CHANGES

 OpenSSL CHANGES
 _______________

 Changes between 1.0.1 and 1.1.0  [xx XXX xxxx]

  *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
     to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
     ciphersuites. At present only RSA key exchange ciphersuites work with
     TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
     SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
     and version checking.
     [Steve Henson]

  *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
     with this defined it will not be affected by any changes to ssl internal
     structures. Add several utility functions to allow openssl application
     to work with OPENSSL_NO_SSL_INTERN defined.
     [Steve Henson]

  *) Minor change to DRBG entropy callback semantics. In some cases
     there is no mutiple of the block length between min_len and
     max_len. Allow the callback to return more than max_len bytes
     of entropy but discard any extra: it is the callback's responsibility
     to ensure that the extra data discarded does not impact the
     requested amount of entropy.
     [Steve Henson]

  *) Add PRNG security strength checks to RSA, DSA and ECDSA using 
     information in FIPS186-3, SP800-57 and SP800-131A.
     [Steve Henson]

  *) CCM support via EVP. Interface is very similar to GCM case except we
     must supply all data in one chunk (i.e. no update, final) and the
     message length must be supplied if AAD is used. Add algorithm test
     support.
     [Steve Henson]

  *) Initial version of POST overhaul. Add POST callback to allow the status
     of POST to be monitored and/or failures induced. Modify fips_test_suite
     to use callback. Always run all selftests even if one fails.
     [Steve Henson]

  *) XTS support including algorithm test driver in the fips_gcmtest program.
     Note: this does increase the maximum key length from 32 to 64 bytes but
     there should be no binary compatibility issues as existing applications
     will never use XTS mode.
     [Steve Henson]

  *) Extensive reorganisation of FIPS PRNG behaviour. Remove all dependencies
     to OpenSSL RAND code and replace with a tiny FIPS RAND API which also
     performs algorithm blocking for unapproved PRNG types. Also do not
     set PRNG type in FIPS_mode_set(): leave this to the application.
     Add default OpenSSL DRBG handling: sets up FIPS PRNG and seeds with
     the standard OpenSSL PRNG: set additional data to a date time vector.
     [Steve Henson]

  *) Rename old X9.31 PRNG functions of the form FIPS_rand* to FIPS_x931*.
     This shouldn't present any incompatibility problems because applications
     shouldn't be using these directly and any that are will need to rethink
     anyway as the X9.31 PRNG is now deprecated by FIPS 140-2
     [Steve Henson]

  *) Extensive self tests and health checking required by SP800-90 DRBG.
     Remove strength parameter from FIPS_drbg_instantiate and always
     instantiate at maximum supported strength.
     [Steve Henson]

  *) Add SRP support.
     [Tom Wu <tjw@cs.stanford.edu> and Ben Laurie]

  *) Add ECDH code to fips module and fips_ecdhvs for primitives only testing.
     [Steve Henson]

  *) New algorithm test program fips_dhvs to handle DH primitives only testing.
     [Steve Henson]

  *) New function DH_compute_key_padded() to compute a DH key and pad with
     leading zeroes if needed: this complies with SP800-56A et al.
     [Steve Henson]

  *) Initial implementation of SP800-90 DRBGs for Hash and CTR. Not used by
     anything, incomplete, subject to change and largely untested at present.
     [Steve Henson]

  *) Modify fipscanisteronly build option to only build the necessary object
     files by filtering FIPS_EX_OBJ through a perl script in crypto/Makefile.
     [Steve Henson]

  *) Add experimental option FIPSSYMS to give all symbols in
     fipscanister.o and FIPS or fips prefix. This will avoid
     conflicts with future versions of OpenSSL. Add perl script
     util/fipsas.pl to preprocess assembly language source files
     and rename any affected symbols.
     [Steve Henson]

  *) Add selftest checks and algorithm block of non-fips algorithms in
     FIPS mode. Remove DES2 from selftests.
     [Steve Henson]

  *) Add ECDSA code to fips module. Add tiny fips_ecdsa_check to just
     return internal method without any ENGINE dependencies. Add new
     tiny fips sign and verify functions.
     [Steve Henson]

  *) New build option no-ec2m to disable characteristic 2 code.
     [Steve Henson]

  *) New build option "fipscanisteronly". This only builds fipscanister.o
     and (currently) associated fips utilities. Uses the file Makefile.fips
     instead of Makefile.org as the prototype.
     [Steve Henson]

