Revision tags: openssl-3-0-14
|
#
1.1.1.11 |
|
11-Jun-2024 |
christos |
Import OpenSSL 3.0.14 (last was 3.0.12)
### Changes between 3.0.13 and 3.0.14 [4 Jun 2024]
* Fixed potential use after free after SSL_free_buffers() is called.
The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use.
The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use.
The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use.
([CVE-2024-4741])
*Matt Caswell*
* Fixed an issue where checking excessively long DSA keys or parameters may be very slow.
Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
To resolve this issue DSA keys larger than OPENSSL_DSA_MAX_MODULUS_BITS will now fail the check immediately with a DSA_R_MODULUS_TOO_LARGE error reason.
([CVE-2024-4603])
*Tom���� Mr��z*
* Fixed an issue where some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.
([CVE-2024-2511])
*Matt Caswell*
* New atexit configuration switch, which controls whether the OPENSSL_cleanup is registered when libcrypto is unloaded. This can be used on platforms where using atexit() from shared libraries causes crashes on exit.
*Randall S. Becker*
### Changes between 3.0.12 and 3.0.13 [30 Jan 2024]
* A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL did not correctly check for this case. A fix has been applied to prevent a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue prior to this fix.
OpenSSL APIs that were vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.
([CVE-2024-0727])
*Matt Caswell*
* When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time.
An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack.
The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the "-pubin" and "-check" options on untrusted data.
To resolve this issue RSA keys larger than OPENSSL_RSA_MAX_MODULUS_BITS will now fail the check immediately with an RSA_R_MODULUS_TOO_LARGE error reason.
([CVE-2023-6237])
*Tom���� Mr��z*
* Restore the encoding of SM2 PrivateKeyInfo and SubjectPublicKeyInfo to have the contained AlgorithmIdentifier.algorithm set to id-ecPublicKey rather than SM2.
*Richard Levitte*
* The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs saves the contents of vector registers in different order than they are restored. Thus the contents of some of these vector registers is corrupted when returning to the caller. The vulnerable code is used only on newer PowerPC processors supporting the PowerISA 2.07 instructions.
The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However unless the compiler uses the vector registers for storing pointers, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.
([CVE-2023-6129])
*Rohan McLure*
* Fix excessive time spent in DH check / generation with large Q parameter value.
Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.
([CVE-2023-5678])
*Richard Levitte*
|
Revision tags: openssl-3-0-12
|
#
1.1.1.10 |
|
25-Oct-2023 |
christos |
Import OpenSSL-3.0.12 (previous was OpenSSL-3.0.9)
### Changes between 3.0.11 and 3.0.12 [24 Oct 2023]
* Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length ([CVE-2023-5363]).
*Paul Dale*
### Changes between 3.0.10 and 3.0.11 [19 Sep 2023]
* Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions.
The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.
([CVE-2023-4807])
*Bernd Edlinger*
### Changes between 3.0.9 and 3.0.10 [1 Aug 2023]
* Fix excessive time spent checking DH q parameter value.
The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.
If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped.
([CVE-2023-3817])
*Tom���� Mr��z*
* Fix DH_check() excessive time with over sized modulus.
The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.
However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail.
([CVE-2023-3446])
*Matt Caswell*
* Do not ignore empty associated data entries with AES-SIV.
The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call `EVP_EncryptUpdate()` (or `EVP_CipherUpdate()`) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. ([CVE-2023-2975])
Thanks to Juerg Wullschleger (Google) for discovering the issue.
The fix changes the authentication tag value and the ciphertext for applications that use empty associated data entries with AES-SIV. To decrypt data encrypted with previous versions of OpenSSL the application has to skip calls to `EVP_DecryptUpdate()` for empty associated data entries.
*Tom���� Mr��z*
|
Revision tags: openssl-3-0-9
|
#
1.1.1.9 |
|
31-May-2023 |
christos |
Import OpenSSL-3.0.9
### Changes between 3.0.8 and 3.0.9 [30 May 2023]
* Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. ([CVE-2023-2650])
To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT IDENTIFIER to canonical numeric text form if the size of that OBJECT IDENTIFIER is 586 bytes or less, and fail otherwise.
The basis for this restriction is RFC 2578 (STD 58), section 3.5. OBJECT IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at most 128 sub-identifiers, and that the maximum value that each sub- identifier may have is 2^32-1 (4294967295 decimal).
For each byte of every sub-identifier, only the 7 lower bits are part of the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with these restrictions may occupy is 32 * 128 / 7, which is approximately 586 bytes.
Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
*Richard Levitte*
* Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can trigger a crash of an application using AES-XTS decryption if the memory just after the buffer being decrypted is not mapped. Thanks to Anton Romanov (Amazon) for discovering the issue. ([CVE-2023-1255])
*Nevine Ebeid*
* Reworked the Fix for the Timing Oracle in RSA Decryption ([CVE-2022-4304]). The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 3.0.7. The new fix uses existing constant time code paths, and restores the previous performance level while fully eliminating all existing timing side channels. The fix was developed by Bernd Edlinger with testing support by Hubert Kario.
*Bernd Edlinger*
* Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention that it does not enable policy checking. Thanks to David Benjamin for discovering this issue. ([CVE-2023-0466])
*Tom���� Mr��z*
* Fixed an issue where invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. ([CVE-2023-0465])
*Matt Caswell*
* Limited the number of nodes created in a policy tree to mitigate against CVE-2023-0464. The default limit is set to 1000 nodes, which should be sufficient for most installations. If required, the limit can be adjusted by setting the OPENSSL_POLICY_TREE_NODES_MAX build time define to a desired maximum number of nodes or zero to allow unlimited growth. ([CVE-2023-0464])
*Paul Dale*
|
Revision tags: openssl-3-0-8
|
#
1.1.1.8 |
|
07-May-2023 |
christos |
Import OpenSSL 3.0.8, last import was 1.1.1t
### Major changes between OpenSSL 3.0.7 and OpenSSL 3.0.8 [7 Feb 2023]
* Fixed NULL dereference during PKCS7 data verification ([CVE-2023-0401]) * Fixed X.400 address type confusion in X.509 GeneralName ([CVE-2023-0286]) * Fixed NULL dereference validating DSA public key ([CVE-2023-0217]) * Fixed Invalid pointer dereference in d2i_PKCS7 functions ([CVE-2023-0216]) * Fixed Use-after-free following BIO_new_NDEF ([CVE-2023-0215]) * Fixed Double free after calling PEM_read_bio_ex ([CVE-2022-4450]) * Fixed Timing Oracle in RSA Decryption ([CVE-2022-4304]) * Fixed X.509 Name Constraints Read Buffer Overflow ([CVE-2022-4203]) * Fixed X.509 Policy Constraints Double Locking ([CVE-2022-3996])
### Major changes between OpenSSL 3.0.6 and OpenSSL 3.0.7 [1 Nov 2022]
* Added RIPEMD160 to the default provider. * Fixed regressions introduced in 3.0.6 version. * Fixed two buffer overflows in punycode decoding functions. ([CVE-2022-3786]) and ([CVE-2022-3602])
### Major changes between OpenSSL 3.0.5 and OpenSSL 3.0.6 [11 Oct 2022]
* Fix for custom ciphers to prevent accidental use of NULL encryption ([CVE-2022-3358])
### Major changes between OpenSSL 3.0.4 and OpenSSL 3.0.5 [5 Jul 2022]
* Fixed heap memory corruption with RSA private key operation ([CVE-2022-2274]) * Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms ([CVE-2022-2097])
### Major changes between OpenSSL 3.0.3 and OpenSSL 3.0.4 [21 Jun 2022]
* Fixed additional bugs in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection ([CVE-2022-2068])
### Major changes between OpenSSL 3.0.2 and OpenSSL 3.0.3 [3 May 2022]
* Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection ([CVE-2022-1292]) * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer certificate on an OCSP response ([CVE-2022-1343]) * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the AAD data as the MAC key ([CVE-2022-1434]) * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory occuppied by the removed hash table entries ([CVE-2022-1473])
### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever for non-prime moduli ([CVE-2022-0778])
### Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
* Fixed invalid handling of X509_verify_cert() internal errors in libssl ([CVE-2021-4044]) * Allow fetching an operation from the provider that owns an unexportable key as a fallback if that is still allowed by the property query.
