CHANGES

     where the 'void *' argument is replaced by a function pointer argument.
     Previously 'void *' was abused to point to functions, which works on
     many platforms, but is not correct.  As these functions are usually
     called by macros defined in OpenSSL header files, most source code
     should work without changes.
     [Richard Levitte]

  *) <openssl/opensslconf.h> (which is created by Configure) now contains
     sections with information on -D... compiler switches used for
     compiling the library so that applications can see them.  To enable
     one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
     must be defined.  E.g.,
        #define OPENSSL_ALGORITHM_DEFINES
        #include <openssl/opensslconf.h>
     defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
     [Richard Levitte, Ulf and Bodo Möller]

  *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
     record layer.
     [Bodo Moeller]

  *) Change the 'other' type in certificate aux info to a STACK_OF
     X509_ALGOR. Although not an AlgorithmIdentifier as such it has
     the required ASN1 format: arbitrary types determined by an OID.
     [Steve Henson]

  *) Add some PEM_write_X509_REQ_NEW() functions and a command line
     argument to 'req'. This is not because the function is newer or
     better than others it just uses the work 'NEW' in the certificate
     request header lines. Some software needs this.
     [Steve Henson]

  *) Reorganise password command line arguments: now passwords can be
     obtained from various sources. Delete the PEM_cb function and make
     it the default behaviour: i.e. if the callback is NULL and the
     usrdata argument is not NULL interpret it as a null terminated pass
     phrase. If usrdata and the callback are NULL then the pass phrase
     is prompted for as usual.
     [Steve Henson]

  *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
     the support is automatically enabled. The resulting binaries will
     autodetect the card and use it if present.
     [Ben Laurie and Compaq Inc.]

  *) Work around for Netscape hang bug. This sends certificate request
     and server done in one record. Since this is perfectly legal in the
     SSL/TLS protocol it isn't a "bug" option and is on by default. See
     the bugs/SSLv3 entry for more info.
     [Steve Henson]

  *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
     [Andy Polyakov]

  *) Add -rand argument to smime and pkcs12 applications and read/write
     of seed file.
     [Steve Henson]

  *) New 'passwd' tool for crypt(3) and apr1 password hashes.
     [Bodo Moeller]

  *) Add command line password options to the remaining applications.
     [Steve Henson]

  *) Bug fix for BN_div_recp() for numerators with an even number of
     bits.
     [Ulf Möller]

  *) More tests in bntest.c, and changed test_bn output.
     [Ulf Möller]

  *) ./config recognizes MacOS X now.
     [Andy Polyakov]

  *) Bug fix for BN_div() when the first words of num and divsor are
     equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
     [Ulf Möller]

  *) Add support for various broken PKCS#8 formats, and command line
     options to produce them.
     [Steve Henson]

  *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
     get temporary BIGNUMs from a BN_CTX.
     [Ulf Möller]

  *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
     for p == 0.
     [Ulf Möller]

  *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
     include a #define from the old name to the new. The original intent
     was that statically linked binaries could for example just call
     SSLeay_add_all_ciphers() to just add ciphers to the table and not
     link with digests. This never worked becayse SSLeay_add_all_digests()
     and SSLeay_add_all_ciphers() were in the same source file so calling
     one would link with the other. They are now in separate source files.
     [Steve Henson]

  *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
     [Steve Henson]

  *) Use a less unusual form of the Miller-Rabin primality test (it used
     a binary algorithm for exponentiation integrated into the Miller-Rabin
     loop, our standard modexp algorithms are faster).
     [Bodo Moeller]

  *) Support for the EBCDIC character set completed.
     [Martin Kraemer <Martin.Kraemer@Mch.SNI.De>]

  *) Source code cleanups: use const where appropriate, eliminate casts,
     use void * instead of char * in lhash.
     [Ulf Möller] 

  *) Bugfix: ssl3_send_server_key_exchange was not restartable
     (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
     this the server could overwrite ephemeral keys that the client
     has already seen).
     [Bodo Moeller]

  *) Turn DSA_is_prime into a macro that calls BN_is_prime,
     using 50 iterations of the Rabin-Miller test.

     DSA_generate_parameters now uses BN_is_prime_fasttest (with 50
     iterations of the Rabin-Miller test as required by the appendix
     to FIPS PUB 186[-1]) instead of DSA_is_prime.
     As BN_is_prime_fasttest includes trial division, DSA parameter
     generation becomes much faster.

