make update

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index db3f6388506fbe2996d8183da378b93fdb37dcf2..0c25e0bac96589575dde9c2c7a75de81d2e84e95 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,11 +4,45 @@
 
  Changes between 1.0.2e and 1.1.0  [xx XXX xxxx]
 
+  *) Support for ChaCha20 and Poly1305 added to libcrypto and libssl.
+     [Andy Polyakov]
+
+  *) New EC_KEY_METHOD, this replaces the older ECDSA_METHOD and ECDH_METHOD
+     and integrates ECDSA and ECDH functionality into EC. Implementations can
+     now redirect key generation and no longer need to convert to or from
+     ECDSA_SIG format.
+
+     Note: the ecdsa.h and ecdh.h headers are now no longer needed and just
+     include the ec.h header file instead.
+     [Steve Henson]
+
   *) Remove support for all 40 and 56 bit ciphers.  This includes all the export
      ciphers who are no longer supported and drops support the ephemeral RSA key
      exchange. The LOW ciphers currently doesn't have any ciphers in it.
      [Kurt Roeckx]
 
+  *) Make EVP_MD_CTX, EVP_MD and HMAC_CTX opaque.  For HMAC_CTX, the
+     following constructors and destructors were added:
+
+        HMAC_CTX *HMAC_CTX_new(void);
+        void HMAC_CTX_free(HMAC_CTX *ctx);
+
+     For EVP_MD, a complete API to create, fill and destroy such
+     methods has been added.  See EVP_MD_meth_new(3) for
+     documentation.
+
+     Additional changes:
+     1) HMAC_CTX_cleanup() and EVP_MD_CTX_cleanup() were removed,
+        HMAC_CTX_init() and EVP_MD_CTX_init() should be called instead
+        to reinitialise and already created structure.  Also,
+        HMAC_CTX_init() and EVP_MD_CTX_init() now return 0 for failure
+        and 1 for success (they previously had the return type void).
+     2) For consistency with the majority of our object creators and
+        destructors, EVP_MD_CTX_(create|destroy) were renamed to
+        EVP_MD_CTX_(new|free).  The old names are retained as macros
+        for deprecated builds.
+     [Richard Levitte]
+
   *) Added ASYNC support. Libcrypto now includes the async sub-library to enable
      cryptographic operations to be performed asynchronously as long as an
      asynchronous capable engine is used. See the ASYNC_start_job() man page for
@@ -20,7 +54,8 @@
 
   *) SSL_{CTX_}set_ecdh_auto() has been removed and ECDH is support is
      always enabled now.  If you want to disable the support you should
-     exclude it using the list of supported ciphers.
+     exclude it using the list of supported ciphers. This also means that the
+     "-no_ecdhe" option has been removed from s_server.
      [Kurt Roeckx]
 
   *) SSL_{CTX}_set_tmp_ecdh() which can set 1 EC curve now internally calls
@@ -49,8 +84,9 @@
   *) The demo files in crypto/threads were moved to demo/threads.
      [Rich Salz]
 
-  *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron and sureware.
-     [Matt Caswell]
+  *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron, gmp,
+     and sureware.
+     [Matt Caswell, Rich Salz]
 
   *) New ASN.1 embed macro.
 
@@ -176,6 +212,10 @@
   *) Added HTTP GET support to the ocsp command.
      [Rich Salz]
 
+  *) Changed default digest for the dgst and enc commands from MD5 to
+     sha256
+     [Rich Salz]
+
   *) RAND_pseudo_bytes has been deprecated. Users should use RAND_bytes instead.
      [Matt Caswell]
 
@@ -200,7 +240,7 @@
 
   *) Added support for OCB mode. OpenSSL has been granted a patent license
      compatible with the OpenSSL license for use of OCB. Details are available
-     at https://www.openssl.org/docs/misc/OCB-patent-grant-OpenSSL.pdf. Support
+     at https://www.openssl.org/source/OCB-patent-grant-OpenSSL.pdf. Support
      for OCB can be removed by calling config with no-ocb.
      [Matt Caswell]