[thirdparty/openssl.git] / CHANGES


 OpenSSL CHANGES
 _______________

 Changes between 0.9.8b and 0.9.9  [xx XXX xxxx]

  *) Initial engine support for EVP_PKEY_ASN1_METHOD.

  *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
     an engine to register a method. Add ENGINE lookups for methods and
     functional reference processing.
     [Steve Henson]

  *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
     EVP_{Sign,Verify}* which allow an application to customise the signature
     process.
     [Steve Henson]

  *) New -resign option to smime utility. This adds one or more signers
     to an existing PKCS#7 signedData structure. Also -md option to use an
     alternative message digest algorithm for signing.
     [Steve Henson]

  *) Tidy up PKCS#7 routines and add new functions to make it easier to
     create PKCS7 structures containing multiple signers. Update smime
     application to support multiple signers.
     [Steve Henson]

  *) New -macalg option to pkcs12 utility to allow setting of an alternative
     digest MAC.
     [Steve Henson]

  *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
     Reorganize PBE internals to lookup from a static table using NIDs,
     add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
     EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
     PRF which will be automatically used with PBES2.
     [Steve Henson]

  *) Replace the algorithm specific calls to generate keys in "req" with the
     new API.
     [Steve Henson]

  *) Update PKCS#7 enveloped data routines to use new API. This is now
     supported by any public key method supporting the encrypt operation. A
     ctrl is added to allow the public key algorithm to examine or modify
     the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
     a no op.
     [Steve Henson]

  *) Add a ctrl to asn1 method to allow a public key algorithm to express
     a default digest type to use. In most cases this will be SHA1 but some
     algorithms (such as GOST) need to specify an alternative digest. The
     return value indicates how strong the prefernce is 1 means optional and
     2 is mandatory (that is it is the only supported type). Modify
     ASN1_item_sign() to accept a NULL digest argument to indicate it should
     use the default md. Update openssl utilities to use the default digest
     type for signing if it is not explicitly indicated.
     [Steve Henson]

  *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
     EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
     signing method from the key type. This effectively removes the link
     between digests and public key types.
     [Steve Henson]

  *) Add an OID cross reference table and utility functions. Its purpose is to
     translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
     rsaEncryption. This will allow some of the algorithm specific hackery
     needed to use the correct OID to be removed. 
     [Steve Henson]

  *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
     structures for PKCS7_sign(). They are now set up by the relevant public
     key ASN1 method.
     [Steve Henson]

  *) Add provisional EC pkey method with support for ECDSA and ECDH.
     [Steve Henson]

  *) Add support for key derivation (agreement) in the API, DH method and
     pkeyutl.
     [Steve Henson]

  *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
     public and private key formats. As a side effect these add additional 
     command line functionality not previously available: DSA signatures can be
     generated and verified using pkeyutl and DH key support and generation in
     pkey, genpkey.
     [Steve Henson]

  *) BeOS support.
     [Oliver Tappe <zooey@hirschkaefer.de>]

  *) New make target "install_html_docs" installs HTML renditions of the
     manual pages.
     [Oliver Tappe <zooey@hirschkaefer.de>]

  *) New utility "genpkey" this is analagous to "genrsa" etc except it can
     generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
     support key and parameter generation and add initial key generation
     functionality for RSA.
     [Steve Henson]

  *) Add functions for main EVP_PKEY_method operations. The undocumented
     functions EVP_PKEY_{encrypt,decrypt} have been renamed to
     EVP_PKEY_{encrypt,decrypt}_old. 
     [Steve Henson]

  *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
     key API, doesn't do much yet.
     [Steve Henson]

  *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
     public key algorithms. New option to openssl utility:
     "list-public-key-algorithms" to print out info.
     [Steve Henson]

  *) Implement the Supported Elliptic Curves Extension for
     ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
     [Douglas Stebila]

  *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
     EVP_CIPHER structures to avoid later problems in EVP_cleanup().
     [Steve Henson]

  *) New utilities pkey and pkeyparam. These are similar to algorithm specific
     utilities such as rsa, dsa, dsaparam etc except they process any key
     type.
     [Steve Henson]

  *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
     functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
     EVP_PKEY_print_param() to print public key data from an EVP_PKEY
     structure.
     [Steve Henson]

  *) Initial support for pluggable public key ASN1.
     De-spaghettify the public key ASN1 handling. Move public and private
     key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
     algorithm specific handling to a single module within the relevant
     algorithm directory. Add functions to allow (near) opaque processing
     of public and private key structures.
     [Steve Henson]

  *) Implement the Supported Point Formats Extension for
     ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
     [Douglas Stebila]

  *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
     for the psk identity [hint] and the psk callback functions to the
     SSL_SESSION, SSL and SSL_CTX structure.
     
