Add.

diff --git a/NEWS b/NEWS
index ae00fc66f70f9762b18b09c0bb5ab8bbc4c680f8..dde2f8f6c70dac14d3aa67b2aca428bdb83957ce 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,16 +5,15 @@ See the end for copying conditions.
 
 * Version 1.2.9
 - MD2 is now supported.
-- MD2 and MD5 as X.509 certificate signing algorithms are now disabled
-  by default.  Verifying untrusted certificates signed with these
-  hashes will now fail with a GNUTLS_CERT_INSECURE_ALGORITHM
-  verification output.  For applications that must remain
-  interoperable, you can use the GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or
-  GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 flags when verifying certificates.
-  Naturally, this is not recommended to be the default behaviour.
-  For example, call gnutls_certificate_set_verify_flags with these
-  flags to change the verification mode used by
-  gnutls_certificate_verify_peers2.
+- Due to cryptographic advances, verifying untrusted X.509
+  certificates signed with MD2 or MD5 will now fail with a
+  GNUTLS_CERT_INSECURE_ALGORITHM verification output.  For
+  applications that must remain interoperable, you can use the
+  GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5
+  flags when verifying certificates.  Naturally, this is not
+  recommended to be the default behaviour.  For example, call
+  gnutls_certificate_set_verify_flags with these flags to change the
+  verification mode used by gnutls_certificate_verify_peers2.
 - Make it possible to send empty data through gnutls_record_send,
   to align with the send API.
 - The (experimental) low-level crypto alternative to libgcrypt used

diff --git a/doc/TODO b/doc/TODO
index d4aaa25b5b1677ab7a7edffeef7618842cb83370..addcbfbffccedfab725d2a8f1504cb2e5931e922 100644 (file)
--- a/doc/TODO
+++ b/doc/TODO
@@ -37,6 +37,8 @@ Current list:
 - Support non-blocking gnutls_{dh,rsa}_params_generate2 for when there
   is not enough entropy available. 
 - Implement Datagram-TLS (DTLS).
+- Short-cut the certificate verification algorithm before the
+  root if a middle-CA is trusted.
 
 (+) Means high priority 
 (*) Means medium priority