All Versions
126
Latest Version
Avg Release Cycle
101 days
Latest Release
1435 days ago

Changelog History
Page 2

  • v1.1.1.c Changes

    September 10, 2019
    • Fixed a fork protection issue. OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case.

    A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced.

    If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. [CVE-2019-1549][]

    Matthias St. Pierre

    • For built-in EC curves, ensure an EC_GROUP built from the curve name is used even when parsing explicit parameters, when loading a serialized key or calling EC_GROUP_new_from_ecpkparameters()/ EC_GROUP_new_from_ecparameters(). This prevents bypass of security hardening and performance gains, especially for curves with specialized EC_METHODs. By default, if a key encoded with explicit parameters is loaded and later serialized, the output is still encoded with explicit parameters, even if internally a "named" EC_GROUP is used for computation.

    Nicola Tuveri

    • Compute ECC cofactors if not provided during EC_GROUP construction. Before this change, EC_GROUP_set_generator would accept order and/or cofactor as NULL. After this change, only the cofactor parameter can be NULL. It also does some minimal sanity checks on the passed order. [CVE-2019-1547][]

    Billy Bob Brumley

    • Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey. An attack is simple, if the first CMS_recipientInfo is valid but the second CMS_recipientInfo is chosen ciphertext. If the second recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct encryption key will be replaced by garbage, and the message cannot be decoded, but if the RSA decryption fails, the correct encryption key is used and the recipient will not notice the attack. As a work around for this potential attack the length of the decrypted key must be equal to the cipher default key length, in case the certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. [CVE-2019-1563][]

    Bernd Edlinger

    • Early start up entropy quality from the DEVRANDOM seed source has been improved for older Linux systems. The RAND subsystem will wait for /dev/random to be producing output before seeding from /dev/urandom. The seeded state is stored for future library initialisations using a system global shared memory segment. The shared memory identifier can be configured by defining OPENSSL_RAND_SEED_DEVRANDOM_SHM_ID to the desired value. The default identifier is 114.

    Paul Dale

    • Correct the extended master secret constant on EBCDIC systems. Without this fix TLS connections between an EBCDIC system and a non-EBCDIC system that negotiate EMS will fail. Unfortunately this also means that TLS connections between EBCDIC systems with this fix, and EBCDIC systems without this fix will fail if they negotiate EMS.

    Matt Caswell

    • Use Windows installation paths in the mingw builds

    Mingw isn't a POSIX environment per se, which means that Windows paths should be used for installation. [CVE-2019-1552][]

    Richard Levitte

    • Changed DH_check to accept parameters with order q and 2q subgroups. With order 2q subgroups the bit 0 of the private key is not secret but DH_generate_key works around that by clearing bit 0 of the private key for those. This avoids leaking bit 0 of the private key.

    Bernd Edlinger

    • Significantly reduce secure memory usage by the randomness pools.

    Paul Dale

    • Revert the DEVRANDOM_WAIT feature for Linux systems

    The DEVRANDOM_WAIT feature added a select() call to wait for the /dev/random device to become readable before reading from the /dev/urandom device.

    It turned out that this change had negative side effects on performance which were not acceptable. After some discussion it was decided to revert this feature and leave it up to the OS resp. the platform maintainer to ensure a proper initialization during early boot time.

    Matthias St. Pierre

  • v1.1.1.b Changes

    May 28, 2019
    • Add build tests for C++. These are generated files that only do one thing, to include one public OpenSSL head file each. This tests that the public header files can be usefully included in a C++ application.

    This test isn't enabled by default. It can be enabled with the option 'enable-buildtest-c++'.

    Richard Levitte

    • Enable SHA3 pre-hashing for ECDSA and DSA.

    Patrick Steuer

    • Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey command when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation commands to use 2048 bits by default.

    Kurt Roeckx

    • Reorganize the manual pages to consistently have RETURN VALUES, EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust util/fix-doc-nits accordingly.

    Paul Yang, Joshua Lock

    • Add the missing accessor EVP_PKEY_get0_engine()

    Matt Caswell

    • Have commands like s_client and s_server output the signature scheme along with other cipher suite parameters when debugging.