### Major changes between OpenSSL 1.1.1 and OpenSSL 3.0.0 [7 sep 2021]
* Enhanced 'openssl list' with many new options. * Added migration guide to man7. * Implemented support for fully "pluggable" TLSv1.3 groups. * Added suport for Kernel TLS (KTLS). * Changed the license to the Apache License v2.0. * Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider. * Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy provider. * Added convenience functions for generating asymmetric key pairs. * Deprecated the `OCSP_REQ_CTX` type and functions. * Deprecated the `EC_KEY` and `EC_KEY_METHOD` types and functions. * Deprecated the `RSA` and `RSA_METHOD` types and functions. * Deprecated the `DSA` and `DSA_METHOD` types and functions. * Deprecated the `DH` and `DH_METHOD` types and functions. * Deprecated the `ERR_load_` functions. * Remove the `RAND_DRBG` API. * Deprecated the `ENGINE` API. * Added `OSSL_LIB_CTX`, a libcrypto library context. * Added various `_ex` functions to the OpenSSL API that support using a non-default `OSSL_LIB_CTX`. * Interactive mode is removed from the 'openssl' program. * The X25519, X448, Ed25519, Ed448, SHAKE128 and SHAKE256 algorithms are included in the FIPS provider. * X509 certificates signed using SHA1 are no longer allowed at security level 1 or higher. The default security level for TLS is 1, so certificates signed using SHA1 are by default no longer trusted to authenticate servers or clients. * enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly disabled; the project uses address sanitize/leak-detect instead. * Added a Certificate Management Protocol (CMP, RFC 4210) implementation also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712). It is part of the crypto lib and adds a 'cmp' app with a demo configuration. All widely used CMP features are supported for both clients and servers. * Added a proper HTTP client supporting GET with optional redirection, POST, arbitrary request and response content types, TLS, persistent connections, connections via HTTP(s) proxies, connections and exchange via user-defined BIOs (allowing implicit connections), and timeout checks. * Added util/check-format.pl for checking adherence to the coding guidelines. * Added OSSL_ENCODER, a generic encoder API. * Added OSSL_DECODER, a generic decoder API. * Added OSSL_PARAM_BLD, an easier to use API to OSSL_PARAM. * Added error raising macros, ERR_raise() and ERR_raise_data(). * Deprecated ERR_put_error(), ERR_get_error_line(), ERR_get_error_line_data(), ERR_peek_error_line_data(), ERR_peek_last_error_line_data() and ERR_func_error_string(). * Added OSSL_PROVIDER_available(), to check provider availibility. * Added 'openssl mac' that uses the EVP_MAC API. * Added 'openssl kdf' that uses the EVP_KDF API. * Add OPENSSL_info() and 'openssl info' to get built-in data. * Add support for enabling instrumentation through trace and debug output. * Changed our version number scheme and set the next major release to 3.0.0 * Added EVP_MAC, an EVP layer MAC API, and a generic EVP_PKEY to EVP_MAC bridge. Supported MACs are: BLAKE2, CMAC, GMAC, HMAC, KMAC, POLY1305 and SIPHASH. * Removed the heartbeat message in DTLS feature. * Added EVP_KDF, an EVP layer KDF and PRF API, and a generic EVP_PKEY to EVP_KDF bridge. Supported KDFs are: HKDF, KBKDF, KRB5 KDF, PBKDF2, PKCS12 KDF, SCRYPT, SSH KDF, SSKDF, TLS1 PRF, X9.42 KDF and X9.63 KDF. * All of the low-level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224, SHA256, SHA384, SHA512 and Whirlpool digest functions have been deprecated. * All of the low-level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2, RC4, RC5 and SEED cipher functions have been deprecated. * All of the low-level DH, DSA, ECDH, ECDSA and RSA public key functions have been deprecated. * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0, except when RSA key exchange without SHA1 is used. * Added providers, a new pluggability concept that will replace the ENGINE API and ENGINE implementations.
OpenSSL 1.1.1
|
Revision tags: openssl-1-1-1t
|
#
1.1.1.7 |
|
07-Feb-2023 |
christos |
Import OpenSSL 1.1.1t
Changes between 1.1.1s and 1.1.1t [7 Feb 2023]
*) Fixed X.400 address type confusion in X.509 GeneralName.
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This vulnerability may allow an attacker who can provide a certificate chain and CRL (neither of which need have a valid signature) to pass arbitrary pointers to a memcmp call, creating a possible read primitive, subject to some constraints. Refer to the advisory for more information. Thanks to David Benjamin for discovering this issue. (CVE-2023-0286)
This issue has been fixed by changing the public header file definition of GENERAL_NAME so that x400Address reflects the implementation. It was not possible for any existing application to successfully use the existing definition; however, if any application references the x400Address field (e.g. in dead code), note that the type of this field has changed. There is no ABI change. [Hugo Landau]
*) Fixed Use-after-free following BIO_new_NDEF.
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. (CVE-2023-0215) [Viktor Dukhovni, Matt Caswell]
*) Fixed Double free after calling PEM_read_bio_ex.
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash.
The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.
These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. (CVE-2022-4450) [Kurt Roeckx, Matt Caswell]
*) Fixed Timing Oracle in RSA Decryption.
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. (CVE-2022-4304) [Dmitry Belyavsky, Hubert Kario]
Changes between 1.1.1r and 1.1.1s [1 Nov 2022]
*) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon]
Changes between 1.1.1q and 1.1.1r [11 Oct 2022]
*) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph]
*) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale]
*) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell]
*) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short]
*) Added the loongarch64 target [Shi Pujin]
*) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger]
*) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger]
*) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger]
*) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny]
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. (CVE-2022-2097) [Alex Chernyakhovsky, David Benjamin, Alejandro Sede��o]
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
*) In addition to the c_rehash shell command injection identified in CVE-2022-1292, further bugs where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection have been fixed.
When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell.
This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-2068) [Daniel Fiala, Tom���� Mr��z]
*) When OpenSSL TLS client is connecting without any supported elliptic curves and TLS-1.3 protocol is disabled the connection will no longer fail if a ciphersuite that does not use a key exchange based on elliptic curves can be negotiated. [Tom���� Mr��z]
Changes between 1.1.1n and 1.1.1o [3 May 2022]
*) Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-1292) [Tom���� Mr��z]
|
Revision tags: netbsd-10-base openssl-1-1-1n openssl-1-1-1m
|
#
1.1.1.6 |
|
07-Jan-2022 |
christos |
branches: 1.1.1.6.2; Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
*) Avoid loading of a dynamic engine twice. [Bernd Edlinger]
*) Fixed building on Debian with kfreebsd kernels [Mattias Ellert]
*) Prioritise DANE TLSA issuer certs over peer certs [Viktor Dukhovni]
*) Fixed random API for MacOS prior to 10.12 These MacOS versions don't support the CommonCrypto APIs [Lenny Primak]
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
*) Fixed an SM2 Decryption Buffer Overflow.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter.
