CHANGES

 OpenSSL CHANGES
 _______________

 Changes between 1.0.0 and 1.1.0  [xx XXX xxxx]

  *) Initial experimental support for explicitly trusted non-root CAs. 
     OpenSSL still tries to build a complete chain to a root but if an
     intermediate CA has a trust setting included that is used. The first
     setting is used: whether to trust or reject.
     [Steve Henson]

  *) New -verify_name option in command line utilities to set verification
     parameters by name.
     [Steve Henson]

  *) Initial CMAC implementation. WARNING: EXPERIMENTAL, API MAY CHANGE.
     Add CMAC pkey methods.
     [Steve Henson]

  *) Experiemental regnegotiation in s_server -www mode. If the client 
     browses /reneg connection is renegotiated. If /renegcert it is
     renegotiated requesting a certificate.
     [Steve Henson]

  *) Add an "external" session cache for debugging purposes to s_server. This
     should help trace issues which normally are only apparent in deployed
     multi-process servers.
     [Steve Henson]

  *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
     a few changes are required:

       Add SSL_OP_NO_TLSv1_1 flag.
       Add TLSv1_1 methods.
       Update version checking logic to handle version 1.1.
       Add explicit IV handling (ported from DTLS code).
       Add command line options to s_client/s_server.
     [Steve Henson]

  *) Experiemental password based recipient info support for CMS library:
     implementing RFC3211.
     [Steve Henson]

  *) Split password based encryption into PBES2 and PBKDF2 functions. This
     neatly separates the code into cipher and PBE sections and is required
     for some algorithms that split PBES2 into separate pieces (such as
     password based CMS).
     [Steve Henson]

  *) Extensive audit of libcrypto with DEBUG_UNUSED. Fix many cases where
     return value is ignored. NB. The functions RAND_add(), RAND_seed(),
     BIO_set_cipher() and some obscure PEM functions were changed so they
     can now return an error. The RAND changes required a change to the
     RAND_METHOD structure.
     [Steve Henson]

  *) New macro __owur for "OpenSSL Warn Unused Result". This makes use of
     a gcc attribute to warn if the result of a function is ignored. This
     is enable if DEBUG_UNUSED is set. Add to several functions in evp.h
     whose return value is often ignored. 
     [Steve Henson]

 Changes between 0.9.8m (?) and 1.0.0  [xx XXX xxxx]

  *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
     context. The operation can be customised via the ctrl mechanism in
     case ENGINEs want to include additional functionality.
     [Steve Henson]

  *) Tolerate yet another broken PKCS#8 key format: private key value negative.
     [Steve Henson]

  *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
     output hashes compatible with older versions of OpenSSL.
     [Willy Weisz <weisz@vcpc.univie.ac.at>]

  *) Fix compression algorithm handling: if resuming a session use the
     compression algorithm of the resumed session instead of determining
     it from client hello again. Don't allow server to change algorithm.
     [Steve Henson]

  *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
     change when encrypting or decrypting.
     [Bodo Moeller]

  *) Add load_crls() function to apps tidying load_certs() too. Add option
     to verify utility to allow additional CRLs to be included.
     [Steve Henson]

  *) Update OCSP request code to permit adding custom headers to the request:
     some responders need this.
     [Steve Henson]

  *) The function EVP_PKEY_sign() returns <=0 on error: check return code
     correctly.
     [Julia Lawall <julia@diku.dk>]

  *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
     needlessly dereferenced structures, used obsolete functions and
     didn't handle all updated verify codes correctly.
     [Steve Henson]

  *) Disable MD2 in the default configuration.
     [Steve Henson]

  *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
     indicate the initial BIO being pushed or popped. This makes it possible
     to determine whether the BIO is the one explicitly called or as a result
     of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
     it handles reference counts correctly and doesn't zero out the I/O bio
     when it is not being explicitly popped. WARNING: applications which
     included workarounds for the old buggy behaviour will need to be modified
     or they could free up already freed BIOs.
     [Steve Henson]

  *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
     renaming to all platforms (within the 0.9.8 branch, this was
     done conditionally on Netware platforms to avoid a name clash).
     [Guenter <lists@gknw.net>]

  *) Add ECDHE and PSK support to DTLS.
     [Michael Tuexen <tuexen@fh-muenster.de>]

  *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
     be used on C++.
     [Steve Henson]

  *) Add "missing" function EVP_MD_flags() (without this the only way to
     retrieve a digest flags is by accessing the structure directly. Update
     EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
     or cipher is registered as in the "from" argument. Print out all
     registered digests in the dgst usage message instead of manually 
     attempting to work them out.
     [Steve Henson]

  *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
     this allows the use of compression and extensions. Change default cipher
     string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
     by default unless an application cipher string requests it.
     [Steve Henson]

  *) Alter match criteria in PKCS12_parse(). It used to try to use local
     key ids to find matching certificates and keys but some PKCS#12 files
     don't follow the (somewhat unwritten) rules and this strategy fails.
     Now just gather all certificates together and the first private key
     then look for the first certificate that matches the key.
     [Steve Henson]

  *) Support use of registered digest and cipher names for dgst and cipher
     commands instead of having to add each one as a special case. So now
     you can do:

        openssl sha256 foo

     as well as:

        openssl dgst -sha256 foo

     and this works for ENGINE based algorithms too.

     [Steve Henson]

  *) Update Gost ENGINE to support parameter files.
     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) Support GeneralizedTime in ca utility. 
     [Oliver Martin <oliver@volatilevoid.net>, Steve Henson]

  *) Enhance the hash format used for certificate directory links. The new
     form uses the canonical encoding (meaning equivalent names will work
     even if they aren't identical) and uses SHA1 instead of MD5. This form
     is incompatible with the older format and as a result c_rehash should
     be used to rebuild symbolic links.
     [Steve Henson]

  *) Make PKCS#8 the default write format for private keys, replacing the
     traditional format. This form is standardised, more secure and doesn't
     include an implicit MD5 dependency.
     [Steve Henson]

  *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
     committed to OpenSSL should pass this lot as a minimum.
     [Steve Henson]

  *) Add session ticket override functionality for use by EAP-FAST.
     [Jouni Malinen <j@w1.fi>]

  *) Modify HMAC functions to return a value. Since these can be implemented
     in an ENGINE errors can occur.
     [Steve Henson]

  *) Type-checked OBJ_bsearch_ex.
     [Ben Laurie]

  *) Type-checked OBJ_bsearch. Also some constification necessitated
     by type-checking.  Still to come: TXT_DB, bsearch(?),
     OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
     CONF_VALUE.
     [Ben Laurie]