
 OpenSSL CHANGES
 _______________

 Changes between 1.0.1m and 1.0.1n [11 Jun 2015]

  *) Malformed ECParameters causes infinite loop

     When processing an ECParameters structure OpenSSL enters an infinite loop
     if the curve specified is over a specially malformed binary polynomial
     field.

     This can be used to perform denial of service against any
     system which processes public keys, certificate requests or
     certificates.  This includes TLS clients and TLS servers with
     client authentication enabled.

     This issue was reported to OpenSSL by Joseph Barr-Pixton.
     (CVE-2015-1788)
     [Andy Polyakov]

  *) Exploitable out-of-bounds read in X509_cmp_time

     X509_cmp_time does not properly check the length of the ASN1_TIME
     string and can read a few bytes out of bounds. In addition,
     X509_cmp_time accepts an arbitrary number of fractional seconds in the
     time string.

     An attacker can use this to craft malformed certificates and CRLs of
     various sizes and potentially cause a segmentation fault, resulting in
     a DoS on applications that verify certificates or CRLs. TLS clients
     that verify CRLs are affected. TLS clients and servers with client
     authentication enabled may be affected if they use custom verification
     callbacks.

     This issue was reported to OpenSSL by Robert Swiecki (Google), and
     independently by Hanno Böck.
     (CVE-2015-1789)
     [Emilia Käsper]

  *) PKCS7 crash with missing EnvelopedContent

     The PKCS#7 parsing code does not handle missing inner EncryptedContent
     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
     with missing content and trigger a NULL pointer dereference on parsing.

     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
     structures from untrusted sources are affected. OpenSSL clients and
     servers are not affected.

     This issue was reported to OpenSSL by Michal Zalewski (Google).
     (CVE-2015-1790)
     [Emilia Käsper]

  *) CMS verify infinite loop with unknown hash function

     When verifying a signedData message the CMS code can enter an infinite loop
     if presented with an unknown hash function OID. This can be used to perform
     denial of service against any system which verifies signedData messages using
     the CMS code.
     This issue was reported to OpenSSL by Johannes Bauer.
     (CVE-2015-1792)
     [Stephen Henson]

  *) Race condition handling NewSessionTicket

     If a NewSessionTicket is received by a multi-threaded client when attempting to
     reuse a previous ticket then a race condition can occur potentially leading to
     a double free of the ticket data.
     (CVE-2015-1791)
     [Matt Caswell]

  *) Reject DH handshakes with parameters shorter than 768 bits.
     [Kurt Roeckx and Emilia Kasper]

 Changes between 1.0.1l and 1.0.1m [19 Mar 2015]

  *) Segmentation fault in ASN1_TYPE_cmp fix

     The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
     made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
     certificate signature algorithm consistency this can be used to crash any
     certificate verification operation and exploited in a DoS attack. Any
     application which performs certificate verification is vulnerable including
     OpenSSL clients and servers which enable client authentication.
     (CVE-2015-0286)
     [Stephen Henson]

  *) ASN.1 structure reuse memory corruption fix

     Reusing a structure in ASN.1 parsing may allow an attacker to cause
     memory corruption via an invalid write. Such reuse is and has been
     strongly discouraged and is believed to be rare.

     Applications that parse structures containing CHOICE or ANY DEFINED BY
     components may be affected. Certificate parsing (d2i_X509 and related
     functions) are however not affected. OpenSSL clients and servers are
     not affected.
     (CVE-2015-0287)
     [Stephen Henson]

  *) PKCS7 NULL pointer dereferences fix

     The PKCS#7 parsing code does not handle missing outer ContentInfo
     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
     missing content and trigger a NULL pointer dereference on parsing.

     Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
     otherwise parse PKCS#7 structures from untrusted sources are
     affected. OpenSSL clients and servers are not affected.

     This issue was reported to OpenSSL by Michal Zalewski (Google).
     (CVE-2015-0289)
     [Emilia Käsper]

  *) DoS via reachable assert in SSLv2 servers fix

     A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
     servers that both support SSLv2 and enable export cipher suites by sending
     a specially crafted SSLv2 CLIENT-MASTER-KEY message.

     This issue was discovered by Sean Burford (Google) and Emilia Käsper
     (OpenSSL development team).
     (CVE-2015-0293)
     [Emilia Käsper]

  *) Use After Free following d2i_ECPrivatekey error fix

     A malformed EC private key file consumed via the d2i_ECPrivateKey function
     could cause a use after free condition. This, in turn, could cause a double
     free in several private key parsing functions (such as d2i_PrivateKey
     or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
     for applications that receive EC private keys from untrusted
     sources. This scenario is considered rare.

     This issue was discovered by the BoringSSL project and fixed in their
     commit 517073cd4b.
     (CVE-2015-0209)
     [Matt Caswell]

  *) X509_to_X509_REQ NULL pointer deref fix

     The function X509_to_X509_REQ will crash with a NULL pointer dereference if
     the certificate key is invalid. This function is rarely used in practice.

     This issue was discovered by Brian Carpenter.
     (CVE-2015-0288)
     [Stephen Henson]

  *) Removed the export ciphers from the DEFAULT ciphers
     [Kurt Roeckx]

 Changes between 1.0.1k and 1.0.1l [15 Jan 2015]

  *) Build fixes for the Windows and OpenVMS platforms
     [Matt Caswell and Richard Levitte]

 Changes between 1.0.1j and 1.0.1k [8 Jan 2015]

  *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
     message can cause a segmentation fault in OpenSSL due to a NULL pointer
     dereference. This could lead to a Denial Of Service attack. Thanks to
     Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
     (CVE-2014-3571)
     [Steve Henson]

  *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
     dtls1_buffer_record function under certain conditions. In particular this
     could occur if an attacker sent repeated DTLS records with the same
     sequence number but for the next epoch. The memory leak could be exploited
     by an attacker in a Denial of Service attack through memory exhaustion.
     Thanks to Chris Mueller for reporting this issue.
     (CVE-2015-0206)
     [Matt Caswell]

  *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
     built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
     method would be set to NULL which could later result in a NULL pointer
     dereference. Thanks to Frank Schmirler for reporting this issue.
     (CVE-2014-3569)
     [Kurt Roeckx]

  *) Abort handshake if server key exchange message is omitted for ephemeral
     ECDH ciphersuites.

     Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
     reporting this issue.
     (CVE-2014-3572)
     [Steve Henson]

  *) Remove non-export ephemeral RSA code on client and server. This code
     violated the TLS standard by allowing the use of temporary RSA keys in
     non-export ciphersuites and could be used by a server to effectively
     downgrade the RSA key length used to a value smaller than the server
     certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
     INRIA or reporting this issue.
     (CVE-2015-0204)
     [Steve Henson]

  *) Fixed issue where DH client certificates are accepted without verification.
     An OpenSSL server will accept a DH certificate for client authentication
     without the certificate verify message. This effectively allows a client to
     authenticate without the use of a private key. This only affects servers
     which trust a client certificate authority which issues certificates
     containing DH keys: these are extremely rare and hardly ever encountered.
     Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
     this issue.
     (CVE-2015-0205)
     [Steve Henson]

  *) Ensure that the session ID context of an SSL is updated when its
     SSL_CTX is updated via SSL_set_SSL_CTX.

     The session ID context is typically set from the parent SSL_CTX,
     and can vary with the CTX.
     [Adam Langley]

  *) Fix various certificate fingerprint issues.

     By using non-DER or invalid encodings outside the signed portion of a
     certificate the fingerprint can be changed without breaking the signature.
     Although no details of the signed portion of the certificate can be changed
     this can cause problems with some applications: e.g. those using the
     certificate fingerprint for blacklists.

     1. Reject signatures with non zero unused bits.

     If the BIT STRING containing the signature has non zero unused bits reject
     the signature. All current signature algorithms require zero unused bits.

     2. Check certificate algorithm consistency.

     Check the AlgorithmIdentifier inside TBS matches the one in the
     certificate signature. NB: this will result in signature failure
     errors for some broken certificates.

     Thanks to Konrad Kraszewski from Google for reporting this issue.

     3. Check DSA/ECDSA signatures use DER.

     Reencode DSA/ECDSA signatures and compare with the original received
     signature. Return an error if there is a mismatch.

     This will reject various cases including garbage after signature
     (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
     program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
     (negative or with leading zeroes).

