[thirdparty/openssl.git] / CHANGES


 OpenSSL CHANGES
 _______________

 Changes between 1.0.1 and 1.0.2 [xx XXX xxxx]

  *) Add -trusted_first option which attempts to find certificates in the
     trusted store even if an untrusted chain is also supplied.
     [Steve Henson]

  *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
     platform support for Linux and Android.
     [Andy Polyakov]

  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
     the right response is stapled. Also change current certificate to
     the certificate actually sent.
     See http://rt.openssl.org/Ticket/Display.html?id=2836.
     [Rob Stradling <rob.stradling@comodo.com>]

  *) Support for linux-x32, ILP32 environment in x86_64 framework.
     [Andy Polyakov]

  *) RFC 5878 support.
     [Emilia Kasper, Adam Langley, Ben Laurie (Google)]

  *) Experimental multi-implementation support for FIPS capable OpenSSL.
     When in FIPS mode the approved implementations are used as normal,
     when not in FIPS mode the internal unapproved versions are used instead.
     This means that the FIPS capable OpenSSL isn't forced to use the
     (often lower perfomance) FIPS implementations outside FIPS mode.
     [Steve Henson]

  *) Transparently support X9.42 DH parameters when calling
     PEM_read_bio_DHparameters. This means existing applications can handle
     the new parameter format automatically.
     [Steve Henson]

  *) Initial experimental support for X9.42 DH parameter format: mainly
     to support use of 'q' parameter for RFC5114 parameters.
     [Steve Henson]

  *) Add DH parameters from RFC5114 including test data to dhtest.
     [Steve Henson]

  *) Support for automatic EC temporary key parameter selection. If enabled
     the most preferred EC parameters are automatically used instead of
     hardcoded fixed parameters. Now a server just has to call:
     SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
     support ECDH and use the most appropriate parameters.
     [Steve Henson]

  *) Enhance and tidy EC curve and point format TLS extension code. Use
     static structures instead of allocation if default values are used.
     New ctrls to set curves we wish to support and to retrieve shared curves.
     Print out shared curves in s_server. New options to s_server and s_client
     to set list of supported curves.
     [Steve Henson]

  *) New ctrls to retrieve supported signature algorithms and 
     supported curve values as an array of NIDs. Extend openssl utility
     to print out received values.
     [Steve Henson]

  *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
     between NIDs and the more common NIST names such as "P-256". Enhance
     ecparam utility and ECC method to recognise the NIST names for curves.
     [Steve Henson]

  *) Enhance SSL/TLS certificate chain handling to support different
     chains for each certificate instead of one chain in the parent SSL_CTX.
     [Steve Henson]

  *) Support for fixed DH ciphersuite client authentication: where both
     server and client use DH certificates with common parameters.
     [Steve Henson]

  *) Support for fixed DH ciphersuites: those requiring DH server
     certificates.
     [Steve Henson]

 Changes between 1.0.1c and 1.0.1d [xx XXX xxxx]

  *) Make openssl verify return errors.
     [Chris Palmer <palmer@google.com> and Ben Laurie]

  *) Fix possible deadlock when decoding public keys.
     [Steve Henson]

  *) Don't use TLS 1.0 record version number in initial client hello
     if renegotiating.
     [Steve Henson]

 Changes between 1.0.1b and 1.0.1c [10 May 2012]

  *) Sanity check record length before skipping explicit IV in TLS
     1.2, 1.1 and DTLS to avoid DoS attack.

     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
     fuzzing as a service testing platform.
     (CVE-2012-2333)
     [Steve Henson]

  *) Initialise tkeylen properly when encrypting CMS messages.
     Thanks to Solar Designer of Openwall for reporting this issue.
     [Steve Henson]

  *) In FIPS mode don't try to use composite ciphers as they are not
     approved.
     [Steve Henson]

 Changes between 1.0.1a and 1.0.1b [26 Apr 2012]

  *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
     1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
     mean any application compiled against OpenSSL 1.0.0 headers setting
     SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
     TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
     0x10000000L Any application which was previously compiled against
     OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
     will need to be recompiled as a result. Letting be results in
     inability to disable specifically TLS 1.1 and in client context,
     in unlike event, limit maximum offered version to TLS 1.0 [see below].
     [Steve Henson]

  *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
     disable just protocol X, but all protocols above X *if* there are
     protocols *below* X still enabled. In more practical terms it means
     that if application wants to disable TLS1.0 in favor of TLS1.1 and
     above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
     SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
     client side.
     [Andy Polyakov]

 Changes between 1.0.1 and 1.0.1a [19 Apr 2012]

  *) Check for potentially exploitable overflows in asn1_d2i_read_bio
     BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
     in CRYPTO_realloc_clean.