  *) Add some FIPS mode restrictions to GCM. Add internal IV generator.
     Update fips_gcmtest to use IV generator.
     [Steve Henson]

  *) Initial, experimental EVP support for AES-GCM. AAD can be input by
     setting output buffer to NULL. The *Final function must be
     called although it will not retrieve any additional data. The tag
     can be set or retrieved with a ctrl. The IV length is by default 12
     bytes (96 bits) but can be set to an alternative value. If the IV
     length exceeds the maximum IV length (currently 16 bytes) it cannot be
     set before the key. 
     [Steve Henson]

  *) New flag in ciphers: EVP_CIPH_FLAG_CUSTOM_CIPHER. This means the
     underlying do_cipher function handles all cipher semantics itself
     including padding and finalisation. This is useful if (for example)
     an ENGINE cipher handles block padding itself. The behaviour of
     do_cipher is subtly changed if this flag is set: the return value
     is the number of characters written to the output buffer (zero is
     no longer an error code) or a negative error code. Also if the
     input buffer is NULL and length 0 finalisation should be performed.
     [Steve Henson]

  *) If a candidate issuer certificate is already part of the constructed
     path ignore it: new debug notification X509_V_ERR_PATH_LOOP for this case.
     [Steve Henson]

  *) Improve forward-security support: add functions

       void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb)(SSL *ssl, int is_forward_secure))
       void SSL_set_not_resumable_session_callback(SSL *ssl, int (*cb)(SSL *ssl, int is_forward_secure))

     for use by SSL/TLS servers; the callback function will be called whenever a
     new session is created, and gets to decide whether the session may be
     cached to make it resumable (return 0) or not (return 1).  (As by the
     SSL/TLS protocol specifications, the session_id sent by the server will be
     empty to indicate that the session is not resumable; also, the server will
     not generate RFC 4507 (RFC 5077) session tickets.)

     A simple reasonable callback implementation is to return is_forward_secure.
     This parameter will be set to 1 or 0 depending on the ciphersuite selected
     by the SSL/TLS server library, indicating whether it can provide forward
     security.
     [Emilia Käsper <emilia.kasper@esat.kuleuven.be> (Google)]

  *) Add Next Protocol Negotiation,
     http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
     disabled with a no-npn flag to config or Configure. Code donated
     by Google.
     [Adam Langley <agl@google.com> and Ben Laurie]

  *) Use type ossl_ssize_t instad of ssize_t which isn't available on
     all platforms. Move ssize_t definition from e_os.h to the public
     header file e_os2.h as it now appears in public header file cms.h
     [Steve Henson]

  *) New function OPENSSL_gmtime_diff to find the difference in days
     and seconds between two tm structures. This will be used to provide
     additional functionality for ASN1_TIME.
     [Steve Henson]

  *) New -sigopt option to the ca, req and x509 utilities. Additional
     signature parameters can be passed using this option and in
     particular PSS. 
     [Steve Henson]

  *) Add RSA PSS signing function. This will generate and set the
     appropriate AlgorithmIdentifiers for PSS based on those in the
     corresponding EVP_MD_CTX structure. No application support yet.
     [Steve Henson]

  *) Support for companion algorithm specific ASN1 signing routines.
     New function ASN1_item_sign_ctx() signs a pre-initialised
     EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
     the appropriate parameters.
     [Steve Henson]

  *) Add new algorithm specific ASN1 verification initialisation function
     to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
     handling will be the same no matter what EVP_PKEY_METHOD is used.
     Add a PSS handler to support verification of PSS signatures: checked
     against a number of sample certificates.
     [Steve Henson]

  *) Add signature printing for PSS. Add PSS OIDs.
     [Steve Henson, Martin Kaiser <lists@kaiser.cx>]

  *) Add algorithm specific signature printing. An individual ASN1 method
     can now print out signatures instead of the standard hex dump. 

