Changes between 1.0.1 and 1.1.0 [xx XXX xxxx]
+ *) Add FIPS selftest for ECDH algorithm using P-224 and B-233 curves.
+ [Steve Henson]
+
+ *) Use separate DRBG fields for internal and external flags. New function
+ FIPS_drbg_health_check() to perform on demand health checking. Add
+ generation tests to fips_test_suite with reduced health check interval to
+ demonstrate periodic health checking. Add "nodh" option to
+ fips_test_suite to skip very slow DH test.
+ [Steve Henson]
+
+ *) New function FIPS_get_cipherbynid() to lookup FIPS supported ciphers
+ based on NID.
+ [Steve Henson]
+
*) More extensive health check for DRBG checking many more failure modes.
New function FIPS_selftest_drbg_all() to handle every possible DRBG
combination: call this in fips_test_suite.
by Google.
[Adam Langley <agl@google.com> and Ben Laurie]
- *) Use type ossl_ssize_t instad of ssize_t which isn't available on
- all platforms. Move ssize_t definition from e_os.h to the public
- header file e_os2.h as it now appears in public header file cms.h
- [Steve Henson]
-
*) New function OPENSSL_gmtime_diff to find the difference in days
and seconds between two tm structures. This will be used to provide
additional functionality for ASN1_TIME.
[Steve Henson]
- *) New -sigopt option to the ca, req and x509 utilities. Additional
- signature parameters can be passed using this option and in
- particular PSS.
- [Steve Henson]
-
- *) Add RSA PSS signing function. This will generate and set the
- appropriate AlgorithmIdentifiers for PSS based on those in the
- corresponding EVP_MD_CTX structure. No application support yet.
- [Steve Henson]
-
- *) Support for companion algorithm specific ASN1 signing routines.
- New function ASN1_item_sign_ctx() signs a pre-initialised
- EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
- the appropriate parameters.
- [Steve Henson]
-
- *) Add new algorithm specific ASN1 verification initialisation function
- to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
- handling will be the same no matter what EVP_PKEY_METHOD is used.
- Add a PSS handler to support verification of PSS signatures: checked
- against a number of sample certificates.
- [Steve Henson]
-
- *) Add signature printing for PSS. Add PSS OIDs.
- [Steve Henson, Martin Kaiser <lists@kaiser.cx>]
-
- *) Add algorithm specific signature printing. An individual ASN1 method
- can now print out signatures instead of the standard hex dump.
-
- More complex signatures (e.g. PSS) can print out more meaningful
- information. Include DSA version that prints out the signature
- parameters r, s.
- [Steve Henson]
-
*) Add -trusted_first option which attempts to find certificates in the
trusted store even if an untrusted chain is also supplied.
[Steve Henson]
multi-process servers.
[Steve Henson]
- *) Experiemental password based recipient info support for CMS library:
- implementing RFC3211.
- [Steve Henson]
-
- *) Split password based encryption into PBES2 and PBKDF2 functions. This
- neatly separates the code into cipher and PBE sections and is required
- for some algorithms that split PBES2 into separate pieces (such as
- password based CMS).
- [Steve Henson]
-
*) Extensive audit of libcrypto with DEBUG_UNUSED. Fix many cases where
return value is ignored. NB. The functions RAND_add(), RAND_seed(),
BIO_set_cipher() and some obscure PEM functions were changed so they
whose return value is often ignored.
[Steve Henson]
- Changes between 1.0.0e and 1.0.1 [xx XXX xxxx]
+ Changes between 1.0.0f and 1.0.1 [xx XXX xxxx]
+
+ *) Use type ossl_ssize_t instad of ssize_t which isn't available on
+ all platforms. Move ssize_t definition from e_os.h to the public
+ header file e_os2.h as it now appears in public header file cms.h
+ [Steve Henson]
+
+ *) New -sigopt option to the ca, req and x509 utilities. Additional
+ signature parameters can be passed using this option and in
+ particular PSS.
+ [Steve Henson]
+
+ *) Add RSA PSS signing function. This will generate and set the
+ appropriate AlgorithmIdentifiers for PSS based on those in the
+ corresponding EVP_MD_CTX structure. No application support yet.
+ [Steve Henson]
+
+ *) Support for companion algorithm specific ASN1 signing routines.
+ New function ASN1_item_sign_ctx() signs a pre-initialised
+ EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
+ the appropriate parameters.
+ [Steve Henson]
+
+ *) Add new algorithm specific ASN1 verification initialisation function
+ to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
+ handling will be the same no matter what EVP_PKEY_METHOD is used.
+ Add a PSS handler to support verification of PSS signatures: checked
+ against a number of sample certificates.
+ [Steve Henson]
+
+ *) Add signature printing for PSS. Add PSS OIDs.
+ [Steve Henson, Martin Kaiser <lists@kaiser.cx>]
+
+ *) Add algorithm specific signature printing. An individual ASN1 method
+ can now print out signatures instead of the standard hex dump.
+
+ More complex signatures (e.g. PSS) can print out more meaningful
+ information. Include DSA version that prints out the signature
+ parameters r, s.
+ [Steve Henson]
+
+ *) Password based recipient info support for CMS library: implementing
+ RFC3211.
+ [Steve Henson]
+
+ *) Split password based encryption into PBES2 and PBKDF2 functions. This
+ neatly separates the code into cipher and PBE sections and is required
+ for some algorithms that split PBES2 into separate pieces (such as
+ password based CMS).
+ [Steve Henson]
*) Session-handling fixes:
- Fix handling of connections that are resuming with a session ID,
Add command line options to s_client/s_server.
[Steve Henson]
- Changes between 1.0.0d and 1.0.0e [xx XXX xxxx]
+ Changes between 1.0.0e and 1.0.0f [xx XXX xxxx]
+
+ *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
+ [Bob Buckholz (Google)]
+
+ Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
*) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
by initialising X509_STORE_CTX properly. (CVE-2011-3207)
Changes between 0.9.8r and 0.9.8s [xx XXX xxxx]
+ *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
+ [Bob Buckholz (Google)]
+
*) Fix SSL memory handling for (EC)DH ciphersuites, in particular
for multi-threaded use of ECDH.
[Adam Langley (Google)]
projects / oweals / openssl.git / blobdiff