     This implies a change for the callback functions in DSA_is_prime
     and DSA_generate_parameters: The callback function is called once
     for each positive witness in the Rabin-Miller test, not just
     occasionally in the inner loop; and the parameters to the
     callback function now provide an iteration count for the outer
     loop rather than for the current invocation of the inner loop.
     DSA_generate_parameters additionally can call the callback
     function with an 'iteration count' of -1, meaning that a
     candidate has passed the trial division test (when q is generated 
     from an application-provided seed, trial division is skipped).
     [Bodo Moeller]

  *) New function BN_is_prime_fasttest that optionally does trial
     division before starting the Rabin-Miller test and has
     an additional BN_CTX * argument (whereas BN_is_prime always
     has to allocate at least one BN_CTX).
     'callback(1, -1, cb_arg)' is called when a number has passed the
     trial division stage.
     [Bodo Moeller]

  *) Fix for bug in CRL encoding. The validity dates weren't being handled
     as ASN1_TIME.
     [Steve Henson]

  *) New -pkcs12 option to CA.pl script to write out a PKCS#12 file.
     [Steve Henson]

  *) New function BN_pseudo_rand().
     [Ulf Möller]

  *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable)
     bignum version of BN_from_montgomery() with the working code from
     SSLeay 0.9.0 (the word based version is faster anyway), and clean up
     the comments.
     [Ulf Möller]

  *) Avoid a race condition in s2_clnt.c (function get_server_hello) that
     made it impossible to use the same SSL_SESSION data structure in
     SSL2 clients in multiple threads.
     [Bodo Moeller]

  *) The return value of RAND_load_file() no longer counts bytes obtained
     by stat().  RAND_load_file(..., -1) is new and uses the complete file
     to seed the PRNG (previously an explicit byte count was required).
     [Ulf Möller, Bodo Möller]

  *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes
     used (char *) instead of (void *) and had casts all over the place.
     [Steve Henson]

  *) Make BN_generate_prime() return NULL on error if ret!=NULL.
     [Ulf Möller]

  *) Retain source code compatibility for BN_prime_checks macro:
     BN_is_prime(..., BN_prime_checks, ...) now uses
     BN_prime_checks_for_size to determine the appropriate number of
     Rabin-Miller iterations.
     [Ulf Möller]

  *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to
     DH_CHECK_P_NOT_SAFE_PRIME.
     (Check if this is true? OpenPGP calls them "strong".)
     [Ulf Möller]

  *) Merge the functionality of "dh" and "gendh" programs into a new program
     "dhparam". The old programs are retained for now but will handle DH keys
     (instead of parameters) in future.
     [Steve Henson]

  *) Make the ciphers, s_server and s_client programs check the return values
     when a new cipher list is set.
     [Steve Henson]

  *) Enhance the SSL/TLS cipher mechanism to correctly handle the TLS 56bit
     ciphers. Before when the 56bit ciphers were enabled the sorting was
     wrong.

     The syntax for the cipher sorting has been extended to support sorting by
     cipher-strength (using the strength_bits hard coded in the tables).
     The new command is "@STRENGTH" (see also doc/apps/ciphers.pod).

     Fix a bug in the cipher-command parser: when supplying a cipher command
     string with an "undefined" symbol (neither command nor alphanumeric
     [A-Za-z0-9], ssl_set_cipher_list used to hang in an endless loop. Now
     an error is flagged.

     Due to the strength-sorting extension, the code of the
     ssl_create_cipher_list() function was completely rearranged. I hope that
     the readability was also increased :-)
     [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]

  *) Minor change to 'x509' utility. The -CAcreateserial option now uses 1
     for the first serial number and places 2 in the serial number file. This
     avoids problems when the root CA is created with serial number zero and
     the first user certificate has the same issuer name and serial number
     as the root CA.
     [Steve Henson]

  *) Fixes to X509_ATTRIBUTE utilities, change the 'req' program so it uses
     the new code. Add documentation for this stuff.
     [Steve Henson]

  *) Changes to X509_ATTRIBUTE utilities. These have been renamed from
     X509_*() to X509at_*() on the grounds that they don't handle X509
     structures and behave in an analagous way to the X509v3 functions:
     they shouldn't be called directly but wrapper functions should be used
     instead.

     So we also now have some wrapper functions that call the X509at functions
     when passed certificate requests. (TO DO: similar things can be done with
     PKCS#7 signed and unsigned attributes, PKCS#12 attributes and a few other
     things. Some of these need some d2i or i2d and print functionality
     because they handle more complex structures.)
     [Steve Henson]

  *) Add missing #ifndefs that caused missing symbols when building libssl
     as a shared library without RSA.  Use #ifndef NO_SSL2 instead of
     NO_RSA in ssl/s2*.c. 
     [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller]

  *) Precautions against using the PRNG uninitialized: RAND_bytes() now
     has a return value which indicates the quality of the random data
     (1 = ok, 0 = not seeded).  Also an error is recorded on the thread's
     error queue. New function RAND_pseudo_bytes() generates output that is
     guaranteed to be unique but not unpredictable. RAND_add is like
     RAND_seed, but takes an extra argument for an entropy estimate
     (RAND_seed always assumes full entropy).
     [Ulf Möller]

  *) Do more iterations of Rabin-Miller probable prime test (specifically,
     3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes
     instead of only 2 for all lengths; see BN_prime_checks_for_size definition
     in crypto/bn/bn_prime.c for the complete table).  This guarantees a
     false-positive rate of at most 2^-80 for random input.
     [Bodo Moeller]

  *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs.
     [Bodo Moeller]

  *) New function X509_CTX_rget_chain() (renamed to X509_CTX_get1_chain
     in the 0.9.5 release), this returns the chain
     from an X509_CTX structure with a dup of the stack and all
     the X509 reference counts upped: so the stack will exist
     after X509_CTX_cleanup() has been called. Modify pkcs12.c
     to use this.

