Don't set default public key methods in FIPS mode so applications

can switch between modes.

1 files changed, 6 insertions, 0 deletions

diff --git a/CHANGES b/CHANGES
index 7127003293..cf52b0f3f7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,12 @@
 
  Changes between 1.0.0e and 1.0.1  [xx XXX xxxx]
 
+  *) For FIPS capable OpenSSL interpret a NULL default public key method
+     as unset and return the appopriate default but do *not* set the default.
+     This means we can return the appopriate method in applications that
+     swicth between FIPS and non-FIPS modes.
+     [Steve Henson]
+
   *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
      ENGINE is used then we cannot handle that in the FIPS module so we
      keep original code iff non-FIPS operations are allowed.