Skip to content
CHANGES 132 KiB
Newer Older
 OpenSSL CHANGES
 Changes between 0.9.5a and 0.9.6  [xx XXX 2000]

  *) When some versions of IIS use the 'NET' form of private key the
     key derivation algorithm is different. Normally MD5(password) is
     used as a 128 bit RC4 key. In the modified case
     MD5(MD5(password) + "SGCKEYSALT")  is used insted. Added some
     new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same
     as the old Netscape_RSA functions except they have an additional
     'sgckey' parameter which uses the modified algorithm. Also added
     an -sgckey command line option to the rsa utility. Thanks to 
     Adrian Peck <bertie@ncipher.com> for posting details of the modified
     algorithm to openssl-dev.
     [Steve Henson]

  *) The evp_local.h macros were using 'c.##kname' which resulted in
     invalid expansion on some systems (SCO 5.0.5 for example).
     Corrected to 'c.kname'.
     [Phillip Porch <root@theporch.com>]

  *) New X509_get1_email() and X509_REQ_get1_email() functions that return
     a STACK of email addresses from a certificate or request, these look
     in the subject name and the subject alternative name extensions and 
     omit any duplicate addresses.
     [Steve Henson]

  *) Re-implement BN_mod_exp2_mont using independent (and larger) windows.
     This makes DSA verification about 2 % faster.
     [Bodo Moeller]

  *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5
     (meaning that now 2^5 values will be precomputed, which is only 4 KB
     plus overhead for 1024 bit moduli).
     This makes exponentiations about 0.5 % faster for 1024 bit
     exponents (as measured by "openssl speed rsa2048").
     [Bodo Moeller]

  *) Rename memory handling macros to avoid conflicts with other
     software:
          Malloc         =>  OPENSSL_malloc
          Malloc_locked  =>  OPENSSL_malloc_locked
          Realloc        =>  OPENSSL_realloc
          Free           =>  OPENSSL_free
     [Richard Levitte]

  *) New function BN_mod_exp_mont_word for small bases (roughly 15%
     faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange).
     [Bodo Moeller]

Ulf Möller's avatar
Ulf Möller committed
  *) CygWin32 support.
     [John Jarvie <jjarvie@newsguy.com>]

  *) The type-safe stack code has been rejigged. It is now only compiled
     in when OpenSSL is configured with the DEBUG_SAFESTACK option and
     by default all type-specific stack functions are "#define"d back to
     standard stack functions. This results in more streamlined output
     but retains the type-safety checking possibilities of the original
     approach.
     [Geoff Thorpe]

  *) The STACK code has been cleaned up, and certain type declarations
     that didn't make a lot of sense have been brought in line. This has
     also involved a cleanup of sorts in safestack.h to more correctly
     map type-safe stack functions onto their plain stack counterparts.
     This work has also resulted in a variety of "const"ifications of
     lots of the code, especially "_cmp" operations which should normally
     be prototyped with "const" parameters anyway.
     [Geoff Thorpe]

Bodo Möller's avatar
Bodo Möller committed
  *) When generating bytes for the first time in md_rand.c, 'stir the pool'
     by seeding with STATE_SIZE dummy bytes (with zero entropy count).
     (The PRNG state consists of two parts, the large pool 'state' and 'md',
     where all of 'md' is used each time the PRNG is used, but 'state'
     is used only indexed by a cyclic counter. As entropy may not be
     well distributed from the beginning, 'md' is important as a
     chaining variable. However, the output function chains only half
     of 'md', i.e. 80 bits.  ssleay_rand_add, on the other hand, chains
     all of 'md', and seeding with STATE_SIZE dummy bytes will result
     in all of 'state' being rewritten, with the new values depending
     on virtually all of 'md'.  This overcomes the 80 bit limitation.)
     [Bodo Moeller]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when
     the handshake is continued after ssl_verify_cert_chain();
     otherwise, if SSL_VERIFY_NONE is set, remaining error codes
     can lead to 'unexplainable' connection aborts later.
     [Bodo Moeller; problem tracked down by Lutz Jaenicke]

  *) Major EVP API cipher revision.
     Add hooks for extra EVP features. This allows various cipher
     parameters to be set in the EVP interface. Support added for variable
     key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and
     setting of RC2 and RC5 parameters.

     Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length
     ciphers.

     Remove lots of duplicated code from the EVP library. For example *every*
     cipher init() function handles the 'iv' in the same way according to the
     cipher mode. They also all do nothing if the 'key' parameter is NULL and
     for CFB and OFB modes they zero ctx->num.

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
     New functionality allows removal of S/MIME code RC2 hack.

     Most of the routines have the same form and so can be declared in terms
     of macros.

     By shifting this to the top level EVP_CipherInit() it can be removed from
     all individual ciphers. If the cipher wants to handle IVs or keys
     differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT
     flags.
Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed

     Change lots of functions like EVP_EncryptUpdate() to now return a
     value: although software versions of the algorithms cannot fail
     any installed hardware versions can.
Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
     [Steve Henson]

  *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if
     this option is set, tolerate broken clients that send the negotiated
     protocol version number instead of the requested protocol version
     number.
     [Bodo Moeller]

  *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag;
     i.e. non-zero for export ciphersuites, zero otherwise.
     Previous versions had this flag inverted, inconsistent with
     rsa_tmp_cb (..._TMP_RSA_CB).
     [Bodo Moeller; problem reported by Amit Chopra]

  *) Add missing DSA library text string. Work around for some IIS
     key files with invalid SEQUENCE encoding.
     [Steve Henson]

  *) Add a document (doc/standards.txt) that list all kinds of standards
     and so on that are implemented in OpenSSL.
     [Richard Levitte]

  *) Enhance c_rehash script. Old version would mishandle certificates
     with the same subject name hash and wouldn't handle CRLs at all.
     Added -fingerprint option to crl utility, to support new c_rehash
     features.
     [Steve Henson]

  *) Eliminate non-ANSI declarations in crypto.h and stack.h.
  *) Fix for SSL server purpose checking. Server checking was
     rejecting certificates which had extended key usage present
     but no ssl client purpose.
     [Steve Henson, reported by Rene Grosser <grosser@hisolutions.com>]

  *) Make PKCS#12 code work with no password. The PKCS#12 spec
     is a little unclear about how a blank password is handled.
     Since the password in encoded as a BMPString with terminating
     double NULL a zero length password would end up as just the
     double NULL. However no password at all is different and is
     handled differently in the PKCS#12 key generation code. NS
     treats a blank password as zero length. MSIE treats it as no
     password on export: but it will try both on import. We now do
     the same: PKCS12_parse() tries zero length and no password if
     the password is set to "" or NULL (NULL is now a valid password:
     it wasn't before) as does the pkcs12 application.
     [Steve Henson]

Bodo Möller's avatar
Bodo Möller committed
  *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use
     perror when PEM_read_bio_X509_REQ fails, the error message must
     be obtained from the error queue.
     [Bodo Moeller]

  *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing
     it in ERR_remove_state if appropriate, and change ERR_get_state
     accordingly to avoid race conditions (this is necessary because
     thread_hash is no longer constant once set).
     [Bodo Moeller]

Ulf Möller's avatar
 
Ulf Möller committed
  *) Bugfix for linux-elf makefile.one.
     [Ulf Möller]

  *) RSA_get_default_method() will now cause a default
     RSA_METHOD to be chosen if one doesn't exist already.
     Previously this was only set during a call to RSA_new()
     or RSA_new_method(NULL) meaning it was possible for
     RSA_get_default_method() to return NULL.
     [Geoff Thorpe]

  *) Added native name translation to the existing DSO code
     that will convert (if the flag to do so is set) filenames
     that are sufficiently small and have no path information
     into a canonical native form. Eg. "blah" converted to
     "libblah.so" or "blah.dll" etc.
     [Geoff Thorpe]

  *) New function ERR_error_string_n(e, buf, len) which is like
     ERR_error_string(e, buf), but writes at most 'len' bytes
     including the 0 terminator.  For ERR_error_string_n, 'buf'
     may not be NULL.
     [Damien Miller <djm@mindrot.org>, Bodo Moeller]
Loading full blame...