[thirdparty/openssl.git] / CHANGES


 OpenSSL CHANGES
 _______________

 Changes between 0.9.7 and 0.9.8  [xx XXX 2002]

  *) Make it possible to inhibit symlinking of shared libraries in
     Makefile.shared, for Cygwin's sake.
     [Richard Levitte]

  *) Extend the BIGNUM API by creating new macros that behave like
     functions

          void BN_set_sign(BIGNUM *a, int neg);
          int BN_get_sign(const BIGNUM *a);

     and avoid the need to access 'a->neg' directly in applications.
     [Nils Larsch  <nla@trustcenter.de>]

  *) Implement fast modular reduction for pseudo-Mersenne primes
     used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
     EC_GROUP_new_curve_GFp() will now automatically use this
     if applicable.
     [Nils Larsch <nla@trustcenter.de>]

  *) Add new lock type (CRYPTO_LOCK_BN).
     [Bodo Moeller]

  *) Change the ENGINE framework to automatically load engines
     dynamically from specific directories unless they could be
     found to already be built in or loaded.  Move all the
     current engines except for the cryptodev one to a new
     directory engines/.
     The engines in engines/ are built as shared libraries if
     the "shared" options was given to ./Configure or ./config.
     Otherwise, they are inserted in libcrypto.a.
     /usr/local/ssl/engines is the default directory for dynamic
     engines, but that can be overriden at configure time through
     the usual use of --prefix and/or --openssldir, and at run
     time with the environment variable OPENSSL_ENGINES.
     [Geoff Thorpe and Richard Levitte]

  *) Add Makefile.shared, a helper makefile to build shared
     libraries.  Addapt Makefile.org.
     [Richard Levitte]

  *) Add version info to Win32 DLLs.
     [Peter 'Luna' Runestig" <peter@runestig.com>]

  *) Add new 'medium level' PKCS#12 API. Certificates and keys
     can be added using this API to created arbitrary PKCS#12
     files while avoiding the low level API.

     New options to PKCS12_create(), key or cert can be NULL and
     will then be omitted from the output file. The encryption
     algorithm NIDs can be set to -1 for no encryption, the mac
     iteration count can be set to 0 to omit the mac.

     Enhance pkcs12 utility by making the -nokeys and -nocerts
     options work when creating a PKCS#12 file. New option -nomac
     to omit the mac, NONE can be set for an encryption algorithm.
     New code is modified to use the enhanced PKCS12_create()
     instead of the low level API.
     [Steve Henson]

  *) Extend ASN1 encoder to support indefinite length constructed
     encoding. This can output sequences tags and octet strings in
     this form. Modify pk7_asn1.c to support indefinite length
     encoding. This is experimental and needs additional code to
     be useful, such as an ASN1 bio and some enhanced streaming
     PKCS#7 code.

     Extend template encode functionality so that tagging is passed
     down to the template encoder.
     [Steve Henson]

  *) Let 'openssl req' fail if an argument to '-newkey' is not
     recognized instead of using RSA as a default.
     [Bodo Moeller]

  *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
     As these are not official, they are not included in "ALL";
     the "ECCdraft" ciphersuite group alias can be used to select them.
     [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]

  *) Add ECDH engine support.
     [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]

  *) Add ECDH in new directory crypto/ecdh/.
TODO: more general interface (return  x  coordinate, not its hash)
TODO: bug: pad  x  with leading zeros if necessary
     [Douglas Stebila (Sun Microsystems Laboratories)]

  *) Let BN_rand_range() abort with an error after 100 iterations
     without success (which indicates a broken PRNG).
     [Bodo Moeller]

  *) Change BN_mod_sqrt() so that it verifies that the input value
     is really the square of the return value.  (Previously,
     BN_mod_sqrt would show GIGO behaviour.)
     [Bodo Moeller]

  *) Add named elliptic curves over binary fields from X9.62, SECG,
     and WAP/WTLS; add OIDs that were still missing.

     [Sheueling Chang Shantz and Douglas Stebila
     (Sun Microsystems Laboratories)]

  *) Extend the EC library for elliptic curves over binary fields
     (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
     New EC_METHOD:

          EC_GF2m_simple_method

     New API functions:

          EC_GROUP_new_curve_GF2m
          EC_GROUP_set_curve_GF2m
          EC_GROUP_get_curve_GF2m
          EC_POINT_set_affine_coordinates_GF2m
          EC_POINT_get_affine_coordinates_GF2m
          EC_POINT_set_compressed_coordinates_GF2m

     Point compression for binary fields is disabled by default for
     patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
     enable it).

     As binary polynomials are represented as BIGNUMs, various members
     of the EC_GROUP and EC_POINT data structures can be shared
     between the implementations for prime fields and binary fields;
     the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
     are essentially identical to their ..._GFp counterparts.
     (For simplicity, the '..._GFp' prefix has been dropped from
     various internal method names.)

