Commit 1d6938b2a4 for openssl.org
commit 1d6938b2a446f9cb83fc9f23eb590d0b25ff52f5
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date: Wed Sep 9 02:46:44 2026 +0200
CHANGES.md: reorder existing entries
Reorder the entries in (roughly) the following order:
* new features pertaining support of standards and protocols;
* protocol-and-standard-support-related additions;
* API additions that are also exposed in CLI;
* CLI additions and changes;
* API additions;
* improvements and changes;
* architecture-specific optimisations and updates;
* internal changes (build configuration, tests, etc.);
* bug fixes;
* deprecations;
* removals.
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Merge-date: Wed Sep 9 11:10:38 2026
Merged-from: https://github.com/openssl/openssl/pull/32758
diff --git a/CHANGES.md b/CHANGES.md
index 06bc436b4c..42f0ee7274 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -32,59 +32,24 @@ OpenSSL 4.1
### Changes between 4.0 and 4.1 [xx XXX xxxx]
- * Refactored remaining cipher `OSSL_PARAM` name parsing so that automatically
- generated parsers are used instead of `OSSL_PARAM_locate()` calls.
- This should ensure that the list of acceptable parameters better matches
- those which are actually processed. It should also provide a small
- performance improvement, because repeated iteration over passed parameter
- arrays is avoided.
-
- *Dr Paul Dale*
-
- * Added a `seed_strict` option to the `random` configuration section,
- which makes the configured random seed source strictly enforced when
- a provider (such as the FIPS provider) requests entropy or a nonce.
-
- When a provider requests seeding material before the primary DRBG
- has been created, the request falls back to the operating system entropy
- sources, because the seed source only comes into existence as a side
- effect of creating the primary DRBG. Whether a configured seed source
- is used therefore depends on operation order. With `seed_strict` enabled,
- the seed source is instead instantiated on demand and an error is reported
- if it cannot be used. The option is off by default with two exceptions:
- the `JITTER` seed source seeds strictly unless the option disables it,
- and `enable-fips-jitter` builds always seed strictly. Additionally,
- the property query used to fetch the default seed source can now be set
- at build time with `-DOPENSSL_DEFAULT_SEED_PROPQ`.
-
- *Jakub Zelenka*
-
- * Fixed a bug where a TLS 1.3 session ticket could retain a stale ALPN
- protocol from an earlier connection after a resumption negotiated
- a different protocol (or none), on both the server and the client,
- which could otherwise affect a later 0-RTT decision.
-
- *Daniel Kubec and Viktor Dukhovni*
-
- * Implemented extended support of metadata for symmetric key objects
- (`EVP_SKEY`).
-
- *Dmitry Belyavskiy*
+ * Added support for DTLS 1.3 ([RFC 9147]).
+ Refer to the `ossl-guide-dtlsv13(7)` manual page for details.
- * Declared support for AArch64 Guarded Control Stack (GCS) in assembly code.
+ *Frederik Wedel-Heinen and Ryan Hooper*
- When building with compilers that support GCS (Clang 18+, GCC 15+),
- assembly modules are marked as compatible when branch protection
- is enabled (e.g. `-mbranch-protection=standard`). No functional changes
- to the assembly implementations are required, but compliance ensures
- correct operation with shadow stack enforcement.
+ * Added support for [RFC 8701] GREASE (Generate Random Extensions And Sustain
+ Extensibility). When `SSL_OP_GREASE` is set, the TLS client injects
+ reserved GREASE values into cipher suites, supported versions, supported
+ groups, signature algorithms, key share, and extensions in the `ClientHello`
+ to prevent ecosystem ossification.
+ Added `-grease` option to `openssl s_client` to enable this.
- *Guillaume Gardet and Gowtham Suresh Kumar*
+ *William McCormack*
- * Added support for DTLS 1.3 ([RFC 9147]).
- Refer to the `ossl-guide-dtlsv13(7)` manual page for details.
+ * Added support for Ed25519 and Ed448 certificates in DTLS 1.2. Previously,
+ these certificate types were only supported in TLS 1.2 and TLS 1.3.
