[thirdparty/openssl.git] / CHANGES


 OpenSSL CHANGES
 _______________

 Changes between 0.9.4 and 0.9.5  [xx XXX 1999]

  *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
     as "read only": it can't be written to and the buffer it points to will
     not be freed. Reading from a read only BIO is much more efficient than
     a normal memory BIO. This was added because there are several times when
     an area of memory needs to be read from a BIO. The previous method was
     to create a memory BIO and write the data to it, this results in two
     copies of the data and an O(n^2) reading algorithm. There is a new
     function BIO_new_mem_buf() which creates a read only memory BIO from
     an area of memory. Also modified the PKCS#7 routines to use read only
     memory BIOSs.
     [Steve Henson]

  *) Bugfix: ssl23_get_client_hello did not work properly when called in
     state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
     a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
     but a retry condition occured while trying to read the rest.
     [Bodo Moeller]

  *) The PKCS7_ENC_CONTENT_new() function was setting the content type as
     NID_pkcs7_encrypted by default: this was wrong since this should almost
     always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle
     the encrypted data type: this is a more sensible place to put it and it
     allows the PKCS#12 code to be tidied up that duplicated this
     functionality.
     [Steve Henson]

  *) Changed obj_dat.pl script so it takes its input and output files on
     the command line. This should avoid shell escape redirection problems
     under Win32.
     [Steve Henson]

  *) Initial support for certificate extension requests, these are included
     in things like Xenroll certificate requests. Included functions to allow
     extensions to be obtained and added.
     [Steve Henson]

  *) -crlf option to s_client and s_server for sending newlines as
     CRLF (as required by many protocols).
     [Bodo Moeller]

 Changes between 0.9.3a and 0.9.4  [09 Aug 1999]
  
  *) Install libRSAglue.a when OpenSSL is built with RSAref.
     [Ralf S. Engelschall]

  *) A few more ``#ifndef NO_FP_API / #endif'' pairs for consistency.
     [Andrija Antonijevic <TheAntony2@bigfoot.com>]

  *) Fix -startdate and -enddate (which was missing) arguments to 'ca'
     program.
     [Steve Henson]

  *) New function DSA_dup_DH, which duplicates DSA parameters/keys as
     DH parameters/keys (q is lost during that conversion, but the resulting
     DH parameters contain its length).

     For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is
     much faster than DH_generate_parameters (which creates parameters
     where p = 2*q + 1), and also the smaller q makes DH computations
     much more efficient (160-bit exponentiation instead of 1024-bit
     exponentiation); so this provides a convenient way to support DHE
     ciphersuites in SSL/TLS servers (see ssl/ssltest.c).  It is of
     utter importance to use
         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
     or
         SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
     when such DH parameters are used, because otherwise small subgroup
     attacks may become possible!
     [Bodo Moeller]

  *) Avoid memory leak in i2d_DHparams.
     [Bodo Moeller]

  *) Allow the -k option to be used more than once in the enc program:
     this allows the same encrypted message to be read by multiple recipients.
     [Steve Henson]

  *) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts
     an ASN1_OBJECT to a text string. If the "no_name" parameter is set then
     it will always use the numerical form of the OID, even if it has a short
     or long name.
     [Steve Henson]

  *) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp
     method only got called if p,q,dmp1,dmq1,iqmp components were present,
     otherwise bn_mod_exp was called. In the case of hardware keys for example
     no private key components need be present and it might store extra data
     in the RSA structure, which cannot be accessed from bn_mod_exp. By setting
     RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for private key
     operations.
     [Steve Henson]

  *) Added support for SPARC Linux.
     [Andy Polyakov]

  *) pem_password_cb function type incompatibly changed from
          typedef int pem_password_cb(char *buf, int size, int rwflag);
     to
          ....(char *buf, int size, int rwflag, void *userdata);
     so that applications can pass data to their callbacks:
     The PEM[_ASN1]_{read,write}... functions and macros now take an
     additional void * argument, which is just handed through whenever
     the password callback is called.
     [Damien Miller <dmiller@ilogic.com.au>, with tiny changes by Bodo Moeller]

     New function SSL_CTX_set_default_passwd_cb_userdata.

     Compatibility note: As many C implementations push function arguments
     onto the stack in reverse order, the new library version is likely to
     interoperate with programs that have been compiled with the old
     pem_password_cb definition (PEM_whatever takes some data that
     happens to be on the stack as its last argument, and the callback
     just ignores this garbage); but there is no guarantee whatsoever that
     this will work.

  *) The -DPLATFORM="\"$(PLATFORM)\"" definition and the similar -DCFLAGS=...
     (both in crypto/Makefile.ssl for use by crypto/cversion.c) caused
     problems not only on Windows, but also on some Unix platforms.
     To avoid problematic command lines, these definitions are now in an
     auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl
     for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds).
     [Bodo Moeller]

  *) MIPS III/IV assembler module is reimplemented.
     [Andy Polyakov]

