 *) Improved PowerPC platform support. Most notably BIGNUM assembler
126 implementation contributed by IBM.
127 [Suresh Chari, Peter Waltenberg, Andy Polyakov]
128
129 *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
130 exponent rather than 'unsigned long'. There is a corresponding change to
131 the new 'rsa_keygen' element of the RSA_METHOD structure.
132 [Jelte Jansen, Geoff Thorpe]
133
134 *) Functionality for creating the initial serial number file is now
135 moved from CA.pl to the 'ca' utility with a new option -create_serial.
136
137 (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
138 number file to 1, which is bound to cause problems. To avoid
139 the problems while respecting compatibility between different 0.9.7
140 patchlevels, 0.9.7e employed 'openssl x509 -next_serial' in
141 CA.pl for serial number initialization. With the new release 0.9.8,
142 we can fix the problem directly in the 'ca' utility.)
143 [Steve Henson]
144
145 *) Reduced header interdepencies by declaring more opaque objects in
146 ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
147 give fewer recursive includes, which could break lazy source code - so
148 this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
149 developers should define this symbol when building and using openssl to
150 ensure they track the recommended behaviour, interfaces, [etc], but
151 backwards-compatible behaviour prevails when this isn't defined.
152 [Geoff Thorpe]
153
154 *) New function X509_POLICY_NODE_print() which prints out policy nodes.
155 [Steve Henson]
156
157 *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
158 This will generate a random key of the appropriate length based on the
159 cipher context. The EVP_CIPHER can provide its own random key generation
160 routine to support keys of a specific form. This is used in the des and
161 3des routines to generate a key of the correct parity. Update S/MIME
162 code to use new functions and hence generate correct parity DES keys.
163 Add EVP_CHECK_DES_KEY #define to return an error if the key is not
164 valid (weak or incorrect parity).
165 [Steve Henson]
166
167 *) Add a local set of CRLs that can be used by X509_verify_cert() as well
168 as looking them up. This is useful when the verified structure may contain
169 CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
170 present unless the new PKCS7_NO_CRL flag is asserted.
171 [Steve Henson]
172
173 *) Extend ASN1 oid configuration module. It now additionally accepts the
174 syntax:
175
176 shortName = some long name, 1.2.3.4
177 [Steve Henson]
178
179 *) Reimplemented the BN_CTX implementation. There is now no more static
180 limitation on the number of variables it can handle nor the depth of the
181 "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
182 information can now expand as required, and rather than having a single
183 static array of bignums, BN_CTX now uses a linked-list of such arrays
184 allowing it to expand on demand whilst maintaining the usefulness of
185 BN_CTX's "bundling".
186 [Geoff Thorpe]
187
188 *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
189 to allow all RSA operations to function using a single BN_CTX.
190 [Geoff Thorpe]
191
192 *) Preliminary support for certificate policy evaluation and checking. This
193 is initially intended to pass the tests outlined in "Conformance Testing
194 of Relying Party Client Certificate Path Processing Logic" v1.07.
195 [Steve Henson]
196
197 *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
198 remained unused and not that useful. A variety of other little bignum
199 tweaks and fixes have also been made continuing on from the audit (see
200 below).
201 [Geoff Thorpe]
202
203 *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
204 associated ASN1, EVP and SSL functions and old ASN1 macros.
205 [Richard Levitte]
206
207 *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
208 and this should never fail. So the return value from the use of
209 BN_set_word() (which can fail due to needless expansion) is now deprecated;
210 if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
211 [Geoff Thorpe]
212
213 *) BN_CTX_get() should return zero-valued bignums, providing the same
214 initialised value as BN_new().
215