- *Frederik Wedel-Heinen and Ryan Hooper*
+ *Adriano Sela Aviles*
* Added DTLS support to the SSL listener API. `SSL_new_listener()` can now
create a DTLS listener that demultiplexes incoming datagrams into per-peer
@@ -105,82 +70,13 @@ OpenSSL 4.1
*Ryan Hooper*
- * Fixed `SSL_listen_ex()` to correctly adopt a QUIC connection and to preserve
- queued connections on allocation failure. Invalid arguments, including
- non-QUIC SSL objects, and internal failures now return `-1`, reserving `0`
- for "no connection available".
-
- *Mounir IDRASSI*
-
- * Fixed QUIC child objects to inherit the effective flags of their explicit
- event domain. `SSL_get0_domain()` now reports that domain for connections
- and streams in the hierarchy.
-
- *Mounir IDRASSI*
-
- * Fixed TLS 1.3 clients to encrypt 0-RTT early data with the first offered
- PSK identity ([RFC 9846 Section 4.3.10]) when a 0-RTT-capable resumption
- ticket has aged out and an external PSK is offered in its place. The early
- data was being encrypted with the retired ticket's secret, rather than
- the external PSK's, causing the server to reject it with a bad record MAC.
-
- *Viktor Dukhovni*
-
- * Fixed TLS 1.3 servers to reject early data when a resumed PSK's
- ticket age is outside tolerance, per [RFC 9846], instead of accepting
- 0-RTT data from a ticket that has aged out.
-
- *Daniel Kubec*
-
- * TLS clients no longer send the TLS padding extension ([RFC 7685]). It was
- only ever sent when `SSL_OP_TLSEXT_PADDING` was set, to work around
- a `ClientHello` length bug in F5 middleboxes; the fix shipped long ago
- and the affected hardware is long out of support, so nothing should still
- be running the problematic version.
- `SSL_OP_TLSEXT_PADDING` is now a no-op retained for compatibility,
- and is no longer included in `SSL_OP_ALL`.
-
- *Bob Beck*
-
- * Fixed X.509v3 extension configuration parsing to reject repeated fields
- in the `basicConstraints`, `basicAttConstraints`, and `policyConstraints`
- X.509v3 extension configurations, instead of silently using the last value.
-
- *Adam Tabak*
-
- * Changed `tsget` utility to use `Net::Curl::Easy` (from the `Net-Curl` CPAN
- distribution) instead of the abandoned `WWW::Curl::Easy`. Users who rely
- on `tsget` should install `Net::Curl::Easy` before upgrading.
-
- *Shreenidhi Shedi*
-
- * Added `CMS_add_standard_smimecap_ex()` API function, which populates
- an `SMIMECapabilities` list using `EVP_CIPHER_fetch()` and `EVP_MD_fetch()`
- so that only algorithms available in the active providers are advertised.
- `PKCS7_sign_add_signer()` was updated in the same way, so that legacy
- ciphers, such as RC2 and DES, are no longer included in `SMIMECapabilities`
- by default when only the default provider is loaded.
-
- *Todd Short*
-
- * Added various optimizations for the Elbrus2000 architecture
- in the cryptographic and BN code.
-
- *Gleb Popov*
-
- * Fixed TLS 1.3 external PSK connections being wrongly rejected when
- the client sets a non-empty session ID context.
-
- *Viktor Dukhovni*
-
- * Fixed a TLS 1.3 server with no session ID context to accept external PSK
- connections and to stop issuing unusable session tickets.
-
- *Viktor Dukhovni*
-
- * Added AVX-512-optimized SHAKE x4 operations for ML-DSA on `x86_64`.
+ * Implemented an ability to configure additional QUIC transport parameters
+ via the `SSL_get_value_uint()`/`SSL_set_value_uint()` functions:
+ `max_udp_payload_size`, `initial_max_data`,
+ `initial_max_stream_data_bidi_local`, `initial_max_stream_data_uni`,
+ `ack_delay_exponent`, and `max_ack_delay`.
- *Marcel Cornu and Tomasz Kantecki*
+ *Nikolas Gauder*
* Simplified EC key point format handling.
@@ -210,145 +106,164 @@ OpenSSL 4.1
*Viktor Dukhovni*
- * Added unit tests setup activated via `enable-unit-tests` option. This works
- only on platforms with ld `--wrap` support (Linux, BSD).
-
- *Jakub Zelenka*
+ * Added a new verification error, `X509_V_ERR_DUPLICATE_EXTENSION`,
+ with a descriptive message for certificates containing duplicate X.509
+ extensions, which are explicitly prohibited by [RFC 5280].