    Lorinczy Zsigmond

    • Make OPENSSL_config() error agnostic again.

    Richard Levitte

    • Do the error handling in RSA decryption constant time.

    Bernd Edlinger

    • Prevent over long nonces in ChaCha20-Poly1305.

    ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.

    It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.

    Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.

    This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. ([CVE-2019-1543])

    Matt Caswell

    • Add DEVRANDOM_WAIT feature for Linux systems

    On older Linux systems where the getrandom() system call is not available, OpenSSL normally uses the /dev/urandom device for seeding its CSPRNG. Contrary to getrandom(), the /dev/urandom device will not block during early boot when the kernel CSPRNG has not been seeded yet.

    To mitigate this known weakness, use select() to wait for /dev/random to become readable before reading from /dev/urandom.

    • Ensure that SM2 only uses SM3 as digest algorithm

    Paul Yang

  • v1.1.1.a Changes

    February 26, 2019
    • Change the info callback signals for the start and end of a post-handshake message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get confused by this and assume that a TLSv1.2 renegotiation has started. This can break KeyUpdate handling. Instead we no longer signal the start and end of a post handshake message exchange (although the messages themselves are still signalled). This could break some applications that were expecting the old signals. However without this KeyUpdate is not usable for many applications.

    Matt Caswell

  • v1.1.0.k Changes

    September 10, 2019
    • For built-in EC curves, ensure an EC_GROUP built from the curve name is used even when parsing explicit parameters, when loading a serialized key or calling EC_GROUP_new_from_ecpkparameters()/ EC_GROUP_new_from_ecparameters(). This prevents bypass of security hardening and performance gains, especially for curves with specialized EC_METHODs. By default, if a key encoded with explicit parameters is loaded and later serialized, the output is still encoded with explicit parameters, even if internally a "named" EC_GROUP is used for computation.

    Nicola Tuveri

    • Compute ECC cofactors if not provided during EC_GROUP construction. Before this change, EC_GROUP_set_generator would accept order and/or cofactor as NULL. After this change, only the cofactor parameter can be NULL. It also does some minimal sanity checks on the passed order. [CVE-2019-1547][]

    Billy Bob Brumley

    • Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey. An attack is simple, if the first CMS_recipientInfo is valid but the second CMS_recipientInfo is chosen ciphertext. If the second recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct encryption key will be replaced by garbage, and the message cannot be decoded, but if the RSA decryption fails, the correct encryption key is used and the recipient will not notice the attack. As a work around for this potential attack the length of the decrypted key must be equal to the cipher default key length, in case the certifiate is not given and all recipientInfo are tried out. The old behaviour can be re-enabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag. [CVE-2019-1563][]

    Bernd Edlinger

    • Use Windows installation paths in the mingw builds

    Mingw isn't a POSIX environment per se, which means that Windows paths should be used for installation. [CVE-2019-1552][]

    Richard Levitte

  • v1.1.0.j Changes

    May 28, 2019
    • Change the default RSA, DSA and DH size to 2048 bit instead of 1024. This changes the size when using the genpkey command when no size is given. It fixes an omission in earlier changes that changed all RSA, DSA and DH generation commands to use 2048 bits by default.

    Kurt Roeckx

    • Prevent over long nonces in ChaCha20-Poly1305.

    ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.

    It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.

    Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable.

    This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk Greef of Ronomon. ([CVE-2019-1543])

    Matt Caswell

    • Added SCA hardening for modular field inversion in EC_GROUP through a new dedicated field_inv() pointer in EC_METHOD. This also addresses a leakage affecting conversions from projective to affine coordinates.

    Billy Bob Brumley, Nicola Tuveri

    • Fix a use after free bug in d2i_X509_PUBKEY when overwriting a re-used X509_PUBKEY object if the second PUBKEY is malformed.

    Bernd Edlinger

    • Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0().

    Richard Levitte

    • Remove the 'dist' target and add a tarball building script. The 'dist' target has fallen out of use, and it shouldn't be necessary to configure just to create a source distribution.

    Richard Levitte

  • v1.1.0.i Changes

    September 11, 2018
    • Add a new ClientHello callback. Provides a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. In particular, this callback can adjust the supported TLS versions in response to the contents of the ClientHello

    Benjamin Kaduk

    • Add SM2 base algorithm support.