     New ciphersuites:
         PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
         PSK-AES256-CBC-SHA
 
     New functions:
         SSL_CTX_use_psk_identity_hint
         SSL_get_psk_identity_hint
         SSL_get_psk_identity
         SSL_use_psk_identity_hint

     [Mika Kousa and Pasi Eronen of Nokia Corporation]

  *) Add RFC 3161 compliant time stamp request creation, response generation
     and response verification functionality.
Commit	Line	Data
81a6c781	1
f1c236f8	2	OpenSSL CHANGES
651d0aff RE	3	_______________
651d0aff RE	4
399a6f0b DSH	5	Changes between 0.9.8b and 0.9.9 [xx XXX xxxx]
399a6f0b DSH	6
de9fcfe3 DSH	7	*) Initial engine support for EVP_PKEY_ASN1_METHOD.
de9fcfe3 DSH	8
58aa573a	9	*) Initial engine support for EVP_PKEY_METHOD. New functions to permit
c9777d26 DSH	10	an engine to register a method. Add ENGINE lookups for methods and
c9777d26 DSH	11	functional reference processing.
58aa573a DSH	12	[Steve Henson]
58aa573a DSH	13
91c9e621 DSH	14	) New functions EVP_Digest{Sign,Verify). These are enchance versions of
	15	EVP_{Sign,Verify}* which allow an application to customise the signature
	16	process.
	17	[Steve Henson]
	18
55311921 DSH	19	*) New -resign option to smime utility. This adds one or more signers
	20	to an existing PKCS#7 signedData structure. Also -md option to use an
	21	alternative message digest algorithm for signing.
	22	[Steve Henson]
	23
a6e7fcd1 DSH	24	*) Tidy up PKCS#7 routines and add new functions to make it easier to
	25	create PKCS7 structures containing multiple signers. Update smime
	26	application to support multiple signers.
	27	[Steve Henson]
	28
121dd39f DSH	29	*) New -macalg option to pkcs12 utility to allow setting of an alternative
	30	digest MAC.
	31	[Steve Henson]
	32
856640b5	33	*) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
b8f702a0	34	Reorganize PBE internals to lookup from a static table using NIDs,
6d3a1eac DSH	35	add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
	36	EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
	37	PRF which will be automatically used with PBES2.
856640b5 DSH	38	[Steve Henson]
856640b5 DSH	39
34b3c72e	40	*) Replace the algorithm specific calls to generate keys in "req" with the
959e8dfe DSH	41	new API.
	42	[Steve Henson]
	43
399a6f0b DSH	44	*) Update PKCS#7 enveloped data routines to use new API. This is now
	45	supported by any public key method supporting the encrypt operation. A
	46	ctrl is added to allow the public key algorithm to examine or modify
	47	the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
	48	a no op.
	49	[Steve Henson]
28e4fe34	50
03919683 DSH	51	*) Add a ctrl to asn1 method to allow a public key algorithm to express
	52	a default digest type to use. In most cases this will be SHA1 but some
	53	algorithms (such as GOST) need to specify an alternative digest. The
	54	return value indicates how strong the prefernce is 1 means optional and
	55	2 is mandatory (that is it is the only supported type). Modify
	56	ASN1_item_sign() to accept a NULL digest argument to indicate it should
	57	use the default md. Update openssl utilities to use the default digest
	58	type for signing if it is not explicitly indicated.
	59	[Steve Henson]
	60
ee1d9ec0 DSH	61	*) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New
	62	EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
	63	signing method from the key type. This effectively removes the link
	64	between digests and public key types.
	65	[Steve Henson]
	66
d2027098 DSH	67	*) Add an OID cross reference table and utility functions. Its purpose is to
	68	translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
	69	rsaEncryption. This will allow some of the algorithm specific hackery
	70	needed to use the correct OID to be removed.
	71	[Steve Henson]
	72
492a9e24 DSH	73	*) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
