From 06da6e49777285f50aeb1b920d950a9bd27fef52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lutz=20J=C3=A4nicke?= Date: Fri, 3 Aug 2001 08:45:13 +0000 Subject: Don't disable rollback attack detection as a recommended bug workaround. --- CHANGES | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'CHANGES') diff --git a/CHANGES b/CHANGES index 0c96da129c..7ec91e58d2 100644 --- a/CHANGES +++ b/CHANGES @@ -12,6 +12,14 @@ *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7 +) applies to 0.9.7 only + +) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended + bug workarounds. Rollback attack detection is a security feature. + The problem will only arise on OpenSSL servers, when TLSv1 is not + available (sslv3_server_method() or SSL_OP_NO_TLSv1). + Software authors not wanting to support TLSv1 will have special reasons + for their choice and can explicitly enable this option. + [Bodo Moeller, Lutz Jaenicke] + +) Rationalise EVP so it can be extended: don't include a union of cipher/digest structures, add init/cleanup functions. This also reduces the number of header dependencies. -- cgit v1.2.3