Reorganise ECC code so it can use FIPS module.

[oweals/openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 86b3fa92b1a45f8f6da8468336351de314358fc9..32ca287bcc8f2445550b0ce9c7d2ea8048fa24d3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,28 @@
 
  Changes between 1.0.0d and 1.0.1  [xx XXX xxxx]
 
+  *) New build option no-ec2m to disable characteristic 2 code.
+     [Steve Henson]
+
+  *) Backport libcrypto audit of return value checking from HEAD, not
+     all cases can be covered as some introduce binary incompatibilities.
+     [Steve Henson]
+
+  *) Redirect RSA operations to FIPS module including keygen,
+     encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
+     [Steve Henson]
+
+  *) Add similar low level API blocking to ciphers.
+     [Steve Henson]
+
+  *) Low level digest APIs are not approved in FIPS mode: any attempt
+     to use these will cause a fatal error. Applications that *really* want
+     to use them can use the private_* version instead.
+     [Steve Henson]
+
+  *) Redirect cipher operations to FIPS module for FIPS builds. 
+     [Steve Henson]
+
   *) Redirect digest operations to FIPS module for FIPS builds. 
      [Steve Henson]
 
@@ -11,6 +33,11 @@
      for static and shared library builds embedding a signature if needed.
      [Steve Henson]
 
+  *) Output TLS supported curves in preference order instead of numerical
+     order. This is currently hardcoded for the highest order curves first.
+     This should be configurable so applications can judge speed vs strength.
+     [Steve Henson]
+
   *) Add protection against ECDSA timing attacks as mentioned in the paper
      by Billy Bob Brumley and Nicola Tuveri, see: