]>
Commit | Line | Data |
---|---|---|
1 | ||
2 | OpenSSL CHANGES | |
3 | _______________ | |
4 | ||
5 | Changes between 0.9.7 and 0.9.8 [xx XXX 2002] | |
6 | ||
7 | *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt. | |
8 | As these are not official, they are not included in "ALL"; | |
9 | the "ECCdraft" ciphersuite group alias can be used to select them. | |
10 | [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)] | |
11 | ||
12 | TODO: COMPLEMENTOFALL and COMPLEMENTOFDEFAULT do not handle ECCdraft | |
13 | cipher suites correctly. | |
14 | ||
15 | *) Add ECDH engine support. | |
16 | [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)] | |
17 | ||
18 | *) Add ECDH in new directory crypto/ecdh/. | |
19 | [Douglas Stebila (Sun Microsystems Laboratories)] | |
20 | ||
21 | *) Let BN_rand_range() abort with an error after 100 iterations | |
22 | without success (which indicates a broken PRNG). | |
23 | [Bodo Moeller] | |
24 | ||
25 | *) Change BN_mod_sqrt() so that it verifies that the input value | |
26 | is really the square of the return value. (Previously, | |
27 | BN_mod_sqrt would show GIGO behaviour.) | |
28 | [Bodo Moeller] | |
29 | ||
30 | *) Add named elliptic curves over binary fields from X9.62, SECG, | |
31 | and WAP/WTLS; add OIDs that were still missing. | |
32 | ||
33 | [Sheueling Chang Shantz and Douglas Stebila | |
34 | (Sun Microsystems Laboratories)] | |
35 | ||
36 | *) Extend the EC library for elliptic curves over binary fields | |
37 | (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/). | |
38 | New EC_METHOD: | |
39 | ||
40 | EC_GF2m_simple_method | |
41 | ||
42 | New API functions: | |
43 | ||
44 | EC_GROUP_new_curve_GF2m | |
45 | EC_GROUP_set_curve_GF2m | |
46 | EC_GROUP_get_curve_GF2m | |
47 | EC_POINT_set_affine_coordinates_GF2m | |
48 | EC_POINT_get_affine_coordinates_GF2m | |
49 | EC_POINT_set_compressed_coordinates_GF2m | |
50 | ||
51 | Point compression for binary fields is disabled by default for | |
52 | patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to | |
53 | enable it). | |
54 | ||
55 | As binary polynomials are represented as BIGNUMs, various members | |
56 | of the EC_GROUP and EC_POINT data structures can be shared | |
57 | between the implementations for prime fields and binary fields; | |
58 | the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m) | |
59 | are essentially identical to their ..._GFp counterparts. | |
60 | (For simplicity, the '..._GFp' prefix has been dropped from | |
61 | various internal method names.) | |
62 | ||
63 | An internal 'field_div' method (similar to 'field_mul' and | |
64 | 'field_sqr') has been added; this is used only for binary fields. | |
65 | ||
66 | [Sheueling Chang Shantz and Douglas Stebila | |
67 | (Sun Microsystems Laboratories)] | |
68 | ||
69 | *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult() | |
70 | through methods ('mul', 'precompute_mult'). | |
71 | ||
72 | The generic implementations (now internally called 'ec_wNAF_mul' | |
73 | and 'ec_wNAF_precomputed_mult') remain the default if these | |
74 | methods are undefined. | |
75 | ||
76 | [Sheueling Chang Shantz and Douglas Stebila | |
77 | (Sun Microsystems Laboratories)] | |
78 | ||
79 | *) New function EC_GROUP_get_degree, which is defined through | |
80 | EC_METHOD. For curves over prime fields, this returns the bit | |
81 | length of the modulus. | |
82 | ||
83 | [Sheueling Chang Shantz and Douglas Stebila | |
84 | (Sun Microsystems Laboratories)] | |
85 | ||
86 | *) New functions EC_GROUP_dup, EC_POINT_dup. | |
87 | (These simply call ..._new and ..._copy). | |
88 | ||
89 | [Sheueling Chang Shantz and Douglas Stebila | |
90 | (Sun Microsystems Laboratories)] | |
91 | ||
92 | *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c. | |
93 | Polynomials are represented as BIGNUMs (where the sign bit is not | |
94 | used) in the following functions [macros]: | |
95 | ||
96 | BN_GF2m_add | |
97 | BN_GF2m_sub [= BN_GF2m_add] | |
98 | BN_GF2m_mod [wrapper for BN_GF2m_mod_arr] | |
99 | BN_GF2m_mod_mul [wrapper for BN_GF2m_mod_mul_arr] | |
100 | BN_GF2m_mod_sqr [wrapper for BN_GF2m_mod_sqr_arr] | |
101 | BN_GF2m_mod_inv | |
102 | BN_GF2m_mod_exp [wrapper for BN_GF2m_mod_exp_arr] | |