     Thanks to Tavis Ormandy, Google Security Team, for discovering this
     issue and to Adam Langley <agl@chromium.org> for fixing it.
     (CVE-2012-2110)
     [Adam Langley (Google), Tavis Ormandy, Google Security Team]

  *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
     [Adam Langley]

  *) Workarounds for some broken servers that "hang" if a client hello
     record length exceeds 255 bytes:
 
     1. Do not use record version number > TLS 1.0 in initial client
        hello: some (but not all) hanging servers will now work.
     2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
        the number of ciphers sent in the client hello. This should be
        set to an even number, such as 50, for example by passing:
        -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
        Most broken servers should now work.
     3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
        TLS 1.2 client support entirely.
     [Steve Henson]

  *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
     [Andy Polyakov]

 Changes between 1.0.0h and 1.0.1  [14 Mar 2012]

  *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
     STRING form instead of a DigestInfo.
     [Steve Henson]

  *) The format used for MDC2 RSA signatures is inconsistent between EVP
     and the RSA_sign/RSA_verify functions. This was made more apparent when
     OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
     those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
     the correct format in RSA_verify so both forms transparently work.
     [Steve Henson]

  *) Some servers which support TLS 1.0 can choke if we initially indicate
     support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
     encrypted premaster secret. As a workaround use the maximum pemitted
     client version in client hello, this should keep such servers happy
     and still work with previous versions of OpenSSL.
     [Steve Henson]

  *) Add support for TLS/DTLS heartbeats.
     [Robin Seggelmann <seggelmann@fh-muenster.de>]

  *) Add support for SCTP.
     [Robin Seggelmann <seggelmann@fh-muenster.de>]

  *) Improved PRNG seeding for VOS.
     [Paul Green <Paul.Green@stratus.com>]

  *) Extensive assembler packs updates, most notably:

	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
	- x86_64:       bit-sliced AES implementation;
	- ARM:          NEON support, contemporary platforms optimizations;
	- s390x:        z196 support;
	- *:            GHASH and GF(2^m) multiplication implementations;

     [Andy Polyakov]

  *) Make TLS-SRP code conformant with RFC 5054 API cleanup
     (removal of unnecessary code)
     [Peter Sylvester <peter.sylvester@edelweb.fr>]

  *) Add TLS key material exporter from RFC 5705.
     [Eric Rescorla]

  *) Add DTLS-SRTP negotiation from RFC 5764.
     [Eric Rescorla]

  *) Add Next Protocol Negotiation,
     http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
     disabled with a no-npn flag to config or Configure. Code donated
     by Google.
     [Adam Langley <agl@google.com> and Ben Laurie]

  *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
     NIST-P256, NIST-P521, with constant-time single point multiplication on
     typical inputs. Compiler support for the nonstandard type __uint128_t is
     required to use this (present in gcc 4.4 and later, for 64-bit builds).
     Code made available under Apache License version 2.0.

     Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
     line to include this in your build of OpenSSL, and run "make depend" (or
     "make update"). This enables the following EC_METHODs:

         EC_GFp_nistp224_method()
         EC_GFp_nistp256_method()
         EC_GFp_nistp521_method()

