Fix -startdate and -enddate arguments to 'ca' program. Also update NEWS file

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 2e03173c5ba5c45c16851c39f5013e182faf4aa2..6dd3eddee470a46c2b78ec03b89b502de3942e1d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,51 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.3a and 0.9.4  [xx Jul/Aug/...? 1999]
+ Changes between 0.9.3a and 0.9.4  [xx Aug 1999]
+
+  *) Fix -startdate and -enddate (which was missing) arguments to 'ca'
+     program.
+     [Steve Henson]
+
+  *) New function DSA_dup_DH, which duplicates DSA parameters/keys as
+     DH parameters/keys (q is lost during that conversion, but the resulting
+     DH parameters contain its length).
+
+     For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is
+     much faster than DH_generate_parameters (which creates parameters
+     where p = 2*q + 1), and also the smaller q makes DH computations
+     much more efficient (160-bit exponentiation instead of 1024-bit
+     exponentiation); so this provides a convenient way to support DHE
+     ciphersuites in SSL/TLS servers (see ssl/ssltest.c).  It is of
+     utter importance to use
+         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
+     or
+         SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
+     when such DH parameters are used, because otherwise small subgroup
+     attacks may become possible!
+     [Bodo Moeller]
+
+  *) Avoid memory leak in i2d_DHparams.
+     [Bodo Moeller]
+
+  *) Allow the -k option to be used more than once in the enc program:
+     this allows the same encrypted message to be read by multiple recipients.
+     [Steve Henson]
+
+  *) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts
+     an ASN1_OBJECT to a text string. If the "no_name" parameter is set then
+     it will always use the numerical form of the OID, even if it has a short
+     or long name.
+     [Steve Henson]
+
+  *) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp
+     method only got called if p,q,dmp1,dmq1,iqmp components were present,
+     otherwise bn_mod_exp was called. In the case of hardware keys for example
+     no private key components need be present and it might store extra data
+     in the RSA structure, which cannot be accessed from bn_mod_exp. By setting
+     RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for private key
+     operations.
+     [Steve Henson]
 
   *) Added support for SPARC Linux.
      [Andy Polyakov]
@@ -31,9 +75,8 @@
      (both in crypto/Makefile.ssl for use by crypto/cversion.c) caused
      problems not only on Windows, but also on some Unix platforms.
      To avoid problematic command lines, these definitions are now in an
-     auto-generated file, which also defines DATE and thus replaces
-     crypto/date.h.  Standard "make" builds use crypto/buildinf.h,
-     mk1mf.pl builds use crypto/mk1mfinf.h (created by mk1mf.pl).
+     auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl
+     for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds).
      [Bodo Moeller]
 
   *) MIPS III/IV assembler module is reimplemented.