     Further analysis was conducted and fixes were developed by Stephen Henson
     of the OpenSSL core team.

     (CVE-2014-8275)
     [Steve Henson]

   *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
      results on some platforms, including x86_64. This bug occurs at random
      with a very low probability, and is not known to be exploitable in any
      way, though its exact impact is difficult to determine. Thanks to Pieter
      Wuille (Blockstream) who reported this issue and also suggested an initial
      fix. Further analysis was conducted by the OpenSSL development team and
      Adam Langley of Google. The final fix was developed by Andy Polyakov of
      the OpenSSL core team.
      (CVE-2014-3570)
      [Andy Polyakov]

   *) Do not resume sessions on the server if the negotiated protocol
      version does not match the session's version. Resuming with a different
      version, while not strictly forbidden by the RFC, is of questionable
      sanity and breaks all known clients.
      [David Benjamin, Emilia Käsper]

   *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
      early CCS messages during renegotiation. (Note that because
      renegotiation is encrypted, this early CCS was not exploitable.)
      [Emilia Käsper]

   *) Tighten client-side session ticket handling during renegotiation:
      ensure that the client only accepts a session ticket if the server sends
      the extension anew in the ServerHello. Previously, a TLS client would
      reuse the old extension state and thus accept a session ticket if one was
      announced in the initial ServerHello.

      Similarly, ensure that the client requires a session ticket if one
      was advertised in the ServerHello. Previously, a TLS client would
      ignore a missing NewSessionTicket message.
      [Emilia Käsper]

 Changes between 1.0.1i and 1.0.1j [15 Oct 2014]

  *) SRTP Memory Leak.

     A flaw in the DTLS SRTP extension parsing code allows an attacker, who
     sends a carefully crafted handshake message, to cause OpenSSL to fail
     to free up to 64k of memory causing a memory leak. This could be
     exploited in a Denial Of Service attack. This issue affects OpenSSL
     1.0.1 server implementations for both SSL/TLS and DTLS regardless of
     whether SRTP is used or configured. Implementations of OpenSSL that
     have been compiled with OPENSSL_NO_SRTP defined are not affected.

     The fix was developed by the OpenSSL team.
     (CVE-2014-3513)
     [OpenSSL team]

  *) Session Ticket Memory Leak.

     When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
     integrity of that ticket is first verified. In the event of a session
     ticket integrity check failing, OpenSSL will fail to free memory
     causing a memory leak. By sending a large number of invalid session
     tickets an attacker could exploit this issue in a Denial Of Service
     attack.
     (CVE-2014-3567)
     [Steve Henson]

  *) Build option no-ssl3 is incomplete.

     When OpenSSL is configured with "no-ssl3" as a build option, servers
     could accept and complete a SSL 3.0 handshake, and clients could be
     configured to send them.
     (CVE-2014-3568)
     [Akamai and the OpenSSL team]

  *) Add support for TLS_FALLBACK_SCSV.
     Client applications doing fallback retries should call
     SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
     (CVE-2014-3566)
     [Adam Langley, Bodo Moeller]

  *) Add additional DigestInfo checks.
 
     Reencode DigestInto in DER and check against the original when
     verifying RSA signature: this will reject any improperly encoded
     DigestInfo structures.

     Note: this is a precautionary measure and no attacks are currently known.

     [Steve Henson]

 Changes between 1.0.1h and 1.0.1i [6 Aug 2014]

  *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
     SRP code can be overrun an internal buffer. Add sanity check that
     g, A, B < N to SRP code.

     Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
     Group for discovering this issue.
     (CVE-2014-3512)
     [Steve Henson]

  *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
     TLS 1.0 instead of higher protocol versions when the ClientHello message
     is badly fragmented. This allows a man-in-the-middle attacker to force a
     downgrade to TLS 1.0 even if both the server and the client support a
     higher protocol version, by modifying the client's TLS records.

     Thanks to David Benjamin and Adam Langley (Google) for discovering and
     researching this issue.
     (CVE-2014-3511)
     [David Benjamin]

  *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
     to a denial of service attack. A malicious server can crash the client
     with a null pointer dereference (read) by specifying an anonymous (EC)DH
     ciphersuite and sending carefully crafted handshake messages.

     Thanks to Felix Gröbert (Google) for discovering and researching this
     issue.
     (CVE-2014-3510)
     [Emilia Käsper]

  *) By sending carefully crafted DTLS packets an attacker could cause openssl
     to leak memory. This can be exploited through a Denial of Service attack.
     Thanks to Adam Langley for discovering and researching this issue.
     (CVE-2014-3507)
     [Adam Langley]

  *) An attacker can force openssl to consume large amounts of memory whilst
     processing DTLS handshake messages. This can be exploited through a
     Denial of Service attack.
     Thanks to Adam Langley for discovering and researching this issue.
     (CVE-2014-3506)
     [Adam Langley]

  *) An attacker can force an error condition which causes openssl to crash
     whilst processing DTLS packets due to memory being freed twice. This
     can be exploited through a Denial of Service attack.
     Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
     this issue.
     (CVE-2014-3505)
     [Adam Langley]

  *) If a multithreaded client connects to a malicious server using a resumed
     session and the server sends an ec point format extension it could write
     up to 255 bytes to freed memory.

     Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
     issue.
     (CVE-2014-3509)
     [Gabor Tyukasz]

  *) A malicious server can crash an OpenSSL client with a null pointer
     dereference (read) by specifying an SRP ciphersuite even though it was not
     properly negotiated with the client. This can be exploited through a
     Denial of Service attack.

     Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for
     discovering and researching this issue.
     (CVE-2014-5139)
     [Steve Henson]

  *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
     X509_name_oneline, X509_name_print_ex et al. to leak some information
     from the stack. Applications may be affected if they echo pretty printing
     output to the attacker.

     Thanks to Ivan Fratric (Google) for discovering this issue.
     (CVE-2014-3508)
     [Emilia Käsper, and Steve Henson]

  *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
     for corner cases. (Certain input points at infinity could lead to
     bogus results, with non-infinity inputs mapped to infinity too.)
     [Bodo Moeller]

 Changes between 1.0.1g and 1.0.1h [5 Jun 2014]

  *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
     handshake can force the use of weak keying material in OpenSSL
     SSL/TLS clients and servers.

     Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
     researching this issue. (CVE-2014-0224)
     [KIKUCHI Masashi, Steve Henson]

  *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
     OpenSSL DTLS client the code can be made to recurse eventually crashing
     in a DoS attack.

     Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
     (CVE-2014-0221)
     [Imre Rad, Steve Henson]

  *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
     be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
     client or server. This is potentially exploitable to run arbitrary
     code on a vulnerable client or server.

     Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195)
     [Jüri Aedla, Steve Henson]

  *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
     are subject to a denial of service attack.

     Thanks to Felix Gröbert and Ivan Fratric at Google for discovering
     this issue. (CVE-2014-3470)
     [Felix Gröbert, Ivan Fratric, Steve Henson]

  *) Harmonize version and its documentation. -f flag is used to display
     compilation flags.
     [mancha <mancha1@zoho.com>]

  *) Fix eckey_priv_encode so it immediately returns an error upon a failure
     in i2d_ECPrivateKey.
     [mancha <mancha1@zoho.com>]

  *) Fix some double frees. These are not thought to be exploitable.
     [mancha <mancha1@zoho.com>]

 Changes between 1.0.1f and 1.0.1g [7 Apr 2014]

  *) A missing bounds check in the handling of the TLS heartbeat extension
     can be used to reveal up to 64k of memory to a connected client or
     server.

     Thanks for Neel Mehta of Google Security for discovering this bug and to
     Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
     preparing the fix (CVE-2014-0160)
     [Adam Langley, Bodo Moeller]

  *) Fix for the attack described in the paper "Recovering OpenSSL
     ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
     by Yuval Yarom and Naomi Benger. Details can be obtained from:
     http://eprint.iacr.org/2014/140

     Thanks to Yuval Yarom and Naomi Benger for discovering this
     flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
     [Yuval Yarom and Naomi Benger]

  *) TLS pad extension: draft-agl-tls-padding-03

     Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
     TLS client Hello record length value would otherwise be > 255 and
     less that 512 pad with a dummy extension containing zeroes so it
     is at least 512 bytes long.

