ispell

==========================

There have been reports of places where the distribution didn't quite get

through, for example if you've copied the tree from a NFS-mounted unix

through, for example if you've copied the tree from a NFS-mounted Unix

mount point.

The easiest way to check if everything got through as it should is to check

for oen of the following files:

for one of the following files:

	[.CRYPTO]OPENSSLCONF.H_IN

	[.CRYPTO]OPENSSLCONF_H.IN

or MAKExxx.COM (in the program directories) and read the comments at

the top to understand how to use them.  However, if you want to

compile all you can get, the simplest is to use MAKEVMS.COM in the top

directory.  The syntax is trhe following:

directory.  The syntax is the following:

  @MAKEVMS <option> <rsaref-p> <debug-p> [<compiler>]

      CONFIG    Just build the "[.CRYPTO]OPENSSLCONF.H" file.

      BUILDINF  Just build the "[.INCLUDE]BUILDINF.H" file.

      SOFTLINKS Just copies some files, to simulate Unix soft links.

      BUILDALL  Same as ALL, except CONFIG, BUILDINF and SOFTILNKS aren't done.

      BUILDALL  Same as ALL, except CONFIG, BUILDINF and SOFTLINKS aren't done.

      RSAREF    Just build the "[.xxx.EXE.RSAREF]LIBRSAGLUE.OLB" library.

      CRYPTO    Just build the "[.xxx.EXE.CRYPTO]LIBCRYPTO.OLB" library.

      SSL       Just build the "[.xxx.EXE.SSL]LIBSSL.OLB" library.

      RSAREF    compile using the RSAREF Library

      NORSAREF  compile without using RSAREF

Note 0: The RASREF library IS NO LONGER NEEDED.  The RSA patent

Note 0: The RSAREF library IS NO LONGER NEEDED.  The RSA patent

        expires September 20, 2000, and RSA Security chose to make

        the algorithm public domain two weeks before that.

The USER_CCDISABLEWARNINGS is there because otherwise, DEC C will complain

that those macros have been changed.

Note: Currently, this is only usefull for library compilation.  The

Note: Currently, this is only useful for library compilation.  The

      programs will still be linked with the current version of the

      C library shareable image, and will thus complain if they are

      faced with an older version of the same C library shareable image.

 malloc(), free() and realloc() as the application.  However there are many

 standard library functions used by OpenSSL that call malloc() internally

 (e.g. fopen()), and OpenSSL cannot change these; so in general you cannot

 rely on CYRPTO_malloc_init() solving your problem, and you should

 rely on CRYPTO_malloc_init() solving your problem, and you should

 consistently use the multithreaded library.

     X.509v3 certificates

        X509 encoding/decoding into/from binary ASN1 and a PEM

             based ascii-binary encoding which supports encryption with a

             based ASCII-binary encoding which supports encryption with a

             private key.  Program to generate RSA and DSA certificate

             requests and to generate RSA and DSA certificates.

 locations around the world. _YOU_ are responsible for ensuring that your use

 of any algorithms is legal by checking if there are any patents in your

 country.  The file contains some of the patents that we know about or are

 rumoured to exist. This is not a definitive list.

 rumored to exist. This is not a definitive list.

 RSA Security holds software patents on the RC5 algorithm.  If you

 intend to use this cipher, you must contact RSA Security for

  crypto devices (eg. accelerator cards). This component is called ENGINE,

  and its presence in OpenSSL 0.9.6 (and subsequent bug-fix releases)

  caused a little confusion as 0.9.6** releases were rolled in two

  versions, a "standard" and an "engine" verion. In development for 0.9.7,

  versions, a "standard" and an "engine" version. In development for 0.9.7,

  the ENGINE code has been merged into the main branch and will be present

  in the standard releases from 0.9.7 forwards.

    gets its own copy of it. As such, multi-threaded code (or code that

    multiplexes multiple uses of 'dynamic' in a single application in any

    way at all) does not get confused by 'dynamic' being used to do many

    independant things. Other ENGINEs typically don't do this so there is

    independent things. Other ENGINEs typically don't do this so there is

    only ever 1 ENGINE structure of its type (and reference counts are used

    to keep order). The dynamic ENGINE itself provides absolutely no

    cryptographic functionality, and any attempt to "initialise" the ENGINE

    "-pre" syntax in the "openssl engine" utility is that some commands

    might be issued to an ENGINE *after* it has been initialised for use.

    Eg. if an ENGINE implementation requires a smart-card to be inserted

    during intialisation (or a PIN to be typed, or whatever), there may be

    during initialisation (or a PIN to be typed, or whatever), there may be

    a control command you can issue afterwards to "forget" the smart-card

    so that additional initialisation is no longer possible. In

    applications such as web-servers, where potentially volatile code may

    hand such applications would only have the memory footprint of any

    ENGINEs explicitly loaded using user/admin provided control commands.

    The main advantage of not statically linking ENGINEs and only using

    "dynamic" for hardare support is that any installation using no

    "external" ENGINE suffers no unecessary memory footprint from unused

    "dynamic" for hardware support is that any installation using no

    "external" ENGINE suffers no unnecessary memory footprint from unused

    ENGINEs. Likewise, installations that do require an ENGINE incur the

    overheads from only *that* ENGINE once it has been loaded.

    if OpenSSL itself is built as a shared library. The instructions are

    the same in each case, but in the former (statically linked any

    dependencies on OpenSSL) you must ensure OpenSSL is built with

    position-independant code ("PIC"). The default OpenSSL compilation may

    position-independent code ("PIC"). The default OpenSSL compilation may

    already specify the relevant flags to do this, but you should consult

    with your compiler documentation if you are in any doubt.

  PROBLEMS

  ========

  It seems like the ENGINE part doesn't work too well with Cryptoswift on Win32.

  It seems like the ENGINE part doesn't work too well with CryptoSwift on Win32.

  A quick test done right before the release showed that trying "openssl speed

  -engine cswift" generated errors. If the DSO gets enabled, an attempt is made

  to write at memory address 0x00000002.

performed. However since the chance of random data passing the test is

better than 1 in 256 it isn't a very good test.

If padding is disabled then the input data must be a muliple of the cipher

If padding is disabled then the input data must be a multiple of the cipher

block length.

All RC2 ciphers have the same key and effective key length.