  *) More DES library cleanups: remove references to srand/rand and
     delete an unused file.
Commit	Line	Data
651d0aff	1
f1c236f8	2	OpenSSL CHANGES
651d0aff RE	3	_______________
651d0aff RE	4
d91e201e RE	5	Changes between 0.9.4 and 0.9.5 [xx XXX 1999]
d91e201e RE	6
8484721a DSH	7	*) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
	8	as "read only": it can't be written to and the buffer it points to will
	9	not be freed. Reading from a read only BIO is much more efficient than
	10	a normal memory BIO. This was added because there are several times when
	11	an area of memory needs to be read from a BIO. The previous method was
	12	to create a memory BIO and write the data to it, this results in two
	13	copies of the data and an O(n^2) reading algorithm. There is a new
	14	function BIO_new_mem_buf() which creates a read only memory BIO from
	15	an area of memory. Also modified the PKCS#7 routines to use read only
	16	memory BIOSs.
	17	[Steve Henson]
	18
de1915e4 BM	19	*) Bugfix: ssl23_get_client_hello did not work properly when called in
	20	state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
	21	a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
	22	but a retry condition occured while trying to read the rest.
	23	[Bodo Moeller]
	24
c6c34506 DSH	25	*) The PKCS7_ENC_CONTENT_new() function was setting the content type as
	26	NID_pkcs7_encrypted by default: this was wrong since this should almost
	27	always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle
	28	the encrypted data type: this is a more sensible place to put it and it
	29	allows the PKCS#12 code to be tidied up that duplicated this
	30	functionality.
	31	[Steve Henson]
	32
fd520577 DSH	33	*) Changed obj_dat.pl script so it takes its input and output files on
	34	the command line. This should avoid shell escape redirection problems
	35	under Win32.
	36	[Steve Henson]
	37
87c49f62	38	*) Initial support for certificate extension requests, these are included
fd520577 DSH	39	in things like Xenroll certificate requests. Included functions to allow
fd520577 DSH	40	extensions to be obtained and added.
87c49f62 DSH	41	[Steve Henson]
87c49f62 DSH	42
1b1a6e78 BM	43	*) -crlf option to s_client and s_server for sending newlines as
	44	CRLF (as required by many protocols).
	45	[Bodo Moeller]
	46
9a577e29	47	Changes between 0.9.3a and 0.9.4 [09 Aug 1999]
dfbaf956	48
9a577e29	49	*) Install libRSAglue.a when OpenSSL is built with RSAref.
dfbaf956	50	[Ralf S. Engelschall]
74678cc2	51
96395158 RE	52	*) A few more ``#ifndef NO_FP_API / #endif'' pairs for consistency.
	53	[Andrija Antonijevic <TheAntony2@bigfoot.com>]
	54
ed7f60fb DSH	55	*) Fix -startdate and -enddate (which was missing) arguments to 'ca'
	56	program.
	57	[Steve Henson]
	58
48c843c3 BM	59	*) New function DSA_dup_DH, which duplicates DSA parameters/keys as
	60	DH parameters/keys (q is lost during that conversion, but the resulting
	61	DH parameters contain its length).
	62
	63	For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is
	64	much faster than DH_generate_parameters (which creates parameters
	65	where p = 2*q + 1), and also the smaller q makes DH computations
	66	much more efficient (160-bit exponentiation instead of 1024-bit
	67	exponentiation); so this provides a convenient way to support DHE
	68	ciphersuites in SSL/TLS servers (see ssl/ssltest.c). It is of
	69	utter importance to use
	70	SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
	71	or
	72	SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
	73	when such DH parameters are used, because otherwise small subgroup
	74	attacks may become possible!
	75	[Bodo Moeller]
	76
	77	*) Avoid memory leak in i2d_DHparams.
	78	[Bodo Moeller]
	79
922180d7 DSH	80	*) Allow the -k option to be used more than once in the enc program:
	81	this allows the same encrypted message to be read by multiple recipients.
	82	[Steve Henson]
	83
3e3d2ea2 DSH	84	*) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts
	85	an ASN1_OBJECT to a text string. If the "no_name" parameter is set then
	86	it will always use the numerical form of the OID, even if it has a short
	87	or long name.
	88	[Steve Henson]
	89
770d19b8 DSH	90	*) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp
	91	method only got called if p,q,dmp1,dmq1,iqmp components were present,
	92	otherwise bn_mod_exp was called. In the case of hardware keys for example
	93	no private key components need be present and it might store extra data
	94	in the RSA structure, which cannot be accessed from bn_mod_exp. By setting
	95	RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for private key
	96	operations.
	97	[Steve Henson]
	98
a0618e3e AP	99	*) Added support for SPARC Linux.
	100	[Andy Polyakov]
	101
74678cc2 BM	102	*) pem_password_cb function type incompatibly changed from
	103	typedef int pem_password_cb(char *buf, int size, int rwflag);
	104	to
	105	....(char buf, int size, int rwflag, void userdata);
	106	so that applications can pass data to their callbacks:
	107	The PEM[_ASN1]_{read,write}... functions and macros now take an
	108	additional void * argument, which is just handed through whenever
	109	the password callback is called.
	110	[Damien Miller <dmiller@ilogic.com.au>, with tiny changes by Bodo Moeller]
	111
	112	New function SSL_CTX_set_default_passwd_cb_userdata.
	113
	114	Compatibility note: As many C implementations push function arguments
	115	onto the stack in reverse order, the new library version is likely to
	116	interoperate with programs that have been compiled with the old
	117	pem_password_cb definition (PEM_whatever takes some data that
	118	happens to be on the stack as its last argument, and the callback
	119	just ignores this garbage); but there is no guarantee whatsoever that
	120	this will work.
0cceb1c7	121
664b9985 BM	122	*) The -DPLATFORM="\"$(PLATFORM)\"" definition and the similar -DCFLAGS=...
	123	(both in crypto/Makefile.ssl for use by crypto/cversion.c) caused
	124	problems not only on Windows, but also on some Unix platforms.
2e0fc875	125	To avoid problematic command lines, these definitions are now in an
57119943 BM	126	auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl
57119943 BM	127	for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds).
664b9985 BM	128	[Bodo Moeller]
664b9985 BM	129
7363455f AP	130	*) MIPS III/IV assembler module is reimplemented.
	131	[Andy Polyakov]
	132
6434450c UM	133	*) More DES library cleanups: remove references to srand/rand and
	134	delete an unused file.
	135