CHANGES

 OpenSSL CHANGES
 _______________

 This is a high-level summary of the most important changes.
 For a full list of changes, see the git commit log; for example,
 https://github.com/openssl/openssl/commits/ and pick the appropriate
 release branch.

 Changes between 1.1.1c and 1.1.1d [xx XXX xxxx]

  *) Fixed a fork protection issue. OpenSSL 1.1.1 introduced a rewritten random
     number generator (RNG). This was intended to include protection in the
     event of a fork() system call in order to ensure that the parent and child
     processes did not share the same RNG state. However this protection was not
     being used in the default case.

     A partial mitigation for this issue is that the output from a high
     precision timer is mixed into the RNG state so the likelihood of a parent
     and child process sharing state is significantly reduced.

     If an application already calls OPENSSL_init_crypto() explicitly using
     OPENSSL_INIT_ATFORK then this problem does not occur at all.
     (CVE-2019-1549)
     [Matthias St. Pierre]

  *) Fixed a padding oracle in PKCS7_decrypt() and CMS_decrypt(). In situations
     where an attacker receives automated notification of the success or failure
     of a decryption attempt an attacker, after sending a very large number of
     messages to be decrypted, can recover a CMS/PKCS7 transported encryption
     key or decrypt any RSA encrypted message that was encrypted with the public
     RSA key, using a Bleichenbacher padding oracle attack. Applications are not
     affected if they use a certificate together with the private RSA key to the
     CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info
     to decrypt.
     (CVE-2019-1563)
     [Bernd Edlinger]

  *) For built-in EC curves, ensure an EC_GROUP built from the curve name is
     used even when parsing explicit parameters, when loading a serialized key
     or calling `EC_GROUP_new_from_ecpkparameters()`/
     `EC_GROUP_new_from_ecparameters()`.
     This prevents bypass of security hardening and performance gains,
     especially for curves with specialized EC_METHODs.
     By default, if a key encoded with explicit parameters is loaded and later
     serialized, the output is still encoded with explicit parameters, even if
     internally a "named" EC_GROUP is used for computation.
     [Nicola Tuveri]

  *) Compute ECC cofactors if not provided during EC_GROUP construction. Before
     this change, EC_GROUP_set_generator would accept order and/or cofactor as
     NULL. After this change, only the cofactor parameter can be NULL. It also
     does some minimal sanity checks on the passed order.
     (CVE-2019-1547)
     [Billy Bob Brumley]

  *) Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.
     An attack is simple, if the first CMS_recipientInfo is valid but the
     second CMS_recipientInfo is chosen ciphertext. If the second
     recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct
     encryption key will be replaced by garbage, and the message cannot be
     decoded, but if the RSA decryption fails, the correct encryption key is
     used and the recipient will not notice the attack.
     As a work around for this potential attack the length of the decrypted
     key must be equal to the cipher default key length, in case the
     certifiate is not given and all recipientInfo are tried out.
     The old behaviour can be re-enabled in the CMS code by setting the
     CMS_DEBUG_DECRYPT flag.
     [Bernd Edlinger]

  *) Early start up entropy quality from the DEVRANDOM seed source has been
     improved for older Linux systems.  The RAND subsystem will wait for
     /dev/random to be producing output before seeding from /dev/urandom.
     The seeded state is stored for future library initialisations using
     a system global shared memory segment.  The shared memory identifier
     can be configured by defining OPENSSL_RAND_SEED_DEVRANDOM_SHM_ID to
     the desired value.  The default identifier is 114.
     [Paul Dale]

  *) Correct the extended master secret constant on EBCDIC systems. Without this
     fix TLS connections between an EBCDIC system and a non-EBCDIC system that
     negotiate EMS will fail. Unfortunately this also means that TLS connections
     between EBCDIC systems with this fix, and EBCDIC systems without this
     fix will fail if they negotiate EMS.
     [Matt Caswell]

  *) Use Windows installation paths in the mingw builds

     Mingw isn't a POSIX environment per se, which means that Windows
     paths should be used for installation.
     (CVE-2019-1552)
     [Richard Levitte]

  *) Changed DH_check to accept parameters with order q and 2q subgroups.
     With order 2q subgroups the bit 0 of the private key is not secret
     but DH_generate_key works around that by clearing bit 0 of the
     private key for those. This avoids leaking bit 0 of the private key.
     [Bernd Edlinger]

  *) Significantly reduce secure memory usage by the randomness pools.
     [Paul Dale]

  *) Revert the DEVRANDOM_WAIT feature for Linux systems

     The DEVRANDOM_WAIT feature added a select() call to wait for the
     /dev/random device to become readable before reading from the
     /dev/urandom device.

