mirror of https://github.com/openssl/openssl
Sync CHANGES.md and NEWS.md with 3.3 branch
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24034)
This commit is contained in:
Tomas Mraz
parent
649705961c
commit
eb33768e87
55
CHANGES.md
55
CHANGES.md
|
|
@ -23,6 +23,13 @@ OpenSSL Releases
|
|||
- [OpenSSL 1.0.0](#openssl-100)
|
||||
- [OpenSSL 0.9.x](#openssl-09x)
|
||||
|
||||
OpenSSL 3.4
|
||||
-----------
|
||||
|
||||
### Changes between 3.3 and 3.4 [xx XXX xxxx]
|
||||
|
||||
* None yet
|
||||
|
||||
OpenSSL 3.3
|
||||
-----------
|
||||
|
||||
|
|
@ -155,6 +162,11 @@ OpenSSL 3.3
|
|||
|
||||
*Hugo Landau*
|
||||
|
||||
* Limited support for polling of QUIC connection and stream objects in a
|
||||
non-blocking manner. Refer to the SSL_poll(3) manpage for details.
|
||||
|
||||
*Hugo Landau*
|
||||
|
||||
* Added APIs to allow querying the size and utilisation of a QUIC stream's
|
||||
write buffer. Refer to the SSL_get_value_uint(3) manpage for details.
|
||||
|
||||
|
|
@ -168,6 +180,49 @@ OpenSSL 3.3
|
|||
|
||||
*Alexandr Nedvedicky*
|
||||
|
||||
* Applied AES-GCM unroll8 optimisation to Microsoft Azure Cobalt 100
|
||||
|
||||
*Tom Cosgrove*
|
||||
|
||||
* Added X509_STORE_get1_objects to avoid issues with the existing
|
||||
X509_STORE_get0_objects API in multi-threaded applications. Refer to the
|
||||
documentation for details.
|
||||
|
||||
*David Benjamin*
|
||||
|
||||
* Added assembly implementation for md5 on loongarch64
|
||||
|
||||
*Min Zhou*
|
||||
|
||||
* Optimized AES-CTR for ARM Neoverse V1 and V2
|
||||
|
||||
*Fisher Yu*
|
||||
|
||||
* Enable AES and SHA3 optimisations on Applie Silicon M3-based MacOS systems
|
||||
similar to M1/M2.
|
||||
|
||||
*Tom Cosgrove*
|
||||
|
||||
* Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
|
||||
times with different output sizes.
|
||||
|
||||
*Shane Lontis, Holger Dengler*
|
||||
|
||||
* Various optimizations for cryptographic routines using RISC-V vector crypto
|
||||
extensions
|
||||
|
||||
*Christoph Müllner, Charalampos Mitrodimas, Ard Biesheuvel, Phoebe Chen,
|
||||
Jerry Shih*
|
||||
|
||||
* Accept longer context for TLS 1.2 exporters
|
||||
|
||||
While RFC 5705 implies that the maximum length of a context for exporters is
|
||||
65535 bytes as the length is embedded in uint16, the previous implementation
|
||||
enforced a much smaller limit, which is less than 1024 bytes. This
|
||||
restriction has been removed.
|
||||
|
||||
*Daiki Ueno*
|
||||
|
||||
OpenSSL 3.2
|
||||
-----------
|
||||
|
||||
|
|
|
|||
121
NEWS.md
121
NEWS.md
|
|
@ -18,14 +18,135 @@ OpenSSL Releases
|
|||
- [OpenSSL 1.0.0](#openssl-100)
|
||||
- [OpenSSL 0.9.x](#openssl-09x)
|
||||
|
||||
OpenSSL 3.4
|
||||
-----------
|
||||
|
||||
### Major changes between OpenSSL 3.3 and OpenSSL 3.4 [under development]
|
||||
|
||||
OpenSSL 3.4.0 is a feature release adding significant new functionality to
|
||||
OpenSSL.
|
||||
|
||||
This release is in development.
|
||||
|
||||
OpenSSL 3.3
|
||||
-----------
|
||||
|
||||
### Major changes between OpenSSL 3.2 and OpenSSL 3.3 [under development]
|
||||
|
||||
OpenSSL 3.3.0 is a feature release adding significant new functionality to
|
||||
OpenSSL.
|
||||
|
||||
This release adds the following new features:
|
||||
|
||||
* Support for qlog for tracing QUIC connections has been added
|
||||
|
||||
* Added APIs to allow configuring the negotiated idle timeout for QUIC
|
||||
connections, and to allow determining the number of additional streams
|
||||
that can currently be created for a QUIC connection.