     More complex signatures (e.g. PSS) can print out more meaningful
     information. Include DSA version that prints out the signature
     parameters r, s.
     [Steve Henson]

  *) Add -trusted_first option which attempts to find certificates in the
     trusted store even if an untrusted chain is also supplied.
     [Steve Henson]

  *) Initial experimental support for explicitly trusted non-root CAs. 
     OpenSSL still tries to build a complete chain to a root but if an
     intermediate CA has a trust setting included that is used. The first
     setting is used: whether to trust or reject.
     [Steve Henson]

  *) New -verify_name option in command line utilities to set verification
     parameters by name.
     [Steve Henson]

  *) Initial CMAC implementation. WARNING: EXPERIMENTAL, API MAY CHANGE.
     Add CMAC pkey methods.
     [Steve Henson]

  *) Experiemental regnegotiation in s_server -www mode. If the client 
     browses /reneg connection is renegotiated. If /renegcert it is
     renegotiated requesting a certificate.
     [Steve Henson]

  *) Add an "external" session cache for debugging purposes to s_server. This
     should help trace issues which normally are only apparent in deployed
     multi-process servers.
     [Steve Henson]

  *) Experiemental password based recipient info support for CMS library:
     implementing RFC3211.
     [Steve Henson]

  *) Split password based encryption into PBES2 and PBKDF2 functions. This
     neatly separates the code into cipher and PBE sections and is required
     for some algorithms that split PBES2 into separate pieces (such as
     password based CMS).
     [Steve Henson]

  *) Extensive audit of libcrypto with DEBUG_UNUSED. Fix many cases where
     return value is ignored. NB. The functions RAND_add(), RAND_seed(),
     BIO_set_cipher() and some obscure PEM functions were changed so they
     can now return an error. The RAND changes required a change to the
     RAND_METHOD structure.
     [Steve Henson]

  *) New macro __owur for "OpenSSL Warn Unused Result". This makes use of
     a gcc attribute to warn if the result of a function is ignored. This
     is enable if DEBUG_UNUSED is set. Add to several functions in evp.h
     whose return value is often ignored. 
     [Steve Henson]
  
 Changes between 1.0.0d and 1.0.1  [xx XXX xxxx]

  *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
     [Steve Henson]

  *) Add EC_GFp_nistp224_method(), a 64-bit optimized implementation for
     elliptic curve NIST-P224 with constant-time single point multiplication on
     typical inputs.  EC_GROUP_new_by_curve_name() will automatically use this
     (while EC_GROUP_new_curve_GFp() currently won't and prefers the more
     flexible implementations).

     The implementation requires support for the nonstandard type __uint128_t,
     and so is disabled by default.  To include this in your build of OpenSSL,
     use -DEC_NISTP224_64_GCC_128 on the Configure (or config) command line,
     and run "make depend" (or "make update").
     [Emilia Käsper <emilia.kasper@esat.kuleuven.be> (Google)]

  *) Permit abbreviated handshakes when renegotiating using the function
     SSL_renegotiate_abbreviated().
     [Robin Seggelmann <seggelmann@fh-muenster.de>]

  *) Add call to ENGINE_register_all_complete() to
     ENGINE_load_builtin_engines(), so some implementations get used
     automatically instead of needing explicit application support.
     [Steve Henson]

  *) Add support for TLS key exporter as described in RFC5705.
     [Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson]

  *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
     a few changes are required:

       Add SSL_OP_NO_TLSv1_1 flag.
       Add TLSv1_1 methods.
       Update version checking logic to handle version 1.1.
       Add explicit IV handling (ported from DTLS code).
       Add command line options to s_client/s_server.
     [Steve Henson]

 Changes between 1.0.0c and 1.0.0d [8 Feb 2011]

  *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
     [Neel Mehta, Adam Langley, Bodo Moeller (Google)]

  *) Fix bug in string printing code: if *any* escaping is enabled we must
     escape the escape character (backslash) or the resulting string is
     ambiguous.
     [Steve Henson]

 Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]

  *) Disable code workaround for ancient and obsolete Netscape browsers
     and servers: an attacker can use it in a ciphersuite downgrade attack.
     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
     [Steve Henson]

  *) Fixed J-PAKE implementation error, originally discovered by
     Sebastien Martini, further info and confirmation from Stefan
     Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
     [Ben Laurie]

 Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]

  *) Fix extension code to avoid race conditions which can result in a buffer
     overrun vulnerability: resumed sessions must not be modified as they can
     be shared by multiple threads. CVE-2010-3864
     [Steve Henson]

  *) Fix WIN32 build system to correctly link an ENGINE directory into
     a DLL. 
     [Steve Henson]

 Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]

  *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
     (CVE-2010-1633)
     [Steve Henson, Peter-Michael Hager <hager@dortmund.net>]

 Changes between 0.9.8n and 1.0.0  [29 Mar 2010]

  *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
     context. The operation can be customised via the ctrl mechanism in
     case ENGINEs want to include additional functionality.
     [Steve Henson]

  *) Tolerate yet another broken PKCS#8 key format: private key value negative.
     [Steve Henson]