     [Adam Langley, Steve Henson]

 Changes between 1.0.1e and 1.0.1f [6 Jan 2014]

  *) Fix for TLS record tampering bug. A carefully crafted invalid 
     handshake could crash OpenSSL with a NULL pointer exception.
     Thanks to Anton Johansson for reporting this issues.
     (CVE-2013-4353)

  *) Keep original DTLS digest and encryption contexts in retransmission
     structures so we can use the previous session parameters if they need
     to be resent. (CVE-2013-6450)
     [Steve Henson]

  *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
     avoids preferring ECDHE-ECDSA ciphers when the client appears to be
     Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
     several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
     is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
     10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
     [Rob Stradling, Adam Langley]

 Changes between 1.0.1d and 1.0.1e [11 Feb 2013]

  *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
     supporting platforms or when small records were transferred.
     [Andy Polyakov, Steve Henson]

 Changes between 1.0.1c and 1.0.1d [5 Feb 2013]

  *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.

     This addresses the flaw in CBC record processing discovered by 
     Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
     at: http://www.isg.rhul.ac.uk/tls/     

     Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
     Security Group at Royal Holloway, University of London
     (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
     Emilia Käsper for the initial patch.
     (CVE-2013-0169)
     [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]

  *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
     ciphersuites which can be exploited in a denial of service attack.
     Thanks go to and to Adam Langley <agl@chromium.org> for discovering
     and detecting this bug and to Wolfgang Ettlinger
     <wolfgang.ettlinger@gmail.com> for independently discovering this issue.
     (CVE-2012-2686)
     [Adam Langley]

  *) Return an error when checking OCSP signatures when key is NULL.
     This fixes a DoS attack. (CVE-2013-0166)
     [Steve Henson]

  *) Make openssl verify return errors.
     [Chris Palmer <palmer@google.com> and Ben Laurie]

  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
     the right response is stapled. Also change SSL_get_certificate()
     so it returns the certificate actually sent.
     See http://rt.openssl.org/Ticket/Display.html?id=2836.
     [Rob Stradling <rob.stradling@comodo.com>]

  *) Fix possible deadlock when decoding public keys.
     [Steve Henson]

  *) Don't use TLS 1.0 record version number in initial client hello
     if renegotiating.
     [Steve Henson]

 Changes between 1.0.1b and 1.0.1c [10 May 2012]

  *) Sanity check record length before skipping explicit IV in TLS
     1.2, 1.1 and DTLS to fix DoS attack.

     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
     fuzzing as a service testing platform.
     (CVE-2012-2333)
     [Steve Henson]

  *) Initialise tkeylen properly when encrypting CMS messages.
     Thanks to Solar Designer of Openwall for reporting this issue.
     [Steve Henson]

  *) In FIPS mode don't try to use composite ciphers as they are not
     approved.
     [Steve Henson]

 Changes between 1.0.1a and 1.0.1b [26 Apr 2012]

  *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
     1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
     mean any application compiled against OpenSSL 1.0.0 headers setting
     SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disablng
     TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
     0x10000000L Any application which was previously compiled against
     OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
     will need to be recompiled as a result. Letting be results in
     inability to disable specifically TLS 1.1 and in client context,
     in unlike event, limit maximum offered version to TLS 1.0 [see below].
     [Steve Henson]

  *) In order to ensure interoperabilty SSL_OP_NO_protocolX does not
     disable just protocol X, but all protocols above X *if* there are
     protocols *below* X still enabled. In more practical terms it means
     that if application wants to disable TLS1.0 in favor of TLS1.1 and
     above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
     SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
     client side.
     [Andy Polyakov]

 Changes between 1.0.1 and 1.0.1a [19 Apr 2012]

  *) Check for potentially exploitable overflows in asn1_d2i_read_bio
     BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
     in CRYPTO_realloc_clean.

     Thanks to Tavis Ormandy, Google Security Team, for discovering this
     issue and to Adam Langley <agl@chromium.org> for fixing it.
     (CVE-2012-2110)
     [Adam Langley (Google), Tavis Ormandy, Google Security Team]

  *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
     [Adam Langley]

  *) Workarounds for some broken servers that "hang" if a client hello
     record length exceeds 255 bytes.

     1. Do not use record version number > TLS 1.0 in initial client
        hello: some (but not all) hanging servers will now work.
     2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
	the number of ciphers sent in the client hello. This should be
        set to an even number, such as 50, for example by passing:
        -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
        Most broken servers should now work.
     3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
	TLS 1.2 client support entirely.
     [Steve Henson]

  *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
     [Andy Polyakov]

 Changes between 1.0.0h and 1.0.1  [14 Mar 2012]

  *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
     STRING form instead of a DigestInfo.
     [Steve Henson]

  *) The format used for MDC2 RSA signatures is inconsistent between EVP
     and the RSA_sign/RSA_verify functions. This was made more apparent when
     OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
     those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect 
     the correct format in RSA_verify so both forms transparently work.
     [Steve Henson]

  *) Some servers which support TLS 1.0 can choke if we initially indicate
     support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
     encrypted premaster secret. As a workaround use the maximum pemitted
     client version in client hello, this should keep such servers happy
     and still work with previous versions of OpenSSL.
     [Steve Henson]

  *) Add support for TLS/DTLS heartbeats.
     [Robin Seggelmann <seggelmann@fh-muenster.de>]

  *) Add support for SCTP.
     [Robin Seggelmann <seggelmann@fh-muenster.de>]

  *) Improved PRNG seeding for VOS.
     [Paul Green <Paul.Green@stratus.com>]

  *) Extensive assembler packs updates, most notably:

	- x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
	- x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
	- x86_64:       bit-sliced AES implementation;
	- ARM:          NEON support, contemporary platforms optimizations;
	- s390x:        z196 support;
	- *:            GHASH and GF(2^m) multiplication implementations;

     [Andy Polyakov]

  *) Make TLS-SRP code conformant with RFC 5054 API cleanup
     (removal of unnecessary code)
     [Peter Sylvester <peter.sylvester@edelweb.fr>]

  *) Add TLS key material exporter from RFC 5705.
     [Eric Rescorla]

  *) Add DTLS-SRTP negotiation from RFC 5764.
     [Eric Rescorla]

  *) Add Next Protocol Negotiation,
     http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
     disabled with a no-npn flag to config or Configure. Code donated
     by Google.
     [Adam Langley <agl@google.com> and Ben Laurie]

  *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
     NIST-P256, NIST-P521, with constant-time single point multiplication on
     typical inputs. Compiler support for the nonstandard type __uint128_t is
     required to use this (present in gcc 4.4 and later, for 64-bit builds).
     Code made available under Apache License version 2.0.

     Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
     line to include this in your build of OpenSSL, and run "make depend" (or
     "make update"). This enables the following EC_METHODs:

         EC_GFp_nistp224_method()
         EC_GFp_nistp256_method()
         EC_GFp_nistp521_method()

     EC_GROUP_new_by_curve_name() will automatically use these (while
     EC_GROUP_new_curve_GFp() currently prefers the more flexible
     implementations).
     [Emilia Käsper, Adam Langley, Bodo Moeller (Google)]

  *) Use type ossl_ssize_t instad of ssize_t which isn't available on
     all platforms. Move ssize_t definition from e_os.h to the public
     header file e_os2.h as it now appears in public header file cms.h
     [Steve Henson]

  *) New -sigopt option to the ca, req and x509 utilities. Additional
     signature parameters can be passed using this option and in
     particular PSS. 
     [Steve Henson]

  *) Add RSA PSS signing function. This will generate and set the
     appropriate AlgorithmIdentifiers for PSS based on those in the
     corresponding EVP_MD_CTX structure. No application support yet.
     [Steve Henson]

  *) Support for companion algorithm specific ASN1 signing routines.
     New function ASN1_item_sign_ctx() signs a pre-initialised
     EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
     the appropriate parameters.
     [Steve Henson]

  *) Add new algorithm specific ASN1 verification initialisation function
     to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
     handling will be the same no matter what EVP_PKEY_METHOD is used.
     Add a PSS handler to support verification of PSS signatures: checked
     against a number of sample certificates.
     [Steve Henson]

  *) Add signature printing for PSS. Add PSS OIDs.
     [Steve Henson, Martin Kaiser <lists@kaiser.cx>]

  *) Add algorithm specific signature printing. An individual ASN1 method
     can now print out signatures instead of the standard hex dump. 

