1 *** Notes, Please read ***
4 CyaSSL now needs all examples and tests to be run from the CyaSSL home
5 directory. This is because it finds certs and keys from ./certs/. Trying to
6 maintain the ability to run each program from its own directory, the testsuite
7 directory, the main directory (for make check/test), and for the various
8 different project layouts (with or without config) was becoming harder and
9 harder. Now to run testsuite just do:
15 make test (when using autoconf)
17 On *nix or Windows the examples and testsuite will check to see if the current
18 directory is the source directory and if so, attempt to change to the CyaSSL
19 home directory. This should work in most setup cases, if not, just follow the
20 beginning of the note and specify the full path.
24 CyaSSL takes a different approach to certificate verification than OpenSSL does.
25 The default policy for the client is to verify the server, this means that if
26 you don't load CAs to verify the server you'll get a connect error, unable to
27 verify (-155). It you want to mimic OpenSSL behavior of having SSL_connect
28 succeed even if verifying the server fails and reducing security you can do
31 SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
33 before calling SSL_new(); Though it's not recommended.
37 CyaSSL Release 2.2.0 (5/18/2012)
39 Release 2.2.0 CyaSSL has bug fixes and a few new features including:
40 - Initial CRL support (--enable-crl)
41 - Initial OCSP support (--enable-ocsp)
42 - Add static ECDH suites
44 - ECC client certificate support
45 - Add medium session cache size (1055 sessions)
47 - Protection against mutex reinitialization
50 The CyaSSL manual is available at:
51 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
52 and comments about the new features please check the manual.
56 ***************CyaSSL Release 2.0.8 (2/24/2012)
58 Release 2.0.8 CyaSSL has bug fixes and a few new features including:
59 - A fix for malicious certificates pointed out by Remi Gacogne (thanks)
60 resulting in NULL pointer use.
61 - Respond to renegotiation attempt with no_renegoatation alert
62 - Add basic path support for load_verify_locations()
63 - Add set Temp EC-DHE key size
64 - Extra checks on rsa test when porting into
67 The CyaSSL manual is available at:
68 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
69 and comments about the new features please check the manual.
73 ************* CyaSSL Release 2.0.6 (1/27/2012)
75 Release 2.0.6 CyaSSL has bug fixes and a few new features including:
76 - Fixes for CA basis constraint check
77 - CTX reference counting
78 - Initial unit test additions
79 - Lean and Mean Windows fix
82 - Ability to group handshake messages with set_group_messages(ctx/ssl)
83 - CA cache addition callback
84 - Export Base64_Encode for general use
86 The CyaSSL manual is available at:
87 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
88 and comments about the new features please check the manual.
92 ************* CyaSSL Release 2.0.2 (12/05/2011)
94 Release 2.0.2 CyaSSL has bug fixes and a few new features including:
95 - CTaoCrypt Runtime library detection settings when directly using the crypto
97 - Default certificate generation now uses SHAwRSA and adds SHA256wRSA generation
98 - All test certificates now use 2048bit and SHA-1 for better modern browser
100 - Direct AES block access and AES-CTR (counter) mode
101 - Microchip pic32 support
103 The CyaSSL manual is available at:
104 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
105 and comments about the new features please check the manual.
109 ************* CyaSSL Release 2.0.0rc3 (9/28/2011)
111 Release 2.0.0rc3 for CyaSSL has bug fixes and a few new features including:
112 - updated autoconf support
113 - better make install and uninstall (uses system directories)
114 - make test / make check
115 - CyaSSL headers now in <cyassl/*.h>
116 - CTaocrypt headers now in <cyassl/ctaocrypt/*.h>
117 - OpenSSL compatibility headers now in <cyassl/openssl/*.h>
118 - examples and tests all run from home diretory so can use certs in ./certs
121 So previous applications that used the OpenSSL compatibility header
122 <openssl/ssl.h> now need to include <cyassl/openssl/ssl.h> instead, no other
123 changes are required.
125 Special Thanks to Brian Aker for his autoconf, install, and header patches.
127 The CyaSSL manual is available at:
128 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
129 and comments about the new features please check the manual.