     An internal 'field_div' method (similar to 'field_mul' and
     'field_sqr') has been added; this is used only for binary fields.

     [Sheueling Chang Shantz and Douglas Stebila
     (Sun Microsystems Laboratories)]

  *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
     through methods ('mul', 'precompute_mult').

     The generic implementations (now internally called 'ec_wNAF_mul'
     and 'ec_wNAF_precomputed_mult') remain the default if these
     methods are undefined.

     [Sheueling Chang Shantz and Douglas Stebila
     (Sun Microsystems Laboratories)]

  *) New function EC_GROUP_get_degree, which is defined through
     EC_METHOD.  For curves over prime fields, this returns the bit
     length of the modulus.

     [Sheueling Chang Shantz and Douglas Stebila
     (Sun Microsystems Laboratories)]

  *) New functions EC_GROUP_dup, EC_POINT_dup.
     (These simply call ..._new  and ..._copy).

     [Sheueling Chang Shantz and Douglas Stebila
     (Sun Microsystems Laboratories)]

  *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
     Polynomials are represented as BIGNUMs (where the sign bit is not
     used) in the following functions [macros]:  

          BN_GF2m_add
          BN_GF2m_sub             [= BN_GF2m_add]
          BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
          BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
          BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
          BN_GF2m_mod_inv
          BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
          BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
          BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
          BN_GF2m_cmp             [= BN_ucmp]

     (Note that only the 'mod' functions are actually for fields GF(2^m).
     BN_GF2m_add() is misnomer, but this is for the sake of consistency.)

     For some functions, an the irreducible polynomial defining a
     field can be given as an 'unsigned int[]' with strictly
     decreasing elements giving the indices of those bits that are set;
     i.e., p[] represents the polynomial
          f(t) = t^p[0] + t^p[1] + ... + t^p[k]
     where
          p[0] > p[1] > ... > p[k] = 0.
     This applies to the following functions:

          BN_GF2m_mod_arr
          BN_GF2m_mod_mul_arr
          BN_GF2m_mod_sqr_arr
          BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
          BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
          BN_GF2m_mod_exp_arr
          BN_GF2m_mod_sqrt_arr
          BN_GF2m_mod_solve_quad_arr
          BN_GF2m_poly2arr
          BN_GF2m_arr2poly

     Conversion can be performed by the following functions:

          BN_GF2m_poly2arr
          BN_GF2m_arr2poly

     bntest.c has additional tests for binary polynomial arithmetic.

     Two implementations for BN_GF2m_mod_div() are available.
     The default algorithm simply uses BN_GF2m_mod_inv() and
     BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
     if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
     copyright notice in crypto/bn/bn_gf2m.c before enabling it).

     [Sheueling Chang Shantz and Douglas Stebila
     (Sun Microsystems Laboratories)]

  *) Add new error code 'ERR_R_DISABLED' that can be used when some
     functionality is disabled at compile-time.
     [Douglas Stebila <douglas.stebila@sun.com>]

  *) Change default behaviour of 'openssl asn1parse' so that more
     information is visible when viewing, e.g., a certificate:

     Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
     mode the content of non-printable OCTET STRINGs is output in a
     style similar to INTEGERs, but with '[HEX DUMP]' prepended to
     avoid the appearance of a printable string.
     [Nils Larsch <nla@trustcenter.de>]

  *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
     functions
          EC_GROUP_set_asn1_flag()
          EC_GROUP_get_asn1_flag()
          EC_GROUP_set_point_conversion_form()
          EC_GROUP_get_point_conversion_form()
     These control ASN1 encoding details:
     - Curves (i.e., groups) are encoded explicitly unless asn1_flag
       has been set to OPENSSL_EC_NAMED_CURVE.
     - Points are encoded in uncompressed form by default; options for
       asn1_for are as for point2oct, namely
          POINT_CONVERSION_COMPRESSED
          POINT_CONVERSION_UNCOMPRESSED
          POINT_CONVERSION_HYBRID

     Also add 'seed' and 'seed_len' members to EC_GROUP with access
     functions
          EC_GROUP_set_seed()
          EC_GROUP_get0_seed()
          EC_GROUP_get_seed_len()
     This is used only for ASN1 purposes (so far).
     [Nils Larsch <nla@trustcenter.de>]

  *) Add 'field_type' member to EC_METHOD, which holds the NID
     of the appropriate field type OID.  The new function
     EC_METHOD_get_field_type() returns this value.
     [Nils Larsch <nla@trustcenter.de>]

  *) Add functions 
          EC_POINT_point2bn()
          EC_POINT_bn2point()
          EC_POINT_point2hex()
          EC_POINT_hex2point()
     providing useful interfaces to EC_POINT_point2oct() and
     EC_POINT_oct2point().
     [Nils Larsch <nla@trustcenter.de>]

  *) Change internals of the EC library so that the functions
          EC_GROUP_set_generator()
          EC_GROUP_get_generator()
          EC_GROUP_get_order()
          EC_GROUP_get_cofactor()
     are implemented directly in crypto/ec/ec_lib.c and not dispatched
     to methods, which would lead to unnecessary code duplication when
     adding different types of curves.
     [Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller]

  *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
     arithmetic, and such that modified wNAFs are generated
     (which avoid length expansion in many cases).
     [Bodo Moeller]

  *) Add a function EC_GROUP_check_discriminant() (defined via
     EC_METHOD) that verifies that the curve discriminant is non-zero.

