NEWS revision 127128
155714Skris 255714Skris NEWS 355714Skris ==== 455714Skris 555714Skris This file gives a brief overview of the major changes between each OpenSSL 655714Skris release. For more details please read the CHANGES file. 755714Skris 8127128Snectar Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d: 9127128Snectar 10127128Snectar o Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug 11127128Snectar o Security: Fix null-pointer assignment in do_change_cipher_spec() 12127128Snectar o Allow multiple active certificates with same subject in CA index 13127128Snectar o Multiple X590 verification fixes 14127128Snectar o Speed up HMAC and other operations 15127128Snectar 16120631Snectar Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c: 17120631Snectar 18120631Snectar o Security: fix various ASN1 parsing bugs. 19120631Snectar o New -ignore_err option to OCSP utility. 20120631Snectar o Various interop and bug fixes in S/MIME code. 21120631Snectar o SSL/TLS protocol fix for unrequested client certificates. 22120631Snectar 23120631Snectar Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b: 24120631Snectar 25120631Snectar o Security: counter the Klima-Pokorny-Rosa extension of 26120631Snectar Bleichbacher's attack 27120631Snectar o Security: make RSA blinding default. 28120631Snectar o Configuration: Irix fixes, AIX fixes, better mingw support. 29120631Snectar o Support for new platforms: linux-ia64-ecc. 30120631Snectar o Build: shared library support fixes. 31120631Snectar o ASN.1: treat domainComponent correctly. 32120631Snectar o Documentation: fixes and additions. 33120631Snectar 34111147Snectar Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a: 35111147Snectar 36111147Snectar o Security: Important security related bugfixes. 37111147Snectar o Enhanced compatibility with MIT Kerberos. 38111147Snectar o Can be built without the ENGINE framework. 39111147Snectar o IA32 assembler enhancements. 40111147Snectar o Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64. 41111147Snectar o Configuration: the no-err option now works properly. 42111147Snectar o SSL/TLS: now handles manual certificate chain building. 43111147Snectar o SSL/TLS: certain session ID malfunctions corrected. 44111147Snectar 45109998Smarkm Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7: 46109998Smarkm 47109998Smarkm o New library section OCSP. 48109998Smarkm o Complete rewrite of ASN1 code. 49109998Smarkm o CRL checking in verify code and openssl utility. 50109998Smarkm o Extension copying in 'ca' utility. 51109998Smarkm o Flexible display options in 'ca' utility. 52109998Smarkm o Provisional support for international characters with UTF8. 53109998Smarkm o Support for external crypto devices ('engine') is no longer 54109998Smarkm a separate distribution. 55109998Smarkm o New elliptic curve library section. 56109998Smarkm o New AES (Rijndael) library section. 57109998Smarkm o Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit, 58109998Smarkm Linux x86_64, Linux 64-bit on Sparc v9 59109998Smarkm o Extended support for some platforms: VxWorks 60109998Smarkm o Enhanced support for shared libraries. 61109998Smarkm o Now only builds PIC code when shared library support is requested. 62109998Smarkm o Support for pkg-config. 63109998Smarkm o Lots of new manuals. 64109998Smarkm o Makes symbolic links to or copies of manuals to cover all described 65109998Smarkm functions. 66109998Smarkm o Change DES API to clean up the namespace (some applications link also 67109998Smarkm against libdes providing similar functions having the same name). 68109998Smarkm Provide macros for backward compatibility (will be removed in the 69109998Smarkm future). 70109998Smarkm o Unify handling of cryptographic algorithms (software and engine) 71109998Smarkm to be available via EVP routines for asymmetric and symmetric ciphers. 72109998Smarkm o NCONF: new configuration handling routines. 73109998Smarkm o Change API to use more 'const' modifiers to improve error checking 74109998Smarkm and help optimizers. 75109998Smarkm o Finally remove references to RSAref. 76109998Smarkm o Reworked parts of the BIGNUM code. 77109998Smarkm o Support for new engines: Broadcom ubsec, Accelerated Encryption 78109998Smarkm Processing, IBM 4758. 