- * Deprecated the `enable-unit-test` configure option and the
- `SSL_test_functions()` function. Both will be removed in OpenSSL 5.0.
+ *Daniel Kubec*
- *Jakub Zelenka*
+ * Implemented extended support of metadata for symmetric key objects
+ (`EVP_SKEY`).
- * Deprecated `BIO_snprintf()` and `BIO_vsnprintf()`. `snprintf()`, being part
- of C99 standard, that is the baseline for OpenSSL since version 3.6,
- is now considered universally available; moreover, the fact that `BIO_*()`
- functions return -1 on truncation, rather than the would-have-been length,
- makes their usage error-prone. Use `snprintf()` and `vsnprintf()` directly.
+ *Dmitry Belyavskiy*
- *Bob Beck*
+ * Added `CMS_VERIFY_PARTIAL` flag to `CMS_verify()`, `-verify_partial`
+ option to `openssl cms -verify` operation,
+ and `CMS_SignerInfo_get_verification_result()`
+ and `CMS_SignerInfo_get0_signer_cert()` functions.
- * Added `-testmode` option for `openssl s_time` command.
+ If the `CMS_VERIFY_PARTIAL` flag is set, the `CMS_verify()` call
+ is successful if at least one of the individual signatures can be verified
+ (as opposed to all of them), which may be useful to gracefully handle various
+ situations, like missing CAs, expired certificates, or unsupported
+ algorithms; applications can call `CMS_get0_signers()` to check if the set
+ of valid signatures satisfies its policy, or use
+ `CMS_SignerInfo_get_verification_result()`
+ and `CMS_SignerInfo_get0_signer_cert()` functions to access the detailed
+ verification results.
- *Jakub Zelenka*
+ *Jan Lübbe*
- * Fixed TLS 1.3 servers to reject early data when the selected ciphersuite
- differs from the ciphersuite associated with the selected PSK. Same-hash
- PSK resumption can still continue without accepting 0-RTT data.
+ * Added `OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES` option for `OSSL_CMP_CTX`
+ and a corresponding `-nonmatched_error_nonces` option for the `openssl cmp`
+ command.
- *Mounir IDRASSI*
+ This work was sponsored by Siemens AG.
- * Added support for Ed25519 and Ed448 certificates in DTLS 1.2. Previously,
- these certificate types were only supported in TLS 1.2 and TLS 1.3.
+ *David von Oheimb*
- *Adriano Sela Aviles*
+ * Changed the output of the `-disabled` option for the `openssl list` command
+ to display disabled features, protocols, and algorithms, in relevant
+ sections.
- * Added `VC-WIN32-MSVC2013` and `VC-WIN64A-MSVC2013` build targets to provide
- internal functions for bridging the gaps in C99 standard support
- that are present in MSVC 2013.
+ *Paul Louvel*
- *Bob Beck*
+ * Added `-testmode` option for `openssl s_time` command.
- * Improved interoperability with TPM 1.2 Endorsement Key certificates
- per [TCG Credential Profiles specification Version 1.2, Section 3.2.7]:
- `SubjectPublicKeyInfo` blobs whose `AlgorithmIdentifier` uses
- `id-RSAES-OAEP` (`NID_rsaesOaep`, 1.2.840.113549.1.1.7) with a plain
- `RSAPublicKey` body are now decoded as RSA keys. The OAEP
- `AlgorithmIdentifier` parameters are not interpreted.
+ *Jakub Zelenka*
- *Craig Lorentzen*
+ * Added ability to utilise memory-mapped I/O when reading raw input
+ from a file for one-shot sign/verify operations (such as Ed25519,
+ Ed448, and ML-DSA) to `openssl pkeyutl` command on platforms
+ that support it (Unix-like). The `openssl dgst` command uses the same
+ approach for one-shot sign/verify when the input is from a file, removing
+ the previous 16 MB limit for file-based input. This improves performance
+ and supports large files without doubling memory use. Other platforms
+ and `stdin` input continue to use the existing buffer-based implementation.