A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small.
A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell]
*) Fixed various read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte.
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure.
However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function.
Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur.
The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base openssl-1-1-1k openssl-1-1-1j openssl-1-1-1i
|
#
1.1.1.5 |
|
10-Dec-2020 |
christos |
Changes between 1.1.1h and 1.1.1i [08 Dec 2020]
Fixed NULL pointer deref in the GENERAL_NAME_cmp function This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME. If an attacker can control both items being compared then this could lead to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) (CVE-2020-1971) Matt Caswell
Changes between 1.1.1g and 1.1.1h [22 Sep 2020] Certificates with explicit curve parameters are now disallowed in verification chains if the X509_V_FLAG_X509_STRICT flag is used.
Tomas Mraz
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configuring DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS.
SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options.
Viktor Dukhovni
Handshake now fails if Extended Master Secret extension is dropped on renegotiation.
Tomas Mraz
The Oracle Developer Studio compiler will start reporting deprecated APIs
|
Revision tags: openssl-1-1-1g phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 openssl-1-1-1f openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: is-mlppp-base netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; 1.1.1.3.4; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-3-0-12
|
#
1.1.1.10 |
|
25-Oct-2023 |
christos |
Import OpenSSL-3.0.12 (previous was OpenSSL-3.0.9)
### Changes between 3.0.11 and 3.0.12 [24 Oct 2023]
* Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length ([CVE-2023-5363]).
*Paul Dale*
### Changes between 3.0.10 and 3.0.11 [19 Sep 2023]
* Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions.
The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service.
([CVE-2023-4807])
*Bernd Edlinger*
### Changes between 3.0.9 and 3.0.10 [1 Aug 2023]
* Fix excessive time spent checking DH q parameter value.
The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.
If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped.
([CVE-2023-3817])
*Tom���� Mr��z*
* Fix DH_check() excessive time with over sized modulus.
The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.
However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail.
([CVE-2023-3446])
*Matt Caswell*
* Do not ignore empty associated data entries with AES-SIV.
The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call `EVP_EncryptUpdate()` (or `EVP_CipherUpdate()`) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. ([CVE-2023-2975])
Thanks to Juerg Wullschleger (Google) for discovering the issue.
The fix changes the authentication tag value and the ciphertext for applications that use empty associated data entries with AES-SIV. To decrypt data encrypted with previous versions of OpenSSL the application has to skip calls to `EVP_DecryptUpdate()` for empty associated data entries.
*Tom���� Mr��z*
|
Revision tags: openssl-3-0-9
|
#
1.1.1.9 |
|
31-May-2023 |
christos |
Import OpenSSL-3.0.9
### Changes between 3.0.8 and 3.0.9 [30 May 2023]
* Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. ([CVE-2023-2650])
To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT IDENTIFIER to canonical numeric text form if the size of that OBJECT IDENTIFIER is 586 bytes or less, and fail otherwise.
The basis for this restriction is RFC 2578 (STD 58), section 3.5. OBJECT IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at most 128 sub-identifiers, and that the maximum value that each sub- identifier may have is 2^32-1 (4294967295 decimal).
For each byte of every sub-identifier, only the 7 lower bits are part of the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with these restrictions may occupy is 32 * 128 / 7, which is approximately 586 bytes.
Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
*Richard Levitte*
* Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can trigger a crash of an application using AES-XTS decryption if the memory just after the buffer being decrypted is not mapped. Thanks to Anton Romanov (Amazon) for discovering the issue. ([CVE-2023-1255])
*Nevine Ebeid*
* Reworked the Fix for the Timing Oracle in RSA Decryption ([CVE-2022-4304]). The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 3.0.7. The new fix uses existing constant time code paths, and restores the previous performance level while fully eliminating all existing timing side channels. The fix was developed by Bernd Edlinger with testing support by Hubert Kario.
*Bernd Edlinger*
* Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention that it does not enable policy checking. Thanks to David Benjamin for discovering this issue. ([CVE-2023-0466])
*Tom���� Mr��z*
* Fixed an issue where invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. ([CVE-2023-0465])
*Matt Caswell*
* Limited the number of nodes created in a policy tree to mitigate against CVE-2023-0464. The default limit is set to 1000 nodes, which should be sufficient for most installations. If required, the limit can be adjusted by setting the OPENSSL_POLICY_TREE_NODES_MAX build time define to a desired maximum number of nodes or zero to allow unlimited growth. ([CVE-2023-0464])
*Paul Dale*
|
Revision tags: openssl-3-0-8
|
#
1.1.1.8 |
|
07-May-2023 |
christos |
Import OpenSSL 3.0.8, last import was 1.1.1t
### Major changes between OpenSSL 3.0.7 and OpenSSL 3.0.8 [7 Feb 2023]
* Fixed NULL dereference during PKCS7 data verification ([CVE-2023-0401]) * Fixed X.400 address type confusion in X.509 GeneralName ([CVE-2023-0286]) * Fixed NULL dereference validating DSA public key ([CVE-2023-0217]) * Fixed Invalid pointer dereference in d2i_PKCS7 functions ([CVE-2023-0216]) * Fixed Use-after-free following BIO_new_NDEF ([CVE-2023-0215]) * Fixed Double free after calling PEM_read_bio_ex ([CVE-2022-4450]) * Fixed Timing Oracle in RSA Decryption ([CVE-2022-4304]) * Fixed X.509 Name Constraints Read Buffer Overflow ([CVE-2022-4203]) * Fixed X.509 Policy Constraints Double Locking ([CVE-2022-3996])
### Major changes between OpenSSL 3.0.6 and OpenSSL 3.0.7 [1 Nov 2022]
* Added RIPEMD160 to the default provider. * Fixed regressions introduced in 3.0.6 version. * Fixed two buffer overflows in punycode decoding functions. ([CVE-2022-3786]) and ([CVE-2022-3602])
### Major changes between OpenSSL 3.0.5 and OpenSSL 3.0.6 [11 Oct 2022]
* Fix for custom ciphers to prevent accidental use of NULL encryption ([CVE-2022-3358])
### Major changes between OpenSSL 3.0.4 and OpenSSL 3.0.5 [5 Jul 2022]
* Fixed heap memory corruption with RSA private key operation ([CVE-2022-2274]) * Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms ([CVE-2022-2097])
### Major changes between OpenSSL 3.0.3 and OpenSSL 3.0.4 [21 Jun 2022]
* Fixed additional bugs in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection ([CVE-2022-2068])
### Major changes between OpenSSL 3.0.2 and OpenSSL 3.0.3 [3 May 2022]
* Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection ([CVE-2022-1292]) * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer certificate on an OCSP response ([CVE-2022-1343]) * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the AAD data as the MAC key ([CVE-2022-1434]) * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory occuppied by the removed hash table entries ([CVE-2022-1473])
### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever for non-prime moduli ([CVE-2022-0778])
### Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
* Fixed invalid handling of X509_verify_cert() internal errors in libssl ([CVE-2021-4044]) * Allow fetching an operation from the provider that owns an unexportable key as a fallback if that is still allowed by the property query.