     EC_GROUP_new_by_curve_name() will automatically use these (while
     EC_GROUP_new_curve_GFp() currently prefers the more flexible
     implementations).
Commit	Line	Data
81a6c781	1
f1c236f8	2	OpenSSL CHANGES
651d0aff RE	3	_______________
651d0aff RE	4
b9115239 DSH	5	Changes between 1.0.1 and 1.0.2 [xx XXX xxxx]
b9115239 DSH	6
9d2006d8 DSH	7	*) Add -trusted_first option which attempts to find certificates in the
	8	trusted store even if an untrusted chain is also supplied.
	9	[Steve Henson]
	10
988037fe AP	11	*) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
	12	platform support for Linux and Android.
	13	[Andy Polyakov]
	14
da8512aa	15	*) Call OCSP Stapling callback after ciphersuite has been chosen, so
dc144417 DSH	16	the right response is stapled. Also change current certificate to
dc144417 DSH	17	the certificate actually sent.
da8512aa BL	18	See http://rt.openssl.org/Ticket/Display.html?id=2836.
	19	[Rob Stradling <rob.stradling@comodo.com>]
	20
0e05b51f AP	21	*) Support for linux-x32, ILP32 environment in x86_64 framework.
	22	[Andy Polyakov]
	23
4e14996e BL	24	*) RFC 5878 support.
	25	[Emilia Kasper, Adam Langley, Ben Laurie (Google)]
	26
1dded7f7 DSH	27	*) Experimental multi-implementation support for FIPS capable OpenSSL.
	28	When in FIPS mode the approved implementations are used as normal,
	29	when not in FIPS mode the internal unapproved versions are used instead.
	30	This means that the FIPS capable OpenSSL isn't forced to use the
	31	(often lower perfomance) FIPS implementations outside FIPS mode.
	32	[Steve Henson]
	33
c3cb0691 DSH	34	*) Transparently support X9.42 DH parameters when calling
	35	PEM_read_bio_DHparameters. This means existing applications can handle
	36	the new parameter format automatically.
	37	[Steve Henson]
	38
491734eb DSH	39	*) Initial experimental support for X9.42 DH parameter format: mainly
	40	to support use of 'q' parameter for RFC5114 parameters.
	41	[Steve Henson]
	42
e811eff5 DSH	43	*) Add DH parameters from RFC5114 including test data to dhtest.
	44	[Steve Henson]
	45
e46c807e DSH	46	*) Support for automatic EC temporary key parameter selection. If enabled
	47	the most preferred EC parameters are automatically used instead of
	48	hardcoded fixed parameters. Now a server just has to call:
	49	SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
	50	support ECDH and use the most appropriate parameters.
	51	[Steve Henson]
	52
6b870763 DSH	53	*) Enhance and tidy EC curve and point format TLS extension code. Use
	54	static structures instead of allocation if default values are used.
	55	New ctrls to set curves we wish to support and to retrieve shared curves.
	56	Print out shared curves in s_server. New options to s_server and s_client
	57	to set list of supported curves.
	58	[Steve Henson]
	59
55058181 DSH	60	*) New ctrls to retrieve supported signature algorithms and
	61	supported curve values as an array of NIDs. Extend openssl utility
	62	to print out received values.
	63	[Steve Henson]
	64
a068a1d0 DSH	65	*) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
	66	between NIDs and the more common NIST names such as "P-256". Enhance
	67	ecparam utility and ECC method to recognise the NIST names for curves.
	68	[Steve Henson]
	69
37b16c84 DSH	70	*) Enhance SSL/TLS certificate chain handling to support different
	71	chains for each certificate instead of one chain in the parent SSL_CTX.
	72	[Steve Henson]
	73
c523eb98 DSH	74	*) Support for fixed DH ciphersuite client authentication: where both
	75	server and client use DH certificates with common parameters.
	76	[Steve Henson]
	77
0ffa4997 DSH	78	*) Support for fixed DH ciphersuites: those requiring DH server
	79	certificates.
	80	[Steve Henson]
b9115239	81
5e145e54 DSH	82	Changes between 1.0.1c and 1.0.1d [xx XXX xxxx]
5e145e54 DSH	83
5f4cf088 BL	84	*) Make openssl verify return errors.
	85	[Chris Palmer <palmer@google.com> and Ben Laurie]
	86
482f2380 DSH	87	*) Fix possible deadlock when decoding public keys.
	88	[Steve Henson]
	89
5e145e54 DSH	90	*) Don't use TLS 1.0 record version number in initial client hello
	91	if renegotiating.
	92	[Steve Henson]
	93
	94	Changes between 1.0.1b and 1.0.1c [10 May 2012]
a56f9a61	95
e7c84838 DSH	96	*) Sanity check record length before skipping explicit IV in TLS
	97	1.2, 1.1 and DTLS to avoid DoS attack.
	98
	99	Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
	100	fuzzing as a service testing platform.
	101	(CVE-2012-2333)
	102	[Steve Henson]
	103
24547c23 DSH	104	*) Initialise tkeylen properly when encrypting CMS messages.
	105	Thanks to Solar Designer of Openwall for reporting this issue.
	106	[Steve Henson]
	107
a56f9a61 DSH	108	*) In FIPS mode don't try to use composite ciphers as they are not
	109	approved.
	110	[Steve Henson]
	111
	112	Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
f69abd53	113
7e0c9630	114	*) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
a6df6702 DSH	115	1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
	116	mean any application compiled against OpenSSL 1.0.0 headers setting
	117	SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
7e0c9630	118	TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
a6df6702 DSH	119	0x10000000L Any application which was previously compiled against
a6df6702 DSH	120	OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