    Jack Lloyd

    • s390x assembly pack: add (improved) hardware-support for the following cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb, aes-cfb/cfb8, aes-ecb.

    Patrick Steuer

    • Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only.

    Richard Levitte

    • Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for prime curves. The new implementation is based on formulae from differential addition-and-doubling in homogeneous projective coordinates from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified to work in projective coordinates.

    Billy Bob Brumley, Nicola Tuveri

    • Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2-128.

    Kurt Roeckx, Annie Yousar

    • Increase the number of Miller-Rabin rounds for DSA key generating to 64.

    Kurt Roeckx

    • The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when moving between systems, and to avoid confusion when a Windows build is done with mingw vs with MSVC. For POSIX installs, there's still a symlink or copy named 'tsget' to avoid that confusion as well.

    Richard Levitte

    • Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication.

    Andy Polyakov

    • Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder step for binary curves. The new implementation is based on formulae from differential addition-and-doubling in mixed Lopez-Dahab projective coordinates, modified to independently blind the operands.

    Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri

    • Add a scaffold to optionally enhance the Montgomery ladder implementation for ec_scalar_mul_ladder (formerly ec_mul_consttime) allowing EC_METHODs to implement their own specialized "ladder step", to take advantage of more favorable coordinate systems or more efficient differential addition-and-doubling algorithms.

    Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri

    • Modified the random device based seed sources to keep the relevant file descriptors open rather than reopening them on each access. This allows such sources to operate in a chroot() jail without the associated device nodes being available. This behaviour can be controlled using RAND_keep_random_devices_open().

    Paul Dale

    • Numerous side-channel attack mitigations have been applied. This may have performance impacts for some algorithms for the benefit of improved security. Specific changes are noted in this change log by their respective authors.

    Matt Caswell

    • AIX shared library support overhaul. Switch to AIX "natural" way of handling shared libraries, which means collecting shared objects of different versions and bitnesses in one common archive. This allows to mitigate conflict between 1.0 and 1.1 side-by-side installations. It doesn't affect the way 3rd party applications are linked, only how multi-version installation is managed.

    Andy Polyakov

    • Make ec_group_do_inverse_ord() more robust and available to other EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA mitigations are applied to the fallback BN_mod_inverse(). When using this function rather than BN_mod_inverse() directly, new EC cryptosystem implementations are then safer-by-default.

    Billy Bob Brumley

    • Add coordinate blinding for EC_POINT and implement projective coordinate blinding for generic prime curves as a countermeasure to chosen point SCA attacks.

    Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley

    • Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group).

    Matt Caswell

    • Enforce checking in the pkeyutl command line app to ensure that the input length does not exceed the maximum supported digest length when performing a sign, verify or verifyrecover operation.

    Matt Caswell

    • SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking I/O in combination with something like select() or poll() will hang. This can be turned off again using SSL_CTX_clear_mode(). Many applications do not properly handle non-application data records, and TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works around the problems in those applications, but can also break some. It's recommended to read the manpages about SSL_read(), SSL_write(), SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and SSL_CTX_set_read_ahead() again.

    Kurt Roeckx

    • When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases.

    Richard Levitte

    • Apply blinding to binary field modular inversion and remove patent pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation.

    Billy Bob Brumley

    • Deprecate ec2_mult.c and unify scalar multiplication code paths for binary and prime elliptic curves.

    Billy Bob Brumley

    • Remove ECDSA nonce padding: EC_POINT_mul is now responsible for constant time fixed point multiplication.

    Billy Bob Brumley

    • Revise elliptic curve scalar multiplication with timing attack defenses: ec_wNAF_mul redirects to a constant time implementation when computing fixed point and variable point multiplication (which in OpenSSL are mostly used with secret scalars in keygen, sign, ECDH derive operations). Billy Bob Brumley, Nicola Tuveri, Cesar Pereida García, Sohaib ul Hassan

    • Updated CONTRIBUTING

    Rich Salz

    • Updated DRBG / RAND to request nonce and additional low entropy randomness from the system.

    Matthias St. Pierre

    • Updated 'openssl rehash' to use OpenSSL consistent default.