     Also make SSL_SESSION_print() print out the verify return
     code.
     [Steve Henson]

  *) Add manpage for the pkcs12 command. Also change the default
     behaviour so MAC iteration counts are used unless the new
     -nomaciter option is used. This improves file security and
     only older versions of MSIE (4.0 for example) need it.
     [Steve Henson]

  *) Honor the no-xxx Configure options when creating .DEF files.
     [Ulf Möller]

  *) Add PKCS#10 attributes to field table: challengePassword, 
     unstructuredName and unstructuredAddress. These are taken from
     draft PKCS#9 v2.0 but are compatible with v1.2 provided no 
     international characters are used.

     More changes to X509_ATTRIBUTE code: allow the setting of types
     based on strings. Remove the 'loc' parameter when adding
     attributes because these will be a SET OF encoding which is sorted
     in ASN1 order.
     [Steve Henson]

  *) Initial changes to the 'req' utility to allow request generation
     automation. This will allow an application to just generate a template
     file containing all the field values and have req construct the
     request.

     Initial support for X509_ATTRIBUTE handling. Stacks of these are
     used all over the place including certificate requests and PKCS#7
     structures. They are currently handled manually where necessary with
     some primitive wrappers for PKCS#7. The new functions behave in a
     manner analogous to the X509 extension functions: they allow
     attributes to be looked up by NID and added.

     Later something similar to the X509V3 code would be desirable to
     automatically handle the encoding, decoding and printing of the
     more complex types. The string types like challengePassword can
     be handled by the string table functions.

     Also modified the multi byte string table handling. Now there is
     a 'global mask' which masks out certain types. The table itself
     can use the flag STABLE_NO_MASK to ignore the mask setting: this
     is useful when for example there is only one permissible type
     (as in countryName) and using the mask might result in no valid
     types at all.
     [Steve Henson]

  *) Clean up 'Finished' handling, and add functions SSL_get_finished and
     SSL_get_peer_finished to allow applications to obtain the latest
     Finished messages sent to the peer or expected from the peer,
     respectively.  (SSL_get_peer_finished is usually the Finished message
     actually received from the peer, otherwise the protocol will be aborted.)

     As the Finished message are message digests of the complete handshake
     (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
     be used for external authentication procedures when the authentication
     provided by SSL/TLS is not desired or is not enough.
     [Bodo Moeller]

  *) Enhanced support for Alpha Linux is added. Now ./config checks if
     the host supports BWX extension and if Compaq C is present on the
     $PATH. Just exploiting of the BWX extension results in 20-30%
     performance kick for some algorithms, e.g. DES and RC4 to mention
     a couple. Compaq C in turn generates ~20% faster code for MD5 and
     SHA1.
     [Andy Polyakov]

  *) Add support for MS "fast SGC". This is arguably a violation of the
     SSL3/TLS protocol. Netscape SGC does two handshakes: the first with
     weak crypto and after checking the certificate is SGC a second one
     with strong crypto. MS SGC stops the first handshake after receiving
     the server certificate message and sends a second client hello. Since
     a server will typically do all the time consuming operations before
     expecting any further messages from the client (server key exchange
     is the most expensive) there is little difference between the two.

     To get OpenSSL to support MS SGC we have to permit a second client
     hello message after we have sent server done. In addition we have to
     reset the MAC if we do get this second client hello.
     [Steve Henson]

  *) Add a function 'd2i_AutoPrivateKey()' this will automatically decide
     if a DER encoded private key is RSA or DSA traditional format. Changed
     d2i_PrivateKey_bio() to use it. This is only needed for the "traditional"
     format DER encoded private key. Newer code should use PKCS#8 format which
     has the key type encoded in the ASN1 structure. Added DER private key
     support to pkcs8 application.
     [Steve Henson]

  *) SSL 3/TLS 1 servers now don't request certificates when an anonymous
     ciphersuites has been selected (as required by the SSL 3/TLS 1
     specifications).  Exception: When SSL_VERIFY_FAIL_IF_NO_PEER_CERT
     is set, we interpret this as a request to violate the specification
     (the worst that can happen is a handshake failure, and 'correct'
     behaviour would result in a handshake failure anyway).
     [Bodo Moeller]

  *) In SSL_CTX_add_session, take into account that there might be multiple
     SSL_SESSION structures with the same session ID (e.g. when two threads
     concurrently obtain them from an external cache).
     The internal cache can handle only one SSL_SESSION with a given ID,
     so if there's a conflict, we now throw out the old one to achieve
     consistency.
     [Bodo Moeller]

  *) Add OIDs for idea and blowfish in CBC mode. This will allow both
     to be used in PKCS#5 v2.0 and S/MIME.  Also add checking to
     some routines that use cipher OIDs: some ciphers do not have OIDs
     defined and so they cannot be used for S/MIME and PKCS#5 v2.0 for
     example.
     [Steve Henson]

  *) Simplify the trust setting structure and code. Now we just have
     two sequences of OIDs for trusted and rejected settings. These will
     typically have values the same as the extended key usage extension
     and any application specific purposes.