     Add a function EC_GROUP_check() that makes some sanity tests
     on a EC_GROUP, its generator and order.  This includes
     EC_GROUP_check_discriminant().
     [Nils Larsch <nla@trustcenter.de>]

  *) Add ECDSA in new directory crypto/ecdsa/.

     Add applications 'openssl ecparam' and 'openssl ecdsa'
     (these are based on 'openssl dsaparam' and 'openssl dsa').

     ECDSA support is also included in various other files across the
     library.  Most notably,
     - 'openssl req' now has a '-newkey ecdsa:file' option;
     - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
     - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
       d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
       them suitable for ECDSA where domain parameters must be
       extracted before the specific public key;
     - ECDSA engine support has been added.
     [Nils Larsch <nla@trustcenter.de>]

  *) Include some named elliptic curves, and add OIDs from X9.62,
     SECG, and WAP/WTLS.  Each curve can be obtained from the new
     function
          EC_GROUP_new_by_nid(),
     and the list of available named curves can be obtained with
          EC_get_builtin_curves().
     Also add a 'curve_name' member to EC_GROUP objects, which can be
     accessed via
         EC_GROUP_set_nid()
         EC_GROUP_get_nid()
     [Nils Larsch <nla@trustcenter.de, Bodo Moeller]
 
 Changes between 0.9.6h and 0.9.7  [XX xxx 2002]

  *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
     cygssl-x.y.z.dll, where x, y and z are the major, minor and
     edit numbers of the version.
     [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]

  *) Introduce safe string copy and catenation functions
     (BUF_strlcpy() and BUF_strlcat()).
     [Ben Laurie (CHATS) and Richard Levitte]

  *) Avoid using fixed-size buffers for one-line DNs.
     [Ben Laurie (CHATS)]

  *) Add BUF_MEM_grow_clean() to avoid information leakage when
     resizing buffers containing secrets, and use where appropriate.
     [Ben Laurie (CHATS)]

  *) Avoid using fixed size buffers for configuration file location.
     [Ben Laurie (CHATS)]

  *) Avoid filename truncation for various CA files.
     [Ben Laurie (CHATS)]

  *) Use sizeof in preference to magic numbers.
     [Ben Laurie (CHATS)]

  *) Avoid filename truncation in cert requests.
     [Ben Laurie (CHATS)]

  *) Add assertions to check for (supposedly impossible) buffer
     overflows.
     [Ben Laurie (CHATS)]

  *) Don't cache truncated DNS entries in the local cache (this could
     potentially lead to a spoofing attack).
     [Ben Laurie (CHATS)]

  *) Fix various buffers to be large enough for hex/decimal
     representations in a platform independent manner.
     [Ben Laurie (CHATS)]

  *) Add CRYPTO_realloc_clean() to avoid information leakage when
     resizing buffers containing secrets, and use where appropriate.
     [Ben Laurie (CHATS)]

  *) Add BIO_indent() to avoid much slightly worrying code to do
     indents.
     [Ben Laurie (CHATS)]

  *) Convert sprintf()/BIO_puts() to BIO_printf().
     [Ben Laurie (CHATS)]

  *) buffer_gets() could terminate with the buffer only half
     full. Fixed.
     [Ben Laurie (CHATS)]

  *) Add assertions to prevent user-supplied crypto functions from
     overflowing internal buffers by having large block sizes, etc.
     [Ben Laurie (CHATS)]

  *) New OPENSSL_assert() macro (similar to assert(), but enabled
     unconditionally).
     [Ben Laurie (CHATS)]

  *) Eliminate unused copy of key in RC4.
     [Ben Laurie (CHATS)]

  *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
     [Ben Laurie (CHATS)]

  *) Fix off-by-one error in EGD path.
     [Ben Laurie (CHATS)]

  *) If RANDFILE path is too long, ignore instead of truncating.
     [Ben Laurie (CHATS)]

  *) Eliminate unused and incorrectly sized X.509 structure
     CBCParameter.
     [Ben Laurie (CHATS)]

  *) Eliminate unused and dangerous function knumber().
     [Ben Laurie (CHATS)]

  *) Eliminate unused and dangerous structure, KSSL_ERR.
     [Ben Laurie (CHATS)]