### Major changes between OpenSSL 1.1.1 and OpenSSL 3.0.0 [7 sep 2021]
* Enhanced 'openssl list' with many new options. * Added migration guide to man7. * Implemented support for fully "pluggable" TLSv1.3 groups. * Added suport for Kernel TLS (KTLS). * Changed the license to the Apache License v2.0. * Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider. * Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy provider. * Added convenience functions for generating asymmetric key pairs. * Deprecated the `OCSP_REQ_CTX` type and functions. * Deprecated the `EC_KEY` and `EC_KEY_METHOD` types and functions. * Deprecated the `RSA` and `RSA_METHOD` types and functions. * Deprecated the `DSA` and `DSA_METHOD` types and functions. * Deprecated the `DH` and `DH_METHOD` types and functions. * Deprecated the `ERR_load_` functions. * Remove the `RAND_DRBG` API. * Deprecated the `ENGINE` API. * Added `OSSL_LIB_CTX`, a libcrypto library context. * Added various `_ex` functions to the OpenSSL API that support using a non-default `OSSL_LIB_CTX`. * Interactive mode is removed from the 'openssl' program. * The X25519, X448, Ed25519, Ed448, SHAKE128 and SHAKE256 algorithms are included in the FIPS provider. * X509 certificates signed using SHA1 are no longer allowed at security level 1 or higher. The default security level for TLS is 1, so certificates signed using SHA1 are by default no longer trusted to authenticate servers or clients. * enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly disabled; the project uses address sanitize/leak-detect instead. * Added a Certificate Management Protocol (CMP, RFC 4210) implementation also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712). It is part of the crypto lib and adds a 'cmp' app with a demo configuration. All widely used CMP features are supported for both clients and servers. * Added a proper HTTP client supporting GET with optional redirection, POST, arbitrary request and response content types, TLS, persistent connections, connections via HTTP(s) proxies, connections and exchange via user-defined BIOs (allowing implicit connections), and timeout checks. * Added util/check-format.pl for checking adherence to the coding guidelines. * Added OSSL_ENCODER, a generic encoder API. * Added OSSL_DECODER, a generic decoder API. * Added OSSL_PARAM_BLD, an easier to use API to OSSL_PARAM. * Added error raising macros, ERR_raise() and ERR_raise_data(). * Deprecated ERR_put_error(), ERR_get_error_line(), ERR_get_error_line_data(), ERR_peek_error_line_data(), ERR_peek_last_error_line_data() and ERR_func_error_string(). * Added OSSL_PROVIDER_available(), to check provider availibility. * Added 'openssl mac' that uses the EVP_MAC API. * Added 'openssl kdf' that uses the EVP_KDF API. * Add OPENSSL_info() and 'openssl info' to get built-in data. * Add support for enabling instrumentation through trace and debug output. * Changed our version number scheme and set the next major release to 3.0.0 * Added EVP_MAC, an EVP layer MAC API, and a generic EVP_PKEY to EVP_MAC bridge. Supported MACs are: BLAKE2, CMAC, GMAC, HMAC, KMAC, POLY1305 and SIPHASH. * Removed the heartbeat message in DTLS feature. * Added EVP_KDF, an EVP layer KDF and PRF API, and a generic EVP_PKEY to EVP_KDF bridge. Supported KDFs are: HKDF, KBKDF, KRB5 KDF, PBKDF2, PKCS12 KDF, SCRYPT, SSH KDF, SSKDF, TLS1 PRF, X9.42 KDF and X9.63 KDF. * All of the low-level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224, SHA256, SHA384, SHA512 and Whirlpool digest functions have been deprecated. * All of the low-level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2, RC4, RC5 and SEED cipher functions have been deprecated. * All of the low-level DH, DSA, ECDH, ECDSA and RSA public key functions have been deprecated. * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0, except when RSA key exchange without SHA1 is used. * Added providers, a new pluggability concept that will replace the ENGINE API and ENGINE implementations.
OpenSSL 1.1.1
|
Revision tags: openssl-1-1-1t
|
#
1.1.1.7 |
|
07-Feb-2023 |
christos |
Import OpenSSL 1.1.1t
Changes between 1.1.1s and 1.1.1t [7 Feb 2023]
*) Fixed X.400 address type confusion in X.509 GeneralName.
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This vulnerability may allow an attacker who can provide a certificate chain and CRL (neither of which need have a valid signature) to pass arbitrary pointers to a memcmp call, creating a possible read primitive, subject to some constraints. Refer to the advisory for more information. Thanks to David Benjamin for discovering this issue. (CVE-2023-0286)
This issue has been fixed by changing the public header file definition of GENERAL_NAME so that x400Address reflects the implementation. It was not possible for any existing application to successfully use the existing definition; however, if any application references the x400Address field (e.g. in dead code), note that the type of this field has changed. There is no ABI change. [Hugo Landau]
*) Fixed Use-after-free following BIO_new_NDEF.
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. (CVE-2023-0215) [Viktor Dukhovni, Matt Caswell]
*) Fixed Double free after calling PEM_read_bio_ex.
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash.
The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.
These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. (CVE-2022-4450) [Kurt Roeckx, Matt Caswell]
*) Fixed Timing Oracle in RSA Decryption.
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. (CVE-2022-4304) [Dmitry Belyavsky, Hubert Kario]
Changes between 1.1.1r and 1.1.1s [1 Nov 2022]
*) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon]
Changes between 1.1.1q and 1.1.1r [11 Oct 2022]
*) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph]
*) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale]
*) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell]
*) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short]
*) Added the loongarch64 target [Shi Pujin]
*) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger]
*) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger]
*) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger]
*) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny]
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. (CVE-2022-2097) [Alex Chernyakhovsky, David Benjamin, Alejandro Sede��o]
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
*) In addition to the c_rehash shell command injection identified in CVE-2022-1292, further bugs where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection have been fixed.
When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell.
This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-2068) [Daniel Fiala, Tom���� Mr��z]
*) When OpenSSL TLS client is connecting without any supported elliptic curves and TLS-1.3 protocol is disabled the connection will no longer fail if a ciphersuite that does not use a key exchange based on elliptic curves can be negotiated. [Tom���� Mr��z]
Changes between 1.1.1n and 1.1.1o [3 May 2022]
*) Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-1292) [Tom���� Mr��z]
|
Revision tags: netbsd-10-base openssl-1-1-1n openssl-1-1-1m
|
#
1.1.1.6 |
|
07-Jan-2022 |
christos |
branches: 1.1.1.6.2; Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
*) Avoid loading of a dynamic engine twice. [Bernd Edlinger]
*) Fixed building on Debian with kfreebsd kernels [Mattias Ellert]
*) Prioritise DANE TLSA issuer certs over peer certs [Viktor Dukhovni]
*) Fixed random API for MacOS prior to 10.12 These MacOS versions don't support the CommonCrypto APIs [Lenny Primak]
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
*) Fixed an SM2 Decryption Buffer Overflow.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter.
A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small.
A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell]
*) Fixed various read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte.
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure.
However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function.
Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur.
The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base openssl-1-1-1k openssl-1-1-1j openssl-1-1-1i
|
#
1.1.1.5 |
|
10-Dec-2020 |
christos |
Changes between 1.1.1h and 1.1.1i [08 Dec 2020]
Fixed NULL pointer deref in the GENERAL_NAME_cmp function This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME. If an attacker can control both items being compared then this could lead to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) (CVE-2020-1971) Matt Caswell
Changes between 1.1.1g and 1.1.1h [22 Sep 2020] Certificates with explicit curve parameters are now disallowed in verification chains if the X509_V_FLAG_X509_STRICT flag is used.