79109998Smarkm o A few new engines added in the demos area. 80109998Smarkm o Extended and corrected OID (object identifier) table. 81109998Smarkm o PRNG: query at more locations for a random device, automatic query for 82109998Smarkm EGD style random sources at several locations. 83109998Smarkm o SSL/TLS: allow optional cipher choice according to server's preference. 84109998Smarkm o SSL/TLS: allow server to explicitly set new session ids. 85109998Smarkm o SSL/TLS: support Kerberos cipher suites (RFC2712). 86109998Smarkm Only supports MIT Kerberos for now. 87109998Smarkm o SSL/TLS: allow more precise control of renegotiations and sessions. 88109998Smarkm o SSL/TLS: add callback to retrieve SSL/TLS messages. 89109998Smarkm o SSL/TLS: support AES cipher suites (RFC3268). 90109998Smarkm 91120631Snectar Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k: 92120631Snectar 93120631Snectar o Security: fix various ASN1 parsing bugs. 94120631Snectar o SSL/TLS protocol fix for unrequested client certificates. 95120631Snectar 96120631Snectar Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j: 97120631Snectar 98120631Snectar o Security: counter the Klima-Pokorny-Rosa extension of 99120631Snectar Bleichbacher's attack 100120631Snectar o Security: make RSA blinding default. 101120631Snectar o Build: shared library support fixes. 102120631Snectar 103111147Snectar Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i: 104111147Snectar 105111147Snectar o Important security related bugfixes. 106111147Snectar 107109998Smarkm Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h: 108109998Smarkm 109109998Smarkm o New configuration targets for Tandem OSS and A/UX. 110109998Smarkm o New OIDs for Microsoft attributes. 111109998Smarkm o Better handling of SSL session caching. 112109998Smarkm o Better comparison of distinguished names. 113109998Smarkm o Better handling of shared libraries in a mixed GNU/non-GNU environment. 114109998Smarkm o Support assembler code with Borland C. 115109998Smarkm o Fixes for length problems. 116109998Smarkm o Fixes for uninitialised variables. 117109998Smarkm o Fixes for memory leaks, some unusual crashes and some race conditions. 118109998Smarkm o Fixes for smaller building problems. 119109998Smarkm o Updates of manuals, FAQ and other instructive documents. 120109998Smarkm 121101618Snectar Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g: 122101618Snectar 123101618Snectar o Important building fixes on Unix. 124101618Snectar 125101613Snectar Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f: 126101613Snectar 127101613Snectar o Various important bugfixes. 128101613Snectar 129101613Snectar Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e: 130101613Snectar 131101613Snectar o Important security related bugfixes. 132101613Snectar o Various SSL/TLS library bugfixes. 133101613Snectar 134100928Snectar Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d: 13589837Skris 13689837Skris o Various SSL/TLS library bugfixes. 137100928Snectar o Fix DH parameter generation for 'non-standard' generators. 138100928Snectar 139100928Snectar Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c: 140100928Snectar 141100928Snectar o Various SSL/TLS library bugfixes. 14289837Skris o BIGNUM library fixes. 14389837Skris o RSA OAEP and random number generation fixes. 14489837Skris o Object identifiers corrected and added. 14589837Skris o Add assembler BN routines for IA64. 14689837Skris o Add support for OS/390 Unix, UnixWare with gcc, OpenUNIX 8, 14789837Skris MIPS Linux; shared library support for Irix, HP-UX. 14889837Skris o Add crypto accelerator support for AEP, Baltimore SureWare, 14989837Skris Broadcom and Cryptographic Appliance's keyserver 15089837Skris [in 0.9.6c-engine release]. 15189837Skris 152100928Snectar Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b: 15379998Skris 15479998Skris o Security fix: PRNG improvements. 15579998Skris o Security fix: RSA OAEP check. 15679998Skris o Security fix: Reinsert and fix countermeasure to Bleichbacher's 15779998Skris attack. 15879998Skris o MIPS bug fix in BIGNUM. 15979998Skris o Bug fix in "openssl enc". 