     More complex signatures (e.g. PSS) can print out more meaningful
     information. Include DSA version that prints out the signature
     parameters r, s.
     [Steve Henson]

  *) Password based recipient info support for CMS library: implementing
     RFC3211.
     [Steve Henson]

  *) Split password based encryption into PBES2 and PBKDF2 functions. This
     neatly separates the code into cipher and PBE sections and is required
     for some algorithms that split PBES2 into separate pieces (such as
     password based CMS).
     [Steve Henson]

  *) Session-handling fixes:
     - Fix handling of connections that are resuming with a session ID,
       but also support Session Tickets.
     - Fix a bug that suppressed issuing of a new ticket if the client
       presented a ticket with an expired session.
     - Try to set the ticket lifetime hint to something reasonable.
     - Make tickets shorter by excluding irrelevant information.
     - On the client side, don't ignore renewed tickets.
     [Adam Langley, Bodo Moeller (Google)]

  *) Fix PSK session representation.
     [Bodo Moeller]

  *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.

     This work was sponsored by Intel.
     [Andy Polyakov]

  *) Add GCM support to TLS library. Some custom code is needed to split
     the IV between the fixed (from PRF) and explicit (from TLS record)
     portions. This adds all GCM ciphersuites supported by RFC5288 and 
     RFC5289. Generalise some AES* cipherstrings to inlclude GCM and
     add a special AESGCM string for GCM only.
     [Steve Henson]

  *) Expand range of ctrls for AES GCM. Permit setting invocation
     field on decrypt and retrieval of invocation field only on encrypt.
     [Steve Henson]

  *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
     As required by RFC5289 these ciphersuites cannot be used if for
     versions of TLS earlier than 1.2.
     [Steve Henson]

  *) For FIPS capable OpenSSL interpret a NULL default public key method
     as unset and return the appopriate default but do *not* set the default.
     This means we can return the appopriate method in applications that
     swicth between FIPS and non-FIPS modes.
     [Steve Henson]

  *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
     ENGINE is used then we cannot handle that in the FIPS module so we
     keep original code iff non-FIPS operations are allowed.
     [Steve Henson]

  *) Add -attime option to openssl utilities.
     [Peter Eckersley <pde@eff.org>, Ben Laurie and Steve Henson]

  *) Redirect DSA and DH operations to FIPS module in FIPS mode.
     [Steve Henson]

  *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
     FIPS EC methods unconditionally for now.
     [Steve Henson]

  *) New build option no-ec2m to disable characteristic 2 code.
     [Steve Henson]

  *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
     all cases can be covered as some introduce binary incompatibilities.
     [Steve Henson]

  *) Redirect RSA operations to FIPS module including keygen,
     encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
     [Steve Henson]

  *) Add similar low level API blocking to ciphers.
     [Steve Henson]

  *) Low level digest APIs are not approved in FIPS mode: any attempt
     to use these will cause a fatal error. Applications that *really* want
     to use them can use the private_* version instead.
     [Steve Henson]

  *) Redirect cipher operations to FIPS module for FIPS builds. 
     [Steve Henson]

  *) Redirect digest operations to FIPS module for FIPS builds. 
     [Steve Henson]

  *) Update build system to add "fips" flag which will link in fipscanister.o
     for static and shared library builds embedding a signature if needed.
     [Steve Henson]

  *) Output TLS supported curves in preference order instead of numerical
     order. This is currently hardcoded for the highest order curves first.
     This should be configurable so applications can judge speed vs strength.
     [Steve Henson]

  *) Add TLS v1.2 server support for client authentication. 
     [Steve Henson]

  *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
     and enable MD5.
     [Steve Henson]

  *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
     FIPS modules versions.
     [Steve Henson]

  *) Add TLS v1.2 client side support for client authentication. Keep cache
     of handshake records longer as we don't know the hash algorithm to use
     until after the certificate request message is received.
     [Steve Henson]

  *) Initial TLS v1.2 client support. Add a default signature algorithms
     extension including all the algorithms we support. Parse new signature
     format in client key exchange. Relax some ECC signing restrictions for
     TLS v1.2 as indicated in RFC5246.
     [Steve Henson]

  *) Add server support for TLS v1.2 signature algorithms extension. Switch
     to new signature format when needed using client digest preference.
     All server ciphersuites should now work correctly in TLS v1.2. No client
     support yet and no support for client certificates.
     [Steve Henson]

  *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
     to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
     ciphersuites. At present only RSA key exchange ciphersuites work with
     TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
     SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
     and version checking.
     [Steve Henson]

  *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
     with this defined it will not be affected by any changes to ssl internal
     structures. Add several utility functions to allow openssl application
     to work with OPENSSL_NO_SSL_INTERN defined.
     [Steve Henson]

  *) Add SRP support.
     [Tom Wu <tjw@cs.stanford.edu> and Ben Laurie]

  *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
     [Steve Henson]

  *) Permit abbreviated handshakes when renegotiating using the function
     SSL_renegotiate_abbreviated().
     [Robin Seggelmann <seggelmann@fh-muenster.de>]

  *) Add call to ENGINE_register_all_complete() to
     ENGINE_load_builtin_engines(), so some implementations get used
     automatically instead of needing explicit application support.
     [Steve Henson]

  *) Add support for TLS key exporter as described in RFC5705.
     [Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson]

  *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
     a few changes are required:

       Add SSL_OP_NO_TLSv1_1 flag.
       Add TLSv1_1 methods.
       Update version checking logic to handle version 1.1.
       Add explicit IV handling (ported from DTLS code).
       Add command line options to s_client/s_server.
     [Steve Henson]

 Changes between 1.0.0g and 1.0.0h [12 Mar 2012]

  *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
     in CMS and PKCS7 code. When RSA decryption fails use a random key for
     content decryption and always return the same error. Note: this attack
     needs on average 2^20 messages so it only affects automated senders. The
     old behaviour can be reenabled in the CMS code by setting the
     CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
     an MMA defence is not necessary.
     Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
     this issue. (CVE-2012-0884)
     [Steve Henson]

  *) Fix CVE-2011-4619: make sure we really are receiving a 
     client hello before rejecting multiple SGC restarts. Thanks to
     Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug.
     [Steve Henson]

 Changes between 1.0.0f and 1.0.0g [18 Jan 2012]

  *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
     Thanks to Antonio Martin, Enterprise Secure Access Research and
     Development, Cisco Systems, Inc. for discovering this bug and
     preparing a fix. (CVE-2012-0050)
     [Antonio Martin]

 Changes between 1.0.0e and 1.0.0f [4 Jan 2012]

  *) Nadhem Alfardan and Kenny Paterson have discovered an extension
     of the Vaudenay padding oracle attack on CBC mode encryption
     which enables an efficient plaintext recovery attack against
     the OpenSSL implementation of DTLS. Their attack exploits timing
     differences arising during decryption processing. A research
     paper describing this attack can be found at:
                  http://www.isg.rhul.ac.uk/~kp/dtls.pdf
     Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
     Security Group at Royal Holloway, University of London
     (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
     <seggelmann@fh-muenster.de> and Michael Tuexen <tuexen@fh-muenster.de>
     for preparing the fix. (CVE-2011-4108)
     [Robin Seggelmann, Michael Tuexen]

  *) Clear bytes used for block padding of SSL 3.0 records.
     (CVE-2011-4576)
     [Adam Langley (Google)]

  *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
     Kadianakis <desnacked@gmail.com> for discovering this issue and
     Adam Langley for preparing the fix. (CVE-2011-4619)
     [Adam Langley (Google)]

  *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
     [Andrey Kulikov <amdeich@gmail.com>]

  *) Prevent malformed RFC3779 data triggering an assertion failure.
     Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
     and Rob Austein <sra@hactrn.net> for fixing it. (CVE-2011-4577)
     [Rob Austein <sra@hactrn.net>]

  *) Improved PRNG seeding for VOS.
     [Paul Green <Paul.Green@stratus.com>]

  *) Fix ssl_ciph.c set-up race.
     [Adam Langley (Google)]

  *) Fix spurious failures in ecdsatest.c.
     [Emilia Käsper (Google)]

  *) Fix the BIO_f_buffer() implementation (which was mixing different
     interpretations of the '..._len' fields).
     [Adam Langley (Google)]

  *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
     BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
     threads won't reuse the same blinding coefficients.