    Richard Levitte

    • Moved the load of the ssl_conf module to libcrypto, which helps loading engines that libssl uses before libssl is initialised.

    Matt Caswell

    • Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA

    Matt Caswell

    • Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases.

    Ingo Schwarze, Rich Salz

    • Added output of accepting IP address and port for 'openssl s_server'

    Richard Levitte

    • Added a new API for TLSv1.3 ciphersuites: SSL_CTX_set_ciphersuites() SSL_set_ciphersuites()

    Matt Caswell

    • Memory allocation failures consistently add an error to the error stack.

    Rich Salz

    • Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values in libcrypto when run as setuid/setgid.

    Bernd Edlinger

    • Load any config file by default when libssl is used.

    Matt Caswell

    • Added new public header file and documentation for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview.

    Matthias St. Pierre

    • QNX support removed (cannot find contributors to get their approval for the license change).

    Rich Salz

    • TLSv1.3 replay protection for early data has been implemented. See the SSL_read_early_data() man page for further details.

    Matt Caswell

    • Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3. In order to avoid issues where legacy TLSv1.2 ciphersuite configuration would otherwise inadvertently disable all TLSv1.3 ciphersuites the configuration has been separated out. See the ciphers man page or the SSL_CTX_set_ciphersuites() man page for more information.

    Matt Caswell

    • On POSIX (BSD, Linux, ...) systems the ocsp(1) command running in responder mode now supports the new "-multi" option, which spawns the specified number of child processes to handle OCSP requests. The "-timeout" option now also limits the OCSP responder's patience to wait to receive the full client request on a newly accepted connection. Child processes are respawned as needed, and the CA index file is automatically reloaded when changed. This makes it possible to run the "ocsp" responder as a long-running service, making the OpenSSL CA somewhat more feature-complete. In this mode, most diagnostic messages logged after entering the event loop are logged via syslog(3) rather than written to stderr.

    Viktor Dukhovni

    • Added support for X448 and Ed448. Heavily based on original work by Mike Hamburg.

    Matt Caswell

    • Extend OSSL_STORE with capabilities to search and to narrow the set of objects loaded. This adds the functions OSSL_STORE_expect() and OSSL_STORE_find() as well as needed tools to construct searches and get the search data out of them.

    Richard Levitte

    • Support for TLSv1.3 added. Note that users upgrading from an earlier version of OpenSSL should review their configuration settings to ensure that they are still appropriate for TLSv1.3. For further information see: https://wiki.openssl.org/index.php/TLS1.3

    Matt Caswell

    • Grand redesign of the OpenSSL random generator

    The default RAND method now utilizes an AES-CTR DRBG according to NIST standard SP 800-90Ar1. The new random generator is essentially a port of the default random generator from the OpenSSL FIPS 2.0 object module. It is a hybrid deterministic random bit generator using an AES-CTR bit stream and which seeds and reseeds itself automatically using trusted system entropy sources.

    Some of its new features are: - Support for multiple DRBG instances with seed chaining. - The default RAND method makes use of a DRBG. - There is a public and private DRBG instance. - The DRBG instances are fork-safe. - Keep all global DRBG instances on the secure heap if it is enabled. - The public and private DRBG instance are per thread for lock free operation

    Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre

    • Changed Configure so it only says what it does and doesn't dump so much data. Instead, ./configdata.pm should be used as a script to display all sorts of configuration data.

    Richard Levitte

    • Added processing of "make variables" to Configure.

    Richard Levitte

    • Added SHA512/224 and SHA512/256 algorithm support.

    Paul Dale

    • The last traces of Netware support, first removed in 1.1.0, have now been removed.

    Rich Salz

    • Get rid of Makefile.shared, and in the process, make the processing of certain files (rc.obj, or the .def/.map/.opt files produced from the ordinal files) more visible and hopefully easier to trace and debug (or make silent).

    Richard Levitte

    • Make it possible to have environment variable assignments as arguments to config / Configure.

    Richard Levitte

    • Add multi-prime RSA (RFC 8017) support.

    Paul Yang

    • Add SM3 implemented according to GB/T 32905-2016

    • Add 'Maximum Fragment Length' TLS extension negotiation and support as documented in RFC6066. Based on a patch from Tomasz Moń

    Filipe Raimundo da Silva

    Rich Salz

    • Add ARIA AEAD TLS support.