     The trust checking code now has a default behaviour: it will just
     check for an object with the same NID as the passed id. Functions can
     be provided to override either the default behaviour or the behaviour
     for a given id. SSL client, server and email already have functions
     in place for compatibility: they check the NID and also return "trusted"
     if the certificate is self signed.
     [Steve Henson]

  *) Add d2i,i2d bio/fp functions for PrivateKey: these convert the
     traditional format into an EVP_PKEY structure.
     [Steve Henson]

  *) Add a password callback function PEM_cb() which either prompts for
     a password if usr_data is NULL or otherwise assumes it is a null
     terminated password. Allow passwords to be passed on command line
     environment or config files in a few more utilities.
     [Steve Henson]

  *) Add a bunch of DER and PEM functions to handle PKCS#8 format private
     keys. Add some short names for PKCS#8 PBE algorithms and allow them
     to be specified on the command line for the pkcs8 and pkcs12 utilities.
     Update documentation.
     [Steve Henson]

  *) Support for ASN1 "NULL" type. This could be handled before by using
     ASN1_TYPE but there wasn't any function that would try to read a NULL
     and produce an error if it couldn't. For compatibility we also have
     ASN1_NULL_new() and ASN1_NULL_free() functions but these are faked and
     don't allocate anything because they don't need to.
     [Steve Henson]

  *) Initial support for MacOS is now provided. Examine INSTALL.MacOS
     for details.
     [Andy Polyakov, Roy Woods <roy@centicsystems.ca>]

  *) Rebuild of the memory allocation routines used by OpenSSL code and
     possibly others as well.  The purpose is to make an interface that
     provide hooks so anyone can build a separate set of allocation and
     deallocation routines to be used by OpenSSL, for example memory
     pool implementations, or something else, which was previously hard
     since Malloc(), Realloc() and Free() were defined as macros having
     the values malloc, realloc and free, respectively (except for Win32
     compilations).  The same is provided for memory debugging code.
     OpenSSL already comes with functionality to find memory leaks, but
     this gives people a chance to debug other memory problems.

     With these changes, a new set of functions and macros have appeared:

       CRYPTO_set_mem_debug_functions()	        [F]
       CRYPTO_get_mem_debug_functions()         [F]
       CRYPTO_dbg_set_options()	                [F]
       CRYPTO_dbg_get_options()                 [F]
       CRYPTO_malloc_debug_init()               [M]

     The memory debug functions are NULL by default, unless the library
     is compiled with CRYPTO_MDEBUG or friends is defined.  If someone
     wants to debug memory anyway, CRYPTO_malloc_debug_init() (which
     gives the standard debugging functions that come with OpenSSL) or
     CRYPTO_set_mem_debug_functions() (tells OpenSSL to use functions
     provided by the library user) must be used.  When the standard
     debugging functions are used, CRYPTO_dbg_set_options can be used to
     request additional information:
     CRYPTO_dbg_set_options(V_CYRPTO_MDEBUG_xxx) corresponds to setting
     the CRYPTO_MDEBUG_xxx macro when compiling the library.   

     Also, things like CRYPTO_set_mem_functions will always give the
     expected result (the new set of functions is used for allocation
     and deallocation) at all times, regardless of platform and compiler
     options.

     To finish it up, some functions that were never use in any other
     way than through macros have a new API and new semantic:

       CRYPTO_dbg_malloc()
       CRYPTO_dbg_realloc()
       CRYPTO_dbg_free()

     All macros of value have retained their old syntax.
     [Richard Levitte and Bodo Moeller]

  *) Some S/MIME fixes. The OID for SMIMECapabilities was wrong, the
     ordering of SMIMECapabilities wasn't in "strength order" and there
     was a missing NULL in the AlgorithmIdentifier for the SHA1 signature
     algorithm.
     [Steve Henson]

  *) Some ASN1 types with illegal zero length encoding (INTEGER,
     ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines.
     [Frans Heymans <fheymans@isaserver.be>, modified by Steve Henson]

  *) Merge in my S/MIME library for OpenSSL. This provides a simple
     S/MIME API on top of the PKCS#7 code, a MIME parser (with enough
     functionality to handle multipart/signed properly) and a utility
     called 'smime' to call all this stuff. This is based on code I
     originally wrote for Celo who have kindly allowed it to be
     included in OpenSSL.
     [Steve Henson]

  *) Add variants des_set_key_checked and des_set_key_unchecked of
     des_set_key (aka des_key_sched).  Global variable des_check_key
     decides which of these is called by des_set_key; this way
     des_check_key behaves as it always did, but applications and
     the library itself, which was buggy for des_check_key == 1,
     have a cleaner way to pick the version they need.
     [Bodo Moeller]

  *) New function PKCS12_newpass() which changes the password of a
     PKCS12 structure.
     [Steve Henson]

  *) Modify X509_TRUST and X509_PURPOSE so it also uses a static and
     dynamic mix. In both cases the ids can be used as an index into the
     table. Also modified the X509_TRUST_add() and X509_PURPOSE_add()
     functions so they accept a list of the field values and the
     application doesn't need to directly manipulate the X509_TRUST
     structure.
     [Steve Henson]

  *) Modify the ASN1_STRING_TABLE stuff so it also uses bsearch and doesn't
     need initialising.
     [Steve Henson]

  *) Modify the way the V3 extension code looks up extensions. This now
     works in a similar way to the object code: we have some "standard"
     extensions in a static table which is searched with OBJ_bsearch()
     and the application can add dynamic ones if needed. The file
     crypto/x509v3/ext_dat.h now has the info: this file needs to be
     updated whenever a new extension is added to the core code and kept
     in ext_nid order. There is a simple program 'tabtest.c' which checks
     this. New extensions are not added too often so this file can readily
     be maintained manually.