     This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
     lock to call BN_BLINDING_invert_ex, and avoids one use of
     BN_BLINDING_update for each BN_BLINDING structure (previously,
     the last update always remained unused).
     [Emilia Käsper (Google)]

  *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
     [Bob Buckholz (Google)]

 Changes between 1.0.0d and 1.0.0e [6 Sep 2011]

  *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
     by initialising X509_STORE_CTX properly. (CVE-2011-3207)
     [Kaspar Brand <ossl@velox.ch>]

  *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
     for multi-threaded use of ECDH. (CVE-2011-3210)
     [Adam Langley (Google)]

  *) Fix x509_name_ex_d2i memory leak on bad inputs.
     [Bodo Moeller]

  *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
     signature public key algorithm by using OID xref utilities instead.
     Before this you could only use some ECC ciphersuites with SHA1 only.
     [Steve Henson]

  *) Add protection against ECDSA timing attacks as mentioned in the paper
     by Billy Bob Brumley and Nicola Tuveri, see:

	http://eprint.iacr.org/2011/232.pdf

     [Billy Bob Brumley and Nicola Tuveri]

 Changes between 1.0.0c and 1.0.0d [8 Feb 2011]

  *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
     [Neel Mehta, Adam Langley, Bodo Moeller (Google)]

  *) Fix bug in string printing code: if *any* escaping is enabled we must
     escape the escape character (backslash) or the resulting string is
     ambiguous.
     [Steve Henson]

 Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]

  *) Disable code workaround for ancient and obsolete Netscape browsers
     and servers: an attacker can use it in a ciphersuite downgrade attack.
     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
     [Steve Henson]

  *) Fixed J-PAKE implementation error, originally discovered by
     Sebastien Martini, further info and confirmation from Stefan
     Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
     [Ben Laurie]

 Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]

  *) Fix extension code to avoid race conditions which can result in a buffer
     overrun vulnerability: resumed sessions must not be modified as they can
     be shared by multiple threads. CVE-2010-3864
     [Steve Henson]

  *) Fix WIN32 build system to correctly link an ENGINE directory into
     a DLL. 
     [Steve Henson]

 Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]

  *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover 
     (CVE-2010-1633)
     [Steve Henson, Peter-Michael Hager <hager@dortmund.net>]

 Changes between 0.9.8n and 1.0.0  [29 Mar 2010]

  *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
     context. The operation can be customised via the ctrl mechanism in
     case ENGINEs want to include additional functionality.
     [Steve Henson]

  *) Tolerate yet another broken PKCS#8 key format: private key value negative.
     [Steve Henson]

  *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
     output hashes compatible with older versions of OpenSSL.
     [Willy Weisz <weisz@vcpc.univie.ac.at>]

  *) Fix compression algorithm handling: if resuming a session use the
     compression algorithm of the resumed session instead of determining
     it from client hello again. Don't allow server to change algorithm.
     [Steve Henson]

  *) Add load_crls() function to apps tidying load_certs() too. Add option
     to verify utility to allow additional CRLs to be included.
     [Steve Henson]

  *) Update OCSP request code to permit adding custom headers to the request:
     some responders need this.
     [Steve Henson]

  *) The function EVP_PKEY_sign() returns <=0 on error: check return code
     correctly.
     [Julia Lawall <julia@diku.dk>]

  *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
     needlessly dereferenced structures, used obsolete functions and
     didn't handle all updated verify codes correctly.
     [Steve Henson]

  *) Disable MD2 in the default configuration.
     [Steve Henson]

  *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
     indicate the initial BIO being pushed or popped. This makes it possible
     to determine whether the BIO is the one explicitly called or as a result
     of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
     it handles reference counts correctly and doesn't zero out the I/O bio
     when it is not being explicitly popped. WARNING: applications which
     included workarounds for the old buggy behaviour will need to be modified
     or they could free up already freed BIOs.
     [Steve Henson]

  *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
     renaming to all platforms (within the 0.9.8 branch, this was
     done conditionally on Netware platforms to avoid a name clash).
     [Guenter <lists@gknw.net>]

  *) Add ECDHE and PSK support to DTLS.
     [Michael Tuexen <tuexen@fh-muenster.de>]

  *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
     be used on C++.
     [Steve Henson]

  *) Add "missing" function EVP_MD_flags() (without this the only way to
     retrieve a digest flags is by accessing the structure directly. Update
     EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
     or cipher is registered as in the "from" argument. Print out all
     registered digests in the dgst usage message instead of manually 
     attempting to work them out.
     [Steve Henson]

  *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
     this allows the use of compression and extensions. Change default cipher
     string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
     by default unless an application cipher string requests it.
     [Steve Henson]

  *) Alter match criteria in PKCS12_parse(). It used to try to use local
     key ids to find matching certificates and keys but some PKCS#12 files
     don't follow the (somewhat unwritten) rules and this strategy fails.
     Now just gather all certificates together and the first private key
     then look for the first certificate that matches the key.
     [Steve Henson]

  *) Support use of registered digest and cipher names for dgst and cipher
     commands instead of having to add each one as a special case. So now
     you can do:

        openssl sha256 foo

     as well as:

        openssl dgst -sha256 foo

     and this works for ENGINE based algorithms too.

     [Steve Henson]

  *) Update Gost ENGINE to support parameter files.
     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) Support GeneralizedTime in ca utility. 
     [Oliver Martin <oliver@volatilevoid.net>, Steve Henson]

  *) Enhance the hash format used for certificate directory links. The new
     form uses the canonical encoding (meaning equivalent names will work
     even if they aren't identical) and uses SHA1 instead of MD5. This form
     is incompatible with the older format and as a result c_rehash should
     be used to rebuild symbolic links.
     [Steve Henson]

  *) Make PKCS#8 the default write format for private keys, replacing the
     traditional format. This form is standardised, more secure and doesn't
     include an implicit MD5 dependency.
     [Steve Henson]

  *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
     committed to OpenSSL should pass this lot as a minimum.
     [Steve Henson]

  *) Add session ticket override functionality for use by EAP-FAST.
     [Jouni Malinen <j@w1.fi>]

  *) Modify HMAC functions to return a value. Since these can be implemented
     in an ENGINE errors can occur.
     [Steve Henson]

  *) Type-checked OBJ_bsearch_ex.
     [Ben Laurie]

  *) Type-checked OBJ_bsearch. Also some constification necessitated
     by type-checking.  Still to come: TXT_DB, bsearch(?),
     OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
     CONF_VALUE.
     [Ben Laurie]

  *) New function OPENSSL_gmtime_adj() to add a specific number of days and
     seconds to a tm structure directly, instead of going through OS
     specific date routines. This avoids any issues with OS routines such
     as the year 2038 bug. New *_adj() functions for ASN1 time structures
     and X509_time_adj_ex() to cover the extended range. The existing
     X509_time_adj() is still usable and will no longer have any date issues.
     [Steve Henson]

  *) Delta CRL support. New use deltas option which will attempt to locate
     and search any appropriate delta CRLs available.

     This work was sponsored by Google.
     [Steve Henson]

  *) Support for CRLs partitioned by reason code. Reorganise CRL processing
     code and add additional score elements. Validate alternate CRL paths
     as part of the CRL checking and indicate a new error "CRL path validation
     error" in this case. Applications wanting additional details can use
     the verify callback and check the new "parent" field. If this is not
     NULL CRL path validation is taking place. Existing applications wont
     see this because it requires extended CRL support which is off by
     default.

     This work was sponsored by Google.
     [Steve Henson]

  *) Support for freshest CRL extension.

     This work was sponsored by Google.
     [Steve Henson]

  *) Initial indirect CRL support. Currently only supported in the CRLs
     passed directly and not via lookup. Process certificate issuer
     CRL entry extension and lookup CRL entries by bother issuer name
     and serial number. Check and process CRL issuer entry in IDP extension.

     This work was sponsored by Google.
     [Steve Henson]

  *) Add support for distinct certificate and CRL paths. The CRL issuer
     certificate is validated separately in this case. Only enabled if
     an extended CRL support flag is set: this flag will enable additional
     CRL functionality in future.

     This work was sponsored by Google.
     [Steve Henson]

  *) Add support for policy mappings extension.

     This work was sponsored by Google.
     [Steve Henson]

  *) Fixes to pathlength constraint, self issued certificate handling,
     policy processing to align with RFC3280 and PKITS tests.