131 ************CyaSSL Release 2.0.0rc2 (6/6/2011)
133 Release 2.0.0rc2 for CyaSSL has bug fixes and a few new features including:
134 - bug fixes (Alerts, DTLS with DHE)
137 - Wshadow warnings removed
139 - CTaoCrypt public headers now all have ctc_ prefix (the manual is still being
140 updated to relfect this change)
143 This is the 2nd and perhaps final release candidate for version 2.
144 Please send any comments or questions to support@yassl.com.
146 The CyaSSL manual is available at:
147 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
148 and comments about the new features please check the manual.
150 ***********CyaSSL Release 2.0.0rc1 (5/2/2011)
152 Release 2.0.0rc1 for CyaSSL has many new features including:
154 - SHA-256 cipher suites
155 - Root Certificate Verification (instead of needing all certs in the chain)
156 - PKCS #8 private key encryption (supports PKCS #5 v1-v2 and PKCS #12)
157 - Serial number retrieval for x509
158 - PBKDF2 and PKCS #12 PBKDF
159 - UID parsing for x509
160 - SHA-256 certificate signatures
161 - Client and server can send chains (SSL_CTX_use_certificate_chain_file)
162 - CA loading can now parse multiple certificates per file
163 - Dynamic memory runtime hooks
164 - Runtime hooks for logging
166 - More informative error codes
167 - More informative logging messages
168 - Version downgrade more robust (use SSL_v23*)
169 - Shared build only by default through ./configure
170 - Compiler visibility is now used, internal functions not polluting namespace
171 - Single Makefile, no recursion, for faster and simpler building
172 - Turn on all warnings possible build option, warning fixes
175 Because of all the new features and the multiple OS, compiler, feature-set
176 options that CyaSSL allows, there may be some configuration fixes needed.
177 Please send any comments or questions to support@yassl.com.
179 The CyaSSL manual is available at:
180 http://www.yassl.com/documentation/CyaSSL-Manual.pdf. For build instructions
181 and comments about the new features please check the manual.
183 ****************** CyaSSL Release 1.9.0 (3/2/2011)
185 Release 1.9.0 for CyaSSL adds bug fixes, improved TLSv1.2 through testing and
186 better hash/sig algo ids, --enable-webServer for the yaSSL embedded web server,
187 improper AES key setup detection, user cert verify callback improvements, and
190 The CyaSSL manual offering is included in the doc/ directory. For build
191 instructions and comments about the new features please check the manual.
193 Please send any comments or questions to support@yassl.com.
195 ****************** CyaSSL Release 1.8.0 (12/23/2010)
197 Release 1.8.0 for CyaSSL adds bug fixes, x509 v3 CA signed certificate
198 generation, a C standard library abstraction layer, lower memory use, increased
199 portability through the os_settings.h file, and the ability to use NTRU cipher
200 suites when used in conjunction with an NTRU license and library.
202 The initial CyaSSL manual offering is included in the doc/ directory. For
203 build instructions and comments about the new features please check the manual.
205 Please send any comments or questions to support@yassl.com.
210 ********************* CyaSSL Release 1.6.5 (9/9/2010)
212 Release 1.6.5 for CyaSSL adds bug fixes and x509 v3 self signed certificate
215 For general build instructions see doc/Building_CyaSSL.pdf.
217 To enable certificate generation support add this option to ./configure
218 ./configure --enable-certgen
220 An example is included in ctaocrypt/test/test.c and documentation is provided
221 in doc/CyaSSL_Extensions_Reference.pdf item 11.
