Initialise context before using it.
(cherry picked from commit a4947e4e064d2d5bb622ac64cf13edc4a46ed196)

PBKDF2 should be efficient. Contributed by Christian Heimes
<christian@python.org>.

Fix warnings (note that gcc 4.2 has a bug that makes one of its
warnings hard to fix without major surgery).

Split PBES2 into cipher and PBKDF2 versions. This tidies the code somewhat
and is a pre-requisite to adding password based CMS support.

Audit libcrypto for unchecked return values: fix all cases enountered

If we're going to return errors (no matter how stupid), then we should
test for them!

Update obsolete email address...

Code tidy.

Extend PBE code to support non default PKCS#5 v2.0 PRFs.

Fix from 0.9.7-stable branch.

improved error checking and some fixes

PR: 1170
Submitted by: Yair Elharrar
Reviewed and edited by: Nils Larsch

Constify d2i, s2i, c2i and r2i functions and other associated
functions and macros.

This change has associated tags: LEVITTE_before_const and
LEVITTE_after_const. Those will be remo

Constify d2i, s2i, c2i and r2i functions and other associated
functions and macros.

This change has associated tags: LEVITTE_before_const and
LEVITTE_after_const. Those will be removed when this change has been
properly reviewed.

show more ...

A general spring-cleaning (in autumn) to fix up signed/unsigned warnings.
I have tried to convert 'len' type variable declarations to unsigned as a
means to address these warnings when approp

A general spring-cleaning (in autumn) to fix up signed/unsigned warnings.
I have tried to convert 'len' type variable declarations to unsigned as a
means to address these warnings when appropriate, but when in doubt I have
used casts in the comparisons instead. The better solution (that would get
us all lynched by API users) would be to go through and convert all the
function prototypes and structure definitions to use unsigned variables
except when signed is necessary. The proliferation of (signed) "int" for
strictly non-negative uses is unfortunate.

show more ...

Make sure we get the definition of OPENSSL_NO_HMAC and OPENSSL_NO_SHA.

Cleanse memory using the new OPENSSL_cleanse() function.
I've covered all the memset()s I felt safe modifying, but may have missed some.

Security fixes brought forward from 0.9.7.

Reorder inclusion of header files:

des_old.h redefines crypt:
#define crypt(b,s)\
DES_crypt((b),(s))

This scheme leads to failure, if header files with the OS's true

Reorder inclusion of header files:

des_old.h redefines crypt:
#define crypt(b,s)\
DES_crypt((b),(s))

This scheme leads to failure, if header files with the OS's true definition
of crypt() are processed _after_ des_old.h was processed. This is e.g. the
case on HP-UX with unistd.h.
As evp.h now again includes des.h (which includes des_old.h), this problem
only came up after this modification.
Solution: move header files (indirectly) including e_os.h before the header
files (indirectly) including evp.h.
Submitted by:
Reviewed by:
PR:

show more ...

Initialize cipher context in KRB5
("D. Russell" <russelld@aol.net>)

Allow HMAC functions to use an alternative ENGINE.

Improve back compatibility.

Modify EVP cipher behaviour in a similar way
to digests to retain compatibility.

Really add the EVP and all of the DES changes.

Change the EVP_somecipher() and EVP_somedigest()
functions to return constant EVP_MD and EVP_CIPHER
pointers.

Update docs.

Make all configuration macros available for application by making
sure they are available in opensslconf.h, by giving them names starting
with "OPENSSL_" to avoid conflicts with other package

Make all configuration macros available for application by making
sure they are available in opensslconf.h, by giving them names starting
with "OPENSSL_" to avoid conflicts with other packages and by making
sure e_os2.h will cover all platform-specific cases together with
opensslconf.h.

I've checked fairly well that nothing breaks with this (apart from
external software that will adapt if they have used something like
NO_KRB5), but I can't guarantee it completely, so a review of this
change would be a good thing.

show more ...

Make PKCS#12 code handle missing passwords.

Add a couple of FAQs.

NO_HMAC.