     This work was sponsored by Google.
     [Steve Henson]

  *) Support for name constraints certificate extension. DN, email, DNS
     and URI types are currently supported.

     This work was sponsored by Google.
     [Steve Henson]

  *) To cater for systems that provide a pointer-based thread ID rather
     than numeric, deprecate the current numeric thread ID mechanism and
     replace it with a structure and associated callback type. This
     mechanism allows a numeric "hash" to be extracted from a thread ID in
     either case, and on platforms where pointers are larger than 'long',
     mixing is done to help ensure the numeric 'hash' is usable even if it
     can't be guaranteed unique. The default mechanism is to use "&errno"
     as a pointer-based thread ID to distinguish between threads.

     Applications that want to provide their own thread IDs should now use
     CRYPTO_THREADID_set_callback() to register a callback that will call
     either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().

     Note that ERR_remove_state() is now deprecated, because it is tied
     to the assumption that thread IDs are numeric.  ERR_remove_state(0)
     to free the current thread's error state should be replaced by
     ERR_remove_thread_state(NULL).

     (This new approach replaces the functions CRYPTO_set_idptr_callback(),
     CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
     OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
     application was previously providing a numeric thread callback that
     was inappropriate for distinguishing threads, then uniqueness might
     have been obtained with &errno that happened immediately in the
     intermediate development versions of OpenSSL; this is no longer the
     case, the numeric thread callback will now override the automatic use
     of &errno.)
     [Geoff Thorpe, with help from Bodo Moeller]

  *) Initial support for different CRL issuing certificates. This covers a
     simple case where the self issued certificates in the chain exist and
     the real CRL issuer is higher in the existing chain.

     This work was sponsored by Google.
     [Steve Henson]

  *) Removed effectively defunct crypto/store from the build.
     [Ben Laurie]

  *) Revamp of STACK to provide stronger type-checking. Still to come:
     TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
     ASN1_STRING, CONF_VALUE.
     [Ben Laurie]

  *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
     RAM on SSL connections.  This option can save about 34k per idle SSL.
     [Nick Mathewson]

  *) Revamp of LHASH to provide stronger type-checking. Still to come:
     STACK, TXT_DB, bsearch, qsort.
     [Ben Laurie]

  *) Initial support for Cryptographic Message Syntax (aka CMS) based
     on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
     support for data, signedData, compressedData, digestedData and
     encryptedData, envelopedData types included. Scripts to check against
     RFC4134 examples draft and interop and consistency checks of many
     content types and variants.
     [Steve Henson]

  *) Add options to enc utility to support use of zlib compression BIO.
     [Steve Henson]

  *) Extend mk1mf to support importing of options and assembly language
     files from Configure script, currently only included in VC-WIN32.
     The assembly language rules can now optionally generate the source
     files from the associated perl scripts.
     [Steve Henson]

  *) Implement remaining functionality needed to support GOST ciphersuites.
     Interop testing has been performed using CryptoPro implementations.
     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) s390x assembler pack.
     [Andy Polyakov]

  *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
     "family."
     [Andy Polyakov]

  *) Implement Opaque PRF Input TLS extension as specified in
     draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
     official specification yet and no extension type assignment by
     IANA exists, this extension (for now) will have to be explicitly
     enabled when building OpenSSL by providing the extension number
     to use.  For example, specify an option

         -DTLSEXT_TYPE_opaque_prf_input=0x9527

     to the "config" or "Configure" script to enable the extension,
     assuming extension number 0x9527 (which is a completely arbitrary
     and unofficial assignment based on the MD5 hash of the Internet
     Draft).  Note that by doing so, you potentially lose
     interoperability with other TLS implementations since these might
     be using the same extension number for other purposes.

     SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
     opaque PRF input value to use in the handshake.  This will create
     an interal copy of the length-'len' string at 'src', and will
     return non-zero for success.

     To get more control and flexibility, provide a callback function
     by using

          SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
          SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)

     where

          int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
          void *arg;

     Callback function 'cb' will be called in handshakes, and is
     expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
     Argument 'arg' is for application purposes (the value as given to
     SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
     be provided to the callback function).  The callback function
     has to return non-zero to report success: usually 1 to use opaque
     PRF input just if possible, or 2 to enforce use of the opaque PRF
     input.  In the latter case, the library will abort the handshake
     if opaque PRF input is not successfully negotiated.

     Arguments 'peerinput' and 'len' given to the callback function
     will always be NULL and 0 in the case of a client.  A server will
     see the client's opaque PRF input through these variables if
     available (NULL and 0 otherwise).  Note that if the server
     provides an opaque PRF input, the length must be the same as the
     length of the client's opaque PRF input.

     Note that the callback function will only be called when creating
     a new session (session resumption can resume whatever was
     previously negotiated), and will not be called in SSL 2.0
     handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
     SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
     for applications that need to enforce opaque PRF input.

     [Bodo Moeller]

  *) Update ssl code to support digests other than SHA1+MD5 for handshake
     MAC. 

     [Victor B. Wagner <vitus@cryptocom.ru>]

  *) Add RFC4507 support to OpenSSL. This includes the corrections in
     RFC4507bis. The encrypted ticket format is an encrypted encoded
     SSL_SESSION structure, that way new session features are automatically
     supported.

     If a client application caches session in an SSL_SESSION structure
     support is transparent because tickets are now stored in the encoded
     SSL_SESSION.
     
     The SSL_CTX structure automatically generates keys for ticket
     protection in servers so again support should be possible
     with no application modification.

     If a client or server wishes to disable RFC4507 support then the option
     SSL_OP_NO_TICKET can be set.

     Add a TLS extension debugging callback to allow the contents of any client
     or server extensions to be examined.

     This work was sponsored by Google.
     [Steve Henson]

  *) Final changes to avoid use of pointer pointer casts in OpenSSL.
     OpenSSL should now compile cleanly on gcc 4.2
     [Peter Hartley <pdh@utter.chaos.org.uk>, Steve Henson]

  *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
     support including streaming MAC support: this is required for GOST
     ciphersuite support.
     [Victor B. Wagner <vitus@cryptocom.ru>, Steve Henson]

  *) Add option -stream to use PKCS#7 streaming in smime utility. New
     function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
     to output in BER and PEM format.
     [Steve Henson]

  *) Experimental support for use of HMAC via EVP_PKEY interface. This
     allows HMAC to be handled via the EVP_DigestSign*() interface. The
     EVP_PKEY "key" in this case is the HMAC key, potentially allowing
     ENGINE support for HMAC keys which are unextractable. New -mac and
     -macopt options to dgst utility.
     [Steve Henson]

  *) New option -sigopt to dgst utility. Update dgst to use
     EVP_Digest{Sign,Verify}*. These two changes make it possible to use
     alternative signing paramaters such as X9.31 or PSS in the dgst 
     utility.
     [Steve Henson]

  *) Change ssl_cipher_apply_rule(), the internal function that does
     the work each time a ciphersuite string requests enabling
     ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
     removing ("!foo+bar") a class of ciphersuites: Now it maintains
     the order of disabled ciphersuites such that those ciphersuites
     that most recently went from enabled to disabled not only stay
     in order with respect to each other, but also have higher priority
     than other disabled ciphersuites the next time ciphersuites are
     enabled again.

     This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
     the same ciphersuites as with "HIGH" alone, but in a specific
     order where the PSK ciphersuites come first (since they are the
     most recently disabled ciphersuites when "HIGH" is parsed).

     Also, change ssl_create_cipher_list() (using this new
     funcionality) such that between otherwise identical
     cihpersuites, ephemeral ECDH is preferred over ephemeral DH in
     the default order.
     [Bodo Moeller]

  *) Change ssl_create_cipher_list() so that it automatically
     arranges the ciphersuites in reasonable order before starting
     to process the rule string.  Thus, the definition for "DEFAULT"
     (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
     remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
     This makes it much easier to arrive at a reasonable default order
     in applications for which anonymous ciphers are OK (meaning
     that you can't actually use DEFAULT).
     [Bodo Moeller; suggested by Victor Duchovni]

  *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
     processing) into multiple integers instead of setting
     "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
     "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
     (These masks as well as the individual bit definitions are hidden
     away into the non-exported interface ssl/ssl_locl.h, so this
     change to the definition of the SSL_CIPHER structure shouldn't
     affect applications.)  This give us more bits for each of these
     categories, so there is no longer a need to coagulate AES128 and
     AES256 into a single algorithm bit, and to coagulate Camellia128
     and Camellia256 into a single algorithm bit, which has led to all
     kinds of kludges.

