CHANGES

 OpenSSL CHANGES
 _______________

 Changes between 0.9.3a and 0.9.4

  *) The x509 application mishandled signing requests containing DSA
     keys when the signing key was also DSA and the parameters didn't match.

     It was supposed to omit the parameters when they matched the signing key:
     the verifying software was then supposed to automatically use the CA's
     parameters if they were absent from the end user certificate.

     Omitting parameters is no longer recommended. The test was also
     the wrong way round! This was probably due to unusual behaviour in
     EVP_cmp_parameters() which returns 1 if the parameters match. 
     This meant that parameters were omitted when they *didn't* match and
     the certificate was useless. Certificates signed with 'ca' didn't have
     this bug.
     [Steve Henson, reported by Doug Erickson <Doug.Erickson@Part.NET>]

  *) Memory leak checking had some problems.  The interface is as follows:
     Applications can use
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON) aka MemCheck_start(),
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF) aka MemCheck_stop();
     "off" is now the default.
     The library internally uses
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE) aka MemCheck_off(),
         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE) aka MemCheck_on()
     to disable memory-checking temporarily.

     Some inconsistent states that previously were possible (and were
     even the default) are now avoided.
     [Bodo Moeller]

  *) Introduce "mode" for SSL structures (with defaults in SSL_CTX),
     which largely parallels "options", but is for changing API behaviour,
     whereas "options" are about protocol behaviour.
     Initial "mode" flags (still experimental) are:

     SSL_MODE_ENABLE_PARTIAL_WRITE   Allow SSL_write to report success when
                                     a single record has been written.
     SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER  Don't insist that SSL_write
                                     retries use the same buffer location.
                                     (But all of the contents must be
                                     copied!)
     [Bodo Moeller]

  *) Bugfix: SSL_set_mode ignored its parameter, only SSL_CTX_set_mode
     worked.

  *) Fix problems with no-hmac etc.
     [Ulf Möller, pointed out by Brian Wellington <bwelling@tislabs.com>]

  *) New functions RSA_get_default_method(), RSA_set_method() and
     RSA_get_method(). These allows replacement of RSA_METHODs without having
     to mess around with the internals of an RSA structure.
     [Steve Henson]

  *) Fix memory leaks in DSA_do_sign and DSA_is_prime.
     Also really enable memory leak checks in openssl.c and in some
     test programs.
     [Chad C. Mulligan, Bodo Moeller]

  *) Fix a bug in d2i_ASN1_INTEGER() and i2d_ASN1_INTEGER() which can mess
     up the length of negative integers. This has now been simplified to just
     store the length when it is first determined and use it later, rather
     than trying to keep track of where data is copied and updating it to
     point to the end.
     [Steve Henson, reported by Brien Wheeler
      <bwheeler@authentica-security.com>]

  *) Add a new function PKCS7_signatureVerify. This allows the verification
     of a PKCS#7 signature but with the signing certificate passed to the
     function itself. This contrasts with PKCS7_dataVerify which assumes the
     certificate is present in the PKCS#7 structure. This isn't always the
     case: certificates can be omitted from a PKCS#7 structure and be
     distributed by "out of band" means (such as a certificate database).
     [Steve Henson]

  *) Complete the PEM_* macros with DECLARE_PEM versions to replace the
     function prototypes in pem.h, also change util/mkdef.pl to add the
     necessary function names. 
     [Steve Henson]

  *) mk1mf.pl (used by Windows builds) did not properly read the
     options set by Configure in the top level Makefile, and Configure
     was not even able to write more than one option correctly.
     Fixed, now "no-idea no-rc5 -DCRYPTO_MDEBUG" etc. works as intended.
     [Bodo Moeller]

  *) New functions CONF_load_bio() and CONF_load_fp() to allow a config
     file to be loaded from a BIO or FILE pointer. The BIO version will
     for example allow memory BIOs to contain config info.
     [Steve Henson]

  *) New function "CRYPTO_num_locks" that returns CRYPTO_NUM_LOCKS.
     Whoever hopes to achieve shared-library compatibility across versions
     must use this, not the compile-time macro.
     (Exercise 0.9.4: Which is the minimum library version required by
     such programs?)
     Note: All this applies only to multi-threaded programs, others don't
     need locks.
     [Bodo Moeller]

