summaryrefslogtreecommitdiffstats
path: root/CHANGES
AgeCommit message (Collapse)Author
2012-10-04update CHANGESOpenSSL-fips-2_0_1Dr. Stephen Henson
2011-11-19Add flag to support cofactor ECDHDr. Stephen Henson
2011-11-06Update fips_test_suite to take multiple command line options andDr. Stephen Henson
an induced error checking function.
2011-11-05Add single call public key sign and verify functions.Dr. Stephen Henson
2011-11-01Add support for multicall fips_algvs utility combining functionalityDr. Stephen Henson
of all fips test utilities in a single binary and some minimal script parsing for platforms lacking a suitable shell. In order to keep changes to the build system to a minimum it #includes all the utilities C source files (yuck).
2011-10-19add authentication parameter to FIPS_module_mode_setDr. Stephen Henson
2011-10-19BN_BLINDING multi-threading fix.Bodo Möller
Submitted by: Emilia Kasper (Google)
2011-10-19Fix warnings.Bodo Möller
Also, use the common Configure mechanism for enabling/disabling the 64-bit ECC code.
2011-10-18Improve optional 64-bit NIST-P224 implementation, and add NIST-P256 andBodo Möller
NIST-P521. (Now -DEC_NISTP_64_GCC_128 enables all three of these; -DEC_NISTP224_64_GCC_128 no longer works.) Submitted by: Google Inc.
2011-10-13typoBodo Möller
2011-10-13In ssl3_clear, preserve s3->init_extra along with s3->rbuf.Bodo Möller
Submitted by: Bob Buckholz <bbuckholz@google.com>
2011-10-09fix CHANGES entryDr. Stephen Henson
2011-09-29Add FIPS selftests for ECDH algorithm.Dr. Stephen Henson
2011-09-22Use function name FIPS_drbg_health_check() for health check function.Dr. Stephen Henson
Add explanatory comments to health check code.
2011-09-21Revise DRBG to split between internal and external flags.Dr. Stephen Henson
One demand health check function. Perform generation test in fips_test_suite. Option to skip dh test if fips_test_suite.
2011-09-14new function to lookup FIPS supported ciphers by NIDDr. Stephen Henson
2011-09-12More extensive DRBG health check. New function to call health checkDr. Stephen Henson
for all DRBG combinations.
2011-09-09Add support for Dual EC DRBG from SP800-90. Include updates to algorithmDr. Stephen Henson
tests and POST code.
2011-09-06Initialise X509_STORE_CTX properly so CRLs with nextUpdate date in the pastDr. Stephen Henson
produce an error (CVE-2011-3207)
2011-09-05Fix session handling.Bodo Möller
2011-09-05Fix d2i_SSL_SESSION.Bodo Möller
2011-09-05(EC)DH memory handling fixes.Bodo Möller
Submitted by: Adam Langley
2011-09-05Fix memory leak on bad inputs.Bodo Möller
2011-09-05Synchronize with 1.0.1 CHANGES file.Bodo Möller
2011-08-26Add support for canonical generation of DSA parameter g.Dr. Stephen Henson
Modify fips_dssvs to support appropriate file format.
2011-08-23Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.Andy Polyakov
2011-08-14Remove hard coded ecdsaWithSHA1 hack in ssl routines and check for RSADr. Stephen Henson
using OBJ xref utilities instead of string comparison with OID name. This removes the arbitrary restriction on using SHA1 only with some ECC ciphersuites.
2011-08-08Add HMAC DRBG from SP800-90Dr. Stephen Henson
2011-08-03Expand range of ctrls for AES GCM to support retrieval and setting ofDr. Stephen Henson
invocation field. Add complete support for AES GCM ciphersuites including all those in RFC5288 and RFC5289.
2011-07-25Update CHANGES.Dr. Stephen Henson
2011-07-04Add functions to return FIPS module version.Dr. Stephen Henson
2011-06-15Fix the version history: changes going into 1.1.0 that are also goingBodo Möller
into 1.0.1 should not be listed as "changes between 1.0.1 and 1.0.0". This makes the OpenSSL_1_0_1-stable and HEAD versions of this file consistent with each other (the HEAD version has the additional 1.1.0 section, but doesn't otherwise differ).
2011-05-30Output supported curves in preference order instead of numerically.Dr. Stephen Henson
2011-05-25Fix the ECDSA timing attack mentioned in the paper at:Dr. Stephen Henson
http://eprint.iacr.org/2011/232.pdf Thanks to the original authors Billy Bob Brumley and Nicola Tuveri for bringing this to our attention.
2011-05-20PR: 2295Dr. Stephen Henson
Submitted by: Alexei Khlebnikov <alexei.khlebnikov@opera.com> Reviewed by: steve OOM checking. Leak in OOM fix. Fall-through comment. Duplicate code elimination.
2011-05-19Add CHANGES entry: add FIPS support to sslDr. Stephen Henson
2011-05-19Implement FIPS_mode and FIPS_mode_setDr. Stephen Henson
2011-05-12Provisional support for TLS v1.2 client authentication: client side only.Dr. Stephen Henson
Parse certificate request message and set digests appropriately. Generate new TLS v1.2 format certificate verify message. Keep handshake caches around for longer as they are needed for client auth.
2011-05-11Rename FIPS_mode_set and FIPS_mode. Theses symbols will be defined inDr. Stephen Henson
the FIPS capable OpenSSL.
2011-05-09Initial TLS v1.2 client support. Include a default supported signatureDr. Stephen Henson
algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.
2011-05-06Continuing TLS v1.2 support: add support for server parsing ofDr. Stephen Henson
signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.
2011-04-29Initial incomplete TLS v1.2 support. New ciphersuites added, new versionDr. Stephen Henson
checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.
2011-04-29Initial "opaque SSL" framework. If an application definesDr. Stephen Henson
OPENSSL_NO_SSL_INTERN all ssl related structures are opaque and internals cannot be directly accessed. Many applications will need some modification to support this and most likely some additional functions added to OpenSSL. The advantage of this option is that any application supporting it will still be binary compatible if SSL structures change.
2011-04-23Always return multiple of block length bytes from default DRBG seedDr. Stephen Henson
callback. Handle case where no multiple of the block size is in the interval [min_len, max_len].
2011-04-23Add PRNG security strength checking.Dr. Stephen Henson
2011-04-18Fix EVP CCM decrypt. Add decrypt support to algorithm test program.Dr. Stephen Henson
2011-04-18Initial untested CCM support via EVP.Dr. Stephen Henson
2011-04-15Add algorithm driver for XTS mode. Fix several bugs in EVP XTS implementation.Dr. Stephen Henson
2011-04-14Initial incomplete POST overhaul: add support for POST callback toDr. Stephen Henson
allow status of POST to be monitored and/or failures induced.
2011-04-12Provisional AES XTS support.Dr. Stephen Henson
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-23 15:49:03 +0000