16079998Skris o Bug fix in X.509 printing routine. 16179998Skris o Bug fix in DSA verification routine and DSA S/MIME verification. 16279998Skris o Bug fix to make PRNG thread-safe. 16379998Skris o Bug fix in RAND_file_name(). 16479998Skris o Bug fix in compatibility mode trust settings. 16579998Skris o Bug fix in blowfish EVP. 16679998Skris o Increase default size for BIO buffering filter. 16779998Skris o Compatibility fixes in some scripts. 16879998Skris 16976866Skris Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a: 17076866Skris 17176866Skris o Security fix: change behavior of OpenSSL to avoid using 17276866Skris environment variables when running as root. 17376866Skris o Security fix: check the result of RSA-CRT to reduce the 17476866Skris possibility of deducing the private key from an incorrectly 17576866Skris calculated signature. 17676866Skris o Security fix: prevent Bleichenbacher's DSA attack. 17776866Skris o Security fix: Zero the premaster secret after deriving the 17876866Skris master secret in DH ciphersuites. 17976866Skris o Reimplement SSL_peek(), which had various problems. 18076866Skris o Compatibility fix: the function des_encrypt() renamed to 18176866Skris des_encrypt1() to avoid clashes with some Unixen libc. 18276866Skris o Bug fixes for Win32, HP/UX and Irix. 18376866Skris o Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and 18476866Skris memory checking routines. 185100936Snectar o Bug fixes for RSA operations in threaded environments. 18676866Skris o Bug fixes in misc. openssl applications. 18776866Skris o Remove a few potential memory leaks. 18876866Skris o Add tighter checks of BIGNUM routines. 18976866Skris o Shared library support has been reworked for generality. 19076866Skris o More documentation. 19176866Skris o New function BN_rand_range(). 19276866Skris o Add "-rand" option to openssl s_client and s_server. 19376866Skris 19468651Skris Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6: 19568651Skris 19668651Skris o Some documentation for BIO and SSL libraries. 19768651Skris o Enhanced chain verification using key identifiers. 19868651Skris o New sign and verify options to 'dgst' application. 19968651Skris o Support for DER and PEM encoded messages in 'smime' application. 20068651Skris o New 'rsautl' application, low level RSA utility. 20168651Skris o MD4 now included. 20268651Skris o Bugfix for SSL rollback padding check. 20368651Skris o Support for external crypto devices [1]. 20468651Skris o Enhanced EVP interface. 20568651Skris 20668651Skris [1] The support for external crypto devices is currently a separate 20768651Skris distribution. See the file README.ENGINE. 20868651Skris 20959191Skris Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a: 21059191Skris 21159191Skris o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8 21259191Skris o Shared library support for HPUX and Solaris-gcc 21359191Skris o Support of Linux/IA64 21459191Skris o Assembler support for Mingw32 21559191Skris o New 'rand' application 21659191Skris o New way to check for existence of algorithms from scripts 21759191Skris 21859191Skris Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5: 21959191Skris 22059191Skris o S/MIME support in new 'smime' command 22159191Skris o Documentation for the OpenSSL command line application 22259191Skris o Automation of 'req' application 22359191Skris o Fixes to make s_client, s_server work under Windows 22459191Skris o Support for multiple fieldnames in SPKACs 22559191Skris o New SPKAC command line utilty and associated library functions 22659191Skris o Options to allow passwords to be obtained from various sources 22759191Skris o New public key PEM format and options to handle it 22859191Skris o Many other fixes and enhancements to command line utilities 22959191Skris o Usable certificate chain verification 23059191Skris o Certificate purpose checking 23159191Skris o Certificate trust settings 23259191Skris o Support of authority information access extension 23359191Skris o Extensions in certificate requests 23459191Skris o Simplified X509 name and attribute routines 23559191Skris o Initial (incomplete) support for international character sets 23659191Skris