  *) Add missing case to s3_clnt.c state machine -- one of the new SSL tests
     through a BIO pair triggered the default case, i.e.
     SSLerr(...,SSL_R_UNKNOWN_STATE).
     [Bodo Moeller]

  *) New "BIO pair" concept (crypto/bio/bss_bio.c) so that applications
     can use the SSL library even if none of the specific BIOs is
     appropriate.
     [Bodo Moeller]

  *) Fix a bug in i2d_DSAPublicKey() which meant it returned the wrong value
     for the encoded length.
     [Jeon KyoungHo <khjeon@sds.samsung.co.kr>]

  *) Add initial documentation of the X509V3 functions.
     [Steve Henson]

  *) Add a new pair of functions PEM_write_PKCS8PrivateKey() and 
     PEM_write_bio_PKCS8PrivateKey() that are equivalent to
     PEM_write_PrivateKey() and PEM_write_bio_PrivateKey() but use the more
     secure PKCS#8 private key format with a high iteration count.
     [Steve Henson]

  *) Fix determination of Perl interpreter: A perl or perl5
     _directory_ in $PATH was also accepted as the interpreter.
     [Ralf S. Engelschall]

  *) Fix demos/sign/sign.c: well there wasn't anything strictly speaking
     wrong with it but it was very old and did things like calling
     PEM_ASN1_read() directly and used MD5 for the hash not to mention some
     unusual formatting.
     [Steve Henson]

  *) Fix demos/selfsign.c: it used obsolete and deleted functions, changed
     to use the new extension code.
     [Steve Henson]

  *) Implement the PEM_read/PEM_write functions in crypto/pem/pem_all.c
     with macros. This should make it easier to change their form, add extra
     arguments etc. Fix a few PEM prototypes which didn't have cipher as a
     constant.
     [Steve Henson]

  *) Add to configuration table a new entry that can specify an alternative
     name for unistd.h (for pre-POSIX systems); we need this for NeXTstep,
     according to Mark Crispin <MRC@Panda.COM>.
     [Bodo Moeller]

#if 0
  *) DES CBC did not update the IV. Weird.
     [Ben Laurie]
#else
     des_cbc_encrypt does not update the IV, but des_ncbc_encrypt does.
     Changing the behaviour of the former might break existing programs --
     where IV updating is needed, des_ncbc_encrypt can be used.
#endif

  *) When bntest is run from "make test" it drives bc to check its
     calculations, as well as internally checking them. If an internal check
     fails, it needs to cause bc to give a non-zero result or make test carries
     on without noticing the failure. Fixed.
     [Ben Laurie]

  *) DES library cleanups.
     [Ulf Möller]

  *) Add support for PKCS#5 v2.0 PBE algorithms. This will permit PKCS#8 to be
     used with any cipher unlike PKCS#5 v1.5 which can at most handle 64 bit
     ciphers. NOTE: although the key derivation function has been verified
     against some published test vectors it has not been extensively tested
     yet. Added a -v2 "cipher" option to pkcs8 application to allow the use
     of v2.0.
     [Steve Henson]

  *) Instead of "mkdir -p", which is not fully portable, use new
     Perl script "util/mkdir-p.pl".
     [Bodo Moeller]

  *) Rewrite the way password based encryption (PBE) is handled. It used to
     assume that the ASN1 AlgorithmIdentifier parameter was a PBEParameter
     structure. This was true for the PKCS#5 v1.5 and PKCS#12 PBE algorithms
     but doesn't apply to PKCS#5 v2.0 where it can be something else. Now
     the 'parameter' field of the AlgorithmIdentifier is passed to the
     underlying key generation function so it must do its own ASN1 parsing.
     This has also changed the EVP_PBE_CipherInit() function which now has a
     'parameter' argument instead of literal salt and iteration count values
     and the function EVP_PBE_ALGOR_CipherInit() has been deleted.
     [Steve Henson]

  *) Support for PKCS#5 v1.5 compatible password based encryption algorithms
     and PKCS#8 functionality. New 'pkcs8' application linked to openssl.
     Needed to change the PEM_STRING_EVP_PKEY value which was just "PRIVATE
     KEY" because this clashed with PKCS#8 unencrypted string. Since this
     value was just used as a "magic string" and not used directly its
     value doesn't matter.