  *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
     output hashes compatible with older versions of OpenSSL.
     [Willy Weisz <weisz@vcpc.univie.ac.at>]

  *) Fix compression algorithm handling: if resuming a session use the
     compression algorithm of the resumed session instead of determining
     it from client hello again. Don't allow server to change algorithm.
     [Steve Henson]

  *) Add load_crls() function to apps tidying load_certs() too. Add option
     to verify utility to allow additional CRLs to be included.
     [Steve Henson]

  *) Update OCSP request code to permit adding custom headers to the request:
     some responders need this.
     [Steve Henson]

  *) The function EVP_PKEY_sign() returns <=0 on error: check return code
     correctly.
     [Julia Lawall <julia@diku.dk>]

  *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
     needlessly dereferenced structures, used obsolete functions and
     didn't handle all updated verify codes correctly.
     [Steve Henson]

  *) Disable MD2 in the default configuration.
     [Steve Henson]

  *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
     indicate the initial BIO being pushed or popped. This makes it possible
     to determine whether the BIO is the one explicitly called or as a result
     of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
     it handles reference counts correctly and doesn't zero out the I/O bio
     when it is not being explicitly popped. WARNING: applications which
     included workarounds for the old buggy behaviour will need to be modified
     or they could free up already freed BIOs.
     [Steve Henson]

  *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
     renaming to all platforms (within the 0.9.8 branch, this was
     done conditionally on Netware platforms to avoid a name clash).
     [Guenter <lists@gknw.net>]

  *) Add ECDHE and PSK support to DTLS.
     [Michael Tuexen <tuexen@fh-muenster.de>]

  *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
     be used on C++.
     [Steve Henson]

  *) Add "missing" function EVP_MD_flags() (without this the only way to
     retrieve a digest flags is by accessing the structure directly. Update
     EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
     or cipher is registered as in the "from" argument. Print out all
     registered digests in the dgst usage message instead of manually 
     attempting to work them out.
     [Steve Henson]

  *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
     this allows the use of compression and extensions. Change default cipher
     string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
     by default unless an application cipher string requests it.
     [Steve Henson]

  *) Alter match criteria in PKCS12_parse(). It used to try to use local
     key ids to find matching certificates and keys but some PKCS#12 files
     don't follow the (somewhat unwritten) rules and this strategy fails.
     Now just gather all certificates together and the first private key
     then look for the first certificate that matches the key.
     [Steve Henson]

  *) Support use of registered digest and cipher names for dgst and cipher
     commands instead of having to add each one as a special case. So now
     you can do:

        openssl sha256 foo

     as well as:

        openssl dgst -sha256 foo

     and this works for ENGINE based algorithms too.

     [Steve Henson]

  *) Update Gost ENGINE to support parameter files.
     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) Support GeneralizedTime in ca utility. 
     [Oliver Martin <oliver@volatilevoid.net>, Steve Henson]

  *) Enhance the hash format used for certificate directory links. The new
     form uses the canonical encoding (meaning equivalent names will work
     even if they aren't identical) and uses SHA1 instead of MD5. This form
     is incompatible with the older format and as a result c_rehash should
     be used to rebuild symbolic links.
     [Steve Henson]

  *) Make PKCS#8 the default write format for private keys, replacing the
     traditional format. This form is standardised, more secure and doesn't
     include an implicit MD5 dependency.
     [Steve Henson]

  *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
     committed to OpenSSL should pass this lot as a minimum.
     [Steve Henson]

  *) Add session ticket override functionality for use by EAP-FAST.
     [Jouni Malinen <j@w1.fi>]

  *) Modify HMAC functions to return a value. Since these can be implemented
     in an ENGINE errors can occur.
     [Steve Henson]

  *) Type-checked OBJ_bsearch_ex.
     [Ben Laurie]

  *) Type-checked OBJ_bsearch. Also some constification necessitated
     by type-checking.  Still to come: TXT_DB, bsearch(?),
     OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
     CONF_VALUE.
     [Ben Laurie]

  *) New function OPENSSL_gmtime_adj() to add a specific number of days and
     seconds to a tm structure directly, instead of going through OS
     specific date routines. This avoids any issues with OS routines such
     as the year 2038 bug. New *_adj() functions for ASN1 time structures
     and X509_time_adj_ex() to cover the extended range. The existing
     X509_time_adj() is still usable and will no longer have any date issues.
     [Steve Henson]

  *) Delta CRL support. New use deltas option which will attempt to locate
     and search any appropriate delta CRLs available.

