DTLS 1.2 support has been added to 1.0.2.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 01b2885bef4d6cb71e5275c126074c69dffd14ba..f67fe393672e68c66804e26e1cfd0e9739fb68c8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -74,11 +74,6 @@
      MGF1 digest and OAEP label.
      [Steve Henson]
 
-  *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
-     supports both DTLS 1.2 and 1.0 and should use whatever version the peer
-     supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
-     [Steve Henson]
-
   *) Make openssl verify return errors.
      [Chris Palmer <palmer@google.com> and Ben Laurie]
 
@@ -310,6 +305,10 @@
 
  Changes between 1.0.1h and 1.0.2 [xx XXX xxxx]
 
+  *) Accelerated NIST P-256 elliptic curve implementation for x86_64
+     (other platforms pending).
+     [Shay Gueron (Intel Corp), Andy Polyakov]
+
   *) Add support for the SignedCertificateTimestampList certificate and
      OCSP response extensions from RFC6962.
      [Rob Stradling]
@@ -354,6 +353,11 @@
      This work was sponsored by Intel Corp.
      [Andy Polyakov]
 
+  *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
+     supports both DTLS 1.2 and 1.0 and should use whatever version the peer
+     supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
+     [Steve Henson]
+
   *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
      this fixes a limiation in previous versions of OpenSSL.
      [Steve Henson]
@@ -615,6 +619,24 @@
      certificates.
      [Steve Henson]
 
+  *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
+     the certificate.
+     Note: Related 1.0.2-beta specific macros X509_get_cert_info,
+     X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
+     X509_CINF_get_signature were reverted post internal team review.
+
+ Changes between 1.0.1i and 1.0.1j [xx XXX xxxx]
+
+  *) Add additional DigestInfo checks.
+ 
+     Reencode DigestInto in DER and check against the original when
+     verifying RSA signature: this will reject any improperly encoded
+     DigestInfo structures.
+
+     Note: this is a precautionary measure and no attacks are currently known.
+
+     [Steve Henson]
+
  Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
 
   *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted