Add a NEWS entry covering the FIPS related changes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/21386)

diff --git a/CHANGES.md b/CHANGES.md
index 2b405ede8d742ec277e16a578b0507bcf62269c1..84f35c7dc4cadcbee117335e134d2df7aabd9763 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,7 +24,12 @@ OpenSSL 3.1
 
 ### Changes between 3.1.1 and 3.1.2 [xx XXX xxxx]
 
- * none yet
+ * When building with the `enable-fips` option and using the resulting
+   FIPS provider, TLS 1.2 will, by default, mandate the use of an extended
+   master secret (FIPS 140-3 IG G.Q) and the Hash and HMAC DRBGs will
+   not operate with truncated digests (FIPS 140-3 IG G.R).
+
+   *Paul Dale*
 
 ### Changes between 3.1.0 and 3.1.1 [30 May 2023]
 

diff --git a/NEWS.md b/NEWS.md
index 708db5c5ef312031a8be3c554fb53fe4624b1599..2ef478cc1ab77292941bdd78fce0e234c0b7dde3 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -21,7 +21,10 @@ OpenSSL 3.1
 
 ### Major changes between OpenSSL 3.1.1 and OpenSSL 3.1.2 [under development]
 
-  * none
+ * When building with the `enable-fips` option and using the resulting
+   FIPS provider, TLS 1.2 will, by default, mandate the use of an
+   extended master secret and the Hash and HMAC DRBGs will not operate
+   with truncated digests.
 
 ### Major changes between OpenSSL 3.1.0 and OpenSSL 3.1.1 [30 May 2023]