Tomas Mraz
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configuring DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS.
SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options.
Viktor Dukhovni
Handshake now fails if Extended Master Secret extension is dropped on renegotiation.
Tomas Mraz
The Oracle Developer Studio compiler will start reporting deprecated APIs
|
Revision tags: openssl-1-1-1g phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 openssl-1-1-1f openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: is-mlppp-base netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; 1.1.1.3.4; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-3-0-9
|
#
1.1.1.9 |
|
31-May-2023 |
christos |
Import OpenSSL-3.0.9
### Changes between 3.0.8 and 3.0.9 [30 May 2023]
* Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. ([CVE-2023-2650])
To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT IDENTIFIER to canonical numeric text form if the size of that OBJECT IDENTIFIER is 586 bytes or less, and fail otherwise.
The basis for this restriction is RFC 2578 (STD 58), section 3.5. OBJECT IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at most 128 sub-identifiers, and that the maximum value that each sub- identifier may have is 2^32-1 (4294967295 decimal).
For each byte of every sub-identifier, only the 7 lower bits are part of the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with these restrictions may occupy is 32 * 128 / 7, which is approximately 586 bytes.
Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
*Richard Levitte*
* Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can trigger a crash of an application using AES-XTS decryption if the memory just after the buffer being decrypted is not mapped. Thanks to Anton Romanov (Amazon) for discovering the issue. ([CVE-2023-1255])
*Nevine Ebeid*
* Reworked the Fix for the Timing Oracle in RSA Decryption ([CVE-2022-4304]). The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 3.0.7. The new fix uses existing constant time code paths, and restores the previous performance level while fully eliminating all existing timing side channels. The fix was developed by Bernd Edlinger with testing support by Hubert Kario.
*Bernd Edlinger*
* Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention that it does not enable policy checking. Thanks to David Benjamin for discovering this issue. ([CVE-2023-0466])
*Tom���� Mr��z*
* Fixed an issue where invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. ([CVE-2023-0465])
*Matt Caswell*
* Limited the number of nodes created in a policy tree to mitigate against CVE-2023-0464. The default limit is set to 1000 nodes, which should be sufficient for most installations. If required, the limit can be adjusted by setting the OPENSSL_POLICY_TREE_NODES_MAX build time define to a desired maximum number of nodes or zero to allow unlimited growth. ([CVE-2023-0464])
*Paul Dale*
|
Revision tags: openssl-3-0-8
|
#
1.1.1.8 |
|
07-May-2023 |
christos |
Import OpenSSL 3.0.8, last import was 1.1.1t
### Major changes between OpenSSL 3.0.7 and OpenSSL 3.0.8 [7 Feb 2023]
* Fixed NULL dereference during PKCS7 data verification ([CVE-2023-0401]) * Fixed X.400 address type confusion in X.509 GeneralName ([CVE-2023-0286]) * Fixed NULL dereference validating DSA public key ([CVE-2023-0217]) * Fixed Invalid pointer dereference in d2i_PKCS7 functions ([CVE-2023-0216]) * Fixed Use-after-free following BIO_new_NDEF ([CVE-2023-0215]) * Fixed Double free after calling PEM_read_bio_ex ([CVE-2022-4450]) * Fixed Timing Oracle in RSA Decryption ([CVE-2022-4304]) * Fixed X.509 Name Constraints Read Buffer Overflow ([CVE-2022-4203]) * Fixed X.509 Policy Constraints Double Locking ([CVE-2022-3996])
### Major changes between OpenSSL 3.0.6 and OpenSSL 3.0.7 [1 Nov 2022]
* Added RIPEMD160 to the default provider. * Fixed regressions introduced in 3.0.6 version. * Fixed two buffer overflows in punycode decoding functions. ([CVE-2022-3786]) and ([CVE-2022-3602])
### Major changes between OpenSSL 3.0.5 and OpenSSL 3.0.6 [11 Oct 2022]
* Fix for custom ciphers to prevent accidental use of NULL encryption ([CVE-2022-3358])
### Major changes between OpenSSL 3.0.4 and OpenSSL 3.0.5 [5 Jul 2022]
* Fixed heap memory corruption with RSA private key operation ([CVE-2022-2274]) * Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms ([CVE-2022-2097])
### Major changes between OpenSSL 3.0.3 and OpenSSL 3.0.4 [21 Jun 2022]
* Fixed additional bugs in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection ([CVE-2022-2068])
### Major changes between OpenSSL 3.0.2 and OpenSSL 3.0.3 [3 May 2022]
* Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection ([CVE-2022-1292]) * Fixed a bug in the function `OCSP_basic_verify` that verifies the signer certificate on an OCSP response ([CVE-2022-1343]) * Fixed a bug where the RC4-MD5 ciphersuite incorrectly used the AAD data as the MAC key ([CVE-2022-1434]) * Fix a bug in the OPENSSL_LH_flush() function that breaks reuse of the memory occuppied by the removed hash table entries ([CVE-2022-1473])
### Major changes between OpenSSL 3.0.1 and OpenSSL 3.0.2 [15 Mar 2022]
* Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever for non-prime moduli ([CVE-2022-0778])
### Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
* Fixed invalid handling of X509_verify_cert() internal errors in libssl ([CVE-2021-4044]) * Allow fetching an operation from the provider that owns an unexportable key as a fallback if that is still allowed by the property query.
### Major changes between OpenSSL 1.1.1 and OpenSSL 3.0.0 [7 sep 2021]
* Enhanced 'openssl list' with many new options. * Added migration guide to man7. * Implemented support for fully "pluggable" TLSv1.3 groups. * Added suport for Kernel TLS (KTLS). * Changed the license to the Apache License v2.0. * Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider. * Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy provider. * Added convenience functions for generating asymmetric key pairs. * Deprecated the `OCSP_REQ_CTX` type and functions. * Deprecated the `EC_KEY` and `EC_KEY_METHOD` types and functions. * Deprecated the `RSA` and `RSA_METHOD` types and functions. * Deprecated the `DSA` and `DSA_METHOD` types and functions. * Deprecated the `DH` and `DH_METHOD` types and functions. * Deprecated the `ERR_load_` functions. * Remove the `RAND_DRBG` API. * Deprecated the `ENGINE` API. * Added `OSSL_LIB_CTX`, a libcrypto library context. * Added various `_ex` functions to the OpenSSL API that support using a non-default `OSSL_LIB_CTX`. * Interactive mode is removed from the 'openssl' program. * The X25519, X448, Ed25519, Ed448, SHAKE128 and SHAKE256 algorithms are included in the FIPS provider. * X509 certificates signed using SHA1 are no longer allowed at security level 1 or higher. The default security level for TLS is 1, so certificates signed using SHA1 are by default no longer trusted to authenticate servers or clients. * enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly disabled; the project uses address sanitize/leak-detect instead. * Added a Certificate Management Protocol (CMP, RFC 4210) implementation also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712). It is part of the crypto lib and adds a 'cmp' app with a demo configuration. All widely used CMP features are supported for both clients and servers. * Added a proper HTTP client supporting GET with optional redirection, POST, arbitrary request and response content types, TLS, persistent connections, connections via HTTP(s) proxies, connections and exchange via user-defined BIOs (allowing implicit connections), and timeout checks. * Added util/check-format.pl for checking adherence to the coding guidelines. * Added OSSL_ENCODER, a generic encoder API. * Added OSSL_DECODER, a generic decoder API. * Added OSSL_PARAM_BLD, an easier to use API to OSSL_PARAM. * Added error raising macros, ERR_raise() and ERR_raise_data(). * Deprecated ERR_put_error(), ERR_get_error_line(), ERR_get_error_line_data(), ERR_peek_error_line_data(), ERR_peek_last_error_line_data() and ERR_func_error_string(). * Added OSSL_PROVIDER_available(), to check provider availibility. * Added 'openssl mac' that uses the EVP_MAC API. * Added 'openssl kdf' that uses the EVP_KDF API. * Add OPENSSL_info() and 'openssl info' to get built-in data. * Add support for enabling instrumentation through trace and debug output. * Changed our version number scheme and set the next major release to 3.0.0 * Added EVP_MAC, an EVP layer MAC API, and a generic EVP_PKEY to EVP_MAC bridge. Supported MACs are: BLAKE2, CMAC, GMAC, HMAC, KMAC, POLY1305 and SIPHASH. * Removed the heartbeat message in DTLS feature. * Added EVP_KDF, an EVP layer KDF and PRF API, and a generic EVP_PKEY to EVP_KDF bridge. Supported KDFs are: HKDF, KBKDF, KRB5 KDF, PBKDF2, PKCS12 KDF, SCRYPT, SSH KDF, SSKDF, TLS1 PRF, X9.42 KDF and X9.63 KDF. * All of the low-level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224, SHA256, SHA384, SHA512 and Whirlpool digest functions have been deprecated. * All of the low-level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2, RC4, RC5 and SEED cipher functions have been deprecated. * All of the low-level DH, DSA, ECDH, ECDSA and RSA public key functions have been deprecated. * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0, except when RSA key exchange without SHA1 is used. * Added providers, a new pluggability concept that will replace the ENGINE API and ENGINE implementations.