     There are two big advantages in doing things this way. The extensions
     can be looked up immediately and no longer need to be "added" using
     X509V3_add_standard_extensions(): this function now does nothing.
     [Side note: I get *lots* of email saying the extension code doesn't
      work because people forget to call this function]
     Also no dynamic allocation is done unless new extensions are added:
     so if we don't add custom extensions there is no need to call
     X509V3_EXT_cleanup().
     [Steve Henson]

  *) Modify enc utility's salting as follows: make salting the default. Add a
     magic header, so unsalted files fail gracefully instead of just decrypting
     to garbage. This is because not salting is a big security hole, so people
     should be discouraged from doing it.
     [Ben Laurie]

  *) Fixes and enhancements to the 'x509' utility. It allowed a message
     digest to be passed on the command line but it only used this
     parameter when signing a certificate. Modified so all relevant
     operations are affected by the digest parameter including the
     -fingerprint and -x509toreq options. Also -x509toreq choked if a
     DSA key was used because it didn't fix the digest.
     [Steve Henson]

  *) Initial certificate chain verify code. Currently tests the untrusted
     certificates for consistency with the verify purpose (which is set
     when the X509_STORE_CTX structure is set up) and checks the pathlength.

     There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour:
     this is because it will reject chains with invalid extensions whereas
     every previous version of OpenSSL and SSLeay made no checks at all.

     Trust code: checks the root CA for the relevant trust settings. Trust
     settings have an initial value consistent with the verify purpose: e.g.
     if the verify purpose is for SSL client use it expects the CA to be
     trusted for SSL client use. However the default value can be changed to
     permit custom trust settings: one example of this would be to only trust
     certificates from a specific "secure" set of CAs.

     Also added X509_STORE_CTX_new() and X509_STORE_CTX_free() functions
     which should be used for version portability: especially since the
     verify structure is likely to change more often now.

     SSL integration. Add purpose and trust to SSL_CTX and SSL and functions
     to set them. If not set then assume SSL clients will verify SSL servers
     and vice versa.

     Two new options to the verify program: -untrusted allows a set of
     untrusted certificates to be passed in and -purpose which sets the
     intended purpose of the certificate. If a purpose is set then the
     new chain verify code is used to check extension consistency.
     [Steve Henson]

  *) Support for the authority information access extension.
     [Steve Henson]

  *) Modify RSA and DSA PEM read routines to transparently handle
     PKCS#8 format private keys. New *_PUBKEY_* functions that handle
     public keys in a format compatible with certificate
     SubjectPublicKeyInfo structures. Unfortunately there were already
     functions called *_PublicKey_* which used various odd formats so
     these are retained for compatibility: however the DSA variants were
     never in a public release so they have been deleted. Changed dsa/rsa
     utilities to handle the new format: note no releases ever handled public
     keys so we should be OK.

     The primary motivation for this change is to avoid the same fiasco
     that dogs private keys: there are several incompatible private key
     formats some of which are standard and some OpenSSL specific and
     require various evil hacks to allow partial transparent handling and
     even then it doesn't work with DER formats. Given the option anything
     other than PKCS#8 should be dumped: but the other formats have to
     stay in the name of compatibility.

     With public keys and the benefit of hindsight one standard format 
     is used which works with EVP_PKEY, RSA or DSA structures: though
     it clearly returns an error if you try to read the wrong kind of key.

     Added a -pubkey option to the 'x509' utility to output the public key.
     Also rename the EVP_PKEY_get_*() to EVP_PKEY_rget_*()
     (renamed to EVP_PKEY_get1_*() in the OpenSSL 0.9.5 release) and add
     EVP_PKEY_rset_*() functions (renamed to EVP_PKEY_set1_*())
     that do the same as the EVP_PKEY_assign_*() except they up the
     reference count of the added key (they don't "swallow" the
     supplied key).
     [Steve Henson]

  *) Fixes to crypto/x509/by_file.c the code to read in certificates and
     CRLs would fail if the file contained no certificates or no CRLs:
     added a new function to read in both types and return the number
     read: this means that if none are read it will be an error. The
     DER versions of the certificate and CRL reader would always fail
     because it isn't possible to mix certificates and CRLs in DER format
     without choking one or the other routine. Changed this to just read
     a certificate: this is the best we can do. Also modified the code
     in apps/verify.c to take notice of return codes: it was previously
     attempting to read in certificates from NULL pointers and ignoring
     any errors: this is one reason why the cert and CRL reader seemed
     to work. It doesn't check return codes from the default certificate
     routines: these may well fail if the certificates aren't installed.
     [Steve Henson]

  *) Code to support otherName option in GeneralName.
     [Steve Henson]