    Jon Spillett

    • Some macro definitions to support VS6 have been removed. Visual Studio 6 has not worked since 1.1.0

    Rich Salz

    • Add ERR_clear_last_mark(), to allow callers to clear the last mark without clearing the errors.

    Richard Levitte

    • Add "atfork" functions. If building on a system that without pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application requirements. The RAND facility now uses/requires this.

    Rich Salz

    • Add SHA3.

    Andy Polyakov

    • The UI API becomes a permanent and integral part of libcrypto, i.e. not possible to disable entirely. However, it's still possible to disable the console reading UI method, UI_OpenSSL() (use UI_null() as a fallback).

    To disable, configure with 'no-ui-console'. 'no-ui' is still possible to use as an alias. Check at compile time with the macro OPENSSL_NO_UI_CONSOLE. The macro OPENSSL_NO_UI is still possible to check and is an alias for OPENSSL_NO_UI_CONSOLE.

    Richard Levitte

    • Add a STORE module, which implements a uniform and URI based reader of stores that can contain keys, certificates, CRLs and numerous other objects. The main API is loosely based on a few stdio functions, and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof, OSSL_STORE_error and OSSL_STORE_close. The implementation uses backends called "loaders" to implement arbitrary URI schemes. There is one built in "loader" for the 'file' scheme.

    Richard Levitte

    • Add devcrypto engine. This has been implemented against cryptodev-linux, then adjusted to work on FreeBSD 8.4 as well. Enable by configuring with 'enable-devcryptoeng'. This is done by default on BSD implementations, as cryptodev.h is assumed to exist on all of them.

    Richard Levitte

    • Module names can prefixed with OSSL_ or OPENSSL_. This affects util/mkerr.pl, which is adapted to allow those prefixes, leading to error code calls like this:

         OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
      

    With this change, we claim the namespaces OSSL and OPENSSL in a manner that can be encoded in C. For the foreseeable future, this will only affect new modules.

    Richard Levitte and Tim Hudson

    • Removed BSD cryptodev engine.

    Rich Salz

    • Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there.

    Richard Levitte

    • In the UI interface, make it possible to duplicate the user data. This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed.

    Richard Levitte

    • Ignore the '-named_curve auto' value for compatibility of applications with OpenSSL 1.0.2.

    Tomas Mraz [email protected]

    • Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibits this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause interoperability issues.

    Matt Caswell

    • Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed with Z. These are meant to replace LONG and ZLONG and to be size safe. The use of LONG and ZLONG is discouraged and scheduled for deprecation in OpenSSL 1.2.0.

    Richard Levitte

    • Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string, 'z' is to be used for [s]size_t, and 'j' - with [u]int64_t.

    Richard Levitte, Andy Polyakov

    • Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine() does for RSA, etc.

    Richard Levitte

    • Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'.

    Richard Levitte

    • The functions X509_STORE_add_cert and X509_STORE_add_crl return success if they are asked to add an object which already exists in the store. This change cascades to other functions which load certificates and CRLs.

    Paul Dale

    • x86_64 assembly pack: annotate code with DWARF CFI directives to facilitate stack unwinding even from assembly subroutines.

    Andy Polyakov

    • Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN. Also remove OPENSSL_GLOBAL entirely, as it became a no-op.

    Richard Levitte

    • Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support.

    Richard Levitte

    • Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed.

    Emilia Käsper

    • Add support for ARIA

    Paul Dale

    • s_client will now send the Server Name Indication (SNI) extension by default unless the new "-noservername" option is used. The server name is based on the host provided to the "-connect" option unless overridden by using "-servername".

    Matt Caswell

    • Add support for SipHash

    Todd Short

    • OpenSSL now fails if it receives an unrecognised record type in TLS1.0 or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them.

    Matt Caswell

    Richard Levitte

    • Heartbeat support has been removed; the ABI is changed for now.

    Richard Levitte, Rich Salz

    • Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd.

    Emilia Käsper

    • The RSA "null" method, which was partially supported to avoid patent issues, has been replaced to always returns NULL.