  *) Protect against overlong session ID context length in an encoded
     session object. Since these are local, this does not appear to be
     exploitable.
     [Ben Laurie (CHATS)]

  *) Change from security patch (see 0.9.6e below) that did not affect
     the 0.9.6 release series:

     Remote buffer overflow in SSL3 protocol - an attacker could
     supply an oversized master key in Kerberos-enabled versions.
     (CAN-2002-0657)
     [Ben Laurie (CHATS)]

  *) Change the SSL kerb5 codes to match RFC 2712.
     [Richard Levitte]

  *) Make -nameopt work fully for req and add -reqopt switch.
     [Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]

  *) The "block size" for block ciphers in CFB and OFB mode should be 1.
     [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve@opera.com>]

  *) Make sure tests can be performed even if the corresponding algorithms
     have been removed entirely.  This was also the last step to make
     OpenSSL compilable with DJGPP under all reasonable conditions.
     [Richard Levitte, Doug Kaufman <dkaufman@rahul.net>]

  *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
     to allow version independent disabling of normally unselected ciphers,
     which may be activated as a side-effect of selecting a single cipher.

     (E.g., cipher list string "RSA" enables ciphersuites that are left
     out of "ALL" because they do not provide symmetric encryption.
     "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
     [Lutz Jaenicke, Bodo Moeller]

  *) Add appropriate support for separate platform-dependent build
     directories.  The recommended way to make a platform-dependent
     build directory is the following (tested on Linux), maybe with
     some local tweaks:

	# Place yourself outside of the OpenSSL source tree.  In
	# this example, the environment variable OPENSSL_SOURCE
	# is assumed to contain the absolute OpenSSL source directory.
	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
	(cd $OPENSSL_SOURCE; find . -type f -o -type l) | while read F; do
		mkdir -p `dirname $F`
		ln -s $OPENSSL_SOURCE/$F $F
	done

     To be absolutely sure not to disturb the source tree, a "make clean"
     is a good thing.  If it isn't successfull, don't worry about it,
     it probably means the source directory is very clean.
     [Richard Levitte]