- * Do not issue TLS 1.3 session tickets if the server has explicitly disabled
- them via `SSL_OP_NO_TICKET` and also turned off the session cache with
- `SSL_SESS_CACHE_OFF`. Both conditions together indicate a clear intent to
- suppress resumption, so sending `NewSessionTicket` messages would be wasteful
- and misleading. TLS 1.3 client that does not send the `psk_key_exchange_modes`
- extension, or that sends it together with [RFC 9149] parameters such as
- `new_session_count = 0` or `resumption_count = 0`, is effectively signaling
- no interest in session tickets and session resumption.
+ *John Claus*
- *Daniel Kubec*
+ * Added a `seed_strict` option to the `random` configuration section,
+ which makes the configured random seed source strictly enforced when
+ a provider (such as the FIPS provider) requests entropy or a nonce.
- * Added test framework for testing function memory allocation failures.
+ When a provider requests seeding material before the primary DRBG
+ has been created, the request falls back to the operating system entropy
+ sources, because the seed source only comes into existence as a side
+ effect of creating the primary DRBG. Whether a configured seed source
+ is used therefore depends on operation order. With `seed_strict` enabled,
+ the seed source is instead instantiated on demand and an error is reported
+ if it cannot be used. The option is off by default with two exceptions:
+ the `JITTER` seed source seeds strictly unless the option disables it,
+ and `enable-fips-jitter` builds always seed strictly. Additionally,
+ the property query used to fetch the default seed source can now be set
+ at build time with `-DOPENSSL_DEFAULT_SEED_PROPQ`.
*Jakub Zelenka*
- * Dropped Windows-on-Itanium (`VC-WIN64I`) and Windows CE (`VC-CE`) targets
- from Configurations.
+ * Added IKEV2 KDF (`EVP_KDF-IKEV2KDF`) to `EVP_KDF`.
- *Bob Beck*
+ *Helen Zhang*
- * Improved DTLS handshake robustness under UDP reordering by buffering
- and replaying early `ChangeCipherSpec` (CCS) records at the expected state.
+ * Added `CRYPTO_atomic_load_ptr`, `CRYPTO_atomic_store_ptr`,
+ and `CRYPTO_atomic_cmp_exch_ptr` functions to `libcrypto`, that implement
+ the respective atomic operations with a locking-based fallback on platforms
+ that do not support them.
- *Tong Li*
+ *Neil Horman*
- * Updated header files to reflect modern development practices: all include
- files now have header guards and they are self-contained (they include all
- dependencies they need to be included on their own).
+ * Added `EVP_EC_affine2oct()` function, that converts the affine coordinates
+ of an EC point to an octet string conforming
+ to [Section 2.3.4 of SECG SEC 1][SECG SEC 1 Section 2.3.4] ("Elliptic Curve
+ Cryptography") standard.
- *Bob Beck*
+ *Igor Ustinov*
- * Deprecated `ASN1_STRING_set()` and `ASN1_STRING_length()`. The replacement
- functions `ASN1_STRING_set1_data()` or `ASN1_STRING_set1_string()`,
- and `ASN1_STRING_get_length()` should be used in their place. This prepares
- the `ASN1_STRING` type to support modern `size_t` length values
- in the future.
+ * Added `EVP_KDF_CTX_get0_kdf()` and `EVP_KDF_CTX_get1_kdf()` functions
+ as a replacement for the now deprecated `EVP_KDF_CTX_kdf()`.
- *Bob Beck*
+ *Leon Timmermans*
- * Deprecated `EVP_CIPHER_CTX_get_num()` and `EVP_CIPHER_CTX_set_num()`
- functions. Refer to `ossl-migration-guide(7)` for more info.
+ * Added `ASN1_STRING_new_not_owned()` function to `libcrypto`. It provides
+ the ability to construct an `ASN1_STRING` with data for which ownership
+ is not taken by the created `ASN1_STRING` object.
- *Shane Lontis*
+ *Bob Beck*
- * Deprecated `ASN1_BIT_STRING_name_print()`, `ASN1_BIT_STRING_num_asc()`,
- and `ASN1_BIT_STRING_set_asc()` functions. Refer to the manual
- pages for more information.
+ * Added `CMS_add_standard_smimecap_ex()` API function, which populates
+ an `SMIMECapabilities` list using `EVP_CIPHER_fetch()` and `EVP_MD_fetch()`
+ so that only algorithms available in the active providers are advertised.