  *) First update to verify code. Change the verify utility
     so it warns if it is passed a self signed certificate:
     for consistency with the normal behaviour. X509_verify
     has been modified to it will now verify a self signed
     certificate if *exactly* the same certificate appears
     in the store: it was previously impossible to trust a
     single self signed certificate. This means that:
     openssl verify ss.pem
     now gives a warning about a self signed certificate but
     openssl verify -CAfile ss.pem ss.pem
     is OK.
     [Steve Henson]

  *) For servers, store verify_result in SSL_SESSION data structure
     (and add it to external session representation).
     This is needed when client certificate verifications fails,
     but an application-provided verification callback (set by
     SSL_CTX_set_cert_verify_callback) allows accepting the session
     anyway (i.e. leaves x509_store_ctx->error != X509_V_OK
     but returns 1): When the session is reused, we have to set
     ssl->verify_result to the appropriate error code to avoid
     security holes.
     [Bodo Moeller, problem pointed out by Lutz Jaenicke]

  *) Fix a bug in the new PKCS#7 code: it didn't consider the
     case in PKCS7_dataInit() where the signed PKCS7 structure
     didn't contain any existing data because it was being created.
     [Po-Cheng Chen <pocheng@nst.com.tw>, slightly modified by Steve Henson]

  *) Add a salt to the key derivation routines in enc.c. This
     forms the first 8 bytes of the encrypted file. Also add a
     -S option to allow a salt to be input on the command line.
     [Steve Henson]

  *) New function X509_cmp(). Oddly enough there wasn't a function
     to compare two certificates. We do this by working out the SHA1
     hash and comparing that. X509_cmp() will be needed by the trust
     code.
     [Steve Henson]

  *) SSL_get1_session() is like SSL_get_session(), but increments
     the reference count in the SSL_SESSION returned.
     [Geoff Thorpe <geoff@eu.c2.net>]

  *) Fix for 'req': it was adding a null to request attributes.
     Also change the X509_LOOKUP and X509_INFO code to handle
     certificate auxiliary information.
     [Steve Henson]

  *) Add support for 40 and 64 bit RC2 and RC4 algorithms: document
     the 'enc' command.
     [Steve Henson]

  *) Add the possibility to add extra information to the memory leak
     detecting output, to form tracebacks, showing from where each
     allocation was originated: CRYPTO_push_info("constant string") adds
     the string plus current file name and line number to a per-thread
     stack, CRYPTO_pop_info() does the obvious, CRYPTO_remove_all_info()
     is like calling CYRPTO_pop_info() until the stack is empty.
     Also updated memory leak detection code to be multi-thread-safe.
     [Richard Levitte]

  *) Add options -text and -noout to pkcs7 utility and delete the
     encryption options which never did anything. Update docs.
     [Steve Henson]

  *) Add options to some of the utilities to allow the pass phrase
     to be included on either the command line (not recommended on
     OSes like Unix) or read from the environment. Update the
     manpages and fix a few bugs.
     [Steve Henson]

  *) Add a few manpages for some of the openssl commands.
     [Steve Henson]

  *) Fix the -revoke option in ca. It was freeing up memory twice,
     leaking and not finding already revoked certificates.
     [Steve Henson]

  *) Extensive changes to support certificate auxiliary information.
     This involves the use of X509_CERT_AUX structure and X509_AUX
     functions. An X509_AUX function such as PEM_read_X509_AUX()
     can still read in a certificate file in the usual way but it
     will also read in any additional "auxiliary information". By
     doing things this way a fair degree of compatibility can be
     retained: existing certificates can have this information added
     using the new 'x509' options. 

     Current auxiliary information includes an "alias" and some trust
     settings. The trust settings will ultimately be used in enhanced
     certificate chain verification routines: currently a certificate
     can only be trusted if it is self signed and then it is trusted
     for all purposes.
     [Steve Henson]

  *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD).
     The problem was that one of the replacement routines had not been working
     since SSLeay releases.  For now the offending routine has been replaced
     with non-optimised assembler.  Even so, this now gives around 95%
     performance improvement for 1024 bit RSA signs.
     [Mark Cox]

  *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2 
     handling. Most clients have the effective key size in bits equal to
     the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key.
     A few however don't do this and instead use the size of the decrypted key
     to determine the RC2 key length and the AlgorithmIdentifier to determine
     the effective key length. In this case the effective key length can still
     be 40 bits but the key length can be 168 bits for example. This is fixed
     by manually forcing an RC2 key into the EVP_PKEY structure because the
     EVP code can't currently handle unusual RC2 key sizes: it always assumes
     the key length and effective key length are equal.
     [Steve Henson]

  *) Add a bunch of functions that should simplify the creation of 
     X509_NAME structures. Now you should be able to do:
     X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC, "Steve", -1, -1, 0);
     and have it automatically work out the correct field type and fill in
     the structures. The more adventurous can try:
     X509_NAME_add_entry_by_txt(nm, field, MBSTRING_UTF8, str, -1, -1, 0);
     and it will (hopefully) work out the correct multibyte encoding.
     [Steve Henson]

