<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body bgcolor="#999999" text="#000000">
<p><font size="+1">Reading the 1.0.2j CHANGES file, it appears that 1.0.2 was built from 1.0.1l.<br>
And there are 1124 of description of the changes for 1.0.2 and about 500 lines of changes from 1.0.1l to 1.0.1u .<br>
And my knowledge of OpenSSL is VERY VERY small.</font></p>
<p><font size="+1">Looking at 1.0.1l, out of bug fixes, I've found some changes that do not look as bugfixes:<br>
- <b>dhparam: generate 2048-bit parameters by default. (1.0.1n)</b><br>
- Reject DH handshakes with parameters shorter than 768 bits.<br>
- In DSA_generate_parameters_ex, if the provided seed is too short, use a random seed, as already documented.<br>
- Reject DH handshakes with parameters shorter than 1024 bits.<br>
- Disable SRP fake user seed to address a server memory leak.<br>
Add a new method SRP_VBASE_get1_by_user that handles the seed properly.<br>
- Remove LOW from the DEFAULT cipher list. This removes singles DES from the default.</font></p>
<p><font size="+1">However, only the first one, in bold, appears in 1.0.1l and NOT in 1.0.2j .</font></p>
<p><font size="+1"><br>
</font></p>
<p><font size="+1">So, my question is still:</font></p>
<p><font size="+1">Why OpenSSL still delivers 1.0.1* though 1.0.2* should provide the same changes plus new features ?<br>
Because change "</font><font size="+1"><b>dhparam: generate 2048-bit parameters by default."</b> appears in 1.0.1[n-l] and not in 1.0.2* ???</font></p>
<p><font size="+1"><br>
</font></p>
<p><font size="+1">I need to know in order to decide if I still manage 1.0.1 compatibility in addition to delivering 1.0.2[last version] .</font></p>
<p><font size="+1">Help is welcome !</font></p>
<p><font size="+1">Tony<br>
</font></p>
<br>
<div class="moz-cite-prefix">Le 26/09/2016 à 17:53, Salz, Rich a écrit :<br>
</div>
<blockquote cite="mid:2e6b57ebd3d9432e8c9cd9b1d813abfc@usma1ex-dag1mb1.msg.corp.akamai.com" type="cite">
<blockquote type="cite">
<pre wrap="">However, out of more ABIs delivered by 1.0.2 compared to 1.0.1, I do not understand what is the exact difference between versions 1.0.1 and 1.0.2 .
</pre>
</blockquote>
<pre wrap="">
Perhaps look at the CHANGES file in 1.0.2 and see what's been added? 1.0.1 only gets bugfixes, 1.0.2 adds features, but starting with 1.0.2a only gets bugfixes.
Hope this help.
--
Senior Architect, Akamai Technologies
IM: <a class="moz-txt-link-abbreviated" href="mailto:richsalz@jabber.at">richsalz@jabber.at</a> Twitter: RichSalz
</pre>
</blockquote>
<br>
</body>
</html>