+ `PKCS7_sign_add_signer()` was updated in the same way, so that legacy
+ ciphers, such as RC2 and DES, are no longer included in `SMIMECapabilities`
+ by default when only the default provider is loaded.
- *Bob Beck*
+ *Todd Short*
- * Added `CRYPTO_atomic_load_ptr`, `CRYPTO_atomic_store_ptr`,
- and `CRYPTO_atomic_cmp_exch_ptr` functions to `libcrypto`, that implement
- the respective atomic operations with a locking-based fallback on platforms
- that do not support them.
+ * Added `CTLOG_STORE_add0_log()` function to add individual CT logs
+ to a `CTLOG_STORE`.
- *Neil Horman*
+ *Tim Perry*
- * Added ability to utilise memory-mapped I/O when reading raw input
- from a file for one-shot sign/verify operations (such as Ed25519,
- Ed448, and ML-DSA) to `openssl pkeyutl` command on platforms
- that support it (Unix-like). The `openssl dgst` command uses the same
- approach for one-shot sign/verify when the input is from a file, removing
- the previous 16 MB limit for file-based input. This improves performance
- and supports large files without doubling memory use. Other platforms
- and `stdin` input continue to use the existing buffer-based implementation.
+ * Added `FIPS_mode()` macro as a convenience alias
+ to `EVP_default_properties_is_fips_enabled(NULL)`, which is a shorthand
+ to check whether the `fips=yes` property is currently enabled in the default
+ library context.
- *John Claus*
+ *Dimitri John Ledkov*
- * Deprecated `X509_check_host()`, `X509_check_email()`, `X509_check_ip()`,
- and `X509_check_ip_asc()` functions. Applications should migrate to setting
- a reference identifier to check using `X509_VERIFY_PARAM_set1_host()`,
- `X509_VERIFY_PARAM_set1_email()`, or `X509_VERIFY_PARAM_set1_ip_asc()`,
- and using `X509_verify_cert()`.
+ * Refactored remaining cipher `OSSL_PARAM` name parsing so that automatically
+ generated parsers are used instead of `OSSL_PARAM_locate()` calls.
+ This should ensure that the list of acceptable parameters better matches
+ those which are actually processed. It should also provide a small
+ performance improvement, because repeated iteration over passed parameter
+ arrays is avoided.
- *Bob Beck*
+ *Dr Paul Dale*
- * Added `ASN1_STRING_new_not_owned()` function to `libcrypto`. It provides
- the ability to construct an `ASN1_STRING` with data for which ownership
- is not taken by the created `ASN1_STRING` object.
+ * Improved interoperability with TPM 1.2 Endorsement Key certificates
+ per [TCG Credential Profiles specification Version 1.2, Section 3.2.7]:
+ `SubjectPublicKeyInfo` blobs whose `AlgorithmIdentifier` uses
+ `id-RSAES-OAEP` (`NID_rsaesOaep`, 1.2.840.113549.1.1.7) with a plain
+ `RSAPublicKey` body are now decoded as RSA keys. The OAEP
+ `AlgorithmIdentifier` parameters are not interpreted.
- *Bob Beck*
+ *Craig Lorentzen*
- * Fixed X.509 verification of certificate chains that use DSA signatures
- with SHA-384 or SHA-512 by registering `dsa_with_SHA384` and
- `dsa_with_SHA512` in the signature-algorithm cross-reference table.
+ * Do not issue TLS 1.3 session tickets if the server has explicitly disabled
+ them via `SSL_OP_NO_TICKET` and also turned off the session cache with
+ `SSL_SESS_CACHE_OFF`. Both conditions together indicate a clear intent to
+ suppress resumption, so sending `NewSessionTicket` messages would be wasteful
+ and misleading. TLS 1.3 client that does not send the `psk_key_exchange_modes`
+ extension, or that sends it together with [RFC 9149] parameters such as
+ `new_session_count = 0` or `resumption_count = 0`, is effectively signaling
+ no interest in session tickets and session resumption.
- *John Claus*
+ *Daniel Kubec*
- * Added AVX2-optimized ML-DSA NTT operations on `x86_64`.
+ * Improved DTLS handshake robustness under UDP reordering by buffering
+ and replaying early `ChangeCipherSpec` (CCS) records at the expected state.
