summaryrefslogtreecommitdiffstats
path: root/CHANGES.md
AgeCommit message (Collapse)Author
2021-04-27Deprecate EVP_PKEY_cmp() and EVP_PKEY_cmp_parameters().Shane Lontis
The replacement functions EVP_PKEY_eq() and EVP_PKEY_parameters_eq() already exist. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14997)
2021-04-26Fixes related to separation of DH and DHX typesShane Lontis
Fix dh_rfc5114 option in genpkey. Fixes #14145 Fixes #13956 Fixes #13952 Fixes #13871 Fixes #14054 Fixes #14444 Updated documentation for app to indicate what options are available for DH and DHX keys. DH and DHX now have different keymanager gen_set_params() methods. Added CHANGES entry to indicate the breaking change. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14883)
2021-04-22add Changelog item for TLS1.3 FFDHE workHubert Kario
Raja added support for FFDHE in TLS 1.3 in commits 9aaecbfc98eb89, 8e63900a71df38ff, dfa1f5476e86f3 in 2019, reflect this in the changelog. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14972)
2021-04-22Prepare for 3.0 alpha 16Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-22Prepare for release of 3.0 alpha 15openssl-3.0.0-alpha15Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-19Change the default MANSUFFIXMatt Caswell
We now use the MANSUFFIX "ossl" by default. Fixes #14318 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14847)
2021-04-15changes: note that some ctrl calls have a different error return.Pauli
Providers do not distinguish between invalid and other errors via the return code. Fixes #14442 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14864)
2021-04-13Note deprecated function/macros with no replacement.Pauli
These functions are deprecated with no replacement specified: DH_clear_flags, DH_get_1024_160, DH_get_2048_224, DH_get_2048_256, DH_set_flags, DH_test_flags, DSA_clear_flags, DSA_dup_DH, DSAparams_dup, DSA_set_flags, DSA_test_flags, RSA_blinding_off, RSA_blinding_on, RSA_clear_flags, RSA_get_version, RSAPrivateKey_dup, RSAPublicKey_dup, RSA_set_flags, RSA_setup_blinding and RSA_test_flags. The flags that are going are: DH_FLAG_CACHE_MONT_P, DSA_FLAG_CACHE_MONT_P, RSA_FLAG_BLINDING, RSA_FLAG_CACHE_PRIVATE, RSA_FLAG_CACHE_PUBLIC, RSA_FLAG_EXT_PKEY, RSA_FLAG_NO_BLINDING, RSA_FLAG_THREAD_SAFE and RSA_METHOD_FLAG_NO_CHECK. These two flags are "readable" via EVP_is_a(). They are not writable: DH_FLAG_TYPE_DHX and DH_FLAG_TYPE_DH. Fixes #14616 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14824)
2021-04-12Remove the function EVP_PKEY_set_alias_typeMatt Caswell
OTC recently voted that EVP_PKEY types will be immutable in 3.0. This means that EVP_PKEY_set_alias_type can no longer work and should be removed entirely (applications will need to be rewritten not to use it). It was primarily used for SM2 which no longer needs this call. Applications should generate SM2 keys directly (without going via an EC key first), or otherwise when loading keys they should automatically be detected as SM2 keys. Fixes #14379 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14803)
2021-04-12Update KTLS documentationMatt Caswell
KTLS support has been changed to be off by default, and configuration is via a single "option" rather two "modes". Documentation is updated accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14799)
2021-04-08Prepare for 3.0 alpha 15Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-08Prepare for release of 3.0 alpha 14openssl-3.0.0-alpha14Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-04-06Deprecate the EVP_PKEY controls for CMS and PKCS#7Tomas Mraz
Improve the ossl_rsa_check_key() to prevent non-signature operations with PSS keys. Do not invoke the EVP_PKEY controls for CMS and PKCS#7 anymore as they are not needed anymore and deprecate them. Fixes #14276 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14760)
2021-04-01Add a range check (from SP800-56Ar3) to DH key derivation.Shane Lontis
Fixes #14401 Note that this moves the public key check out of DH compute_key() since key validation does not belong inside this primitive.. The check has been moved to the EVP_PKEY_derive_set_peer() function so that it generally applies to all exchange operations.. Use EVP_PKEY_derive_set_peer_ex() to disable this behaviour. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14717)
2021-03-31CHANGES.md: reflect OSSL_HTTP_REQ_CTX_i2d renamed to OSSL_HTTP_REQ_CTX_set1_reqDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14630)
2021-03-25Update CHANGES.md and NEWS.md for new releaseMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-03-22Dual 1024-bit exponentiation optimization for Intel IceLake CPUAndrey Matyukov
with AVX512_IFMA + AVX512_VL instructions, primarily for RSA CRT private key operations. It uses 256-bit registers to avoid CPU frequency scaling issues. The performance speedup for RSA2k signature on ICL is ~2x. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13750)
2021-03-18TS and CMS CAdES-BES: Refactor check_signing_certs() funcs into common ESS funcDr. David von Oheimb
Also constify related CMS/PKCS7 functions and improve error codes thrown. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
2021-03-18ts_check_signing_certs(): Make sure both ESSCertID and ESSCertIDv2 are checkedDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
2021-03-18TS ESS: Invert the search logic of ts_check_signing_certs() to correctly ↵Dr. David von Oheimb
cover cert ID list Fixes #14190 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
2021-03-15Add a CHANGES entry for the cosmetic differences in textual outputMatt Caswell
Numerous functions have had their textual output amended. We add a CHANGES entry for this. Fixes #14476 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14485)
2021-03-12Update CHANGES with info about AuthEnvelopedData additionJakub Zelenka
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14456)