7e0c9630 AP	121	will need to be recompiled as a result. Letting be results in
	122	inability to disable specifically TLS 1.1 and in client context,
	123	in unlike event, limit maximum offered version to TLS 1.0 [see below].
a6df6702 DSH	124	[Steve Henson]
a6df6702 DSH	125
f69abd53 AP	126	*) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
	127	disable just protocol X, but all protocols above X if there are
	128	protocols below X still enabled. In more practical terms it means
	129	that if application wants to disable TLS1.0 in favor of TLS1.1 and
	130	above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
0ae89cf3 AP	131	SSL_OP_NO_TLSv1\|SSL_OP_NO_SSLv3\|SSL_OP_NO_SSLv2. This applies to
0ae89cf3 AP	132	client side.
f69abd53 AP	133	[Andy Polyakov]
f69abd53 AP	134
d6ef8165	135	Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
54543b95	136
564a503b DSH	137	*) Check for potentially exploitable overflows in asn1_d2i_read_bio
	138	BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
	139	in CRYPTO_realloc_clean.
	140
	141	Thanks to Tavis Ormandy, Google Security Team, for discovering this
	142	issue and to Adam Langley <agl@chromium.org> for fixing it.
	143	(CVE-2012-2110)
	144	[Adam Langley (Google), Tavis Ormandy, Google Security Team]
	145
bb3add20 BM	146	*) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
	147	[Adam Langley]
	148
48e0f666 DSH	149	*) Workarounds for some broken servers that "hang" if a client hello
	150	record length exceeds 255 bytes:
	151
	152	1. Do not use record version number > TLS 1.0 in initial client
	153	hello: some (but not all) hanging servers will now work.
	154	2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
	155	the number of ciphers sent in the client hello. This should be
	156	set to an even number, such as 50, for example by passing:
	157	-DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
	158	Most broken servers should now work.
	159	3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
	160	TLS 1.2 client support entirely.
a6df6702	161	[Steve Henson]
48e0f666	162
54543b95 AP	163	*) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
	164	[Andy Polyakov]
	165
f3dcae15	166	Changes between 1.0.0h and 1.0.1 [14 Mar 2012]
9472baae	167
0cd7a032 DSH	168	*) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
	169	STRING form instead of a DigestInfo.
	170	[Steve Henson]
	171
16b7c81d DSH	172	*) The format used for MDC2 RSA signatures is inconsistent between EVP
	173	and the RSA_sign/RSA_verify functions. This was made more apparent when
	174	OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
	175	those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect
	176	the correct format in RSA_verify so both forms transparently work.
	177	[Steve Henson]
	178
fc6800d1 DSH	179	*) Some servers which support TLS 1.0 can choke if we initially indicate
	180	support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
	181	encrypted premaster secret. As a workaround use the maximum pemitted
	182	client version in client hello, this should keep such servers happy
	183	and still work with previous versions of OpenSSL.
	184	[Steve Henson]
	185
bd6941cf DSH	186	*) Add support for TLS/DTLS heartbeats.
	187	[Robin Seggelmann <seggelmann@fh-muenster.de>]
	188
6e750fcb DSH	189	*) Add support for SCTP.
	190	[Robin Seggelmann <seggelmann@fh-muenster.de>]
	191
62308f3f DSH	192	*) Improved PRNG seeding for VOS.
	193	[Paul Green <Paul.Green@stratus.com>]
	194
cecafcce AP	195	*) Extensive assembler packs updates, most notably:
	196
	197	- x86[_64]: AES-NI, PCLMULQDQ, RDRAND support;
	198	- x86[_64]: SSSE3 support (SHA1, vector-permutation AES);
	199	- x86_64: bit-sliced AES implementation;
	200	- ARM: NEON support, contemporary platforms optimizations;
	201	- s390x: z196 support;
	202	- *: GHASH and GF(2^m) multiplication implementations;
	203
	204	[Andy Polyakov]
	205
ca0efb75 DSH	206	*) Make TLS-SRP code conformant with RFC 5054 API cleanup
	207	(removal of unnecessary code)
	208	[Peter Sylvester <peter.sylvester@edelweb.fr>]
	209
b1d74291 BL	210	*) Add TLS key material exporter from RFC 5705.
	211	[Eric Rescorla]
	212
060a38a2 BL	213	*) Add DTLS-SRTP negotiation from RFC 5764.
	214	[Eric Rescorla]
	215
e2809bfb BL	216	*) Add Next Protocol Negotiation,
	217	http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
	218	disabled with a no-npn flag to config or Configure. Code donated
	219	by Google.
	220	[Adam Langley <agl@google.com> and Ben Laurie]
	221
9c37519b BM	222	*) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
	223	NIST-P256, NIST-P521, with constant-time single point multiplication on
	224	typical inputs. Compiler support for the nonstandard type __uint128_t is
3d520f7c BM	225	required to use this (present in gcc 4.4 and later, for 64-bit builds).
3d520f7c BM	226	Code made available under Apache License version 2.0.
9c37519b	227
3d520f7c BM	228	Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
	229	line to include this in your build of OpenSSL, and run "make depend" (or
	230	"make update"). This enables the following EC_METHODs:
9c37519b BM	231
	232	EC_GFp_nistp224_method()
	233	EC_GFp_nistp256_method()
	234	EC_GFp_nistp521_method()
	235
	236	EC_GROUP_new_by_curve_name() will automatically use these (while
	237	EC_GROUP_new_curve_GFp() currently prefers the more flexible
	238	implementations).
	239