- *Marcel Cornu and Tomasz Kantecki*
+ *Tong Li*
* Updated X.509 certificate verification to no longer consult the subject
distinguished name (DN) by default. Previously, when a certificate contained
@@ -362,120 +277,205 @@ OpenSSL 4.1
*Bob Beck*
- * Added `CMS_VERIFY_PARTIAL` flag to `CMS_verify()`, `-verify_partial`
- option to `openssl cms -verify` operation,
- and `CMS_SignerInfo_get_verification_result()`
- and `CMS_SignerInfo_get0_signer_cert()` functions.
+ * Added various optimizations for the Elbrus2000 architecture
+ in the cryptographic and BN code.
- If the `CMS_VERIFY_PARTIAL` flag is set, the `CMS_verify()` call
- is successful if at least one of the individual signatures can be verified
- (as opposed to all of them), which may be useful to gracefully handle various
- situations, like missing CAs, expired certificates, or unsupported
- algorithms; applications can call `CMS_get0_signers()` to check if the set
- of valid signatures satisfies its policy, or use
- `CMS_SignerInfo_get_verification_result()`
- and `CMS_SignerInfo_get0_signer_cert()` functions to access the detailed
- verification results.
+ *Gleb Popov*
- *Jan Lübbe*
+ * Declared support for AArch64 Guarded Control Stack (GCS) in assembly code.
- * Changed the output of the `-disabled` option for the `openssl list` command
- to display disabled features, protocols, and algorithms, in relevant
- sections.
+ When building with compilers that support GCS (Clang 18+, GCC 15+),
+ assembly modules are marked as compatible when branch protection
+ is enabled (e.g. `-mbranch-protection=standard`). No functional changes
+ to the assembly implementations are required, but compliance ensures
+ correct operation with shadow stack enforcement.
- *Paul Louvel*
+ *Guillaume Gardet and Gowtham Suresh Kumar*
- * Added `CTLOG_STORE_add0_log()` function to add individual CT logs
- to a `CTLOG_STORE`.
+ * Added optimized ML-DSA NTT operations on `s390x`
+ (or other architectures with 128 bit vector registers).
- *Tim Perry*
+ *Timo Keller*
- * Dropped `no-ecdsa` and `no-ecdh` options from `Configure`, as these options
- did not really disable the implementations. Use `no-ec` to disable
- the elliptic curve support.
+ * Added AVX2-optimized ML-DSA NTT operations on `x86_64`.
- *Tomáš Mráz*
+ *Marcel Cornu and Tomasz Kantecki*
- * Added `EVP_EC_affine2oct()` function, that converts the affine coordinates
- of an EC point to an octet string conforming
- to [Section 2.3.4 of SECG SEC 1][SECG SEC 1 Section 2.3.4] ("Elliptic Curve
- Cryptography") standard.
+ * Added AVX-512-optimized SHAKE x4 operations for ML-DSA on `x86_64`.
- *Igor Ustinov*
+ *Marcel Cornu and Tomasz Kantecki*
- * Implemented an ability to configure additional QUIC transport parameters
- via the `SSL_get_value_uint()`/`SSL_set_value_uint()` functions:
- `max_udp_payload_size`, `initial_max_data`,
- `initial_max_stream_data_bidi_local`, `initial_max_stream_data_uni`,
- `ack_delay_exponent`, and `max_ack_delay`.
+ * Added AVX-512 and VAES optimizations for AES-CBC decryption. Decryption
+ performance for large inputs (1024 bytes or more) improved by 3.5x to 3.8x.
- *Nikolas Gauder*
+ *Madan Mohan Manokar*
- * Added a new verification error, `X509_V_ERR_DUPLICATE_EXTENSION`,
- with a descriptive message for certificates containing duplicate X.509
- extensions, which are explicitly prohibited by [RFC 5280].
+ * Added `VC-WIN32-MSVC2013` and `VC-WIN64A-MSVC2013` build targets to provide
+ internal functions for bridging the gaps in C99 standard support
+ that are present in MSVC 2013.
+
+ *Bob Beck*
+
+ * Added unit tests setup activated via `enable-unit-tests` option. This works
+ only on platforms with ld `--wrap` support (Linux, BSD).
+
+ *Jakub Zelenka*
+
+ * Added test framework for testing function memory allocation failures.
+
+ *Jakub Zelenka*
+
+ * Updated header files to reflect modern development practices: all include
+ files now have header guards and they are self-contained (they include all
+ dependencies they need to be included on their own).
