Changes between 1.1.1 and 3.0.0 [xx XXX xxxx]
+ *) The test suite is changed to preserve results of each test recipe.
+ A new directory test-runs/ with subdirectories named like the
+ test recipes are created in the build tree for this purpose.
+ [Richard Levitte]
+
+ *) The command line utilities ecparam and ec have been deprecated. Instead
+ use the pkeyparam, pkey and genpkey programs.
+ [Paul Dale]
+
+ *) All of the low level RSA functions have been deprecated including:
+
+ RSA_new_method, RSA_bits, RSA_size, RSA_security_bits,
+ RSA_get0_pss_params, RSA_get_version, RSA_get0_engine,
+ RSA_generate_key_ex, RSA_generate_multi_prime_key,
+ RSA_X931_derive_ex, RSA_X931_generate_key_ex, RSA_check_key,
+ RSA_check_key_ex, RSA_public_encrypt, RSA_private_encrypt,
+ RSA_public_decrypt, RSA_private_decrypt, RSA_set_default_method,
+ RSA_get_default_method, RSA_null_method, RSA_get_method, RSA_set_method,
+ RSA_PKCS1_OpenSSL, RSA_print_fp, RSA_print, RSA_sign, RSA_verify,
+ RSA_sign_ASN1_OCTET_STRING, RSA_verify_ASN1_OCTET_STRING,
+ RSA_blinding_on, RSA_blinding_off, RSA_setup_blinding,
+ RSA_padding_add_PKCS1_type_1, RSA_padding_check_PKCS1_type_1,
+ RSA_padding_add_PKCS1_type_2, RSA_padding_check_PKCS1_type_2,
+ PKCS1_MGF1, RSA_padding_add_PKCS1_OAEP, RSA_padding_check_PKCS1_OAEP,
+ RSA_padding_add_PKCS1_OAEP_mgf1, RSA_padding_check_PKCS1_OAEP_mgf1,
+ RSA_padding_add_SSLv23, RSA_padding_check_SSLv23,
+ RSA_padding_add_none, RSA_padding_check_none, RSA_padding_add_X931,
+ RSA_padding_check_X931, RSA_X931_hash_id, RSA_verify_PKCS1_PSS,
+ RSA_padding_add_PKCS1_PSS, RSA_verify_PKCS1_PSS_mgf1,
+ RSA_padding_add_PKCS1_PSS_mgf1, RSA_set_ex_data, RSA_get_ex_data,
+ RSA_meth_new, RSA_meth_free, RSA_meth_dup, RSA_meth_get0_name,
+ RSA_meth_set1_name, RSA_meth_get_flags, RSA_meth_set_flags,
+ RSA_meth_get0_app_data, RSA_meth_set0_app_data, RSA_meth_get_pub_enc,
+ RSA_meth_set_pub_enc, RSA_meth_get_pub_dec, RSA_meth_set_pub_dec,
+ RSA_meth_get_priv_enc, RSA_meth_set_priv_enc, RSA_meth_get_priv_dec,
+ RSA_meth_set_priv_dec, RSA_meth_get_mod_exp, RSA_meth_set_mod_exp,
+ RSA_meth_get_bn_mod_exp, RSA_meth_set_bn_mod_exp, RSA_meth_get_init,
+ RSA_meth_set_init, RSA_meth_get_finish, RSA_meth_set_finish,
+ RSA_meth_get_sign, RSA_meth_set_sign, RSA_meth_get_verify,
+ RSA_meth_set_verify, RSA_meth_get_keygen, RSA_meth_set_keygen,
+ RSA_meth_get_multi_prime_keygen and RSA_meth_set_multi_prime_keygen.
+
+ Use of these low level functions has been informally discouraged for a long
+ time. Instead applications should use L<EVP_PKEY_encrypt_init(3)>,
+ L<EVP_PKEY_encrypt(3)>, L<EVP_PKEY_decrypt_init(3)> and
+ L<EVP_PKEY_decrypt(3)>.
+ [Paul Dale]
+
*) X509 certificates signed using SHA1 are no longer allowed at security
level 1 and above.