     Thus, among other things, the kludge introduced in 0.9.7m and
     0.9.8e for masking out AES256 independently of AES128 or masking
     out Camellia256 independently of AES256 is not needed here in 0.9.9.

     With the change, we also introduce new ciphersuite aliases that
     so far were missing: "AES128", "AES256", "CAMELLIA128", and
     "CAMELLIA256".
     [Bodo Moeller]

  *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
     Use the leftmost N bytes of the signature input if the input is
     larger than the prime q (with N being the size in bytes of q).
     [Nils Larsch]

  *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
     it yet and it is largely untested.
     [Steve Henson]

  *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
     [Nils Larsch]

  *) Initial incomplete changes to avoid need for function casts in OpenSSL
     some compilers (gcc 4.2 and later) reject their use. Safestack is
     reimplemented.  Update ASN1 to avoid use of legacy functions. 
     [Steve Henson]

  *) Win32/64 targets are linked with Winsock2.
     [Andy Polyakov]

  *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
     to external functions. This can be used to increase CRL handling 
     efficiency especially when CRLs are very large by (for example) storing
     the CRL revoked certificates in a database.
     [Steve Henson]

  *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
     new CRLs added to a directory can be used. New command line option
     -verify_return_error to s_client and s_server. This causes real errors
     to be returned by the verify callback instead of carrying on no matter
     what. This reflects the way a "real world" verify callback would behave.
     [Steve Henson]

  *) GOST engine, supporting several GOST algorithms and public key formats.
     Kindly donated by Cryptocom.
     [Cryptocom]

  *) Partial support for Issuing Distribution Point CRL extension. CRLs
     partitioned by DP are handled but no indirect CRL or reason partitioning
     (yet). Complete overhaul of CRL handling: now the most suitable CRL is
     selected via a scoring technique which handles IDP and AKID in CRLs.
     [Steve Henson]

  *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
     will ultimately be used for all verify operations: this will remove the
     X509_STORE dependency on certificate verification and allow alternative
     lookup methods.  X509_STORE based implementations of these two callbacks.
     [Steve Henson]

  *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
     Modify get_crl() to find a valid (unexpired) CRL if possible.
     [Steve Henson]

  *) New function X509_CRL_match() to check if two CRLs are identical. Normally
     this would be called X509_CRL_cmp() but that name is already used by
     a function that just compares CRL issuer names. Cache several CRL 
     extensions in X509_CRL structure and cache CRLDP in X509.
     [Steve Henson]

  *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
     this maps equivalent X509_NAME structures into a consistent structure.
     Name comparison can then be performed rapidly using memcmp().
     [Steve Henson]

  *) Non-blocking OCSP request processing. Add -timeout option to ocsp 
     utility.
     [Steve Henson]

  *) Allow digests to supply their own micalg string for S/MIME type using
     the ctrl EVP_MD_CTRL_MICALG.
     [Steve Henson]

  *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
     EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
     ctrl. It can then customise the structure before and/or after signing
     if necessary.
     [Steve Henson]

  *) New function OBJ_add_sigid() to allow application defined signature OIDs
     to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
     to free up any added signature OIDs.
     [Steve Henson]

  *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
     EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
     digest and cipher tables. New options added to openssl utility:
     list-message-digest-algorithms and list-cipher-algorithms.
     [Steve Henson]

  *) Change the array representation of binary polynomials: the list
     of degrees of non-zero coefficients is now terminated with -1.
     Previously it was terminated with 0, which was also part of the
     value; thus, the array representation was not applicable to
     polynomials where t^0 has coefficient zero.  This change makes
     the array representation useful in a more general context.
     [Douglas Stebila]

  *) Various modifications and fixes to SSL/TLS cipher string
     handling.  For ECC, the code now distinguishes between fixed ECDH
     with RSA certificates on the one hand and with ECDSA certificates
     on the other hand, since these are separate ciphersuites.  The
     unused code for Fortezza ciphersuites has been removed.

     For consistency with EDH, ephemeral ECDH is now called "EECDH"
     (not "ECDHE").  For consistency with the code for DH
     certificates, use of ECDH certificates is now considered ECDH
     authentication, not RSA or ECDSA authentication (the latter is
     merely the CA's signing algorithm and not actively used in the
     protocol).

     The temporary ciphersuite alias "ECCdraft" is no longer
     available, and ECC ciphersuites are no longer excluded from "ALL"
     and "DEFAULT".  The following aliases now exist for RFC 4492
     ciphersuites, most of these by analogy with the DH case:

         kECDHr   - ECDH cert, signed with RSA
         kECDHe   - ECDH cert, signed with ECDSA
         kECDH    - ECDH cert (signed with either RSA or ECDSA)
         kEECDH   - ephemeral ECDH
         ECDH     - ECDH cert or ephemeral ECDH

         aECDH    - ECDH cert
         aECDSA   - ECDSA cert
         ECDSA    - ECDSA cert

         AECDH    - anonymous ECDH
         EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")

     [Bodo Moeller]

  *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
     Use correct micalg parameters depending on digest(s) in signed message.
     [Steve Henson]

  *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
     an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
     [Steve Henson]

  *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
     an engine to register a method. Add ENGINE lookups for methods and
     functional reference processing.
     [Steve Henson]

  *) New functions EVP_Digest{Sign,Verify)*. These are enchance versions of
     EVP_{Sign,Verify}* which allow an application to customise the signature
     process.
     [Steve Henson]

  *) New -resign option to smime utility. This adds one or more signers
     to an existing PKCS#7 signedData structure. Also -md option to use an
     alternative message digest algorithm for signing.
     [Steve Henson]

  *) Tidy up PKCS#7 routines and add new functions to make it easier to
     create PKCS7 structures containing multiple signers. Update smime
     application to support multiple signers.
     [Steve Henson]

  *) New -macalg option to pkcs12 utility to allow setting of an alternative
     digest MAC.
     [Steve Henson]

  *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
     Reorganize PBE internals to lookup from a static table using NIDs,
     add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
     EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
     PRF which will be automatically used with PBES2.
     [Steve Henson]

  *) Replace the algorithm specific calls to generate keys in "req" with the
     new API.
     [Steve Henson]

  *) Update PKCS#7 enveloped data routines to use new API. This is now
     supported by any public key method supporting the encrypt operation. A
     ctrl is added to allow the public key algorithm to examine or modify
     the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
     a no op.
     [Steve Henson]

  *) Add a ctrl to asn1 method to allow a public key algorithm to express
     a default digest type to use. In most cases this will be SHA1 but some
     algorithms (such as GOST) need to specify an alternative digest. The
     return value indicates how strong the prefernce is 1 means optional and
     2 is mandatory (that is it is the only supported type). Modify
     ASN1_item_sign() to accept a NULL digest argument to indicate it should
     use the default md. Update openssl utilities to use the default digest
     type for signing if it is not explicitly indicated.
     [Steve Henson]

  *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New 
     EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
     signing method from the key type. This effectively removes the link
     between digests and public key types.
     [Steve Henson]

  *) Add an OID cross reference table and utility functions. Its purpose is to
     translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
     rsaEncryption. This will allow some of the algorithm specific hackery
     needed to use the correct OID to be removed. 
     [Steve Henson]

  *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
     structures for PKCS7_sign(). They are now set up by the relevant public
     key ASN1 method.
     [Steve Henson]

  *) Add provisional EC pkey method with support for ECDSA and ECDH.
     [Steve Henson]

  *) Add support for key derivation (agreement) in the API, DH method and
     pkeyutl.
     [Steve Henson]

  *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
     public and private key formats. As a side effect these add additional 
     command line functionality not previously available: DSA signatures can be
     generated and verified using pkeyutl and DH key support and generation in
     pkey, genpkey.
     [Steve Henson]

  *) BeOS support.
     [Oliver Tappe <zooey@hirschkaefer.de>]

  *) New make target "install_html_docs" installs HTML renditions of the
     manual pages.
     [Oliver Tappe <zooey@hirschkaefer.de>]

  *) New utility "genpkey" this is analagous to "genrsa" etc except it can
     generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
     support key and parameter generation and add initial key generation
     functionality for RSA.
     [Steve Henson]

