All kinds of changes from 0.9.6-stable.

 OpenSSL CHANGES

 _______________

 Changes between 0.9.6h and 0.9.6i  [xx XXX xxxx]

 Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]

  *)

  *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked

     via timing by performing a MAC computation even if incorrrect

     block cipher padding has been found.  This is a countermeasure

     against active attacks where the attacker has to distinguish

     between bad padding and a MAC verification error. (CAN-2003-0078)

 Changes between 0.9.6g and 0.9.6h  [21 Dec 2002]

     [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),

     Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and

     Martin Vuagnoux (EPFL, Ilion)]

 Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]

  *) New function OPENSSL_cleanse(), which is used to cleanse a section of

     memory from it's contents.  This is done with a counter that will

Cryptographic software needs a source of unpredictable data to work

correctly.  Many open source operating systems provide a "randomness

device" that serves this purpose.  On other systems, applications have

to call the RAND_add() or RAND_seed() function with appropriate data

before generating keys or performing public key encryption.

(These functions initialize the pseudo-random number generator, PRNG.)

Some broken applications do not do this.  As of version 0.9.5, the

OpenSSL functions that need randomness report an error if the random

number generator has not been seeded with at least 128 bits of

randomness.  If this error occurs, please contact the author of the

application you are using.  It is likely that it never worked

correctly.  OpenSSL 0.9.5 and later make the error visible by refusing

to perform potentially insecure encryption.

device" (/dev/urandom or /dev/random) that serves this purpose.

All OpenSSL versions try to use /dev/urandom by default; starting with

version 0.9.7, OpenSSL also tries /dev/random if /dev/urandom is not

available.

On other systems, applications have to call the RAND_add() or

RAND_seed() function with appropriate data before generating keys or

performing public key encryption. (These functions initialize the

pseudo-random number generator, PRNG.)  Some broken applications do

not do this.  As of version 0.9.5, the OpenSSL functions that need

randomness report an error if the random number generator has not been

seeded with at least 128 bits of randomness.  If this error occurs and

is not discussed in the documentation of the application you are

using, please contact the author of that application; it is likely

that it never worked correctly.  OpenSSL 0.9.5 and later make the

error visible by refusing to perform potentially insecure encryption.

If you are using Solaris 8, you can add /dev/urandom and /dev/random

devices by installing patch 112438 (Sparc) or 112439 (x86), which are

available via the Patchfinder at <URL: http://sunsolve.sun.com>

(Solaris 9 includes these devices by default). For /dev/random support

for earlier Solaris versions, see Sun's statement at

<URL: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsrdb/27606&zone_32=SUNWski>

(the SUNWski package is available in patch 105710).

On systems without /dev/urandom and /dev/random, it is a good idea to

use the Entropy Gathering Demon (EGD); see the RAND_egd() manpage for

provide their own configuration options to specify the entropy source,

please check out the documentation coming the with application.

For Solaris 2.6, Tim Nibbe <tnibbe@sprint.net> and others have suggested

installing the SUNski package from Sun patch 105710-01 (Sparc) which

adds a /dev/random device and make sure it gets used, usually through

$RANDFILE.  There are probably similar patches for the other Solaris

versions.  An official statement from Sun with respect to /dev/random

support can be found at

  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsrdb/27606&zone_32=SUNWski

However, be warned that /dev/random is usually a blocking device, which

may have some effects on OpenSSL.

A third party /dev/random solution for Solaris is available at

  http://www.cosy.sbg.ac.at/~andi/

* Why do I get an "unable to write 'random state'" error message?

	long (_far *ctrl)();

	int (_far *create)();

	int (_far *destroy)();

	long (_fat *callback_ctrl)();

	long (_far *callback_ctrl)();

	} BIO_METHOD;

#endif

	void *ret = NULL;

	extern unsigned char cleanse_ctr;

	if (num < 0) return NULL;

	allow_customize = 0;

	if (malloc_debug_func != NULL)

		{

	void *ret = NULL;

	extern unsigned char cleanse_ctr;

	if (num < 0) return NULL;

	allow_customize = 0;

	if (malloc_debug_func != NULL)

		{

	if (str == NULL)

		return CRYPTO_malloc(num, file, line);

	if (num < 0) return NULL;

	if (realloc_debug_func != NULL)

		realloc_debug_func(str, NULL, num, file, line, 0);

	ret = realloc_func(str,num);

Set a certificate to be trusted for SSL client use and change set its alias to

"Steve's Class 1 CA"

 openssl x509 -in cert.pem -addtrust sslclient \

	-alias "Steve's Class 1 CA" -out trust.pem

 openssl x509 -in cert.pem -addtrust clientAuth \

	-setalias "Steve's Class 1 CA" -out trust.pem

=head1 NOTES