     This work was sponsored by Google.
     [Steve Henson]

  *) Support for CRLs partitioned by reason code. Reorganise CRL processing
     code and add additional score elements. Validate alternate CRL paths
     as part of the CRL checking and indicate a new error "CRL path validation
     error" in this case. Applications wanting additional details can use
     the verify callback and check the new "parent" field. If this is not
     NULL CRL path validation is taking place. Existing applications wont
     see this because it requires extended CRL support which is off by
     default.

     This work was sponsored by Google.
     [Steve Henson]

  *) Support for freshest CRL extension.

     This work was sponsored by Google.
     [Steve Henson]

  *) Initial indirect CRL support. Currently only supported in the CRLs
     passed directly and not via lookup. Process certificate issuer
     CRL entry extension and lookup CRL entries by bother issuer name
     and serial number. Check and process CRL issuer entry in IDP extension.

     This work was sponsored by Google.
     [Steve Henson]

  *) Add support for distinct certificate and CRL paths. The CRL issuer
     certificate is validated separately in this case. Only enabled if
     an extended CRL support flag is set: this flag will enable additional
     CRL functionality in future.

     This work was sponsored by Google.
     [Steve Henson]

  *) Add support for policy mappings extension.

     This work was sponsored by Google.
     [Steve Henson]

  *) Fixes to pathlength constraint, self issued certificate handling,
     policy processing to align with RFC3280 and PKITS tests.

     This work was sponsored by Google.
     [Steve Henson]

  *) Support for name constraints certificate extension. DN, email, DNS
     and URI types are currently supported.

     This work was sponsored by Google.
     [Steve Henson]

  *) To cater for systems that provide a pointer-based thread ID rather
     than numeric, deprecate the current numeric thread ID mechanism and
     replace it with a structure and associated callback type. This
     mechanism allows a numeric "hash" to be extracted from a thread ID in
     either case, and on platforms where pointers are larger than 'long',
     mixing is done to help ensure the numeric 'hash' is usable even if it
     can't be guaranteed unique. The default mechanism is to use "&errno"
     as a pointer-based thread ID to distinguish between threads.

     Applications that want to provide their own thread IDs should now use
     CRYPTO_THREADID_set_callback() to register a callback that will call
     either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().

     Note that ERR_remove_state() is now deprecated, because it is tied
     to the assumption that thread IDs are numeric.  ERR_remove_state(0)
     to free the current thread's error state should be replaced by
     ERR_remove_thread_state(NULL).

     (This new approach replaces the functions CRYPTO_set_idptr_callback(),
     CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
     OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
     application was previously providing a numeric thread callback that
     was inappropriate for distinguishing threads, then uniqueness might
     have been obtained with &errno that happened immediately in the
     intermediate development versions of OpenSSL; this is no longer the
     case, the numeric thread callback will now override the automatic use
     of &errno.)
     [Geoff Thorpe, with help from Bodo Moeller]

  *) Initial support for different CRL issuing certificates. This covers a
     simple case where the self issued certificates in the chain exist and
     the real CRL issuer is higher in the existing chain.

     This work was sponsored by Google.
     [Steve Henson]

  *) Removed effectively defunct crypto/store from the build.
     [Ben Laurie]

  *) Revamp of STACK to provide stronger type-checking. Still to come:
     TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
     ASN1_STRING, CONF_VALUE.
     [Ben Laurie]

  *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
     RAM on SSL connections.  This option can save about 34k per idle SSL.
     [Nick Mathewson]

  *) Revamp of LHASH to provide stronger type-checking. Still to come:
     STACK, TXT_DB, bsearch, qsort.
     [Ben Laurie]

  *) Initial support for Cryptographic Message Syntax (aka CMS) based
     on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
     support for data, signedData, compressedData, digestedData and
     encryptedData, envelopedData types included. Scripts to check against
     RFC4134 examples draft and interop and consistency checks of many
     content types and variants.
     [Steve Henson]

  *) Add options to enc utility to support use of zlib compression BIO.
     [Steve Henson]

  *) Extend mk1mf to support importing of options and assembly language
     files from Configure script, currently only included in VC-WIN32.
     The assembly language rules can now optionally generate the source
     files from the associated perl scripts.
     [Steve Henson]

  *) Implement remaining functionality needed to support GOST ciphersuites.
     Interop testing has been performed using CryptoPro implementations.
     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) s390x assembler pack.
     [Andy Polyakov]