103 | BN_GF2m_mod_sqrt [wrapper for BN_GF2m_mod_sqrt_arr] | |
104 | BN_GF2m_mod_solve_quad [wrapper for BN_GF2m_mod_solve_quad_arr] | |
105 | BN_GF2m_cmp [= BN_ucmp] | |
106 | ||
107 | (Note that only the 'mod' functions are actually for fields GF(2^m). | |
108 | BN_GF2m_add() is misnomer, but this is for the sake of consistency.) | |
109 | ||
110 | For some functions, an the irreducible polynomial defining a | |
111 | field can be given as an 'unsigned int[]' with strictly | |
112 | decreasing elements giving the indices of those bits that are set; | |
113 | i.e., p[] represents the polynomial | |
114 | f(t) = t^p[0] + t^p[1] + ... + t^p[k] | |
115 | where | |
116 | p[0] > p[1] > ... > p[k] = 0. | |
117 | This applies to the following functions: | |
118 | ||
119 | BN_GF2m_mod_arr | |
120 | BN_GF2m_mod_mul_arr | |
121 | BN_GF2m_mod_sqr_arr | |
122 | BN_GF2m_mod_inv_arr [wrapper for BN_GF2m_mod_inv] | |
123 | BN_GF2m_mod_div_arr [wrapper for BN_GF2m_mod_div] | |
124 | BN_GF2m_mod_exp_arr | |
125 | BN_GF2m_mod_sqrt_arr | |
126 | BN_GF2m_mod_solve_quad_arr | |
127 | BN_GF2m_poly2arr | |
128 | BN_GF2m_arr2poly | |
129 | ||
130 | Conversion can be performed by the following functions: | |
131 | ||
132 | BN_GF2m_poly2arr | |
133 | BN_GF2m_arr2poly | |
134 | ||
135 | bntest.c has additional tests for binary polynomial arithmetic. | |
136 | ||
137 | Two implementations for BN_GF2m_mod_div() are available. | |
138 | The default algorithm simply uses BN_GF2m_mod_inv() and | |
139 | BN_GF2m_mod_mul(). The alternative algorithm is compiled in only | |
140 | if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the | |
141 | copyright notice in crypto/bn/bn_gf2m.c before enabling it). | |
142 | ||
143 | [Sheueling Chang Shantz and Douglas Stebila | |
144 | (Sun Microsystems Laboratories)] | |
145 | ||
146 | *) Add new error code 'ERR_R_DISABLED' that can be used when some | |
147 | functionality is disabled at compile-time. | |
148 | [Douglas Stebila <douglas.stebila@sun.com>] | |
149 | ||
150 | *) Change default behaviour of 'openssl asn1parse' so that more | |
151 | information is visible when viewing, e.g., a certificate: | |
152 | ||
153 | Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump' | |
154 | mode the content of non-printable OCTET STRINGs is output in a | |
155 | style similar to INTEGERs, but with '[HEX DUMP]' prepended to | |
156 | avoid the appearance of a printable string. | |
157 | [Nils Larsch <nla@trustcenter.de>] | |
158 | ||
159 | *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access | |
160 | functions | |
161 | EC_GROUP_set_asn1_flag() | |
162 | EC_GROUP_get_asn1_flag() | |
163 | EC_GROUP_set_point_conversion_form() | |
164 | EC_GROUP_get_point_conversion_form() | |
165 | These control ASN1 encoding details: | |
166 | - Curves (i.e., groups) are encoded explicitly unless asn1_flag | |
167 | has been set to OPENSSL_EC_NAMED_CURVE. | |
168 | - Points are encoded in uncompressed form by default; options for | |
169 | asn1_for are as for point2oct, namely | |
170 | POINT_CONVERSION_COMPRESSED | |
171 | POINT_CONVERSION_UNCOMPRESSED | |
172 | POINT_CONVERSION_HYBRID | |
173 | ||
174 | Also add 'seed' and 'seed_len' members to EC_GROUP with access | |
175 | functions | |
176 | EC_GROUP_set_seed() | |
177 | EC_GROUP_get0_seed() | |
178 | EC_GROUP_get_seed_len() | |
179 | This is used only for ASN1 purposes (so far). | |
180 | [Nils Larsch <nla@trustcenter.de>] | |
181 | ||
182 | *) Add 'field_type' member to EC_METHOD, which holds the NID | |
183 | of the appropriate field type OID. The new function | |
184 | EC_METHOD_get_field_type() returns this value. | |
185 | [Nils Larsch <nla@trustcenter.de>] | |
186 | ||
187 | *) Add functions | |
188 | EC_POINT_point2bn() | |
189 | EC_POINT_bn2point() | |
190 | EC_POINT_point2hex() | |
191 | EC_POINT_hex2point() | |
192 | providing useful interfaces to EC_POINT_point2oct() and | |
193 | EC_POINT_oct2point(). | |
194 | [Nils Larsch <nla@trustcenter.de>] | |
195 | ||
196 | *) Change internals of the EC library so that the functions | |
197 | EC_GROUP_set_generator() | |
198 | EC_GROUP_get_generator() | |
199 | EC_GROUP_get_order() | |
200 | EC_GROUP_get_cofactor() | |
201 | are implemented directly in crypto/ec/ec_lib.c and not dispatched | |
