8bc643efc8
Modified version of the commit ffaef3f15 in the master branch by Stephen Henson. This makes the SSL_OP_SINGLE_DH_USE option a no-op and always generates a new DH key for every handshake regardless. This is a follow on from CVE-2016-0701. This branch is not impacted by that CVE because it does not support X9.42 style parameters. It is still possible to generate parameters based on primes that are not "safe", although by default OpenSSL does not do this. The documentation does sign post that using such parameters is unsafe if the private DH key is reused. However to avoid accidental problems or future attacks this commit has been backported to this branch. Issue reported by Antonio Sanso Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
apps/openssl.pod .... Documentation of OpenSSL `openssl' command
crypto/crypto.pod ... Documentation of OpenSSL crypto.h+libcrypto.a
ssl/ssl.pod ......... Documentation of OpenSSL ssl.h+libssl.a
openssl.txt ......... Assembled documentation files for OpenSSL [not final]
ssleay.txt .......... Assembled documentation of ancestor SSLeay [obsolete]
standards.txt ....... Assembled pointers to standards, RFCs or internet drafts
that are related to OpenSSL.
An archive of HTML documents for the SSLeay library is available from
http://www.columbia.edu/~ariel/ssleay/