openssl/doc, branch OpenSSL_1_0_2b

Explicitly mention PKCS5_PBKDF2_HMAC in EVP doc.

2015-06-09T00:21:23Z

Signed-off-by: Rich Salz Reviewed-by: Matt Caswell (cherry picked from commit 82c4d793181058de9fde5c9088fd400fdb7e01e3)

PEM doc fixes

2015-05-28T17:01:52Z

Reviewed-by: Rich Salz (cherry picked from commit f097f81c891bb1f479426d8ac9c9541390334983)

Remove export static DH ciphersuites

2015-05-22T23:01:45Z

Remove support for the two export grade static DH ciphersuites. These two ciphersuites were newly added (along with a number of other static DH ciphersuites) to 1.0.2. However the two export ones have *never* worked since they were introduced. It seems strange in any case to be adding new export ciphersuites, and given "logjam" it also does not seem correct to fix them. Reviewed-by: Richard Levitte (cherry picked from commit 13f8eb4730b9fc039e743870f81e5ff54b3d05b8) Conflicts: CHANGES

Fix off-by-one in BN_rand

2015-05-22T22:43:07Z

If BN_rand is called with |bits| set to 1 and |top| set to 1 then a 1 byte buffer overflow can occur. There are no such instances within the OpenSSL at the moment. Thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke, Filip Palian for discovering and reporting this issue. Reviewed-by: Kurt Roeckx

Reject negative shifts for BN_rshift and BN_lshift

2015-05-22T22:19:34Z

The functions BN_rshift and BN_lshift shift their arguments to the right or left by a specified number of bits. Unpredicatable results (including crashes) can occur if a negative number is supplied for the shift value. Thanks to Mateusz Kocielski (LogicalTrust), Marek Kroemeke and Filip Palian for discovering and reporting this issue. Reviewed-by: Kurt Roeckx (cherry picked from commit 7cc18d8158b5fc2676393d99b51c30c135502107) Conflicts: crypto/bn/bn.h crypto/bn/bn_err.c

Update documentation with Diffie-Hellman best practices.

2015-05-20T12:54:51Z

- Do not advise generation of DH parameters with dsaparam to save computation time. - Promote use of custom parameters more, and explicitly forbid use of built-in parameters weaker than 2048 bits. - Advise the callback to ignore - it is currently called with 1024 bits, but this value can and should be safely ignored by servers. Reviewed-by: Rich Salz

dhparam: fix documentation

2015-05-20T12:54:51Z

The default bitlength is now 2048. Also clarify that either the number of bits or the generator must be present: $ openssl dhparam -2 and $ openssl dhparam 2048 generate parameters but $ openssl dhparam does not. Reviewed-by: Matt Caswell

RT1207: document SSL_COMP_free_compression_methods.

2015-05-13T17:03:32Z

Reviewed-by: Matt Caswell (cherry picked from commit c490a5512e988559a830c15b8efb1d0376f2e282)

Add documentation for the -no_alt_chains option for various apps, as well as

2015-04-20T12:42:17Z

the X509_V_FLAG_NO_ALT_CHAINS flag. Conflicts: doc/apps/cms.pod doc/apps/ocsp.pod doc/apps/s_client.pod doc/apps/s_server.pod doc/apps/smime.pod doc/apps/verify.pod Reviewed-by: Rich Salz

Configuration file examples.

2015-03-24T12:27:13Z

Reviewed-by: Matt Caswell (cherry picked from commit 7b68c30da01b4eedcd546f81844156646387cacb)