  *) Make sure any ENGINE control commands make local copies of string
     pointers passed to them whenever necessary. Otherwise it is possible
     the caller may have overwritten (or deallocated) the original string
     data when a later ENGINE operation tries to use the stored values.
Commit	Line	Data
81a6c781	1
f1c236f8	2	OpenSSL CHANGES
651d0aff RE	3	_______________
651d0aff RE	4
4d94ae00 BM	5	Changes between 0.9.7 and 0.9.8 [xx XXX 2002]
4d94ae00 BM	6
6f17f16f RL	7	*) Make it possible to inhibit symlinking of shared libraries in
	8	Makefile.shared, for Cygwin's sake.
	9	[Richard Levitte]
	10
b53e44e5 BM	11	*) Extend the BIGNUM API by creating new macros that behave like
	12	functions
	13
	14	void BN_set_sign(BIGNUM *a, int neg);
	15	int BN_get_sign(const BIGNUM *a);
	16
	17	and avoid the need to access 'a->neg' directly in applications.
	18	[Nils Larsch <nla@trustcenter.de>]
	19
5c6bf031 BM	20	*) Implement fast modular reduction for pseudo-Mersenne primes
	21	used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
	22	EC_GROUP_new_curve_GFp() will now automatically use this
	23	if applicable.
	24	[Nils Larsch <nla@trustcenter.de>]
	25
19b8d06a BM	26	*) Add new lock type (CRYPTO_LOCK_BN).
	27	[Bodo Moeller]
	28
6f7c2cb3 RL	29	*) Change the ENGINE framework to automatically load engines
	30	dynamically from specific directories unless they could be
	31	found to already be built in or loaded. Move all the
	32	current engines except for the cryptodev one to a new
	33	directory engines/.
	34	The engines in engines/ are built as shared libraries if
	35	the "shared" options was given to ./Configure or ./config.
	36	Otherwise, they are inserted in libcrypto.a.
	37	/usr/local/ssl/engines is the default directory for dynamic
874fee47 RL	38	engines, but that can be overriden at configure time through
	39	the usual use of --prefix and/or --openssldir, and at run
	40	time with the environment variable OPENSSL_ENGINES.
6f7c2cb3 RL	41	[Geoff Thorpe and Richard Levitte]
6f7c2cb3 RL	42
30afcc07 RL	43	*) Add Makefile.shared, a helper makefile to build shared
	44	libraries. Addapt Makefile.org.
	45	[Richard Levitte]
	46
fc6a6a10 DSH	47	*) Add version info to Win32 DLLs.
	48	[Peter 'Luna' Runestig" <peter@runestig.com>]
	49
9a48b07e DSH	50	*) Add new 'medium level' PKCS#12 API. Certificates and keys
	51	can be added using this API to created arbitrary PKCS#12
	52	files while avoiding the low level API.
	53
	54	New options to PKCS12_create(), key or cert can be NULL and
	55	will then be omitted from the output file. The encryption
	56	algorithm NIDs can be set to -1 for no encryption, the mac
	57	iteration count can be set to 0 to omit the mac.
	58
	59	Enhance pkcs12 utility by making the -nokeys and -nocerts
	60	options work when creating a PKCS#12 file. New option -nomac
	61	to omit the mac, NONE can be set for an encryption algorithm.
	62	New code is modified to use the enhanced PKCS12_create()
	63	instead of the low level API.
	64	[Steve Henson]
	65
230fd6b7 DSH	66	*) Extend ASN1 encoder to support indefinite length constructed
	67	encoding. This can output sequences tags and octet strings in
	68	this form. Modify pk7_asn1.c to support indefinite length
	69	encoding. This is experimental and needs additional code to
	70	be useful, such as an ASN1 bio and some enhanced streaming
	71	PKCS#7 code.
	72
	73	Extend template encode functionality so that tagging is passed
	74	down to the template encoder.
	75	[Steve Henson]
	76
9226e218 BM	77	*) Let 'openssl req' fail if an argument to '-newkey' is not
	78	recognized instead of using RSA as a default.
	79	[Bodo Moeller]
	80
ea262260 BM	81	*) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
	82	As these are not official, they are not included in "ALL";
	83	the "ECCdraft" ciphersuite group alias can be used to select them.
	84	[Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
	85
e172d60d BM	86	*) Add ECDH engine support.
	87	[Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
	88
	89	*) Add ECDH in new directory crypto/ecdh/.
49a0f778 BM	90	TODO: more general interface (return x coordinate, not its hash)
49a0f778 BM	91	TODO: bug: pad x with leading zeros if necessary
e172d60d BM	92	[Douglas Stebila (Sun Microsystems Laboratories)]
e172d60d BM	93
95ecacf8 BM	94	*) Let BN_rand_range() abort with an error after 100 iterations
	95	without success (which indicates a broken PRNG).
	96	[Bodo Moeller]
	97
6fb60a84 BM	98	*) Change BN_mod_sqrt() so that it verifies that the input value
	99	is really the square of the return value. (Previously,
	100	BN_mod_sqrt would show GIGO behaviour.)
	101	[Bodo Moeller]
	102
7793f30e BM	103	*) Add named elliptic curves over binary fields from X9.62, SECG,
	104	and WAP/WTLS; add OIDs that were still missing.
	105
	106	[Sheueling Chang Shantz and Douglas Stebila
	107	(Sun Microsystems Laboratories)]
	108
