Don't give dependency warning for fips builds.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index c518f38326bc7eb5b5bf9630f06b877f201263a0..fa1bb509aa7e6cb81fd58438d5ccd2663ae483e5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,8 +4,27 @@
 
  Changes between 1.0.1 and 1.1.0  [xx XXX xxxx]
 
+  *) Extensive reorganisation of FIPS PRNG behaviour. Remove all dependencies
+     to OpenSSL RAND code and replace with a tiny FIPS RAND API which also
+     performs algorithm blocking for unapproved PRNG types. Also do not
+     set PRNG type in FIPS_mode_set(): leave this to the application.
+     Add default OpenSSL DRBG handling: sets up FIPS PRNG and seeds with
+     the standard OpenSSL PRNG: set additional data to a date time vector.
+     [Steve Henson]
+
+  *) Rename old X9.31 PRNG functions of the form FIPS_rand* to FIPS_x931*.
+     This shouldn't present any incompatibility problems because applications
+     shouldn't be using these directly and any that are will need to rethink
+     anyway as the X9.31 PRNG is now deprecated by FIPS 140-2
+     [Steve Henson]
+
+  *) Extensive self tests and health checking required by SP800-90 DRBG.
+     Remove strength parameter from FIPS_drbg_instantiate and always
+     instantiate at maximum supported strength.
+     [Steve Henson]
+
   *) Add SRP support.
-     [Tom Wu <thomwu@cisco.com> and Ben Laurie]
+     [Tom Wu <tjw@cs.stanford.edu> and Ben Laurie]
 
   *) Add ECDH code to fips module and fips_ecdhvs for primitives only testing.
      [Steve Henson]