+
+ *Bob Beck*
+
+ * Fixed a bug where a TLS 1.3 session ticket could retain a stale ALPN
+ protocol from an earlier connection after a resumption negotiated
+ a different protocol (or none), on both the server and the client,
+ which could otherwise affect a later 0-RTT decision.
+
+ *Daniel Kubec and Viktor Dukhovni*
+
+ * Fixed `SSL_listen_ex()` to correctly adopt a QUIC connection and to preserve
+ queued connections on allocation failure. Invalid arguments, including
+ non-QUIC SSL objects, and internal failures now return `-1`, reserving `0`
+ for "no connection available".
+
+ *Mounir IDRASSI*
+
+ * Fixed QUIC child objects to inherit the effective flags of their explicit
+ event domain. `SSL_get0_domain()` now reports that domain for connections
+ and streams in the hierarchy.
+
+ *Mounir IDRASSI*
+
+ * Fixed TLS 1.3 clients to encrypt 0-RTT early data with the first offered
+ PSK identity ([RFC 9846 Section 4.3.10]) when a 0-RTT-capable resumption
+ ticket has aged out and an external PSK is offered in its place. The early
+ data was being encrypted with the retired ticket's secret, rather than
+ the external PSK's, causing the server to reject it with a bad record MAC.
+
+ *Viktor Dukhovni*
+
+ * Fixed TLS 1.3 servers to reject early data when a resumed PSK's
+ ticket age is outside tolerance, per [RFC 9846], instead of accepting
+ 0-RTT data from a ticket that has aged out.
*Daniel Kubec*
- * Deprecated `CMS_stream()` and `PKCS7_stream()` functions. These are internal
- plumbing that leaked into the public API, and no longer return a streaming
- boundary. Use `BIO_new_CMS()` or `BIO_new_PKCS7()` to stream CMS and PKCS#7
- content.
+ * Fixed TLS 1.3 external PSK connections being wrongly rejected when
+ the client sets a non-empty session ID context.
+
+ *Viktor Dukhovni*
+
+ * Fixed a TLS 1.3 server with no session ID context to accept external PSK
+ connections and to stop issuing unusable session tickets.
+
+ *Viktor Dukhovni*
+
+ * Fixed TLS 1.3 servers to reject early data when the selected ciphersuite
+ differs from the ciphersuite associated with the selected PSK. Same-hash
+ PSK resumption can still continue without accepting 0-RTT data.
+
+ *Mounir IDRASSI*
+
+ * Fixed X.509v3 extension configuration parsing to reject repeated fields
+ in the `basicConstraints`, `basicAttConstraints`, and `policyConstraints`
+ X.509v3 extension configurations, instead of silently using the last value.
+
+ *Adam Tabak*
+
+ * Fixed X.509 verification of certificate chains that use DSA signatures
+ with SHA-384 or SHA-512 by registering `dsa_with_SHA384` and
+ `dsa_with_SHA512` in the signature-algorithm cross-reference table.
+
+ *John Claus*
+
+ * TLS clients no longer send the TLS padding extension ([RFC 7685]). It was
+ only ever sent when `SSL_OP_TLSEXT_PADDING` was set, to work around
+ a `ClientHello` length bug in F5 middleboxes; the fix shipped long ago
+ and the affected hardware is long out of support, so nothing should still
+ be running the problematic version.
+ `SSL_OP_TLSEXT_PADDING` is now a no-op retained for compatibility,
+ and is no longer included in `SSL_OP_ALL`.
*Bob Beck*
- * Added `OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES` option for `OSSL_CMP_CTX`
- and a corresponding `-nonmatched_error_nonces` option for the `openssl cmp`
- command.
+ * Changed `tsget` utility to use `Net::Curl::Easy` (from the `Net-Curl` CPAN
+ distribution) instead of the abandoned `WWW::Curl::Easy`. Users who rely
+ on `tsget` should install `Net::Curl::Easy` before upgrading.
- This work was sponsored by Siemens AG.
+ *Shreenidhi Shedi*
- *David von Oheimb*
+ * Deprecated the `enable-unit-test` configure option and the
+ `SSL_test_functions()` function. Both will be removed in OpenSSL 5.0.