202 | to methods, which would lead to unnecessary code duplication when | |
203 | adding different types of curves. | |
204 | [Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller] | |
205 | ||
206 | *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM | |
207 | arithmetic, and such that modified wNAFs are generated | |
208 | (which avoid length expansion in many cases). | |
209 | [Bodo Moeller] | |
210 | ||
211 | *) Add a function EC_GROUP_check_discriminant() (defined via | |
212 | EC_METHOD) that verifies that the curve discriminant is non-zero. | |
213 | ||
214 | Add a function EC_GROUP_check() that makes some sanity tests | |
215 | on a EC_GROUP, its generator and order. This includes | |
216 | EC_GROUP_check_discriminant(). | |
217 | [Nils Larsch <nla@trustcenter.de>] | |
218 | ||
219 | *) Add ECDSA in new directory crypto/ecdsa/. | |
220 | ||
221 | Add applications 'openssl ecparam' and 'openssl ecdsa' | |
222 | (these are based on 'openssl dsaparam' and 'openssl dsa'). | |
223 | ||
224 | ECDSA support is also included in various other files across the | |
225 | library. Most notably, | |
226 | - 'openssl req' now has a '-newkey ecdsa:file' option; | |
227 | - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA; | |
228 | - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and | |
229 | d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make | |
230 | them suitable for ECDSA where domain parameters must be | |
231 | extracted before the specific public key; | |
232 | - ECDSA engine support has been added. | |
233 | [Nils Larsch <nla@trustcenter.de>] | |
234 | ||
235 | *) Include some named elliptic curves, and add OIDs from X9.62, | |
236 | SECG, and WAP/WTLS. The curves can be obtained from the new | |
237 | functions | |
238 | EC_GROUP_new_by_nid() | |
239 | EC_GROUP_new_by_name() | |
240 | Also add a 'curve_name' member to EC_GROUP objects, which can be | |
241 | accessed via | |
242 | EC_GROUP_set_nid() | |
243 | EC_GROUP_get_nid() | |
244 | [Nils Larsch <nla@trustcenter.de, Bodo Moeller] | |
245 | ||
246 | Changes between 0.9.6g and 0.9.7 [XX xxx 2002] | |
247 | ||
248 | *) Make sure tests can be performed even if the corresponding algorithms | |
249 | have been removed entirely. This was also the last step to make | |
250 | OpenSSL compilable with DJGPP under all reasonable conditions. | |
251 | [Richard Levitte, Doug Kaufman <dkaufman@rahul.net>] | |
252 | ||
253 | *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT | |
254 | to allow version independent disabling of normally unselected ciphers, | |
255 | which may be activated as a side-effect of selecting a single cipher. | |
256 | ||
257 | (E.g., cipher list string "RSA" enables ciphersuites that are left | |
258 | out of "ALL" because they do not provide symmetric encryption. | |
259 | "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.) | |
260 | [Lutz Jaenicke, Bodo Moeller] | |
261 | ||
262 | *) Add appropriate support for separate platform-dependent build | |
263 | directories. The recommended way to make a platform-dependent | |
264 | build directory is the following (tested on Linux), maybe with | |
265 | some local tweaks: | |
266 | ||
267 | # Place yourself outside of the OpenSSL source tree. In | |
268 | # this example, the environment variable OPENSSL_SOURCE | |
269 | # is assumed to contain the absolute OpenSSL source directory. | |
270 | mkdir -p objtree/`uname -s`-`uname -r`-`uname -m` | |
271 | cd objtree/`uname -s`-`uname -r`-`uname -m` | |
272 | (cd $OPENSSL_SOURCE; find . -type f -o -type l) | while read F; do | |
273 | mkdir -p `dirname $F` | |
274 | ln -s $OPENSSL_SOURCE/$F $F | |
275 | done | |
276 | ||
277 | To be absolutely sure not to disturb the source tree, a "make clean" | |
278 | is a good thing. If it isn't successfull, don't worry about it, | |
279 | it probably means the source directory is very clean. | |
280 | [Richard Levitte] | |
281 | ||
282 | *) Make sure any ENGINE control commands make local copies of string | |
283 | pointers passed to them whenever necessary. Otherwise it is possible | |
284 | the caller may have overwritten (or deallocated) the original string | |
285 | data when a later ENGINE operation tries to use the stored values. | |
286 |