     It turned out that this change had negative side effects on
     performance which were not acceptable. After some discussion it
     was decided to revert this feature and leave it up to the OS
     resp. the platform maintainer to ensure a proper initialization
     during early boot time.
     [Matthias St. Pierre]

 Changes between 1.1.1b and 1.1.1c [28 May 2019]

  *) Add build tests for C++.  These are generated files that only do one
     thing, to include one public OpenSSL head file each.  This tests that
     the public header files can be usefully included in a C++ application.

     This test isn't enabled by default.  It can be enabled with the option
     'enable-buildtest-c++'.
     [Richard Levitte]

  *) Enable SHA3 pre-hashing for ECDSA and DSA.
     [Patrick Steuer]

  *) Change the default RSA, DSA and DH size to 2048 bit instead of 1024.
     This changes the size when using the genpkey app when no size is given. It
     fixes an omission in earlier changes that changed all RSA, DSA and DH
     generation apps to use 2048 bits by default.
     [Kurt Roeckx]

  *) Reorganize the manual pages to consistently have RETURN VALUES,
     EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust
     util/fix-doc-nits accordingly.
     [Paul Yang, Joshua Lock]

  *) Add the missing accessor EVP_PKEY_get0_engine()
     [Matt Caswell]

  *) Have apps like 's_client' and 's_server' output the signature scheme
     along with other cipher suite parameters when debugging.
     [Lorinczy Zsigmond]

  *) Make OPENSSL_config() error agnostic again.
     [Richard Levitte]

  *) Do the error handling in RSA decryption constant time.
     [Bernd Edlinger]

  *) Prevent over long nonces in ChaCha20-Poly1305.

     ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input
     for every encryption operation. RFC 7539 specifies that the nonce value
     (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length
     and front pads the nonce with 0 bytes if it is less than 12
     bytes. However it also incorrectly allows a nonce to be set of up to 16
     bytes. In this case only the last 12 bytes are significant and any
     additional leading bytes are ignored.

     It is a requirement of using this cipher that nonce values are
     unique. Messages encrypted using a reused nonce value are susceptible to
     serious confidentiality and integrity attacks. If an application changes
     the default nonce length to be longer than 12 bytes and then makes a
     change to the leading bytes of the nonce expecting the new value to be a
     new unique nonce then such an application could inadvertently encrypt
     messages with a reused nonce.

     Additionally the ignored bytes in a long nonce are not covered by the
     integrity guarantee of this cipher. Any application that relies on the
     integrity of these ignored leading bytes of a long nonce may be further
     affected. Any OpenSSL internal use of this cipher, including in SSL/TLS,
     is safe because no such use sets such a long nonce value. However user
     applications that use this cipher directly and set a non-default nonce
     length to be longer than 12 bytes may be vulnerable.

     This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk
     Greef of Ronomon.
     (CVE-2019-1543)
     [Matt Caswell]

  *) Add DEVRANDOM_WAIT feature for Linux systems

     On older Linux systems where the getrandom() system call is not available,
     OpenSSL normally uses the /dev/urandom device for seeding its CSPRNG.
     Contrary to getrandom(), the /dev/urandom device will not block during
     early boot when the kernel CSPRNG has not been seeded yet.

     To mitigate this known weakness, use select() to wait for /dev/random to
     become readable before reading from /dev/urandom.

  *) Ensure that SM2 only uses SM3 as digest algorithm
     [Paul Yang]

 Changes between 1.1.1a and 1.1.1b [26 Feb 2019]

  *) Added SCA hardening for modular field inversion in EC_GROUP through
     a new dedicated field_inv() pointer in EC_METHOD.