In TLS/SSL the default security level is 1. It can be set either
options of the apps.
[Kurt Roeckx]
+ *) The command line utilities dhparam, dsa, gendsa and dsaparam have been
+ deprecated. Instead use the pkeyparam, pkey, genpkey and pkeyparam
+ programs respectively.
+ [Paul Dale]
+
+ *) All of the low level DH functions have been deprecated including:
+
+ DH_OpenSSL, DH_set_default_method, DH_get_default_method, DH_set_method,
+ DH_new_method, DH_bits, DH_size, DH_security_bits, DH_get_ex_new_index,
+ DH_set_ex_data, DH_get_ex_data, DH_generate_parameters_ex,
+ DH_check_params_ex, DH_check_ex, DH_check_pub_key_ex,
+ DH_check, DH_check_pub_key, DH_generate_key, DH_compute_key,
+ DH_compute_key_padded, DHparams_print_fp, DHparams_print, DH_get_nid,
+ DH_KDF_X9_42, DH_get0_engine, DH_get_length, DH_set_length, DH_meth_new,
+ DH_meth_free, DH_meth_dup, DH_meth_get0_name, DH_meth_set1_name,
+ DH_meth_get_flags, DH_meth_set_flags, DH_meth_get0_app_data,
+ DH_meth_set0_app_data, DH_meth_get_generate_key,
+ DH_meth_set_generate_key, DH_meth_get_compute_key,
+ DH_meth_set_compute_key, DH_meth_get_bn_mod_exp,
+ DH_meth_set_bn_mod_exp, DH_meth_get_init, DH_meth_set_init,
+ DH_meth_get_finish, DH_meth_set_finish, DH_meth_get_generate_params
+ and DH_meth_set_generate_params.
+
+ Use of these low level functions has been informally discouraged for a long
+ time. Instead applications should use L<EVP_PKEY_derive_init(3)>
+ and L<EVP_PKEY_derive(3)>.
+ [Paul Dale]
+
+ *) All of the low level DSA functions have been deprecated including:
+
+ DSA_do_sign, DSA_do_verify, DSA_OpenSSL, DSA_set_default_method,
+ DSA_get_default_method, DSA_set_method, DSA_get_method, DSA_new_method,
+ DSA_sign_setup, DSA_sign, DSA_verify, DSA_get_ex_new_index,
+ DSA_set_ex_data, DSA_get_ex_data, DSA_generate_parameters_ex,
+ DSA_generate_key, DSA_meth_new, DSA_get0_engine, DSA_meth_free,
+ DSA_meth_dup, DSA_meth_get0_name, DSA_meth_set1_name, DSA_meth_get_flags,
+ DSA_meth_set_flags, DSA_meth_get0_app_data, DSA_meth_set0_app_data,
+ DSA_meth_get_sign, DSA_meth_set_sign, DSA_meth_get_sign_setup,
+ DSA_meth_set_sign_setup, DSA_meth_get_verify, DSA_meth_set_verify,
+ DSA_meth_get_mod_exp, DSA_meth_set_mod_exp, DSA_meth_get_bn_mod_exp,
+ DSA_meth_set_bn_mod_exp, DSA_meth_get_init, DSA_meth_set_init,
+ DSA_meth_get_finish, DSA_meth_set_finish, DSA_meth_get_paramgen,
+ DSA_meth_set_paramgen, DSA_meth_get_keygen and DSA_meth_set_keygen.
+
+ Use of these low level functions has been informally discouraged for a long
+ time. Instead applications should use L<EVP_DigestSignInit_ex(3)>,
+ L<EVP_DigestSignUpdate(3)> and L<EVP_DigestSignFinal(3)>.
+ [Paul Dale]
+
*) Reworked the treatment of EC EVP_PKEYs with the SM2 curve to
automatically become EVP_PKEY_SM2 rather than EVP_PKEY_EC.
This means that applications don't have to look at the curve NID and
and L<EVP_MAC_final(3)>.
