Patch so the new crl stuff actually compiles this time :-) Also update the

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 7cc1ece6ebff61a3181ad3a0a53ee11a0f18eb61..2e4769243acbf2898e42b66ce72a0166cf1445c5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -5,9 +5,41 @@
 
  Changes between 0.9.1c and 0.9.2
 
+  *) Overhaul for 'crl' utility. New function X509_CRL_print. Partial support
+     for some CRL extensions and new objects added.
+     [Steve Henson]
+
+  *) Really fix the ASN1 IMPLICIT bug this time... Partial support for private
+     key usage extension and fuller support for authority key id.
+     [Steve Henson]
+
+  *) Add OAEP encryption for the OpenSSL crypto library. OAEP is the improved
+     padding method for RSA, which is recommended for new applications in PKCS
+     #1 v2.0 (RFC 2437, October 1998).
+     OAEP (Optimal Asymmetric Encryption Padding) has better theoretical
+     foundations than the ad-hoc padding used in PKCS #1 v1.5. It is secure
+     against Bleichbacher's attack on RSA.
+     [Ulf Moeller <ulf@fitug.de>, reformatted, corrected and integrated by
+      Ben Laurie]
+
+  *) Updates to the new SSL compression code
+     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
+
+  *) Fix so that the version number in the master secret, when passed
+     via RSA, checks that if TLS was proposed, but we roll back to SSLv3
+     (because the server will not accept higher), that the version number
+     is 0x03,0x01, not 0x03,0x00
+     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
+
+  *) Run extensive memory leak checks on SSL apps. Fixed *lots* of memory
+     leaks in ssl/ relating to new X509_get_pubkey() behaviour. Also fixes
+     in apps/ and an unrelated leak in crypto/dsa/dsa_vrf.c
+     [Steve Henson]
+
   *) Support for RAW extensions where an arbitrary extension can be
      created by including its DER encoding. See apps/openssl.cnf for
      an example.
+     [Steve Henson]
 
   *) Make sure latest Perl versions don't interpret some generated C array
      code as Perl array code in the crypto/err/err_genc.pl script.