  *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
     "family."
     [Andy Polyakov]

  *) Implement Opaque PRF Input TLS extension as specified in
     draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
     official specification yet and no extension type assignment by
     IANA exists, this extension (for now) will have to be explicitly
     enabled when building OpenSSL by providing the extension number
     to use.  For example, specify an option

         -DTLSEXT_TYPE_opaque_prf_input=0x9527

     to the "config" or "Configure" script to enable the extension,
     assuming extension number 0x9527 (which is a completely arbitrary
     and unofficial assignment based on the MD5 hash of the Internet
     Draft).  Note that by doing so, you potentially lose
     interoperability with other TLS implementations since these might
     be using the same extension number for other purposes.

     SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
     opaque PRF input value to use in the handshake.  This will create
     an interal copy of the length-'len' string at 'src', and will
     return non-zero for success.

     To get more control and flexibility, provide a callback function
     by using

          SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
          SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)

     where

          int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
          void *arg;

     Callback function 'cb' will be called in handshakes, and is
     expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
     Argument 'arg' is for application purposes (the value as given to
     SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
     be provided to the callback function).  The callback function
     has to return non-zero to report success: usually 1 to use opaque
     PRF input just if possible, or 2 to enforce use of the opaque PRF
     input.  In the latter case, the library will abort the handshake
     if opaque PRF input is not successfully negotiated.

     Arguments 'peerinput' and 'len' given to the callback function
     will always be NULL and 0 in the case of a client.  A server will
     see the client's opaque PRF input through these variables if
     available (NULL and 0 otherwise).  Note that if the server
     provides an opaque PRF input, the length must be the same as the
     length of the client's opaque PRF input.

     Note that the callback function will only be called when creating
     a new session (session resumption can resume whatever was
     previously negotiated), and will not be called in SSL 2.0
     handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
     SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
     for applications that need to enforce opaque PRF input.

     [Bodo Moeller]

  *) Update ssl code to support digests other than SHA1+MD5 for handshake
     MAC. 

     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) Add RFC4507 support to OpenSSL. This includes the corrections in
     RFC4507bis. The encrypted ticket format is an encrypted encoded
     SSL_SESSION structure, that way new session features are automatically
     supported.

     If a client application caches session in an SSL_SESSION structure
     support is transparent because tickets are now stored in the encoded
     SSL_SESSION.
     
     The SSL_CTX structure automatically generates keys for ticket
     protection in servers so again support should be possible
     with no application modification.

     If a client or server wishes to disable RFC4507 support then the option
     SSL_OP_NO_TICKET can be set.

     Add a TLS extension debugging callback to allow the contents of any client
     or server extensions to be examined.

     This work was sponsored by Google.
     [Steve Henson]

  *) Final changes to avoid use of pointer pointer casts in OpenSSL.
     OpenSSL should now compile cleanly on gcc 4.2
     [Peter Hartley <pdh@utter.chaos.org.uk>, Steve Henson]

  *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
     support including streaming MAC support: this is required for GOST
     ciphersuite support.
     [Victor B. Wagner <vitus@cryptocom.ru>, Steve Henson]

  *) Add option -stream to use PKCS#7 streaming in smime utility. New
     function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
     to output in BER and PEM format.
     [Steve Henson]

  *) Experimental support for use of HMAC via EVP_PKEY interface. This
     allows HMAC to be handled via the EVP_DigestSign*() interface. The
     EVP_PKEY "key" in this case is the HMAC key, potentially allowing
     ENGINE support for HMAC keys which are unextractable. New -mac and
     -macopt options to dgst utility.
     [Steve Henson]

  *) New option -sigopt to dgst utility. Update dgst to use
     EVP_Digest{Sign,Verify}*. These two changes make it possible to use
     alternative signing paramaters such as X9.31 or PSS in the dgst 
     utility.
     [Steve Henson]

  *) Change ssl_cipher_apply_rule(), the internal function that does
     the work each time a ciphersuite string requests enabling
     ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
     removing ("!foo+bar") a class of ciphersuites: Now it maintains
     the order of disabled ciphersuites such that those ciphersuites
     that most recently went from enabled to disabled not only stay
     in order with respect to each other, but also have higher priority
     than other disabled ciphersuites the next time ciphersuites are
     enabled again.