[Paul Dale]
+ *) Over two thousand fixes were made to the documentation, including:
+ - Common options (such as -rand/-writerand, TLS version control, etc)
+ were refactored and point to newly-enhanced descriptions in openssl.pod.
+ - Added style conformance for all options (with help from Richard Levitte),
+ documented all reported missing options, added a CI build to check
+ that all options are documented and that no unimplemented options
+ are documented.
+ - Documented some internals, such as all use of environment variables.
+ - Addressed all internal broken L<> references.
+ [Rich Salz]
+
*) All of the low level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224, SHA256,
SHA384, SHA512 and Whirlpool digest functions have been deprecated.
These include:
pages for further details.
[Matt Caswell]
- *) Most common options (such as -rand/-writerand, TLS version control, etc)
- were refactored and point to newly-enhanced descriptions in openssl.pod
- [Rich Salz]
-
- *) Over two thousand fixes were made to the documentation, including:
- adding missing command flags, better style conformance, documentation
- of internals, etc.
- [Rich Salz, Richard Levitte]
-
*) s390x assembly pack: add hardware-support for P-256, P-384, P-521,
X25519, X448, Ed25519 and Ed448.
[Patrick Steuer]
bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such
alerts across multiple records (some of which could be empty). In practice
it make no sense to send an empty alert record, or to fragment one. TLSv1.3
- prohibts this altogether and other libraries (BoringSSL, NSS) do not
+ prohibits this altogether and other libraries (BoringSSL, NSS) do not
support this at all. Supporting it adds significant complexity to the
- record layer, and its removal is unlikely to cause inter-operability
+ record layer, and its removal is unlikely to cause interoperability
issues.
[Matt Caswell]
implementations).
[Emilia Käsper, Adam Langley, Bodo Moeller (Google)]
- *) Use type ossl_ssize_t instad of ssize_t which isn't available on
+ *) Use type ossl_ssize_t instead of ssize_t which isn't available on
all platforms. Move ssize_t definition from e_os.h to the public
header file e_os2.h as it now appears in public header file cms.h
[Steve Henson]
*) New OCSP utility. Allows OCSP requests to be generated or
read. The request can be sent to a responder and the output
- parsed, outputed or printed in text form. Not complete yet:
+ parsed, outputted or printed in text form. Not complete yet:
still needs to check the OCSP response validity.
[Steve Henson]
[Andy Polyakov]
*) Modified SSL library such that the verify_callback that has been set
- specificly for an SSL object with SSL_set_verify() is actually being
+ specifically for an SSL object with SSL_set_verify() is actually being
used. Before the change, a verify_callback set with this function was
ignored and the verify_callback() set in the SSL_CTX at the time of
the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
as other interfaces in OpenSSL, like the BIO interface.
NCONF_dump_* dump the internal storage of the configuration file,
which is useful for debugging. All other functions take the same
- arguments as the old CONF_* functions wth the exception of the
+ arguments as the old CONF_* functions with the exception of the
first that must be a `CONF *' instead of a `LHASH *'.
- To make it easer to use the new classes with the old CONF_* functions,
+ To make it easier to use the new classes with the old CONF_* functions,
the function CONF_set_default_method is provided.
[Richard Levitte]
than the old method: it now uses a modified version of Ulf's parser to
read the ANSI prototypes in all header files (thus the old K&R definitions
aren't needed for error creation any more) and do a better job of
- translating function codes into names. The old 'ASN1 error code imbedded
+ translating function codes into names. The old 'ASN1 error code embedded
in a comment' is no longer necessary and it doesn't use .err files which
have now been deleted. Also the error code call doesn't have to appear all
on one line (which resulted in some large lines...).
*) Add a useful kludge to allow package maintainers to specify compiler and
other platforms details on the command line without having to patch the
- Configure script everytime: One now can use ``perl Configure
+ Configure script every time: One now can use ``perl Configure
<id>:<details>'', i.e. platform ids are allowed to have details appended
to them (separated by colons). This is treated as there would be a static
pre-configured entry in Configure's %table under key <id> with value
projects / openssl.git / blobdiff