  *) Add functions for main EVP_PKEY_method operations. The undocumented
     functions EVP_PKEY_{encrypt,decrypt} have been renamed to
     EVP_PKEY_{encrypt,decrypt}_old. 
     [Steve Henson]

  *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
     key API, doesn't do much yet.
     [Steve Henson]

  *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
     public key algorithms. New option to openssl utility:
     "list-public-key-algorithms" to print out info.
     [Steve Henson]

  *) Implement the Supported Elliptic Curves Extension for
     ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
     [Douglas Stebila]

  *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
     EVP_CIPHER structures to avoid later problems in EVP_cleanup().
     [Steve Henson]

  *) New utilities pkey and pkeyparam. These are similar to algorithm specific
     utilities such as rsa, dsa, dsaparam etc except they process any key
     type.
     [Steve Henson]

  *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New 
     functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
     EVP_PKEY_print_param() to print public key data from an EVP_PKEY
     structure.
     [Steve Henson]

  *) Initial support for pluggable public key ASN1.
     De-spaghettify the public key ASN1 handling. Move public and private
     key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
     algorithm specific handling to a single module within the relevant
     algorithm directory. Add functions to allow (near) opaque processing
     of public and private key structures.
     [Steve Henson]

  *) Implement the Supported Point Formats Extension for
     ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
     [Douglas Stebila]

  *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
     for the psk identity [hint] and the psk callback functions to the
     SSL_SESSION, SSL and SSL_CTX structure.
     
     New ciphersuites:
         PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
         PSK-AES256-CBC-SHA
 
     New functions:
         SSL_CTX_use_psk_identity_hint
         SSL_get_psk_identity_hint
         SSL_get_psk_identity
         SSL_use_psk_identity_hint

     [Mika Kousa and Pasi Eronen of Nokia Corporation]

  *) Add RFC 3161 compliant time stamp request creation, response generation
     and response verification functionality.
     [Zoltán Glózik <zglozik@opentsa.org>, The OpenTSA Project]

  *) Add initial support for TLS extensions, specifically for the server_name
     extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
     have new members for a host name.  The SSL data structure has an
     additional member SSL_CTX *initial_ctx so that new sessions can be
     stored in that context to allow for session resumption, even after the
     SSL has been switched to a new SSL_CTX in reaction to a client's
     server_name extension.

     New functions (subject to change):

         SSL_get_servername()
         SSL_get_servername_type()
         SSL_set_SSL_CTX()

     New CTRL codes and macros (subject to change):

         SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
                                 - SSL_CTX_set_tlsext_servername_callback()
         SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
                                      - SSL_CTX_set_tlsext_servername_arg()
         SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()

     openssl s_client has a new '-servername ...' option.

     openssl s_server has new options '-servername_host ...', '-cert2 ...',
     '-key2 ...', '-servername_fatal' (subject to change).  This allows
     testing the HostName extension for a specific single host name ('-cert'
     and '-key' remain fallbacks for handshakes without HostName
     negotiation).  If the unrecogninzed_name alert has to be sent, this by
     default is a warning; it becomes fatal with the '-servername_fatal'
     option.

     [Peter Sylvester,  Remy Allais, Christophe Renou]

  *) Whirlpool hash implementation is added.
     [Andy Polyakov]

  *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
     bn(64,32). Because of instruction set limitations it doesn't have
     any negative impact on performance. This was done mostly in order
     to make it possible to share assembler modules, such as bn_mul_mont
     implementations, between 32- and 64-bit builds without hassle.
     [Andy Polyakov]

  *) Move code previously exiled into file crypto/ec/ec2_smpt.c
     to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
     macro.
     [Bodo Moeller]

  *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
     dedicated Montgomery multiplication procedure, is introduced.
     BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
     "64-bit" performance on certain 32-bit targets.
     [Andy Polyakov]

  *) New option SSL_OP_NO_COMP to disable use of compression selectively
     in SSL structures. New SSL ctrl to set maximum send fragment size. 
     Save memory by seeting the I/O buffer sizes dynamically instead of
     using the maximum available value.
     [Steve Henson]

  *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
     in addition to the text details.
     [Bodo Moeller]

  *) Very, very preliminary EXPERIMENTAL support for printing of general
     ASN1 structures. This currently produces rather ugly output and doesn't
     handle several customised structures at all.
     [Steve Henson]

  *) Integrated support for PVK file format and some related formats such
     as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
     these in the 'rsa' and 'dsa' utilities.
     [Steve Henson]

  *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
     [Steve Henson]

  *) Remove the ancient ASN1_METHOD code. This was only ever used in one
     place for the (very old) "NETSCAPE" format certificates which are now
     handled using new ASN1 code equivalents.
     [Steve Henson]

  *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
     pointer and make the SSL_METHOD parameter in SSL_CTX_new,
     SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
     [Nils Larsch]

  *) Modify CRL distribution points extension code to print out previously
     unsupported fields. Enhance extension setting code to allow setting of
     all fields.
     [Steve Henson]

  *) Add print and set support for Issuing Distribution Point CRL extension.
     [Steve Henson]

  *) Change 'Configure' script to enable Camellia by default.
     [NTT]

 Changes between 0.9.8m and 0.9.8n [24 Mar 2010]

  *) When rejecting SSL/TLS records due to an incorrect version number, never
     update s->server with a new major version number.  As of
     - OpenSSL 0.9.8m if 'short' is a 16-bit type,
     - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
     the previous behavior could result in a read attempt at NULL when
     receiving specific incorrect SSL/TLS records once record payload
     protection is active.  (CVE-2010-0740)
     [Bodo Moeller, Adam Langley <agl@chromium.org>]

  *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL 
     could be crashed if the relevant tables were not present (e.g. chrooted).
     [Tomas Hoger <thoger@redhat.com>]

 Changes between 0.9.8l and 0.9.8m [25 Feb 2010]

  *) Always check bn_wexpend() return values for failure.  (CVE-2009-3245)
     [Martin Olsson, Neel Mehta]

  *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
     accommodate for stack sorting, always a write lock!).
     [Bodo Moeller]

  *) On some versions of WIN32 Heap32Next is very slow. This can cause
     excessive delays in the RAND_poll(): over a minute. As a workaround
     include a time check in the inner Heap32Next loop too.
     [Steve Henson]

  *) The code that handled flushing of data in SSL/TLS originally used the
     BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
     the problem outlined in PR#1949. The fix suggested there however can
     trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
     of Apache). So instead simplify the code to flush unconditionally.
     This should be fine since flushing with no data to flush is a no op.
     [Steve Henson]

  *) Handle TLS versions 2.0 and later properly and correctly use the
     highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
     off ancient servers have a habit of sticking around for a while...
     [Steve Henson]

  *) Modify compression code so it frees up structures without using the
     ex_data callbacks. This works around a problem where some applications
     call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
     restarting) then use compression (e.g. SSL with compression) later.
     This results in significant per-connection memory leaks and
     has caused some security issues including CVE-2008-1678 and
     CVE-2009-4355.
     [Steve Henson]

  *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
     change when encrypting or decrypting.
     [Bodo Moeller]

  *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
     connect and renegotiate with servers which do not support RI.
     Until RI is more widely deployed this option is enabled by default.
     [Steve Henson]

  *) Add "missing" ssl ctrls to clear options and mode.
     [Steve Henson]

  *) If client attempts to renegotiate and doesn't support RI respond with
     a no_renegotiation alert as required by RFC5746.  Some renegotiating
     TLS clients will continue a connection gracefully when they receive
     the alert. Unfortunately OpenSSL mishandled this alert and would hang
     waiting for a server hello which it will never receive. Now we treat a
     received no_renegotiation alert as a fatal error. This is because
     applications requesting a renegotiation might well expect it to succeed
     and would have no code in place to handle the server denying it so the
     only safe thing to do is to terminate the connection.
     [Steve Henson]

  *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
     peer supports secure renegotiation and 0 otherwise. Print out peer
     renegotiation support in s_client/s_server.
     [Steve Henson]

  *) Replace the highly broken and deprecated SPKAC certification method with
     the updated NID creation version. This should correctly handle UTF8.
     [Steve Henson]

  *) Implement RFC5746. Re-enable renegotiation but require the extension
     as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
     turns out to be a bad idea. It has been replaced by
     SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
     SSL_CTX_set_options(). This is really not recommended unless you
     know what you are doing.