- * Added support for [RFC 8701] GREASE (Generate Random Extensions And Sustain
- Extensibility). When `SSL_OP_GREASE` is set, the TLS client injects
- reserved GREASE values into cipher suites, supported versions, supported
- groups, signature algorithms, key share, and extensions in the `ClientHello`
- to prevent ecosystem ossification.
- Added `-grease` option to `openssl s_client` to enable this.
+ *Jakub Zelenka*
- *William McCormack*
+ * Deprecated `BIO_snprintf()` and `BIO_vsnprintf()`. `snprintf()`, being part
+ of C99 standard, that is the baseline for OpenSSL since version 3.6,
+ is now considered universally available; moreover, the fact that `BIO_*()`
+ functions return -1 on truncation, rather than the would-have-been length,
+ makes their usage error-prone. Use `snprintf()` and `vsnprintf()` directly.
+
+ *Bob Beck*
* Deprecated undocumented public functions `UTF8_putc()` and `UTF8_getc()`,
No public replacement is planned.
*Bob Beck*
- * Added IKEV2 KDF (`EVP_KDF-IKEV2KDF`) to `EVP_KDF`.
+ * Deprecated `EVP_CIPHER_CTX_get_num()` and `EVP_CIPHER_CTX_set_num()`
+ functions. Refer to `ossl-migration-guide(7)` for more info.
- *Helen Zhang*
+ *Shane Lontis*
- * Added AVX-512 and VAES optimizations for AES-CBC decryption. Decryption
- performance for large inputs (1024 bytes or more) improved by 3.5x to 3.8x.
+ * Deprecated `ASN1_STRING_set()` and `ASN1_STRING_length()`. The replacement
+ functions `ASN1_STRING_set1_data()` or `ASN1_STRING_set1_string()`,
+ and `ASN1_STRING_get_length()` should be used in their place. This prepares
+ the `ASN1_STRING` type to support modern `size_t` length values
+ in the future.
- *Madan Mohan Manokar*
+ *Bob Beck*
+
+ * Deprecated `ASN1_BIT_STRING_name_print()`, `ASN1_BIT_STRING_num_asc()`,
+ and `ASN1_BIT_STRING_set_asc()` functions. Refer to the manual
+ pages for more information.
+
+ *Bob Beck*
* Deprecated `ASN1_BIT_STRING_set()` function in favour
of `ASN1_BIT_STRING_set1()`.
*Norbert Pócs*
- * Added optimized ML-DSA NTT operations on `s390x`
- (or other architectures with 128 bit vector registers).
+ * Deprecated `CMS_stream()` and `PKCS7_stream()` functions. These are internal
+ plumbing that leaked into the public API, and no longer return a streaming
+ boundary. Use `BIO_new_CMS()` or `BIO_new_PKCS7()` to stream CMS and PKCS#7
+ content.
- *Timo Keller*
+ *Bob Beck*
- * Added `EVP_KDF_CTX_get0_kdf()` and `EVP_KDF_CTX_get1_kdf()` functions
- as a replacement for the now deprecated `EVP_KDF_CTX_kdf()`.
+ * Deprecated `X509_check_host()`, `X509_check_email()`, `X509_check_ip()`,
+ and `X509_check_ip_asc()` functions. Applications should migrate to setting
+ a reference identifier to check using `X509_VERIFY_PARAM_set1_host()`,
+ `X509_VERIFY_PARAM_set1_email()`, or `X509_VERIFY_PARAM_set1_ip_asc()`,
+ and using `X509_verify_cert()`.
- *Leon Timmermans*
+ *Bob Beck*
- * Added `FIPS_mode()` macro as a convenience alias
- to `EVP_default_properties_is_fips_enabled(NULL)`, which is a shorthand
- to check whether the `fips=yes` property is currently enabled in the default
- library context.
+ * Dropped Windows-on-Itanium (`VC-WIN64I`) and Windows CE (`VC-CE`) targets
+ from Configurations.
- *Dimitri John Ledkov*
+ *Bob Beck*
+
+ * Dropped `no-ecdsa` and `no-ecdh` options from `Configure`, as these options
+ did not really disable the implementations. Use `no-ec` to disable
+ the elliptic curve support.
+
+ *Tomáš Mráz*
* Fixed CRL scope checking for certificates without a CRL distribution
points extension. A CRL having an issuing distribution point extension