     This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
     the same ciphersuites as with "HIGH" alone, but in a specific
     order where the PSK ciphersuites come first (since they are the
     most recently disabled ciphersuites when "HIGH" is parsed).

     Also, change ssl_create_cipher_list() (using this new
     funcionality) such that between otherwise identical
     cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
     the default order.
     [Bodo Moeller]

  *) Change ssl_create_cipher_list() so that it automatically
     arranges the ciphersuites in reasonable order before starting
     to process the rule string.  Thus, the definition for "DEFAULT"
     (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
     remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
     This makes it much easier to arrive at a reasonable default order
     in applications for which anonymous ciphers are OK (meaning
     that you can't actually use DEFAULT).
     [Bodo Moeller; suggested by Victor Duchovni]

  *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
     processing) into multiple integers instead of setting
     "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
     "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
     (These masks as well as the individual bit definitions are hidden
     away into the non-exported interface ssl/ssl_locl.h, so this
     change to the definition of the SSL_CIPHER structure shouldn't
     affect applications.)  This give us more bits for each of these
     categories, so there is no longer a need to coagulate AES128 and
     AES256 into a single algorithm bit, and to coagulate Camellia128
     and Camellia256 into a single algorithm bit, which has led to all
     kinds of kludges.

     Thus, among other things, the kludge introduced in 0.9.7m and
     0.9.8e for masking out AES256 independently of AES128 or masking
     out Camellia256 independently of AES256 is not needed here in 0.9.9.

     With the change, we also introduce new ciphersuite aliases that
     so far were missing: "AES128", "AES256", "CAMELLIA128", and
     "CAMELLIA256".
     [Bodo Moeller]

  *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
     Use the leftmost N bytes of the signature input if the input is
     larger than the prime q (with N being the size in bytes of q).
     [Nils Larsch]

  *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
     it yet and it is largely untested.
     [Steve Henson]

  *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
     [Nils Larsch]

  *) Initial incomplete changes to avoid need for function casts in OpenSSL
     some compilers (gcc 4.2 and later) reject their use. Safestack is
     reimplemented.  Update ASN1 to avoid use of legacy functions. 
     [Steve Henson]

  *) Win32/64 targets are linked with Winsock2.
     [Andy Polyakov]

  *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
     to external functions. This can be used to increase CRL handling 
     efficiency especially when CRLs are very large by (for example) storing
     the CRL revoked certificates in a database.
     [Steve Henson]

  *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
     new CRLs added to a directory can be used. New command line option
     -verify_return_error to s_client and s_server. This causes real errors
     to be returned by the verify callback instead of carrying on no matter
     what. This reflects the way a "real world" verify callback would behave.
     [Steve Henson]

  *) GOST engine, supporting several GOST algorithms and public key formats.
     Kindly donated by Cryptocom.
     [Cryptocom]

  *) Partial support for Issuing Distribution Point CRL extension. CRLs
     partitioned by DP are handled but no indirect CRL or reason partitioning
     (yet). Complete overhaul of CRL handling: now the most suitable CRL is
     selected via a scoring technique which handles IDP and AKID in CRLs.
     [Steve Henson]

  *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
     will ultimately be used for all verify operations: this will remove the
     X509_STORE dependency on certificate verification and allow alternative
     lookup methods.  X509_STORE based implementations of these two callbacks.
     [Steve Henson]

  *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
     Modify get_crl() to find a valid (unexpired) CRL if possible.
     [Steve Henson]

  *) New function X509_CRL_match() to check if two CRLs are identical. Normally
     this would be called X509_CRL_cmp() but that name is already used by
     a function that just compares CRL issuer names. Cache several CRL 
     extensions in X509_CRL structure and cache CRLDP in X509.
     [Steve Henson]

  *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
     this maps equivalent X509_NAME structures into a consistent structure.
     Name comparison can then be performed rapidly using memcmp().
     [Steve Henson]

  *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
     utility.
     [Steve Henson]

  *) Allow digests to supply their own micalg string for S/MIME type using
     the ctrl EVP_MD_CTRL_MICALG.
     [Steve Henson]

  *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
     EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
     ctrl. It can then customise the structure before and/or after signing
     if necessary.
     [Steve Henson]

  *) New function OBJ_add_sigid() to allow application defined signature OIDs
     to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
     to free up any added signature OIDs.
     [Steve Henson]

  *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
     EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
     digest and cipher tables. New options added to openssl utility:
     list-message-digest-algorithms and list-cipher-algorithms.
     [Steve Henson]

  *) Change the array representation of binary polynomials: the list
     of degrees of non-zero coefficients is now terminated with -1.
     Previously it was terminated with 0, which was also part of the
     value; thus, the array representation was not applicable to
     polynomials where t^0 has coefficient zero.  This change makes
     the array representation useful in a more general context.
     [Douglas Stebila]

  *) Various modifications and fixes to SSL/TLS cipher string
     handling.  For ECC, the code now distinguishes between fixed ECDH
     with RSA certificates on the one hand and with ECDSA certificates
     on the other hand, since these are separate ciphersuites.  The
     unused code for Fortezza ciphersuites has been removed.

