Oops! Correct version file.

[thirdparty/openssl.git] / CHANGES

 OpenSSL CHANGES
 _______________

 Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]

  *) Cleanse PEM buffers before freeing them since they may contain 
     sensitive data.
     [Benjamin Bennett <ben@psc.edu>]

  *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
     a ciphersuite string such as "DEFAULT:RSA" cannot enable
     authentication-only ciphersuites.
     [Bodo Moeller]

  *) Since AES128 and AES256 share a single mask bit in the logic of
     ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
     kludge to work properly if AES128 is available and AES256 isn't.
     [Victor Duchovni]

  *) Expand security boundary to match 1.1.1 module.
     [Steve Henson]

  *) Remove redundant features: hash file source, editing of test vectors
     modify fipsld to use external fips_premain.c signature.
     [Steve Henson]

  *) New perl script mkfipsscr.pl to create shell scripts or batch files to
     run algorithm test programs.
     [Steve Henson]

  *) Make algorithm test programs more tolerant of whitespace.
     [Steve Henson]

  *) Have SSL/TLS server implementation tolerate "mismatched" record
     protocol version while receiving ClientHello even if the
     ClientHello is fragmented.  (The server can't insist on the
     particular protocol version it has chosen before the ServerHello
     message has informed the client about his choice.)
     [Bodo Moeller]

  *) Load error codes if they are not already present instead of using a
     static variable. This allows them to be cleanly unloaded and reloaded.
     [Steve Henson]

 Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]

  *) Introduce limits to prevent malicious keys being able to
     cause a denial of service.  (CVE-2006-2940)
     [Steve Henson, Bodo Moeller]

  *) Fix ASN.1 parsing of certain invalid structures that can result
     in a denial of service.  (CVE-2006-2937)  [Steve Henson]

  *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
     (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]

  *) Fix SSL client code which could crash if connecting to a
     malicious SSLv2 server.  (CVE-2006-4343)
     [Tavis Ormandy and Will Drewry, Google Security Team]

  *) Change ciphersuite string processing so that an explicit
     ciphersuite selects this one ciphersuite (so that "AES256-SHA"
     will no longer include "AES128-SHA"), and any other similar
     ciphersuite (same bitmap) from *other* protocol versions (so that
     "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
     SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
     changes from 0.9.8b and 0.9.8d.
     [Bodo Moeller]

 Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]

  *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
     (CVE-2006-4339)  [Ben Laurie and Google Security Team]

  *) Change the Unix randomness entropy gathering to use poll() when
     possible instead of select(), since the latter has some
     undesirable limitations.
     [Darryl Miles via Richard Levitte and Bodo Moeller]

  *) Disable rogue ciphersuites:

      - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
      - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
      - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")

     The latter two were purportedly from
     draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
     appear there.

     Also deactive the remaining ciphersuites from
     draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
     unofficial, and the ID has long expired.
     [Bodo Moeller]

  *) Fix RSA blinding Heisenbug (problems sometimes occured on
     dual-core machines) and other potential thread-safety issues.
     [Bodo Moeller]

 Changes between 0.9.7i and 0.9.7j  [04 May 2006]

  *) Adapt fipsld and the build system to link against the validated FIPS
     module in FIPS mode.
     [Steve Henson]

  *) Fixes for VC++ 2005 build under Windows.
     [Steve Henson]

  *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make 
     from a Windows bash shell such as MSYS. It is autodetected from the
     "config" script when run from a VC++ environment. Modify standard VC++
     build to use fipscanister.o from the GNU make build. 
     [Steve Henson]

 Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]

  *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
     The value now differs depending on if you build for FIPS or not.
     BEWARE!  A program linked with a shared FIPSed libcrypto can't be
     safely run with a non-FIPSed libcrypto, as it may crash because of
     the difference induced by this change.
     [Andy Polyakov]

 Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]

  *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
     (part of SSL_OP_ALL).  This option used to disable the
     countermeasure against man-in-the-middle protocol-version
     rollback in the SSL 2.0 server implementation, which is a bad
     idea.  (CVE-2005-2969)

     [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
     for Information Security, National Institute of Advanced Industrial
     Science and Technology [AIST], Japan)]

  *) Minimal support for X9.31 signatures and PSS padding modes. This is
     mainly for FIPS compliance and not fully integrated at this stage.
     [Steve Henson]

  *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
     the exponentiation using a fixed-length exponent.  (Otherwise,
     the information leaked through timing could expose the secret key
     after many signatures; cf. Bleichenbacher's attack on DSA with
     biased k.)
     [Bodo Moeller]

  *) Make a new fixed-window mod_exp implementation the default for
     RSA, DSA, and DH private-key operations so that the sequence of
     squares and multiplies and the memory access pattern are
     independent of the particular secret key.  This will mitigate
     cache-timing and potential related attacks.

     BN_mod_exp_mont_consttime() is the new exponentiation implementation,
     and this is automatically used by BN_mod_exp_mont() if the new flag
     BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
     will use this BN flag for private exponents unless the flag
     RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
     DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.

     [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]

  *) Change the client implementation for SSLv23_method() and
     SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
     Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
     (Previously, the SSL 2.0 backwards compatible Client Hello
     message format would be used even with SSL_OP_NO_SSLv2.)
     [Bodo Moeller]

  *) Add support for smime-type MIME parameter in S/MIME messages which some
     clients need.
     [Steve Henson]

  *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
     a threadsafe manner. Modify rsa code to use new function and add calls
     to dsa and dh code (which had race conditions before).
     [Steve Henson]

  *) Include the fixed error library code in the C error file definitions
     instead of fixing them up at runtime. This keeps the error code
     structures constant.
     [Steve Henson]

 Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]

  [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
  OpenSSL 0.9.8.]

  *) Fixes for newer kerberos headers. NB: the casts are needed because
     the 'length' field is signed on one version and unsigned on another
     with no (?) obvious way to tell the difference, without these VC++
     complains. Also the "definition" of FAR (blank) is no longer included
     nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
     some needed definitions.
     [Steve Henson]

  *) Undo Cygwin change.