Add security patch and create release.

[oweals/openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 0a4d18cbea9501ae7a5cec0284200cd2e1cc7c0c..f88867b065eefa06273f1cb2ad20ba522b42ccc1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,32 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.6a and 0.9.6b  [XX xxx XXXX]
+ Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
+
+  *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
+     to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
+     Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com>:
+     PRNG state recovery was possible based on the output of
+     one PRNG request appropriately sized to gain knowledge on
+     'md' followed by enough consecutive 1-byte PRNG requests
+     to traverse all of 'state'.
+
+     1. When updating 'md_local' (the current thread's copy of 'md')
+        during PRNG output generation, hash all of the previous
+        'md_local' value, not just the half used for PRNG output.
+
+     2. Make the number of bytes from 'state' included into the hash
+        independent from the number of PRNG bytes requested.
+
+     The first measure alone would be sufficient to avoid
+     Markku-Juhani's attack.  (Actually it had never occurred
+     to me that the half of 'md_local' used for chaining was the
+     half from which PRNG output bytes were taken -- I had always
+     assumed that the secret half would be used.)  The second
+     measure makes sure that additional data from 'state' is never
+     mixed into 'md_local' in small portions; this heuristically
+     further strengthens the PRNG.
+     [Bodo Moeller]
 
   *) Fix crypto/bn/asm/mips3.s.
      [Andy Polyakov]