2021-03-11Prepare for 3.0 alpha 14Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-03-11Prepare for release of 3.0 alpha 13openssl-3.0.0-alpha13Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-03-11Use read/write locking on WindowsVincent Drake
Fixes #13914 The "SRWLock" synchronization primitive is available in Windows Vista and later. CRYPTO_THREAD functions now use SRWLock functions when the target operating system supports them. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14381)
2021-03-11Add new filter BIO BIO_f_readbuffer()Shane Lontis
This allows BIO_tell() and BIO_seek() to work for BIO's that do not support these methods. The main use case for this is file/fd BIO's that use stdin. This works for stdin taken from input redirection (command < file), and stdin via pipe (cat file | command). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14407)
2021-03-10Change default algorithms in PKCS12_create() and PKCS12_set_mac()Tomas Mraz
Use the modern defaults as now set in the pkcs12 app. This also allows modifying the application to not override the default values when calling the API. Fixes #14034 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14450)
2021-03-10Mention the change of licence in NEWS.mdMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14465)
2021-03-10Expand the CHANGES entry for SHA1 and libsslMatt Caswell
As well as SSL 3, TLS 1.0, TLS 1.1 and DTLS 1.0 not working at security level 1 we also document that TLS 1.2 connection will fail if the ClientHello does not have a signature algorithms extension. Fixes #14447 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14465)
2021-03-10Add a CHANGES for OSSL_STORE_INFO_get_type()Matt Caswell
The function OSSL_STORE_INFO_get_type() may now return a new object type. Applications may have to be amended accordingly. Fixes #14446 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14465)
2021-03-10Add a missing CHANGES.md entry for the legacy providerMatt Caswell
Numerous ciphers and digests have been moved to the legacy provider. There should be a CHANGES.md entry pointing this out. Fixes #14441 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14465)
2021-03-09Non-const accessor to legacy keysDmitry Belyavskiy
Fixes #14466. Reverting the changes of the EVP_PKEY_get0 function. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14468)
2021-03-08Make the EVP_PKEY_get0* functions have a const return typeMatt Caswell
OTC have decided that the EVP_PKEY_get0* functions should have a const return type. This is a breaking change to emphasise that these values should be considered as immutable. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14319)
2021-03-08Document the change in behaviour of the the low level key getters/settersMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14319)
2021-03-08Ensure the various legacy key EVP_PKEY getters/setters are deprecatedMatt Caswell
Most of these were already deprecated but a few have been missed. This commit corrects that. Fixes #14303 Fixes #14317 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14319)
2021-03-01Remove RSA SSLv23 padding modeRich Salz
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14248)
2021-03-01OSSL_HTTP_parse_url(): Handle any userinfo, query, and fragment componentsDr. David von Oheimb
Now handle [http[s]://][userinfo@]host[:port][/path][?query][#frag] by optionally providing any userinfo, query, and frag components. All usages of this function, which are client-only, silently ignore userinfo and frag components, while the query component is taken as part of the path. Update and extend the unit tests and all affected documentation. Document and deprecat OCSP_parse_url(). Fixes an issue that came up when discussing FR #14001. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14009)
2021-02-24speed: Use EVP for ciphers, cmac, ghash, rsa, dsa, and ecdsaTomas Mraz
Fixes #13909 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14228)
2021-02-24Deprecated EVP_PKEY_CTX_get0_dh_kdf_ukm() and EVP_PKEY_CTX_get0_ecdh_kdf_ukm()Tomas Mraz
The functions are not needed and require returning octet ptr parameters from providers that would like to support them which complicates provider implementations. Fixes #12985 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14279)
2021-02-23changes: note the deprecation of RAND_METHOD APIsPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13652)
2021-02-18Prepare for 3.0 alpha 13Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-02-18Prepare for release of 3.0 alpha 12openssl-3.0.0-alpha12Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-02-16Update CHANGES and NEWS for new releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-02-12Update documentation following deprecation of SRPMatt Caswell
Ensure all the man pages correctly reflect the deprecated status of SRP. Fixes #13917 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
2021-02-12changes: add a CHANGES.md entry for the OSSL_FORCE_NO_CACHE_FETCH option.Pauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14126)
2021-02-09CHANGES.md: Mention RSA key generation slowdown related changesTomas Mraz
Fixes #14068 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14073)
2021-02-09Deprecate BN_pseudo_rand() and BN_pseudo_rand_range()Tomas Mraz
The functions are obsolete aliases for BN_rand() and BN_rand_range() since 1.1.0. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14080)
2021-02-05Stop disabling TLSv1.3 if ec and dh are disabledMatt Caswell
Even if EC and DH are disabled then we may still be able to use TLSv1.3 if we have groups that have been plugged in by an external provider. Fixes #13767 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13916)
2021-02-03Deprecate EVP_MD_CTX_{set_}update_fn()Rich Salz
They are still used internally in legacy code. Also fixed up some minor things in EVP_DigestInit.pod Fixes: #14003 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14008)
2021-02-03Add diacritics to my name in CHANGES.mdTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14044)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 09:44:50 +0000