  *) Change the 'req' utility to use the new field handling and multibyte
     copy routines. Before the DN field creation was handled in an ad hoc
     way in req, ca, and x509 which was rather broken and didn't support
     BMPStrings or UTF8Strings. Since some software doesn't implement
     BMPStrings or UTF8Strings yet, they can be enabled using the config file
     using the dirstring_type option. See the new comment in the default
     openssl.cnf for more info.
     [Steve Henson]

  *) Make crypto/rand/md_rand.c more robust:
     - Assure unique random numbers after fork().
     - Make sure that concurrent threads access the global counter and
       md serializably so that we never lose entropy in them
       or use exactly the same state in multiple threads.
       Access to the large state is not always serializable because
       the additional locking could be a performance killer, and
       md should be large enough anyway.
     [Bodo Moeller]

  *) New file apps/app_rand.c with commonly needed functionality
     for handling the random seed file.

     Use the random seed file in some applications that previously did not:
          ca,
          dsaparam -genkey (which also ignored its '-rand' option), 
          s_client,
          s_server,
          x509 (when signing).
     Except on systems with /dev/urandom, it is crucial to have a random
     seed file at least for key creation, DSA signing, and for DH exchanges;
     for RSA signatures we could do without one.

     gendh and gendsa (unlike genrsa) used to read only the first byte
     of each file listed in the '-rand' option.  The function as previously
     found in genrsa is now in app_rand.c and is used by all programs
     that support '-rand'.
     [Bodo Moeller]

  *) In RAND_write_file, use mode 0600 for creating files;
     don't just chmod when it may be too late.
     [Bodo Moeller]

  *) Report an error from X509_STORE_load_locations
     when X509_LOOKUP_load_file or X509_LOOKUP_add_dir failed.
     [Bill Perry]

  *) New function ASN1_mbstring_copy() this copies a string in either
     ASCII, Unicode, Universal (4 bytes per character) or UTF8 format
     into an ASN1_STRING type. A mask of permissible types is passed
     and it chooses the "minimal" type to use or an error if not type
     is suitable.
     [Steve Henson]

  *) Add function equivalents to the various macros in asn1.h. The old
     macros are retained with an M_ prefix. Code inside the library can
     use the M_ macros. External code (including the openssl utility)
     should *NOT* in order to be "shared library friendly".
     [Steve Henson]

  *) Add various functions that can check a certificate's extensions
     to see if it usable for various purposes such as SSL client,
     server or S/MIME and CAs of these types. This is currently 
     VERY EXPERIMENTAL but will ultimately be used for certificate chain
     verification. Also added a -purpose flag to x509 utility to
     print out all the purposes.
     [Steve Henson]

  *) Add a CRYPTO_EX_DATA to X509 certificate structure and associated
     functions.
     [Steve Henson]

  *) New X509V3_{X509,CRL,REVOKED}_get_d2i() functions. These will search
     for, obtain and decode and extension and obtain its critical flag.
     This allows all the necessary extension code to be handled in a
     single function call.
     [Steve Henson]

  *) RC4 tune-up featuring 30-40% performance improvement on most RISC
     platforms. See crypto/rc4/rc4_enc.c for further details.
     [Andy Polyakov]

  *) New -noout option to asn1parse. This causes no output to be produced
     its main use is when combined with -strparse and -out to extract data
     from a file (which may not be in ASN.1 format).
     [Steve Henson]

  *) Fix for pkcs12 program. It was hashing an invalid certificate pointer
     when producing the local key id.
     [Richard Levitte <levitte@stacken.kth.se>]

  *) New option -dhparam in s_server. This allows a DH parameter file to be
     stated explicitly. If it is not stated then it tries the first server
     certificate file. The previous behaviour hard coded the filename
     "server.pem".
     [Steve Henson]

  *) Add -pubin and -pubout options to the rsa and dsa commands. These allow
     a public key to be input or output. For example:
     openssl rsa -in key.pem -pubout -out pubkey.pem
     Also added necessary DSA public key functions to handle this.
     [Steve Henson]

  *) Fix so PKCS7_dataVerify() doesn't crash if no certificates are contained
     in the message. This was handled by allowing
     X509_find_by_issuer_and_serial() to tolerate a NULL passed to it.
     [Steve Henson, reported by Sampo Kellomaki <sampo@mail.neuronio.pt>]

  *) Fix for bug in d2i_ASN1_bytes(): other ASN1 functions add an extra null
     to the end of the strings whereas this didn't. This would cause problems
     if strings read with d2i_ASN1_bytes() were later modified.
     [Steve Henson, reported by Arne Ansper <arne@ats.cyber.ee>]

  *) Fix for base64 decode bug. When a base64 bio reads only one line of
     data and it contains EOF it will end up returning an error. This is
     caused by input 46 bytes long. The cause is due to the way base64
     BIOs find the start of base64 encoded data. They do this by trying a
     trial decode on each line until they find one that works. When they
     do a flag is set and it starts again knowing it can pass all the
     data directly through the decoder. Unfortunately it doesn't reset
     the context it uses. This means that if EOF is reached an attempt
     is made to pass two EOFs through the context and this causes the
     resulting error. This can also cause other problems as well. As is
     usual with these problems it takes *ages* to find and the fix is
     trivial: move one line.
     [Steve Henson, reported by ian@uns.ns.ac.yu (Ivan Nejgebauer) ]