OpenSSL 1.1.1
|
Revision tags: openssl-1-1-1t
|
#
1.1.1.7 |
|
07-Feb-2023 |
christos |
Import OpenSSL 1.1.1t
Changes between 1.1.1s and 1.1.1t [7 Feb 2023]
*) Fixed X.400 address type confusion in X.509 GeneralName.
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This vulnerability may allow an attacker who can provide a certificate chain and CRL (neither of which need have a valid signature) to pass arbitrary pointers to a memcmp call, creating a possible read primitive, subject to some constraints. Refer to the advisory for more information. Thanks to David Benjamin for discovering this issue. (CVE-2023-0286)
This issue has been fixed by changing the public header file definition of GENERAL_NAME so that x400Address reflects the implementation. It was not possible for any existing application to successfully use the existing definition; however, if any application references the x400Address field (e.g. in dead code), note that the type of this field has changed. There is no ABI change. [Hugo Landau]
*) Fixed Use-after-free following BIO_new_NDEF.
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. (CVE-2023-0215) [Viktor Dukhovni, Matt Caswell]
*) Fixed Double free after calling PEM_read_bio_ex.
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash.
The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.
These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. (CVE-2022-4450) [Kurt Roeckx, Matt Caswell]
*) Fixed Timing Oracle in RSA Decryption.
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. (CVE-2022-4304) [Dmitry Belyavsky, Hubert Kario]
Changes between 1.1.1r and 1.1.1s [1 Nov 2022]
*) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon]
Changes between 1.1.1q and 1.1.1r [11 Oct 2022]
*) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph]
*) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale]
*) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell]
*) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short]
*) Added the loongarch64 target [Shi Pujin]
*) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger]
*) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger]
*) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger]
*) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny]
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. (CVE-2022-2097) [Alex Chernyakhovsky, David Benjamin, Alejandro Sede��o]
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
*) In addition to the c_rehash shell command injection identified in CVE-2022-1292, further bugs where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection have been fixed.
When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell.
This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-2068) [Daniel Fiala, Tom���� Mr��z]
*) When OpenSSL TLS client is connecting without any supported elliptic curves and TLS-1.3 protocol is disabled the connection will no longer fail if a ciphersuite that does not use a key exchange based on elliptic curves can be negotiated. [Tom���� Mr��z]
Changes between 1.1.1n and 1.1.1o [3 May 2022]
*) Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-1292) [Tom���� Mr��z]
|
Revision tags: netbsd-10-base openssl-1-1-1n openssl-1-1-1m
|
#
1.1.1.6 |
|
07-Jan-2022 |
christos |
branches: 1.1.1.6.2; Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
*) Avoid loading of a dynamic engine twice. [Bernd Edlinger]
*) Fixed building on Debian with kfreebsd kernels [Mattias Ellert]
*) Prioritise DANE TLSA issuer certs over peer certs [Viktor Dukhovni]
*) Fixed random API for MacOS prior to 10.12 These MacOS versions don't support the CommonCrypto APIs [Lenny Primak]
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
*) Fixed an SM2 Decryption Buffer Overflow.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter.
A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small.
A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell]
*) Fixed various read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte.
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure.
However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function.
Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur.
The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base openssl-1-1-1k openssl-1-1-1j openssl-1-1-1i
|
#
1.1.1.5 |
|
10-Dec-2020 |
christos |
Changes between 1.1.1h and 1.1.1i [08 Dec 2020]
Fixed NULL pointer deref in the GENERAL_NAME_cmp function This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME. If an attacker can control both items being compared then this could lead to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) (CVE-2020-1971) Matt Caswell
Changes between 1.1.1g and 1.1.1h [22 Sep 2020] Certificates with explicit curve parameters are now disallowed in verification chains if the X509_V_FLAG_X509_STRICT flag is used.
Tomas Mraz
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configuring DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS.
SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options.
Viktor Dukhovni
Handshake now fails if Extended Master Secret extension is dropped on renegotiation.
Tomas Mraz
The Oracle Developer Studio compiler will start reporting deprecated APIs
|
Revision tags: openssl-1-1-1g phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 openssl-1-1-1f openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: is-mlppp-base netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; 1.1.1.3.4; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-1-1-1t
|
#
1.1.1.7 |
|
07-Feb-2023 |
christos |
Import OpenSSL 1.1.1t
Changes between 1.1.1s and 1.1.1t [7 Feb 2023]
*) Fixed X.400 address type confusion in X.509 GeneralName.
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This vulnerability may allow an attacker who can provide a certificate chain and CRL (neither of which need have a valid signature) to pass arbitrary pointers to a memcmp call, creating a possible read primitive, subject to some constraints. Refer to the advisory for more information. Thanks to David Benjamin for discovering this issue. (CVE-2023-0286)
This issue has been fixed by changing the public header file definition of GENERAL_NAME so that x400Address reflects the implementation. It was not possible for any existing application to successfully use the existing definition; however, if any application references the x400Address field (e.g. in dead code), note that the type of this field has changed. There is no ABI change. [Hugo Landau]
*) Fixed Use-after-free following BIO_new_NDEF.
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. (CVE-2023-0215) [Viktor Dukhovni, Matt Caswell]
*) Fixed Double free after calling PEM_read_bio_ex.
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash.
The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.
These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. (CVE-2022-4450) [Kurt Roeckx, Matt Caswell]
*) Fixed Timing Oracle in RSA Decryption.
