On 27/09/16 08:52, REIX, Tony wrote: > Reading the 1.0.2j CHANGES file, it appears that 1.0.2 was built from > 1.0.1l. > And there are 1124 of description of the changes for 1.0.2 and about 500 > lines of changes from 1.0.1l to 1.0.1u . > And my knowledge of OpenSSL is VERY VERY small. > > Looking at 1.0.1l, out of bug fixes, I've found some changes that do not > look as bugfixes: > - *dhparam: generate 2048-bit parameters by default. (1.0.1n)* > - Reject DH handshakes with parameters shorter than 768 bits. > - In DSA_generate_parameters_ex, if the provided seed is too short, use > a random seed, as already documented. > - Reject DH handshakes with parameters shorter than 1024 bits. > - Disable SRP fake user seed to address a server memory leak. > Add a new method SRP_VBASE_get1_by_user that handles the seed properly. > - Remove LOW from the DEFAULT cipher list. This removes singles DES > from the default. > > However, only the first one, in bold, appears in 1.0.1l and NOT in 1.0.2j . That's just an omission. dhparam has generated 2048-bit parameters by default in 1.0.2 since its first release. > > > So, my question is still: > > Why OpenSSL still delivers 1.0.1* though 1.0.2* should provide the same > changes plus new features ? 1.0.1 should be binary compatible with 1.0.2 (as long as they are compiled with the same configuration options etc). However many users still prefer to use an exactly matching version. > Because change "*dhparam: generate 2048-bit parameters by default."* > appears in 1.0.1[n-l] and not in 1.0.2* ??? > > > I need to know in order to decide if I still manage 1.0.1 compatibility > in addition to delivering 1.0.2[last version] . 1.0.1 is nearing end-of-life. From the beginning of this year it has been receiving security fixes only. From the end of this year it will be out of support completely. All users should be making plans to move off of 1.0.1 if they are still using it, and transitioning to 1.0.2. This should be a very easy move. Matt