223 ********************** CyaSSL Release 1.6.0 (8/27/2010)
225 Release 1.6.0 for CyaSSL adds bug fixes, RIPEMD-160, SHA-512, and RSA key
228 For general build instructions see doc/Building_CyaSSL.pdf.
230 To add RIPEMD-160 support add this option to ./configure
231 ./configure --enable-ripemd
233 To add SHA-512 support add this option to ./configure
234 ./configure --enable-sha512
236 To add RSA key generation support add this option to ./configure
237 ./configure --enable-keygen
239 Please see ctaocrypt/test/test.c for examples and usage.
241 For Windows, RIPEMD-160 and SHA-512 are enabled by default but key generation is
242 off by default. To turn key generation on add the define CYASSL_KEY_GEN to
246 ************* CyaSSL Release 1.5.6 (7/28/2010)
248 Release 1.5.6 for CyaSSL adds bug fixes, compatibility for our JSSE provider,
249 and a fix for GCC builds on some systems.
251 For general build instructions see doc/Building_CyaSSL.pdf.
253 To add AES-NI support add this option to ./configure
254 ./configure --enable-aesni
256 You'll need GCC 4.4.3 or later to make use of the assembly.
258 ************** CyaSSL Release 1.5.4 (7/7/2010)
260 Release 1.5.4 for CyaSSL adds bug fixes, support for AES-NI, SHA1 speed
261 improvements from loop unrolling, and support for the Mongoose Web Server.
263 For general build instructions see doc/Building_CyaSSL.pdf.
265 To add AES-NI support add this option to ./configure
266 ./configure --enable-aesni
268 You'll need GCC 4.4.3 or later to make use of the assembly.
270 *************** CyaSSL Release 1.5.0 (5/11/2010)
272 Release 1.5.0 for CyaSSL adds bug fixes, GoAhead WebServer support, sniffer
273 support, and initial swig interface support.
275 For general build instructions see doc/Building_CyaSSL.pdf.
277 To add support for GoAhead WebServer either --enable-opensslExtra or if you
278 don't want all the features of opensslExtra you can just define GOAHEAD_WS
279 instead. GOAHEAD_WS can be added to ./configure with CFLAGS=-DGOAHEAD_WS or
280 you can define it yourself.
282 To look at the sniffer support please see the sniffertest app in
283 sslSniffer/sslSnifferTest. Build with --enable-sniffer on *nix or use the
284 vcproj files on windows. You'll need to have pcap installed on *nix and
287 A swig interface file is now located in the swig directory for using Python,
288 Java, Perl, and others with CyaSSL. This is initial support and experimental,
289 please send questions or comments to support@yassl.com.
291 When doing load testing with CyaSSL, on the echoserver example say, the client
292 machine may run out of tcp ephemeral ports, they will end up in the TIME_WAIT
293 queue, and can't be reused by default. There are generally two ways to fix
294 this. 1) Reduce the length sockets remain on the TIME_WAIT queue or 2) Allow
295 items on the TIME_WAIT queue to be reused.
298 To reduce the TIME_WAIT length in OS X to 3 seconds (3000 milliseconds)
300 sudo sysctl -w net.inet.tcp.msl=3000
304 sudo sysctl -w net.ipv4.tcp_tw_reuse=1
306 allows reuse of sockets in TIME_WAIT
308 sudo sysctl -w net.ipv4.tcp_tw_recycle=1
310 works but seems to remove sockets from TIME_WAIT entirely?
312 sudo sysctl -w net.ipv4.tcp_fin_timeout=1
314 doen't control TIME_WAIT, it controls FIN_WAIT(2) contrary to some posts
317 ******************** CyaSSL Release 1.4.0 (2/18/2010)
319 Release 1.3.0 for CyaSSL adds bug fixes, better multi TLS/SSL version support
320 through SSLv23_server_method(), and improved documentation in the doc/ folder.
322 For general build instructions doc/Building_CyaSSL.pdf.
324 ******************** CyaSSL Release 1.3.0 (1/21/2010)
326 Release 1.3.0 for CyaSSL adds bug fixes, a potential security problem fix,
327 better porting support, removal of assert()s, and a complete THREADX port.
329 For general build instructions see rc1 below.
331 ******************** CyaSSL Release 1.2.0 (11/2/2009)
333 Release 1.2.0 for CyaSSL adds bug fixes and session negotiation if first use is
336 For general build instructions see rc1 below.
338 ******************** CyaSSL Release 1.1.0 (9/2/2009)
340 Release 1.1.0 for CyaSSL adds bug fixes, a check against malicious session
341 cache use, support for lighttpd, and TLS 1.2.