o New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD 23759191Skris o Read only memory BIOs and simplified creation function 23859191Skris o TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0 23959191Skris record; allow fragmentation and interleaving of handshake and other 24059191Skris data 24159191Skris o TLS/SSL code now "tolerates" MS SGC 24259191Skris o Work around for Netscape client certificate hang bug 24359191Skris o RSA_NULL option that removes RSA patent code but keeps other 24459191Skris RSA functionality 24559191Skris o Memory leak detection now allows applications to add extra information 24659191Skris via a per-thread stack 24759191Skris o PRNG robustness improved 24859191Skris o EGD support 24959191Skris o BIGNUM library bug fixes 25059191Skris o Faster DSA parameter generation 25159191Skris o Enhanced support for Alpha Linux 25259191Skris o Experimental MacOS support 25359191Skris 25455714Skris Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4: 25555714Skris 25655714Skris o Transparent support for PKCS#8 format private keys: these are used 25755714Skris by several software packages and are more secure than the standard 25855714Skris form 25955714Skris o PKCS#5 v2.0 implementation 26055714Skris o Password callbacks have a new void * argument for application data 26155714Skris o Avoid various memory leaks 26255714Skris o New pipe-like BIO that allows using the SSL library when actual I/O 26355714Skris must be handled by the application (BIO pair) 26455714Skris 26555714Skris Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3: 26655714Skris o Lots of enhancements and cleanups to the Configuration mechanism 26755714Skris o RSA OEAP related fixes 26855714Skris o Added `openssl ca -revoke' option for revoking a certificate 26955714Skris o Source cleanups: const correctness, type-safe stacks and ASN.1 SETs 27055714Skris o Source tree cleanups: removed lots of obsolete files 27155714Skris o Thawte SXNet, certificate policies and CRL distribution points 27255714Skris extension support 27355714Skris o Preliminary (experimental) S/MIME support 27455714Skris o Support for ASN.1 UTF8String and VisibleString 27555714Skris o Full integration of PKCS#12 code 27655714Skris o Sparc assembler bignum implementation, optimized hash functions 27755714Skris o Option to disable selected ciphers 27855714Skris 27955714Skris Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b: 28055714Skris o Fixed a security hole related to session resumption 28155714Skris o Fixed RSA encryption routines for the p < q case 28255714Skris o "ALL" in cipher lists now means "everything except NULL ciphers" 28355714Skris o Support for Triple-DES CBCM cipher 28455714Skris o Support of Optimal Asymmetric Encryption Padding (OAEP) for RSA 28555714Skris o First support for new TLSv1 ciphers 28655714Skris o Added a few new BIOs (syslog BIO, reliable BIO) 28755714Skris o Extended support for DSA certificate/keys. 28855714Skris o Extended support for Certificate Signing Requests (CSR) 28955714Skris o Initial support for X.509v3 extensions 29055714Skris o Extended support for compression inside the SSL record layer 29155714Skris o Overhauled Win32 builds 29255714Skris o Cleanups and fixes to the Big Number (BN) library 29355714Skris o Support for ASN.1 GeneralizedTime 29455714Skris o Splitted ASN.1 SETs from SEQUENCEs 29555714Skris o ASN1 and PEM support for Netscape Certificate Sequences 29655714Skris o Overhauled Perl interface 29755714Skris o Lots of source tree cleanups. 29855714Skris o Lots of memory leak fixes. 29955714Skris o Lots of bug fixes. 30055714Skris 30155714Skris Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c: 30255714Skris o Integration of the popular NO_RSA/NO_DSA patches 30355714Skris o Initial support for compression inside the SSL record layer 30455714Skris o Added BIO proxy and filtering functionality 30555714Skris o Extended Big Number (BN) library 30655714Skris o Added RIPE MD160 message digest 30755714Skris o Addeed support for RC2/64bit cipher 30855714Skris o Extended ASN.1 parser routines 30955714Skris o Adjustations of the source tree for CVS 31055714Skris o Support for various new platforms 31155714Skris 312