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. (CVE-2022-4304) [Dmitry Belyavsky, Hubert Kario]
Changes between 1.1.1r and 1.1.1s [1 Nov 2022]
*) Fixed a regression introduced in 1.1.1r version not refreshing the certificate data to be signed before signing the certificate. [Gibeom Gwon]
Changes between 1.1.1q and 1.1.1r [11 Oct 2022]
*) Fixed the linux-mips64 Configure target which was missing the SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that platform. [Adam Joseph]
*) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was causing incorrect results in some cases as a result. [Paul Dale]
*) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to report correct results in some cases [Matt Caswell]
*) Fixed a regression introduced in 1.1.1o for re-signing certificates with different key sizes [Todd Short]
*) Added the loongarch64 target [Shi Pujin]
*) Fixed a DRBG seed propagation thread safety issue [Bernd Edlinger]
*) Fixed a memory leak in tls13_generate_secret [Bernd Edlinger]
*) Fixed reported performance degradation on aarch64. Restored the implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid 32-bit lane assignment in CTR mode") for 64bit targets only, since it is reportedly 2-17% slower and the silicon errata only affects 32bit targets. The new algorithm is still used for 32 bit targets. [Bernd Edlinger]
*) Added a missing header for memcmp that caused compilation failure on some platforms [Gregor Jasny]
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation would not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. (CVE-2022-2097) [Alex Chernyakhovsky, David Benjamin, Alejandro Sede��o]
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
*) In addition to the c_rehash shell command injection identified in CVE-2022-1292, further bugs where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection have been fixed.
When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell.
This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-2068) [Daniel Fiala, Tom���� Mr��z]
*) When OpenSSL TLS client is connecting without any supported elliptic curves and TLS-1.3 protocol is disabled the connection will no longer fail if a ciphersuite that does not use a key exchange based on elliptic curves can be negotiated. [Tom���� Mr��z]
Changes between 1.1.1n and 1.1.1o [3 May 2022]
*) Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. (CVE-2022-1292) [Tom���� Mr��z]
|
Revision tags: netbsd-10-base openssl-1-1-1n openssl-1-1-1m
|
#
1.1.1.6 |
|
07-Jan-2022 |
christos |
Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
*) Avoid loading of a dynamic engine twice. [Bernd Edlinger]
*) Fixed building on Debian with kfreebsd kernels [Mattias Ellert]
*) Prioritise DANE TLSA issuer certs over peer certs [Viktor Dukhovni]
*) Fixed random API for MacOS prior to 10.12 These MacOS versions don't support the CommonCrypto APIs [Lenny Primak]
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
*) Fixed an SM2 Decryption Buffer Overflow.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter.
A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small.
A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell]
*) Fixed various read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte.
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure.
However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function.
Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur.
The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base openssl-1-1-1k openssl-1-1-1j openssl-1-1-1i
|
#
1.1.1.5 |
|
10-Dec-2020 |
christos |
Changes between 1.1.1h and 1.1.1i [08 Dec 2020]
Fixed NULL pointer deref in the GENERAL_NAME_cmp function This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME. If an attacker can control both items being compared then this could lead to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) (CVE-2020-1971) Matt Caswell
Changes between 1.1.1g and 1.1.1h [22 Sep 2020] Certificates with explicit curve parameters are now disallowed in verification chains if the X509_V_FLAG_X509_STRICT flag is used.
Tomas Mraz
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configuring DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS.
SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options.
Viktor Dukhovni
Handshake now fails if Extended Master Secret extension is dropped on renegotiation.
Tomas Mraz
The Oracle Developer Studio compiler will start reporting deprecated APIs
|
Revision tags: openssl-1-1-1g phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 openssl-1-1-1f openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: is-mlppp-base netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; 1.1.1.3.4; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-1-1-1m
|
#
1.1.1.6 |
|
07-Jan-2022 |
christos |
Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
*) Avoid loading of a dynamic engine twice. [Bernd Edlinger]
*) Fixed building on Debian with kfreebsd kernels [Mattias Ellert]
*) Prioritise DANE TLSA issuer certs over peer certs [Viktor Dukhovni]
*) Fixed random API for MacOS prior to 10.12 These MacOS versions don't support the CommonCrypto APIs [Lenny Primak]
Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
*) Fixed an SM2 Decryption Buffer Overflow.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter.
A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small.
A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell]
*) Fixed various read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte.
Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure.
However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function.
Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur.
The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base openssl-1-1-1k openssl-1-1-1j openssl-1-1-1i
|
#
1.1.1.5 |
|
10-Dec-2020 |
christos |
Changes between 1.1.1h and 1.1.1i [08 Dec 2020]
Fixed NULL pointer deref in the GENERAL_NAME_cmp function This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME. If an attacker can control both items being compared then this could lead to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) (CVE-2020-1971) Matt Caswell
Changes between 1.1.1g and 1.1.1h [22 Sep 2020] Certificates with explicit curve parameters are now disallowed in verification chains if the X509_V_FLAG_X509_STRICT flag is used.
Tomas Mraz
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configuring DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS.
SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options.
Viktor Dukhovni
Handshake now fails if Extended Master Secret extension is dropped on renegotiation.
Tomas Mraz
The Oracle Developer Studio compiler will start reporting deprecated APIs
|
Revision tags: openssl-1-1-1g phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 openssl-1-1-1f openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: is-mlppp-base netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; 1.1.1.3.4; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-1-1-1i
|
#
1.1.1.5 |
|
10-Dec-2020 |
christos |
Changes between 1.1.1h and 1.1.1i [08 Dec 2020]
Fixed NULL pointer deref in the GENERAL_NAME_cmp function This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME. If an attacker can control both items being compared then this could lead to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes:
Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) (CVE-2020-1971) Matt Caswell
Changes between 1.1.1g and 1.1.1h [22 Sep 2020] Certificates with explicit curve parameters are now disallowed in verification chains if the X509_V_FLAG_X509_STRICT flag is used.
Tomas Mraz
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configuring DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS.
SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options.
Viktor Dukhovni
Handshake now fails if Extended Master Secret extension is dropped on renegotiation.
Tomas Mraz
The Oracle Developer Studio compiler will start reporting deprecated APIs
|
Revision tags: openssl-1-1-1g phil-wifi-20200421 phil-wifi-20200411 phil-wifi-20200406 openssl-1-1-1f openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: is-mlppp-base netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; 1.1.1.3.4; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-1-1-1e
|
#
1.1.1.4 |
|
22-Mar-2020 |
christos |
Changes between 1.1.1d and 1.1.1e [17 Mar 2020] *) Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong. [Matt Caswell]
*) Check that ed25519 and ed448 are allowed by the security level. Previously signature algorithms not using an MD were not being checked that they were allowed by the security level. [Kurt Roeckx]
*) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername() was not quite right. The behaviour was not consistent between resumption and normal handshakes, and also not quite consistent with historical behaviour. The behaviour in various scenarios has been clarified and it has been updated to make it match historical behaviour as closely as possible. [Matt Caswell]
*) [VMS only] The header files that the VMS compilers include automatically, __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that the C++ compiler doesn't understand. This is a shortcoming in the compiler, but can be worked around with __cplusplus guards.
C++ applications that use OpenSSL libraries must be compiled using the qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL functions. Otherwise, only functions with symbols of less than 31 characters can be used, as the linker will not be able to successfully resolve symbols with longer names. [Richard Levitte]
*) Corrected the documentation of the return values from the EVP_DigestSign* set of functions. The documentation mentioned negative values for some errors, but this was never the case, so the mention of negative values was removed.