343 To get TLS 1.2 support please use the client and server functions:
345 SSL_METHOD *TLSv1_2_server_method(void);
346 SSL_METHOD *TLSv1_2_client_method(void);
348 CyaSSL was tested against lighttpd 1.4.23. To build CyaSSL for use with
349 lighttpd use the following commands from the CyaSSL install dir <CyaSSLDir>:
351 ./configure --disable-shared --enable-opensslExtra --enable-fastmath --without-zlib
356 Then to build lighttpd with CyaSSL use the following commands from the
357 lighttpd install dir:
359 ./configure --with-openssl --with-openssl-includes=<CyaSSLDir>/include --with-openssl-libs=<CyaSSLDir>/lib LDFLAGS=-lm
363 On some systems you may get a linker error about a duplicate symbol for
364 MD5_Init or other MD5 calls. This seems to be caused by the lighttpd src file
365 md5.c, which defines MD5_Init(), and is included in liblightcomp_la-md5.o.
366 When liblightcomp is linked with the SSL_LIBs the linker may complain about
367 the duplicate symbol. This can be fixed by editing the lighttpd src file md5.c
368 and adding this line to the beginning of the file:
372 and this line to the end of the file
376 Then from the lighttpd src dir do a:
382 If you get link errors about undefined symbols more than likely the actual
383 OpenSSL libraries are found by the linker before the CyaSSL openssl-links that
384 point to the CyaSSL library, causing the linker confusion. This can be fixed
385 by editing the Makefile in the lighttpd src directory and changing the line:
387 SSL_LIB = -lssl -lcrypto
393 Then from the lighttpd src dir do a:
398 This should remove any confusion the linker may be having with missing symbols.
400 For any questions or concerns please contact support@yassl.com .
402 For general build instructions see rc1 below.
404 ******************CyaSSL Release 1.0.6 (8/03/2009)
406 Release 1.0.6 for CyaSSL adds bug fixes, an improved session cache, and faster
407 math with a huge code option.
409 The session cache now defaults to a client mode, also good for embedded servers.
410 For servers not under heavy load (less than 200 new sessions per minute), define
411 BIG_SESSION_CACHE. If the server will be under heavy load, define
414 There is now a fasthugemath option for configure. This enables fastmath plus
415 even faster math by greatly increasing the code size of the math library. Use
416 the benchmark utility to compare public key operations.
419 For general build instructions see rc1 below.
421 ******************CyaSSL Release 1.0.3 (5/10/2009)
423 Release 1.0.3 for CyaSSL adds bug fixes and add increased support for OpenSSL
424 compatibility when building other applications.
426 Release 1.0.3 includes an alpha release of DTLS for both client and servers.
427 This is only for testing purposes at this time. Rebroadcast and reordering
428 aren't fully implemented at this time but will be for the next release.
430 For general build instructions see rc1 below.
432 ******************CyaSSL Release 1.0.2 (4/3/2009)
434 Release 1.0.2 for CyaSSL adds bug fixes for a couple I/O issues. Some systems
435 will send a SIGPIPE on socket recv() at any time and this should be handled by
436 the application by turning off SIGPIPE through setsockopt() or returning from
439 Release 1.0.2 includes an alpha release of DTLS for both client and servers.
440 This is only for testing purposes at this time. Rebroadcast and reordering
441 aren't fully implemented at this time but will be for the next release.
443 For general build instructions see rc1 below.
445 *****************CyaSSL Release Candidiate 3 rc3-1.0.0 (2/25/2009)
448 Release Candidate 3 for CyaSSL 1.0.0 adds bug fixes and adds a project file for
449 iPhone development with Xcode. cyassl-iphone.xcodeproj is located in the root
450 directory. This release also includes a fix for supporting other
451 implementations that bundle multiple messages at the record layer, this was
452 lost when cyassl i/o was re-implemented but is now fixed.