	109	*) Extend the EC library for elliptic curves over binary fields
	110	(new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
	111	New EC_METHOD:
	112
	113	EC_GF2m_simple_method
	114
	115	New API functions:
	116
	117	EC_GROUP_new_curve_GF2m
	118	EC_GROUP_set_curve_GF2m
	119	EC_GROUP_get_curve_GF2m
7793f30e BM	120	EC_POINT_set_affine_coordinates_GF2m
	121	EC_POINT_get_affine_coordinates_GF2m
	122	EC_POINT_set_compressed_coordinates_GF2m
	123
	124	Point compression for binary fields is disabled by default for
	125	patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
	126	enable it).
	127
	128	As binary polynomials are represented as BIGNUMs, various members
	129	of the EC_GROUP and EC_POINT data structures can be shared
	130	between the implementations for prime fields and binary fields;
	131	the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
	132	are essentially identical to their ..._GFp counterparts.
9e4f9b36 BM	133	(For simplicity, the '..._GFp' prefix has been dropped from
9e4f9b36 BM	134	various internal method names.)
7793f30e BM	135
	136	An internal 'field_div' method (similar to 'field_mul' and
	137	'field_sqr') has been added; this is used only for binary fields.
	138
	139	[Sheueling Chang Shantz and Douglas Stebila
	140	(Sun Microsystems Laboratories)]
	141
9e4f9b36	142	*) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
7793f30e BM	143	through methods ('mul', 'precompute_mult').
	144
	145	The generic implementations (now internally called 'ec_wNAF_mul'
	146	and 'ec_wNAF_precomputed_mult') remain the default if these
	147	methods are undefined.
	148
	149	[Sheueling Chang Shantz and Douglas Stebila
	150	(Sun Microsystems Laboratories)]
	151
	152	*) New function EC_GROUP_get_degree, which is defined through
	153	EC_METHOD. For curves over prime fields, this returns the bit
	154	length of the modulus.
	155
	156	[Sheueling Chang Shantz and Douglas Stebila
	157	(Sun Microsystems Laboratories)]
	158
	159	*) New functions EC_GROUP_dup, EC_POINT_dup.
	160	(These simply call ..._new and ..._copy).
	161
	162	[Sheueling Chang Shantz and Douglas Stebila
	163	(Sun Microsystems Laboratories)]
	164
1dc920c8 BM	165	*) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
	166	Polynomials are represented as BIGNUMs (where the sign bit is not
	167	used) in the following functions [macros]:
	168
	169	BN_GF2m_add
	170	BN_GF2m_sub [= BN_GF2m_add]
	171	BN_GF2m_mod [wrapper for BN_GF2m_mod_arr]
	172	BN_GF2m_mod_mul [wrapper for BN_GF2m_mod_mul_arr]
	173	BN_GF2m_mod_sqr [wrapper for BN_GF2m_mod_sqr_arr]
	174	BN_GF2m_mod_inv
	175	BN_GF2m_mod_exp [wrapper for BN_GF2m_mod_exp_arr]
	176	BN_GF2m_mod_sqrt [wrapper for BN_GF2m_mod_sqrt_arr]
	177	BN_GF2m_mod_solve_quad [wrapper for BN_GF2m_mod_solve_quad_arr]
	178	BN_GF2m_cmp [= BN_ucmp]
	179
	180	(Note that only the 'mod' functions are actually for fields GF(2^m).
	181	BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
	182
	183	For some functions, an the irreducible polynomial defining a
	184	field can be given as an 'unsigned int[]' with strictly
	185	decreasing elements giving the indices of those bits that are set;
	186	i.e., p[] represents the polynomial
	187	f(t) = t^p[0] + t^p[1] + ... + t^p[k]
	188	where
	189	p[0] > p[1] > ... > p[k] = 0.
	190	This applies to the following functions:
	191
	192	BN_GF2m_mod_arr
	193	BN_GF2m_mod_mul_arr
	194	BN_GF2m_mod_sqr_arr
	195	BN_GF2m_mod_inv_arr [wrapper for BN_GF2m_mod_inv]
	196	BN_GF2m_mod_div_arr [wrapper for BN_GF2m_mod_div]
	197	BN_GF2m_mod_exp_arr
	198	BN_GF2m_mod_sqrt_arr
	199	BN_GF2m_mod_solve_quad_arr
	200	BN_GF2m_poly2arr
	201	BN_GF2m_arr2poly
	202
	203	Conversion can be performed by the following functions:
	204
	205	BN_GF2m_poly2arr
	206	BN_GF2m_arr2poly
	207
	208	bntest.c has additional tests for binary polynomial arithmetic.
	209
909abce8 BM	210	Two implementations for BN_GF2m_mod_div() are available.
	211	The default algorithm simply uses BN_GF2m_mod_inv() and
	212	BN_GF2m_mod_mul(). The alternative algorithm is compiled in only
	213	if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
	214	copyright notice in crypto/bn/bn_gf2m.c before enabling it).
1dc920c8 BM	215
	216	[Sheueling Chang Shantz and Douglas Stebila
	217	(Sun Microsystems Laboratories)]
	218
16dc1cfb BM	219	*) Add new error code 'ERR_R_DISABLED' that can be used when some
	220	functionality is disabled at compile-time.
	221	[Douglas Stebila <douglas.stebila@sun.com>]
	222
ea4f109c BM	223	*) Change default behaviour of 'openssl asn1parse' so that more
	224	information is visible when viewing, e.g., a certificate:
	225
	226	Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
	227	mode the content of non-printable OCTET STRINGs is output in a
	228	style similar to INTEGERs, but with '[HEX DUMP]' prepended to
	229	avoid the appearance of a printable string.
	230	[Nils Larsch <nla@trustcenter.de>]