Code that followed the documentation and thereby check with something like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed. [Richard Levitte]
*) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. (CVE-2019-1551) [Andy Polyakov]
*) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY. The presence of this system service is determined at run-time. [Richard Levitte]
*) Added newline escaping functionality to a filename when using openssl dgst. This output format is to replicate the output format found in the '*sum' checksum programs. This aims to preserve backward compatibility. [Matt Eaton, Richard Levitte, and Paul Dale]
*) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just the first value. [Jon Spillett]
|
Revision tags: netbsd-9-0-RELEASE netbsd-9-0-RC2 openssl-1-1-1d netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
branches: 1.1.1.3.2; Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: phil-wifi-20190609 openssl-1-1-1c
|
#
1.1.1.3 |
|
09-Jun-2019 |
christos |
Import 1.1.1c:
Changes between 1.1.1b and 1.1.1c [28 May 2019]
*) Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.
This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'. [Richard Levitte]
*) Enable SHA3 pre-hashing for ECDSA and DSA. [Patrick Steuer]
*) Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey app when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation apps to use 2048 bits by default. [Kurt Roeckx]
*) Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly. [Paul Yang, Joshua Lock]
*) Add the missing accessor EVP_PKEY_get0_engine() [Matt Caswell]
*) Have apps like 's_client' and 's_server' output the signature scheme along with other cipher suite parameters when debugging. [Lorinczy Zsigmond]
*) Make OPENSSL_config() error agnostic again. [Richard Levitte]
*) Do the error handling in RSA decryption constant time. [Bernd Edlinger]
*) Prevent over long nonces in ChaCha20-Poly1305.
ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.
It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.
Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.
This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. (CVE-2019-1543) [Matt Caswell]
*) Ensure that SM2 only uses SM3 as digest algorithm [Paul Yang]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|
Revision tags: openssl-1-1-1b
|
#
1.1.1.2 |
|
12-Mar-2019 |
christos |
Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
*) Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications. [Matt Caswell]
*) Fix a bug in the computation of the endpoint-pair shared secret used by DTLS over SCTP. This breaks interoperability with older versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling interoperability with such broken implementations. However, enabling this switch breaks interoperability with correct implementations.
*) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed. [Bernd Edlinger]
*) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0(). [Richard Levitte]
*) Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution. [Richard Levitte]
|
Revision tags: pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 openssl-1-1-1a pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 openssl-1-1-1
|
#
1.1.1.1 |
|
23-Sep-2018 |
christos |
branches: 1.1.1.1.2; OpenSSL CHANGES _______________
This is a high-level summary of the most important changes. For a full list of changes, see the git commit log; for example, https://github.com/openssl/openssl/commits/ and pick the appropriate release branch.
Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
*) Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello [Benjamin Kaduk]
*) Add SM2 base algorithm support. [Jack Lloyd]
*) s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb. [Patrick Steuer]
*) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only. [Richard Levitte]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates. [Billy Bob Brumley, Nicola Tuveri]
*) Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar]
*) Increase the number of Miller-Rabin rounds for DSA key generating to 64. [Kurt Roeckx]
*) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well. [Richard Levitte]
*) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication. [Andy Polyakov]
*) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Add a scaffold to optionally enhance the Montgomery ladder implementation for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms. [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
*) Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open(). [Paul Dale]
*) Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors. [Matt Caswell]
*) AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed. [Andy Polyakov]
*) Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default. [Billy Bob Brumley]
*) Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks. [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
*) Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell]
*) Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation. [Matt Caswell]
*) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again. [Kurt Roeckx]
*) When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases. [Richard Levitte]
*) Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation. [Billy Bob Brumley]
*) Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves. [Billy Bob Brumley]
*) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication. [Billy Bob Brumley]
*) Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida Garc��a, Sohaib ul Hassan]
*) Updated CONTRIBUTING [Rich Salz]
*) Updated DRBG / RAND to request nonce and additional low entropy randomness from the system. [Matthias St. Pierre]
*) Updated 'openssl rehash' to use OpenSSL consistent default. [Richard Levitte]
*) Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised. [Matt Caswell]
*) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA [Matt Caswell]
*) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases. [Ingo Schwarze, Rich Salz]
*) Added output of accepting IP address and port for 'openssl s_server' [Richard Levitte]
*) Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites() [Matt Caswell]
*) Memory allocation failures consistenly add an error to the error stack. [Rich Salz]
*) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid. [Bernd Edlinger]
*) Load any config file by default when libssl is used. [Matt Caswell]
*) Added new public header file <openssl/rand_drbg.h> and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview. [Matthias St. Pierre]
*) QNX support removed (cannot find contributors to get their approval for the license change). [Rich Salz]
*) TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details. [Matt Caswell]
*) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information. [Matt Caswell]
*) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr. [Viktor Dukhovni]
*) Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg. [Matt Caswell]
*) Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them. [Richard Levitte]
*) Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3 [Matt Caswell]
*) Grand redesign of the OpenSSL random generator
The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.
Some of its new features are: o Support for multiple DRBG instances with seed chaining. o The default RAND method makes use of a DRBG. o There is a public and private DRBG instance. o The DRBG instances are fork-safe. o Keep all global DRBG instances on the secure heap if it is enabled. o The public and private DRBG instance are per thread for lock free operation [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
*) Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data. [Richard Levitte]
*) Added processing of "make variables" to Configure. [Richard Levitte]
*) Added SHA512/224 and SHA512/256 algorithm support. [Paul Dale]
*) The last traces of Netware support, first removed in 1.1.0, have now been removed. [Rich Salz]
*) Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent). [Richard Levitte]
*) Make it possible to have environment variable assignments as arguments to config / Configure. [Richard Levitte]
*) Add multi-prime RSA (RFC 8017) support. [Paul Yang]
*) Add SM3 implemented according to GB/T 32905-2016 [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Mo�� [Filipe Raimundo da Silva]
*) Add SM4 implemented according to GB/T 32907-2016. [ Jack Lloyd <jack.lloyd@ribose.com>, Ronald Tse <ronald.tse@ribose.com>, Erick Borsboom <erick.borsboom@ribose.com> ]
*) Reimplement -newreq-nodes and ERR_error_string_n; the original author does not agree with the license change. [Rich Salz]
*) Add ARIA AEAD TLS support. [Jon Spillett]
*) Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0 [Rich Salz]
*) Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors. [Richard Levitte]
*) Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this. [Rich Salz]
*) Add SHA3. [Andy Polyakov]
*) The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).
To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE. [Richard Levitte]
*) Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme. [Richard Levitte]
*) Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them. [Richard Levitte]
*) Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:
OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules. [Richard Levitte and Tim Hudson]
*) Removed BSD cryptodev engine. [Rich Salz]
*) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. [Richard Levitte]
*) In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. [Richard Levitte]
*) Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2. [Tomas Mraz <tmraz@fedoraproject.org>]
*) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. [Matt Caswell]
*) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0. [Richard Levitte]
*) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t. [Richard Levitte, Andy Polyakov]
*) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc. [Richard Levitte]
*) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'. [Richard Levitte]
*) The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs. [Paul Dale]
*) x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines. [Andy Polyakov]
*) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op. [Richard Levitte]
*) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support. [Richard Levitte]
*) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K��sper]
*) Add support for ARIA [Paul Dale]
*) s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername". [Matt Caswell]
*) Add support for SipHash [Todd Short]
*) OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. [Matt Caswell]
*) 'openssl passwd' can now produce SHA256 and SHA512 based output, using the algorithm defined in https://www.akkadia.org/drepper/SHA-crypt.txt [Richard Levitte]
*) Heartbeat support has been removed; the ABI is changed for now. [Richard Levitte, Rich Salz]
*) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd. [Emilia K��sper]
*) The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL. [Rich Salz]
|