454 For general build instructions see rc1 below.
456 *****************CyaSSL Release Candidiate 2 rc2-1.0.0 (1/21/2009)
459 Release Candidate 2 for CyaSSL 1.0.0 adds bug fixes and adds two new stream
460 ciphers along with their respective cipher suites. CyaSSL adds support for
461 HC-128 and RABBIT stream ciphers. The new suites are:
463 TLS_RSA_WITH_HC_128_CBC_SHA
464 TLS_RSA_WITH_RABBIT_CBC_SHA
466 And the corresponding cipher names are
471 CyaSSL also adds support for building with devkitPro for PPC by changing the
472 library proper to use libogc. The examples haven't been changed yet but if
473 there's interest they can be. Here's an example ./configure to build CyaSSL
476 ./configure --disable-shared CC=/pathTo/devkitpro/devkitPPC/bin/powerpc-gekko-gcc --host=ppc --without-zlib --enable-singleThreaded RANLIB=/pathTo/devkitpro/devkitPPC/bin/powerpc-gekko-ranlib CFLAGS="-DDEVKITPRO -DGEKKO"
478 For linking purposes you'll need
480 LDFLAGS="-g -mrvl -mcpu=750 -meabi -mhard-float -Wl,-Map,$(notdir $@).map"
482 For general build instructions see rc1 below.
485 ********************CyaSSL Release Candidiate 1 rc1-1.0.0 (12/17/2008)
488 Release Candidate 1 for CyaSSL 1.0.0 contains major internal changes. Several
489 areas have optimization improvements, less dynamic memory use, and the I/O
490 strategy has been refactored to allow alternate I/O handling or Library use.
491 Many thanks to Thierry Fournier for providing these ideas and most of the work.
493 Because of these changes, this release is only a candidate since some problems
494 are probably inevitable on some platform with some I/O use. Please report any
495 problems and we'll try to resolve them as soon as possible. You can contact us
496 at support@yassl.com or todd@yassl.com.
498 Using TomsFastMath by passing --enable-fastmath to ./configure now uses assembly
499 on some platforms. This is new so please report any problems as every compiler,
500 mode, OS combination hasn't been tested. On ia32 all of the registers need to
501 be available so be sure to pass these options to CFLAGS:
503 CFLAGS="-O3 -fomit-frame-pointer"
505 OS X will also need -mdynamic-no-pic added to CFLAGS
507 Also if you're building in shared mode for ia32 you'll need to pass options to
508 LDFLAGS as well on OS X:
510 LDFLAGS=-Wl,-read_only_relocs,warning
512 This gives warnings for some symbols but seems to work.
515 --To build on Linux, Solaris, *BSD, Mac OS X, or Cygwin:
520 from the ./testsuite/ directory run ./testsuite
522 to make a debug build:
524 ./configure --enable-debug --disable-shared
531 Choose (Re)Build All from the project workspace
533 Run the testsuite program
539 *************************CyaSSL version 0.9.9 (7/25/2008)
541 This release of CyaSSL adds bug fixes, Pre-Shared Keys, over-rideable memory
542 handling, and optionally TomsFastMath. Thanks to Moisés Guimarães for the
543 work on TomsFastMath.
545 To optionally use TomsFastMath pass --enable-fastmath to ./configure
546 Or define USE_FAST_MATH in each project from CyaSSL for MSVC.
548 Please use the benchmark routine before and after to see the performance
549 difference, on some platforms the gains will be little but RSA encryption
550 always seems to be faster. On x86-64 machines with GCC the normal math library
551 may outperform the fast one when using CFLAGS=-m64 because TomsFastMath can't
552 yet use -m64 because of GCCs inability to do 128bit division.
