In cases where we ask PEM_def_callback for minimum 0 length, accept 0 length

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index e5f6cb6c9d1c0321c5edfaae912982b843ac4d05..c67a9c61ec0a4f3d71fa20a801101f38febde8b1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,62 @@
 
  Changes between 1.1.0h and 1.1.1 [xx XXX xxxx]
 
+  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
+     now allow empty (zero character) pass phrases.
+     [Richard Levitte]
+
+  *) Apply blinding to binary field modular inversion and remove patent
+     pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation.
+     [Billy Bob Brumley]
+
+  *) Deprecate ec2_mult.c and unify scalar multiplication code paths for
+     binary and prime elliptic curves.
+     [Billy Bob Brumley]
+
+  *) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for
+     constant time fixed point multiplication.
+     [Billy Bob Brumley]
+
+  *) Revise elliptic curve scalar multiplication with timing attack
+     defenses: ec_wNAF_mul redirects to a constant time implementation
+     when computing fixed point and variable point multiplication (which
+     in OpenSSL are mostly used with secret scalars in keygen, sign,
+     ECDH derive operations).
+     [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida García,
+      Sohaib ul Hassan]
+
+  *) Updated CONTRIBUTING
+     [Rich Salz]
+
+  *) Updated DRBG / RAND to request nonce and additional low entropy
+     randomness from the system.
+     [Matthias St. Pierre]
+
+  *) Updated 'openssl rehash' to use OpenSSL consistent default.
+     [Richard Levitte]
+
+  *) Moved the load of the ssl_conf module to libcrypto, which helps
+     loading engines that libssl uses before libssl is initialised.
+     [Matt Caswell]
+
+  *) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA
+     [Matt Caswell]
+
+  *) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases.
+     [Ingo Schwarze, Rich Salz]
+
+  *) Added output of accepting IP address and port for 'openssl s_server'
+     [Richard Levitte]
+
+  *) Added a new API for TLSv1.3 ciphersuites:
+        SSL_CTX_set_ciphersuites()
+        SSL_set_ciphersuites()
+     [Matt Caswell]
+
+  *) Memory allocation failures consistenly add an error to the error
+     stack.
+     [Rich Salz]
+
   *) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values
      in libcrypto when run as setuid/setgid.
      [Bernd Edlinger]
@@ -33,7 +89,7 @@
      below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3.
      In order to avoid issues where legacy TLSv1.2 ciphersuite configuration
      would otherwise inadvertently disable all TLSv1.3 ciphersuites the
-     configuraton has been separated out. See the ciphers man page or the
+     configuration has been separated out. See the ciphers man page or the
      SSL_CTX_set_ciphersuites() man page for more information.
      [Matt Caswell]