This is an engine contributed by Broadcom - it is meant to support the

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index f1773f7a4e27a4dc4901d054d2b92bc36b5112e8..a4de57a591daba7a0a411ecdd902b1204beb691f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,11 +3,60 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) Move common extension printing code to new function
+     X509V3_print_extensions(). Reorganise OCSP print routines and
+     implement some needed OCSP ASN1 functions.
+     [Steve Henson]
+
+  *) New function X509_signature_print() to remove duplication in some
+     print routines.
+     [Steve Henson]
+
+  *) Add a special meaning when SET OF and SEQUENCE OF flags are both
+     set (this was treated exactly the same as SET OF previously). This
+     is used to reorder the STACK representing the structure to match the
+     encoding. This will be used to get round a problem where a PKCS7
+     structure which was signed could not be verified because the STACK
+     order did not reflect the encoded order.
+     [Steve Henson]
+
+  *) Reimplement the OCSP ASN1 module using the new code.
+     [Steve Henson]
+
+  *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
+     for its ASN1 operations. The old style function pointers still exist
+     for now but they will eventually go away.
+     [Steve Henson]
+
+  *) Merge in replacement ASN1 code from the ASN1 branch. This almost
+     completely replaces the old ASN1 functionality.
+     [Steve Henson]
+
+  *) Change BN_mod_exp_recp so that negative moduli are tolerated
+     (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
+     so that BN_mod_exp_mont and BN_mod_exp_mont_word work
+     for negative moduli.
+     [Bodo Moeller]
+
+  *) Fix BN_uadd and BN_usub: Always return non-negative results instead
+     of not touching the result's sign bit.
+     [Bodo Moeller]
+
+  *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
+     set.
+     [Bodo Moeller]
+
+  *) Changed the LHASH code to use prototypes for callbacks, and created
+     macros to declare and implement thin (optionally static) functions
+     that provide type-safety and avoid function pointer casting for the
+     type-specific callbacks.
+     [Geoff Thorpe]
+
   *) Use better test patterns in bntest.
      [Ulf Möller]
 
-  *) Added Kerberos Cipher Suites to be used with TLS, as written in RFC
-     2712.
+  *) Added Kerberos Cipher Suites to be used with TLS, as written in
+     RFC 2712.
      [Veers Staats <staatsvr@asc.hpc.mil>,
       Jeffrey Altman <jaltman@columbia.edu>, via Richard Levitte]
 
@@ -26,7 +75,9 @@
      [Richard Levitte]
 
   *) New function BN_mod_sqrt for computing square roots modulo a prime
-     (Tonelli-Shanks algorithm).
+     (using the probabilistic Tonelli-Shanks algorithm unless
+     p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
+     be handled deterministically).
      [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
 
   *) Store verify_result within SSL_SESSION also for client side to
@@ -42,8 +93,9 @@
 
   *) Disable ssl2_peek and ssl3_peek (i.e., both implementations
      of SSL_peek) because they both are completely broken.
-     They will be fixed RSN by adding an additional 'peek' parameter
-     to the internal read functions.
+     For fixing this, the internal read functions now have an additional
+     'peek' parameter, but the actual peek functionality has not
+     yet been implemented.
      [Bodo Moeller]
 
   *) New function BN_kronecker.