	231
254ef80d BM	232	*) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
	233	functions
	234	EC_GROUP_set_asn1_flag()
	235	EC_GROUP_get_asn1_flag()
	236	EC_GROUP_set_point_conversion_form()
	237	EC_GROUP_get_point_conversion_form()
	238	These control ASN1 encoding details:
b8e0e123 BM	239	- Curves (i.e., groups) are encoded explicitly unless asn1_flag
b8e0e123 BM	240	has been set to OPENSSL_EC_NAMED_CURVE.
5f3d6f70	241	- Points are encoded in uncompressed form by default; options for
254ef80d BM	242	asn1_for are as for point2oct, namely
	243	POINT_CONVERSION_COMPRESSED
	244	POINT_CONVERSION_UNCOMPRESSED
	245	POINT_CONVERSION_HYBRID
5f3d6f70 BM	246
	247	Also add 'seed' and 'seed_len' members to EC_GROUP with access
	248	functions
	249	EC_GROUP_set_seed()
	250	EC_GROUP_get0_seed()
	251	EC_GROUP_get_seed_len()
	252	This is used only for ASN1 purposes (so far).
458c2917 BM	253	[Nils Larsch <nla@trustcenter.de>]
	254
	255	*) Add 'field_type' member to EC_METHOD, which holds the NID
	256	of the appropriate field type OID. The new function
	257	EC_METHOD_get_field_type() returns this value.
	258	[Nils Larsch <nla@trustcenter.de>]
	259
6cbe6382 BM	260	*) Add functions
	261	EC_POINT_point2bn()
	262	EC_POINT_bn2point()
	263	EC_POINT_point2hex()
	264	EC_POINT_hex2point()
	265	providing useful interfaces to EC_POINT_point2oct() and
	266	EC_POINT_oct2point().
	267	[Nils Larsch <nla@trustcenter.de>]
	268
b6db386f BM	269	*) Change internals of the EC library so that the functions
	270	EC_GROUP_set_generator()
	271	EC_GROUP_get_generator()
	272	EC_GROUP_get_order()
	273	EC_GROUP_get_cofactor()
	274	are implemented directly in crypto/ec/ec_lib.c and not dispatched
	275	to methods, which would lead to unnecessary code duplication when
	276	adding different types of curves.
6cbe6382	277	[Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller]
b6db386f	278
47234cd3 BM	279	*) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
	280	arithmetic, and such that modified wNAFs are generated
	281	(which avoid length expansion in many cases).
	282	[Bodo Moeller]
	283
82652aaf BM	284	*) Add a function EC_GROUP_check_discriminant() (defined via
	285	EC_METHOD) that verifies that the curve discriminant is non-zero.
	286
	287	Add a function EC_GROUP_check() that makes some sanity tests
	288	on a EC_GROUP, its generator and order. This includes
	289	EC_GROUP_check_discriminant().
	290	[Nils Larsch <nla@trustcenter.de>]
	291
4d94ae00 BM	292	*) Add ECDSA in new directory crypto/ecdsa/.
4d94ae00 BM	293
5dbd3efc BM	294	Add applications 'openssl ecparam' and 'openssl ecdsa'
5dbd3efc BM	295	(these are based on 'openssl dsaparam' and 'openssl dsa').
4d94ae00 BM	296
	297	ECDSA support is also included in various other files across the
	298	library. Most notably,
	299	- 'openssl req' now has a '-newkey ecdsa:file' option;
	300	- EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
	301	- X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
	302	d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
	303	them suitable for ECDSA where domain parameters must be
e172d60d BM	304	extracted before the specific public key;
e172d60d BM	305	- ECDSA engine support has been added.
f8e21776	306	[Nils Larsch <nla@trustcenter.de>]
4d94ae00	307
af28dd6c	308	*) Include some named elliptic curves, and add OIDs from X9.62,
ed5e37c3	309	SECG, and WAP/WTLS. Each curve can be obtained from the new
7eb18f12	310	function
ed5e37c3 BM	311	EC_GROUP_new_by_nid(),
	312	and the list of available named curves can be obtained with
	313	EC_get_builtin_curves().
254ef80d BM	314	Also add a 'curve_name' member to EC_GROUP objects, which can be
254ef80d BM	315	accessed via
4d94ae00 BM	316	EC_GROUP_set_nid()
	317	EC_GROUP_get_nid()
	318	[Nils Larsch <nla@trustcenter.de, Bodo Moeller]
	319
3e06fb75 BM	320	Changes between 0.9.6h and 0.9.7 [XX xxx 2002]
3e06fb75 BM	321
6f17f16f RL	322	*) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
	323	cygssl-x.y.z.dll, where x, y and z are the major, minor and
	324	edit numbers of the version.
	325	[Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
	326
54a656ef BL	327	*) Introduce safe string copy and catenation functions
	328	(BUF_strlcpy() and BUF_strlcat()).
	329	[Ben Laurie (CHATS) and Richard Levitte]
	330
	331	*) Avoid using fixed-size buffers for one-line DNs.
	332	[Ben Laurie (CHATS)]
	333
	334	*) Add BUF_MEM_grow_clean() to avoid information leakage when
	335	resizing buffers containing secrets, and use where appropriate.
	336	[Ben Laurie (CHATS)]
	337
	338	*) Avoid using fixed size buffers for configuration file location.
	339	[Ben Laurie (CHATS)]
	340
	341	*) Avoid filename truncation for various CA files.
	342	[Ben Laurie (CHATS)]
	343
	344	*) Use sizeof in preference to magic numbers.
	345	[Ben Laurie (CHATS)]
	346
	347	*) Avoid filename truncation in cert requests.
	348	[Ben Laurie (CHATS)]