554 **** UPDATE GCC 4.2.1 can now do 128bit division ***
556 See notes below (0.2.0) for complete build instructions.
559 ****************CyaSSL version 0.9.8 (5/7/2008)
561 This release of CyaSSL adds bug fixes, client side Diffie-Hellman, and better
564 See notes below (0.2.0) for complete build instructions.
567 ****************CyaSSL version 0.9.6 (1/31/2008)
569 This release of CyaSSL adds bug fixes, increased session management, and a fix
572 See notes below (0.2.0) for complete build instructions.
575 ****************CyaSSL version 0.9.0 (10/15/2007)
577 This release of CyaSSL adds bug fixes, MSVC 2005 support, GCC 4.2 support,
578 IPV6 support and test, and new test certificates.
580 See notes below (0.2.0) for complete build instructions.
583 ****************CyaSSL version 0.8.0 (1/10/2007)
585 This release of CyaSSL adds increased socket support, for non-blocking writes,
586 connects, and interrupted system calls.
588 See notes below (0.2.0) for complete build instructions.
591 ****************CyaSSL version 0.6.3 (10/30/2006)
593 This release of CyaSSL adds debug logging to stderr to aid in the debugging of
594 CyaSSL on systems that may not provide the best support.
596 If CyaSSL is built with debugging support then you need to call
597 CyaSSL_Debugging_ON() to turn logging on.
599 On Unix use ./configure --enable-debug
601 On Windows define DEBUG_CYASSL when building CyaSSL
604 To turn logging back off call CyaSSL_Debugging_OFF()
606 See notes below (0.2.0) for complete build instructions.
609 *****************CyaSSL version 0.6.2 (10/29/2006)
611 This release of CyaSSL adds TLS 1.1.
613 Note that CyaSSL has certificate verification on by default, unlike OpenSSL.
614 To emulate OpenSSL behavior, you must call SSL_CTX_set_verify() with
615 SSL_VERIFY_NONE. In order to have full security you should never do this,
616 provide CyaSSL with the proper certificates to eliminate impostors and call
617 CyaSSL_check_domain_name() to prevent man in the middle attacks.
619 See notes below (0.2.0) for build instructions.
621 *****************CyaSSL version 0.6.0 (10/25/2006)
623 This release of CyaSSL adds more SSL functions, better autoconf, nonblocking
624 I/O for accept, connect, and read. There is now an --enable-small configure
625 option that turns off TLS, AES, DES3, HMAC, and ERROR_STRINGS, see configure.in
626 for the defines. Note that TLS requires HMAC and AES requires TLS.
628 See notes below (0.2.0) for build instructions.
631 *****************CyaSSL version 0.5.5 (09/27/2006)
633 This mini release of CyaSSL adds better input processing through buffered input
634 and big message support. Added SSL_pending() and some sanity checks on user
637 See notes below (0.2.0) for build instructions.
640 *****************CyaSSL version 0.5.0 (03/27/2006)
642 This release of CyaSSL adds AES support and minor bug fixes.
644 See notes below (0.2.0) for build instructions.
647 *****************CyaSSL version 0.4.0 (03/15/2006)
649 This release of CyaSSL adds TLSv1 client/server support and libtool.
651 See notes below for build instructions.
654 *****************CyaSSL version 0.3.0 (02/26/2006)
656 This release of CyaSSL adds SSLv3 server support and session resumption.
658 See notes below for build instructions.
661 *****************CyaSSL version 0.2.0 (02/19/2006)
664 This is the first release of CyaSSL and its crypt brother, CTaoCrypt. CyaSSL
665 is written in ANSI C with the idea of a small code size, footprint, and memory
666 usage in mind. CTaoCrypt can be as small as 32K, and the current client
667 version of CyaSSL can be as small as 12K.
670 The first release of CTaoCrypt supports MD5, SHA-1, 3DES, ARC4, Big Integer
671 Support, RSA, ASN parsing, and basic x509 (en/de)coding.
673 The first release of CyaSSL supports normal client RSA mode SSLv3 connections
674 with support for SHA-1 and MD5 digests. Ciphers include 3DES and RC4.
677 --To build on Linux, Solaris, *BSD, Mac OS X, or Cygwin:
682 from the ./testsuite/ directory run ./testsuite
684 to make a debug build:
686 ./configure --enable-debug --disable-shared
693 Choose (Re)Build All from the project workspace
695 Run the testsuite program
699 *** The next release of CyaSSL will support a server and more OpenSSL
700 compatibility functions.
703 Please send questions or comments to todd@yassl.com