Add.

diff --git a/NEWS b/NEWS
index a4c6cd4d6e8e165e2774950ee08ed86258155c6e..27ae18e3f8eb0962bca6b5138cc728333da05548 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,15 @@ Copyright (C) 2000, 2001, 2002, 2003, 2004 Nikos Mavroyanopoulos
 See the end for copying conditions.
 
 * Version 1.2.9
+- MD2 is now supported.
+- MD2 and MD5 as X.509 certificate signing algorithms are now disabled
+  by default.  Verifying certificates signed with this hash will now
+  fail with a GNUTLS_CERT_INSECURE_ALGORITHM verification output.  For
+  applications that must remain interoperable, you can use the
+  GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2
+  flags when verifying certificates.  For example, call
+  gnutls_certificate_set_verify_flags with these flags to change the
+  verification mode used by gnutls_certificate_verify_peers2.
 - Make it possible to send empty data through gnutls_record_send,
   to align with the send API.
 - The (experimental) low-level crypto alternative to libgcrypt used
@@ -18,7 +27,17 @@ See the end for copying conditions.
   based on GnuTLS's gc.h.
 - Fix compiler warning in the "anonself" self test.
 - API and ABI modifications:
-  No changes since last version.
+GNUTLS_MAC_MD2: New gnutls_mac_algorithm_t value.
+GNUTLS_DIG_MD2: New gnutls_digest_algorithm_t value.
+GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2,
+GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: New gnutls_certificate_verify_flags values.
+                                  Use when calling
+                                  gnutls_x509_crt_list_verify,
+                                  gnutls_x509_crt_verify, or
+                                  gnutls_certificate_set_verify_flags.
+GNUTLS_CERT_INSECURE_ALGORITHM: New gnutls_certificate_status_t value,
+                                used when broken algorithms is used
+                                (currently MD2/MD5).
 
 * Version 1.2.8 (2005-10-07)
 - Libgcrypt 1.2.2 is required to fix a bug for forking GnuTLS servers.