Fix undefined behavior in s390x aes-gcm/ccm

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 4cdcf52f31e6c7742f42fe82b986b5c29e1ae602..4765e0b14a42f2c2931b15f9b6639ee30079ce0f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,13 @@
 
  Changes between 1.1.0h and 1.1.1 [xx XXX xxxx]
 
+  *) Modified the random device based seed sources to keep the relevant
+     file descriptors open rather than reopening them on each access.
+     This allows such sources to operate in a chroot() jail without
+     the associated device nodes being available. This behaviour can be
+     controlled using RAND_keep_random_devices_open().
+     [Paul Dale]
+
   *) Numerous side-channel attack mitigations have been applied. This may have
      performance impacts for some algorithms for the benefit of improved
      security. Specific changes are noted in this change log by their respective
@@ -189,12 +196,12 @@
 
      Some of its new features are:
       o Support for multiple DRBG instances with seed chaining.
-      o Add a public DRBG instance for the default RAND method.
-      o Add a dedicated DRBG instance for generating long term private keys.
-      o Make the DRBG instances fork-safe.
+      o The default RAND method makes use of a DRBG.
+      o There is a public and private DRBG instance.
+      o The DRBG instances are fork-safe.
       o Keep all global DRBG instances on the secure heap if it is enabled.
-      o Add a DRBG instance to every SSL instance for lock free operation
-        and to increase unpredictability.
+      o The public and private DRBG instance are per thread for lock free
+        operation
      [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
 
   *) Changed Configure so it only says what it does and doesn't dump