From: Simon Josefsson <simon@josefsson.org>
Date: Fri, 28 Oct 2005 09:45:57 +0000 (+0000)
Subject: Add.
X-Git-Tag: gnutls_1_2_9~49
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3c1d06b17cea46ae5cc15d2dfeb80ec862743a09;p=thirdparty%2Fgnutls.git

Add.
---

diff --git a/NEWS b/NEWS
index ae00fc66f7..dde2f8f6c7 100644
--- a/NEWS
+++ b/NEWS
@@ -5,16 +5,15 @@ See the end for copying conditions.
 
 * Version 1.2.9
 - MD2 is now supported.
-- MD2 and MD5 as X.509 certificate signing algorithms are now disabled
-  by default.  Verifying untrusted certificates signed with these
-  hashes will now fail with a GNUTLS_CERT_INSECURE_ALGORITHM
-  verification output.  For applications that must remain
-  interoperable, you can use the GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or
-  GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 flags when verifying certificates.
-  Naturally, this is not recommended to be the default behaviour.
-  For example, call gnutls_certificate_set_verify_flags with these
-  flags to change the verification mode used by
-  gnutls_certificate_verify_peers2.
+- Due to cryptographic advances, verifying untrusted X.509
+  certificates signed with MD2 or MD5 will now fail with a
+  GNUTLS_CERT_INSECURE_ALGORITHM verification output.  For
+  applications that must remain interoperable, you can use the
+  GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5
+  flags when verifying certificates.  Naturally, this is not
+  recommended to be the default behaviour.  For example, call
+  gnutls_certificate_set_verify_flags with these flags to change the
+  verification mode used by gnutls_certificate_verify_peers2.
 - Make it possible to send empty data through gnutls_record_send,
   to align with the send API.
 - The (experimental) low-level crypto alternative to libgcrypt used
diff --git a/doc/TODO b/doc/TODO
index d4aaa25b5b..addcbfbffc 100644
--- a/doc/TODO
+++ b/doc/TODO
@@ -37,6 +37,8 @@ Current list:
 - Support non-blocking gnutls_{dh,rsa}_params_generate2 for when there
   is not enough entropy available. 
 - Implement Datagram-TLS (DTLS).
+- Short-cut the certificate verification algorithm before the
+  root if a middle-CA is trusted.
 
 (+) Means high priority 
 (*) Means medium priority