  *) Ugly workaround to get s_client and s_server working under Windows. The
     old code wouldn't work because it needed to select() on sockets and the
     tty (for keypresses and to see if data could be written). Win32 only
     supports select() on sockets so we select() with a 1s timeout on the
     sockets and then see if any characters are waiting to be read, if none
     are present then we retry, we also assume we can always write data to
     the tty. This isn't nice because the code then blocks until we've
     received a complete line of data and it is effectively polling the
     keyboard at 1s intervals: however it's quite a bit better than not
     working at all :-) A dedicated Windows application might handle this
     with an event loop for example.
     [Steve Henson]

  *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign
     and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions
     will be called when RSA_sign() and RSA_verify() are used. This is useful
     if rsa_pub_dec() and rsa_priv_enc() equivalents are not available.
     For this to work properly RSA_public_decrypt() and RSA_private_encrypt()
     should *not* be used: RSA_sign() and RSA_verify() must be used instead.
     This necessitated the support of an extra signature type NID_md5_sha1
     for SSL signatures and modifications to the SSL library to use it instead
     of calling RSA_public_decrypt() and RSA_private_encrypt().
     [Steve Henson]

  *) Add new -verify -CAfile and -CApath options to the crl program, these
     will lookup a CRL issuers certificate and verify the signature in a
     similar way to the verify program. Tidy up the crl program so it
     no longer accesses structures directly. Make the ASN1 CRL parsing a bit
     less strict. It will now permit CRL extensions even if it is not
     a V2 CRL: this will allow it to tolerate some broken CRLs.
     [Steve Henson]

  *) Initialize all non-automatic variables each time one of the openssl
     sub-programs is started (this is necessary as they may be started
     multiple times from the "OpenSSL>" prompt).
     [Lennart Bang, Bodo Moeller]

  *) Preliminary compilation option RSA_NULL which disables RSA crypto without
     removing all other RSA functionality (this is what NO_RSA does). This
     is so (for example) those in the US can disable those operations covered
     by the RSA patent while allowing storage and parsing of RSA keys and RSA
     key generation.
     [Steve Henson]

  *) Non-copying interface to BIO pairs.
     (still largely untested)
     [Bodo Moeller]

  *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive
     ASCII string. This was handled independently in various places before.
     [Steve Henson]

  *) New functions UTF8_getc() and UTF8_putc() that parse and generate
     UTF8 strings a character at a time.
     [Steve Henson]

  *) Use client_version from client hello to select the protocol
     (s23_srvr.c) and for RSA client key exchange verification
     (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications.
     [Bodo Moeller]

  *) Add various utility functions to handle SPKACs, these were previously
     handled by poking round in the structure internals. Added new function
     NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
     print, verify and generate SPKACs. Based on an original idea from
     Massimiliano Pala <madwolf@comune.modena.it> but extensively modified.
     [Steve Henson]

  *) RIPEMD160 is operational on all platforms and is back in 'make test'.
     [Andy Polyakov]

  *) Allow the config file extension section to be overwritten on the
     command line. Based on an original idea from Massimiliano Pala
     <madwolf@comune.modena.it>. The new option is called -extensions
     and can be applied to ca, req and x509. Also -reqexts to override
     the request extensions in req and -crlexts to override the crl extensions
     in ca.
     [Steve Henson]

  *) Add new feature to the SPKAC handling in ca.  Now you can include
     the same field multiple times by preceding it by "XXXX." for example:
     1.OU="Unit name 1"
     2.OU="Unit name 2"
     this is the same syntax as used in the req config file.
     [Steve Henson]

  *) Allow certificate extensions to be added to certificate requests. These
     are specified in a 'req_extensions' option of the req section of the
     config file. They can be printed out with the -text option to req but
     are otherwise ignored at present.
     [Steve Henson]

  *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first
     data read consists of only the final block it would not decrypted because
     EVP_CipherUpdate() would correctly report zero bytes had been decrypted.
     A misplaced 'break' also meant the decrypted final block might not be
     copied until the next read.
     [Steve Henson]

  *) Initial support for DH_METHOD. Again based on RSA_METHOD. Also added
     a few extra parameters to the DH structure: these will be useful if
     for example we want the value of 'q' or implement X9.42 DH.
     [Steve Henson]

  *) Initial support for DSA_METHOD. This is based on the RSA_METHOD and
     provides hooks that allow the default DSA functions or functions on a
     "per key" basis to be replaced. This allows hardware acceleration and
     hardware key storage to be handled without major modification to the
     library. Also added low level modexp hooks and CRYPTO_EX structure and 
     associated functions.
     [Steve Henson]

  *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
     as "read only": it can't be written to and the buffer it points to will
     not be freed. Reading from a read only BIO is much more efficient than
     a normal memory BIO. This was added because there are several times when
     an area of memory needs to be read from a BIO. The previous method was
     to create a memory BIO and write the data to it, this results in two
     copies of the data and an O(n^2) reading algorithm. There is a new
     function BIO_new_mem_buf() which creates a read only memory BIO from