Fix a bug which caused BN_div to produce the

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 24be99630bccbf2afe86f64544972502d32b8d76..753853c8fa869803b5eef4fab78e2ff20028bae3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,29 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) In BN_div() keep a copy of the sign of 'num' before writing the
+     result to 'rm' because if rm==num the value will be overwritten
+     and produce the wrong result if 'num' is negative: this caused
+     problems with BN_mod() and BN_nnmod().
+     [Steve Henson]
+
+  *) Function OCSP_request_verify(). This checks the signature on an
+     OCSP request and verifies the signer certificate. The signer
+     certificate is just checked for a generic purpose and OCSP request
+     trust settings.
+     [Steve Henson]
+
+  *) Add OCSP_check_validity() function to check the validity of OCSP
+     responses. OCSP responses are prepared in real time and may only
+     be a few seconds old. Simply checking that the current time lies
+     between thisUpdate and nextUpdate max reject otherwise valid responses
+     caused by either OCSP responder or client clock innacuracy. Instead
+     we allow thisUpdate and nextUpdate to fall within a certain period of
+     the current time. The age of the response can also optionally be
+     checked. Two new options -validity_period and -status_age added to
+     ocsp utility.
+     [Steve Henson]
+
   *) If signature or public key algorithm is unrecognized print out its
      OID rather that just UNKOWN.
      [Steve Henson]