     For consistency with EDH, ephemeral ECDH is now called "EECDH"
     (not "ECDHE").  For consistency with the code for DH
     certificates, use of ECDH certificates is now considered ECDH
     authentication, not RSA or ECDSA authentication (the latter is
     merely the CA's signing algorithm and not actively used in the
     protocol).

     The temporary ciphersuite alias "ECCdraft" is no longer
     available, and ECC ciphersuites are no longer excluded from "ALL"
     and "DEFAULT".  The following aliases now exist for RFC 4492
     ciphersuites, most of these by analogy with the DH case:

         kECDHr   - ECDH cert, signed with RSA
         kECDHe   - ECDH cert, signed with ECDSA
         kECDH    - ECDH cert (signed with either RSA or ECDSA)
         kEECDH   - ephemeral ECDH
         ECDH     - ECDH cert or ephemeral ECDH

         aECDH    - ECDH cert
         aECDSA   - ECDSA cert
         ECDSA    - ECDSA cert

         AECDH    - anonymous ECDH
         EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")

     [Bodo Moeller]

  *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
     Use correct micalg parameters depending on digest(s) in signed message.
     [Steve Henson]

  *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
     an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
     [Steve Henson]

  *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
     an engine to register a method. Add ENGINE lookups for methods and
     functional reference processing.
     [Steve Henson]

  *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
     EVP_{Sign,Verify}* which allow an application to customise the signature
     process.
     [Steve Henson]

  *) New -resign option to smime utility. This adds one or more signers
     to an existing PKCS#7 signedData structure. Also -md option to use an
     alternative message digest algorithm for signing.
     [Steve Henson]

  *) Tidy up PKCS#7 routines and add new functions to make it easier to
     create PKCS7 structures containing multiple signers. Update smime
     application to support multiple signers.
     [Steve Henson]

  *) New -macalg option to pkcs12 utility to allow setting of an alternative
     digest MAC.
     [Steve Henson]

  *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
     Reorganize PBE internals to lookup from a static table using NIDs,
     add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
     EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
     PRF which will be automatically used with PBES2.
     [Steve Henson]

  *) Replace the algorithm specific calls to generate keys in "req" with the
     new API.
     [Steve Henson]

  *) Update PKCS#7 enveloped data routines to use new API. This is now
     supported by any public key method supporting the encrypt operation. A
     ctrl is added to allow the public key algorithm to examine or modify
     the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
     a no op.
     [Steve Henson]

  *) Add a ctrl to asn1 method to allow a public key algorithm to express
     a default digest type to use. In most cases this will be SHA1 but some
     algorithms (such as GOST) need to specify an alternative digest. The
     return value indicates how strong the prefernce is 1 means optional and
     2 is mandatory (that is it is the only supported type). Modify
     ASN1_item_sign() to accept a NULL digest argument to indicate it should
     use the default md. Update openssl utilities to use the default digest
     type for signing if it is not explicitly indicated.
     [Steve Henson]

  *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
     EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
     signing method from the key type. This effectively removes the link
     between digests and public key types.
     [Steve Henson]

  *) Add an OID cross reference table and utility functions. Its purpose is to
     translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
     rsaEncryption. This will allow some of the algorithm specific hackery
     needed to use the correct OID to be removed. 
     [Steve Henson]

  *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
     structures for PKCS7_sign(). They are now set up by the relevant public
     key ASN1 method.
     [Steve Henson]

  *) Add provisional EC pkey method with support for ECDSA and ECDH.
     [Steve Henson]

  *) Add support for key derivation (agreement) in the API, DH method and
     pkeyutl.
     [Steve Henson]

  *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
     public and private key formats. As a side effect these add additional 
     command line functionality not previously available: DSA signatures can be
     generated and verified using pkeyutl and DH key support and generation in
     pkey, genpkey.
     [Steve Henson]