Fix problem occuring when used from OpenSSH on Solaris 8.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index b1929cace8fb341b664a70f03d9d6bd4115ed168..5f4b3d37eaf5092cb893a9bd1ce4ca1157bd3982 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -8,10 +8,77 @@
      and OpenSSL 0.9.7 were developped in parallel, based on OpenSSL 0.9.6.  
 
      Change log entries are tagged as follows:
-         -) applies to 0.9.6a/0.9.6b only
-         *) applies to 0.9.6a/0.9.6b and 0.9.7
+         -) applies to 0.9.6a/0.9.6b/0.9.6c only
+         *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  *) Initialize static variable in crypto/dsa/dsa_lib.c explicitely to
+     NULL, as at least on Solaris 8 this seems not to be done automatically
+     (in contradiction to the requirements of the C standard).
+     This made problems when used from OpenSSH.
+     [Lutz Jaenicke]
+
+  *) In crypto/dh/dh_key.c, change generate_key() (the default
+     implementation of DH_generate_key()) so that a new key is
+     generated each time DH_generate_key() is used on a DH object.
+
+     Previously, DH_generate_key() did not change existing keys
+     -- but ssl/s3_srvr.c always expected it to do so (in effect,
+     SSL_OP_SINGLE_DH_USE was ignored in servers reusing the same SSL
+     object for multiple connections; however, each new SSL object
+     created from an SSL_CTX got its own key).
+     [Bodo Moeller]
+
+  *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
+     dh->length and always used
+
+          BN_rand_range(priv_key, dh->p).
+
+     BN_rand_range() is not necessary for Diffie-Hellman, and this
+     specific range makes Diffie-Hellman unnecessarily inefficient if
+     dh->length (recommended exponent length) is much smaller than the
+     length of dh->p.  We could use BN_rand_range() if the order of
+     the subgroup was stored in the DH structure, but we only have
+     dh->length.
+
+     So switch back to
+
+          BN_rand(priv_key, l, ...)
+
+     where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
+     otherwise.
+     [Bodo Moeller]
+
+  *) In
+
+          RSA_eay_public_encrypt
+          RSA_eay_private_decrypt
+          RSA_eay_private_encrypt (signing)
+          RSA_eay_public_decrypt (signature verification)
+
+     (default implementations for RSA_public_encrypt,
+     RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
+     always reject numbers >= n.
+     [Bodo Moeller]
+
+  *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
+     to synchronize access to 'locking_thread'.  This is necessary on
+     systems where access to 'locking_thread' (an 'unsigned long'
+     variable) is not atomic.
+     [Bodo Moeller]
+
+  *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
+     *before* setting the 'crypto_lock_rand' flag.  The previous code had
+     a race condition if 0 is a valid thread ID.
+     [Travis Vitek <vitek@roguewave.com>]
+
+  +) Cleanup of EVP macros.
+     [Ben Laurie]
+
+  +) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
+     correct _ecb suffix.
+     [Ben Laurie]
+
   +) Add initial OCSP responder support to ocsp application. The
      revocation information is handled using the text based index
      use by the ca application. The responder can either handle