Don't use the SSL 2.0 Client Hello format if SSL 2.0 is disabled

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index f75ddd90bf1d02fb9a60cabe4ea52a76f43181a6..0be0a88e1b7c087c6398974e6053060a2cb65b93 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,19 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.7g and 0.9.8  [xx XXX xxxx]
+ Changes between 0.9.7h and 0.9.8  [xx XXX xxxx]
+
+  *) Add new functionality to the bn blinding code:
+     - automatic re-creation of the BN_BLINDING parameters after
+       a fixed number of uses (currently 32)
+     - add new function for parameter creation
+     - introduce flags to control the update behaviour of the
+       BN_BLINDING parameters
+     - hide BN_BLINDING structure
+     Add a second BN_BLINDING slot to the RSA structure to improve
+     performance when a single RSA object is shared among several
+     threads.
+     [Nils Larsch]
 
   *) Add support for DTLS.
      [Nagendra Modadugu <nagendra@cs.stanford.edu> and Ben Laurie]
@@ -762,14 +774,14 @@
   *) Include some named elliptic curves, and add OIDs from X9.62,
      SECG, and WAP/WTLS.  Each curve can be obtained from the new
      function
-          EC_GROUP_new_by_nid(),
+          EC_GROUP_new_by_curve_name(),
      and the list of available named curves can be obtained with
           EC_get_builtin_curves().
      Also add a 'curve_name' member to EC_GROUP objects, which can be
      accessed via
-         EC_GROUP_set_nid()
-         EC_GROUP_get_nid()
-     [Nils Larsch <nla@trustcenter.de, Bodo Moeller]
+         EC_GROUP_set_curve_name()
+         EC_GROUP_get_curve_name()
+     [Nils Larsch <larsch@trustcenter.de, Bodo Moeller]
  
   *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
      was actually never needed) and in BN_mul().  The removal in BN_mul()
@@ -782,6 +794,22 @@
 
  Changes between 0.9.7g and 0.9.7h  [XX xxx XXXX]
 
+  *) Change the client implementation for SSLv23_method() and
+     SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
+     Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
+     (Previously, the SSL 2.0 backwards compatible Client Hello
+     message format would be used even with SSL_OP_NO_SSLv2.)
+     [Bodo Moeller]
+
+  *) Add support for smime-type MIME parameter in S/MIME messages which some
+     clients need.
+     [Steve Henson]
+
+  *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
+     a threadsafe manner. Modify rsa code to use new function and add calls
+     to dsa and dh code (which had race conditions before).
+     [Steve Henson]
+
   *) Include the fixed error library code in the C error file definitions
      instead of fixing them up at runtime. This keeps the error code
      structures constant.