	349
54a656ef BL	350	*) Add assertions to check for (supposedly impossible) buffer
	351	overflows.
	352	[Ben Laurie (CHATS)]
	353
	354	*) Don't cache truncated DNS entries in the local cache (this could
	355	potentially lead to a spoofing attack).
	356	[Ben Laurie (CHATS)]
	357
	358	*) Fix various buffers to be large enough for hex/decimal
	359	representations in a platform independent manner.
	360	[Ben Laurie (CHATS)]
	361
	362	*) Add CRYPTO_realloc_clean() to avoid information leakage when
	363	resizing buffers containing secrets, and use where appropriate.
	364	[Ben Laurie (CHATS)]
	365
	366	*) Add BIO_indent() to avoid much slightly worrying code to do
	367	indents.
	368	[Ben Laurie (CHATS)]
	369
	370	*) Convert sprintf()/BIO_puts() to BIO_printf().
	371	[Ben Laurie (CHATS)]
	372
	373	*) buffer_gets() could terminate with the buffer only half
	374	full. Fixed.
	375	[Ben Laurie (CHATS)]
	376
	377	*) Add assertions to prevent user-supplied crypto functions from
	378	overflowing internal buffers by having large block sizes, etc.
	379	[Ben Laurie (CHATS)]
	380
2b2ab523 BM	381	*) New OPENSSL_assert() macro (similar to assert(), but enabled
	382	unconditionally).
	383	[Ben Laurie (CHATS)]
	384
54a656ef BL	385	*) Eliminate unused copy of key in RC4.
	386	[Ben Laurie (CHATS)]
	387
	388	*) Eliminate unused and incorrectly sized buffers for IV in pem.h.
	389	[Ben Laurie (CHATS)]
	390
	391	*) Fix off-by-one error in EGD path.
	392	[Ben Laurie (CHATS)]
	393
	394	*) If RANDFILE path is too long, ignore instead of truncating.
	395	[Ben Laurie (CHATS)]
	396
	397	*) Eliminate unused and incorrectly sized X.509 structure
	398	CBCParameter.
	399	[Ben Laurie (CHATS)]
	400
	401	*) Eliminate unused and dangerous function knumber().
	402	[Ben Laurie (CHATS)]
	403
	404	*) Eliminate unused and dangerous structure, KSSL_ERR.
	405	[Ben Laurie (CHATS)]
	406
	407	*) Protect against overlong session ID context length in an encoded
	408	session object. Since these are local, this does not appear to be
	409	exploitable.
	410	[Ben Laurie (CHATS)]
	411
3e06fb75 BM	412	*) Change from security patch (see 0.9.6e below) that did not affect
	413	the 0.9.6 release series:
	414
	415	Remote buffer overflow in SSL3 protocol - an attacker could
	416	supply an oversized master key in Kerberos-enabled versions.
	417	(CAN-2002-0657)
	418	[Ben Laurie (CHATS)]
dc014d43	419
7ba3a4c3 RL	420	*) Change the SSL kerb5 codes to match RFC 2712.
	421	[Richard Levitte]
	422
ba111217 BM	423	*) Make -nameopt work fully for req and add -reqopt switch.
	424	[Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]
	425
3f6db7f5 DSH	426	*) The "block size" for block ciphers in CFB and OFB mode should be 1.
	427	[Steve Henson, reported by Yngve Nysaeter Pettersen <yngve@opera.com>]
	428
f013c7f2 RL	429	*) Make sure tests can be performed even if the corresponding algorithms
	430	have been removed entirely. This was also the last step to make
	431	OpenSSL compilable with DJGPP under all reasonable conditions.
	432	[Richard Levitte, Doug Kaufman <dkaufman@rahul.net>]
	433
648765ba	434	*) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
c6ccf055 LJ	435	to allow version independent disabling of normally unselected ciphers,
c6ccf055 LJ	436	which may be activated as a side-effect of selecting a single cipher.
648765ba BM	437
	438	(E.g., cipher list string "RSA" enables ciphersuites that are left
	439	out of "ALL" because they do not provide symmetric encryption.
	440	"RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
c6ccf055 LJ	441	[Lutz Jaenicke, Bodo Moeller]
c6ccf055 LJ	442
041843e4 RL	443	*) Add appropriate support for separate platform-dependent build
	444	directories. The recommended way to make a platform-dependent
	445	build directory is the following (tested on Linux), maybe with
	446	some local tweaks:
	447
	448	# Place yourself outside of the OpenSSL source tree. In
	449	# this example, the environment variable OPENSSL_SOURCE
	450	# is assumed to contain the absolute OpenSSL source directory.
3e06fb75 BM	451	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
3e06fb75 BM	452	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
041843e4 RL	453	(cd $OPENSSL_SOURCE; find . -type f -o -type l) \| while read F; do
	454	mkdir -p `dirname $F`
	455	ln -s $OPENSSL_SOURCE/$F $F
	456	done
	457
	458	To be absolutely sure not to disturb the source tree, a "make clean"
	459	is a good thing. If it isn't successfull, don't worry about it,
	460	it probably means the source directory is very clean.
	461	[Richard Levitte]
	462
a6c6874a GT	463	*) Make sure any ENGINE control commands make local copies of string
	464	pointers passed to them whenever necessary. Otherwise it is possible
	465	the caller may have overwritten (or deallocated) the original string
	466	data when a later ENGINE operation tries to use the stored values.
	467