	74	structures for PKCS7_sign(). They are now set up by the relevant public
	75	key ASN1 method.
	76	[Steve Henson]
	77
9ca7047d DSH	78	*) Add provisional EC pkey method with support for ECDSA and ECDH.
	79	[Steve Henson]
	80
ffb1ac67 DSH	81	*) Add support for key derivation (agreement) in the API, DH method and
	82	pkeyutl.
	83	[Steve Henson]
	84
3ba0885a DSH	85	*) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
	86	public and private key formats. As a side effect these add additional
	87	command line functionality not previously available: DSA signatures can be
	88	generated and verified using pkeyutl and DH key support and generation in
	89	pkey, genpkey.
	90	[Steve Henson]
	91
4700aea9 UM	92	*) BeOS support.
	93	[Oliver Tappe <zooey@hirschkaefer.de>]
	94
	95	*) New make target "install_html_docs" installs HTML renditions of the
	96	manual pages.
	97	[Oliver Tappe <zooey@hirschkaefer.de>]
	98
f5cda4cb DSH	99	*) New utility "genpkey" this is analagous to "genrsa" etc except it can
	100	generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
	101	support key and parameter generation and add initial key generation
	102	functionality for RSA.
	103	[Steve Henson]
	104
f733a5ef DSH	105	*) Add functions for main EVP_PKEY_method operations. The undocumented
	106	functions EVP_PKEY_{encrypt,decrypt} have been renamed to
	107	EVP_PKEY_{encrypt,decrypt}_old.
	108	[Steve Henson]
	109
0b6f3c66 DSH	110	*) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
	111	key API, doesn't do much yet.
	112	[Steve Henson]
	113
0b33dac3 DSH	114	*) New function EVP_PKEY_asn1_get0_info() to retrieve information about
	115	public key algorithms. New option to openssl utility:
	116	"list-public-key-algorithms" to print out info.
	117	[Steve Henson]
	118
33273721 BM	119	*) Implement the Supported Elliptic Curves Extension for
	120	ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
	121	[Douglas Stebila]
	122
246e0931 DSH	123	*) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
	124	EVP_CIPHER structures to avoid later problems in EVP_cleanup().
	125	[Steve Henson]
	126
3e4585c8	127	*) New utilities pkey and pkeyparam. These are similar to algorithm specific
f5cda4cb	128	utilities such as rsa, dsa, dsaparam etc except they process any key
3e4585c8	129	type.
3e84b6e1 DSH	130	[Steve Henson]
3e84b6e1 DSH	131
35208f36 DSH	132	*) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New
	133	functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
	134	EVP_PKEY_print_param() to print public key data from an EVP_PKEY
	135	structure.
	136	[Steve Henson]
	137
448be743 DSH	138	*) Initial support for pluggable public key ASN1.
	139	De-spaghettify the public key ASN1 handling. Move public and private
	140	key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
	141	algorithm specific handling to a single module within the relevant
	142	algorithm directory. Add functions to allow (near) opaque processing
	143	of public and private key structures.
	144	[Steve Henson]
	145
36ca4ba6 BM	146	*) Implement the Supported Point Formats Extension for
	147	ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
	148	[Douglas Stebila]
	149
ddac1974 NL	150	*) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
	151	for the psk identity [hint] and the psk callback functions to the
	152	SSL_SESSION, SSL and SSL_CTX structure.
	153
	154	New ciphersuites:
	155	PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
	156	PSK-AES256-CBC-SHA
	157
	158	New functions:
	159	SSL_CTX_use_psk_identity_hint
	160	SSL_get_psk_identity_hint
	161	SSL_get_psk_identity
	162	SSL_use_psk_identity_hint
	163
	164	[Mika Kousa and Pasi Eronen of Nokia Corporation]
	165
c7235be6 UM	166	*) Add RFC 3161 compliant time stamp request creation, response generation
	167	and response verification functionality.
	168