    Rich Salz

    OpenSSL 1.1.0

  • v1.1.0.h Changes

    August 14, 2018
    • Client DoS due to large DH parameter

    During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack.

    This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken [CVE-2018-0732][]

    Guido Vranken

    • Cache timing vulnerability in RSA Key Generation

    The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.

    This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia. [CVE-2018-0737][]

    Billy Brumley

    • Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem_str parameter is no longer accepted, as it leads to a corrupt table. NULL pem_str is reserved for alias entries only.

    Richard Levitte

    • Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplication.

    Andy Polyakov

    • Change generating and checking of primes so that the error rate of not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2-128.

    Kurt Roeckx, Annie Yousar

    • Increase the number of Miller-Rabin rounds for DSA key generating to 64.

    Kurt Roeckx

    • Add blinding to ECDSA and DSA signatures to protect against side channel attacks discovered by Keegan Ryan (NCC Group).

    Matt Caswell

    • When unlocking a pass phrase protected PEM file or PKCS#8 container, we now allow empty (zero character) pass phrases.

    Richard Levitte

    • Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed.

    Emilia Käsper

    • Fixed a text canonicalisation bug in CMS

    Where a CMS detached signature is used with text content the text goes through a canonicalisation process first prior to signing or verifying a signature. This process strips trailing space at the end of lines, converts line terminators to CRLF and removes additional trailing line terminators at the end of a file. A bug in the canonicalisation process meant that some characters, such as form-feed, were incorrectly treated as whitespace and removed. This is contrary to the specification (RFC5485). This fix could mean that detached text data signed with an earlier version of OpenSSL 1.1.0 may fail to verify using the fixed version, or text data signed with a fixed OpenSSL may fail to verify with an earlier version of OpenSSL 1.1.0. A workaround is to only verify the canonicalised text data and use the "-binary" flag (for the "cms" command line application) or set the SMIME_BINARY/PKCS7_BINARY/CMS_BINARY flags (if using CMS_verify()).

    Matt Caswell

  • v1.1.0.g Changes

    March 27, 2018
    • Constructed ASN.1 types with a recursive definition could exceed the stack

    Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe.

    This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz project. ([CVE-2018-0739])

    Matt Caswell

    • Incorrect CRYPTO_memcmp on HP-UX PA-RISC

    Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected.

    This issue was reported to OpenSSL on 2nd March 2018 by Peter Waltenberg (IBM). ([CVE-2018-0733])

    Andy Polyakov

    • Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there.

    Richard Levitte

    • Backport SSL_OP_NO_RENGOTIATION

    OpenSSL 1.0.2 and below had the ability to disable renegotiation using the (undocumented) SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag. Due to the opacity changes this is no longer possible in 1.1.0. Therefore, the new SSL_OP_NO_RENEGOTIATION option from 1.1.1-dev has been backported to 1.1.0 to provide equivalent functionality.

    Note that if an application built against 1.1.0h headers (or above) is run using an older version of 1.1.0 (prior to 1.1.0h) then the option will be accepted but nothing will happen, i.e. renegotiation will not be prevented.

    Matt Caswell

    • Removed the OS390-Unix config target. It relied on a script that doesn't exist.

    Rich Salz

    • rsaz_1024_mul_avx2 overflow bug on x86_64

    There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701.

    This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation).

    This issue was reported to OpenSSL by David Benjamin (Google). The issue was originally found via the OSS-Fuzz project. ([CVE-2017-3738])

    Andy Polyakov

  • v1.1.0.f Changes

    November 02, 2017
    • bn_sqrx8x_internal carry bug on x86_64

    There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients.

    This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

    This issue was reported to OpenSSL by the OSS-Fuzz project. [CVE-2017-3736][]

    Andy Polyakov

    • Malformed X.509 IPAddressFamily could cause OOB read

    If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. The most likely result would be an erroneous display of the certificate in text format.

    This issue was reported to OpenSSL by the OSS-Fuzz project. [CVE-2017-3735][]

    Rich Salz

  • v1.1.0.e Changes

    May 25, 2017
    • Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target platform rather than 'mingw'.

    Richard Levitte

    • Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c. VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1, which is the minimum version we support.

    Richard Levitte