|
||||
|
||||
* Added APIs to allow disabling implicit QUIC event processing for QUIC SSL
|
||||
objects
|
||||
|
||||
* Added APIs to allow querying the size and utilisation of a QUIC stream's
|
||||
write buffer
|
||||
|
||||
* New API `SSL_write_ex2`, which can be used to send an end-of-stream (FIN)
|
||||
condition in an optimised way when using QUIC.
|
||||
|
||||
* Limited support for polling of QUIC connection and stream objects in a
|
||||
non-blocking manner.
|
||||
|
||||
* Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
|
||||
times with different output sizes.
|
||||
|
||||
* Added exporter for CMake on Unix and Windows, alongside the pkg-config
|
||||
exporter.
|
||||
|
||||
* The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
|
||||
output length.
|
||||
|
||||
* The EVP_PKEY_fromdata function has been augmented to allow for the
|
||||
derivation of CRT (Chinese Remainder Theorem) parameters when requested
|
||||
|
||||
* Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
|
||||
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
|
||||
is enabled
|
||||
|
||||
* Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
|
||||
config options and the respective calls to SSL[_CTX]_set1_sigalgs() and
|
||||
SSL[_CTX]_set1_client_sigalgs() that start with `?` character are
|
||||
ignored and the configuration will still be used.
|
||||
|
||||
* Added `-set_issuer` and `-set_subject` options to `openssl x509` to
|
||||
override the Issuer and Subject when creating a certificate. The `-subj`
|
||||
option now is an alias for `-set_subject`.
|
||||
|
||||
* Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
|
||||
|
||||
* New option `SSL_OP_PREFER_NO_DHE_KEX`, which allows configuring a TLS1.3
|
||||
server to prefer session resumption using PSK-only key exchange over PSK
|
||||
with DHE, if both are available.
|
||||
|
||||
* New atexit configuration switch, which controls whether the OPENSSL_cleanup
|
||||
is registered when libcrypto is unloaded.
|
||||
|
||||
* Added X509_STORE_get1_objects to avoid issues with the existing
|
||||
X509_STORE_get0_objects API in multi-threaded applications.
|
||||
|
||||
This release incorporates the following potentially significant or incompatible
|
||||
changes:
|
||||
|
||||
* Applied AES-GCM unroll8 optimisation to Microsoft Azure Cobalt 100
|
||||
|
||||
* Optimized AES-CTR for ARM Neoverse V1 and V2
|
||||
|
||||
* Enable AES and SHA3 optimisations on Applie Silicon M3-based MacOS systems
|
||||
similar to M1/M2.
|
||||
|
||||
* Various optimizations for cryptographic routines using RISC-V vector crypto
|
||||
extensions
|
||||
|
||||
* Added assembly implementation for md5 on loongarch64
|
||||
|
||||
* Accept longer context for TLS 1.2 exporters
|
||||
|
||||
* The activate and soft_load configuration settings for providers in
|
||||
openssl.cnf have been updated to require a value of [1|yes|true|on]
|
||||
(in lower or UPPER case) to enable the setting. Conversely a value
|
||||
of [0|no|false|off] will disable the setting.
|
||||
|
||||
* In `openssl speed`, changed the default hash function used with `hmac` from
|
||||
`md5` to `sha256`.
|
||||
|
||||
* The `-verify` option to the `openssl crl` and `openssl req` will make the
|
||||
program exit with 1 on failure.
|
||||
|
||||
* The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(), and
|
||||
related functions have been augmented to check for a minimum length of
|
||||
the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
|
||||
|
||||
* OPENSSL_sk_push() and sk_<TYPE>_push() functions now return 0 instead of -1
|
||||
if called with a NULL stack argument.
|
||||
|
||||
* New limit on HTTP response headers is introduced to HTTP client. The
|
||||
default limit is set to 256 header lines.
|
||||
|
||||
This release incorporates the following bug fixes and mitigations:
|
||||
|
||||
* The BIO_get_new_index() function can only be called 127 times before it
|
||||
reaches its upper bound of BIO_TYPE_MASK and will now return -1 once its
|
||||
exhausted.
|
||||
|
||||
A more detailed list of changes in this release can be found in the
|
||||
[CHANGES.md] file.
|
||||
|
||||
Users interested in using the new QUIC functionality are encouraged to read the
|
||||
[README file for QUIC][README-QUIC.md], which provides links to relevant
|
||||
documentation and example code.
|
||||
|
||||
As always, bug reports and issues relating to OpenSSL can be [filed on our issue
|
||||
tracker][issue tracker].
|
||||
|
||||
OpenSSL 3.2
|
||||
-----------
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue