+ openCryptoki 3.15.1
- Bug fixes

+ openCryptoki 3.15
- common: conform to PKCS 11 3.0 Baseline Provider profile
- Introduce new vendor defined interface named "Vendor IBM"
- Support C_IBM_ReencryptSingle via "Vendor IBM" interface
- CCA: support key wrapping
- SOFT: support ECC
- p11sak tool: add remove-key command
- Bug fixes

+ openCryptoki 3.14
- EP11: Dilitium support stage 2
- Common: Rework on process and thread locking
- Common: Rework on btree and object locking
- ICSF: minor fixes
- TPM, ICA, ICSF: support multiple token instances
- new tool p11sak

+ openCryptoki 3.13.0
- EP11: Dilithium support
- EP11: EdDSA support
- EP11: support RSA-OAEP with non-SHA1 hash and MGF

+ openCryptoki 3.12.1
- Fix pkcsep11_migrate tool

+ openCryptoki 3.12.0
- Update token pin and data store encryption for soft,ica,cca and ep11
- EP11: Allow importing of compressed EC public keys
- EP11: Add support for the CMAC mechanisms
- EP11: Add support for the IBM-SHA3 mechanisms
- SOFT: Add AES-CMAC and 3DES-CMAC support to the soft token
- ICA: Add AES-CMAC and 3DES-CMAC support to the ICA token
- EP11: Add config option USE_PRANDOM
- CCA: Use Random Number Generate Long for token_specific_rng()
- Common rng function: Prefer /dev/prandom over /dev/urandom
- ICA: add SHA*_RSA_PKCS_PSS mechanisms
- Bug fixes

+ openCryptoki 3.11.1
- Bug fixes

* opencryptoki 3.11.0
- EP11 enhancements
- A lot of bug fixes

* opencryptoki 3.10.0
- Add support to ECC on ICA token and to common code.
- Add SHA224 support to SOFT token.
- Improve pkcsslotd logging.
- Fix sha512_hmac_sign and rsa_x509_verify for ICA token.
- Fix tracing of session id.
- Fix and improve testcases.
- Fix spec file permission for log directory.
- Fix build warnings.

* opencryptoki 3.9.0
- Fix token reinitialization
- Fix conditional man pages
- EP11 enhancements
- EP11 EC Key import
- Increase RSA max key length
- Fix broken links on documentation
- Define CK_FALSE and CK_TRUE macros
- Improve build flags

* opencryptoki 3.8.2
- Update man pages.
- Improve ock_tests for parallel execution.
- Fix FindObjectsInit for hidden HW-feature.
- Fix to allow vendor defined hardware features.
- Fix unresolved symbols.
- Fix tracing.
- Code/project cleanup.

* opencryptoki 3.8.1
- Fix TPM data-structure reset function.
- Fix error message when dlsym fails.
- Update configure.ac
- Update travis.

* opencryptoki 3.8.0
- Multi token instance feature.
- Added possibility to run opencryptoki with transactional memory or locks
(--enable-locks on configure step).
- Updated documentation.
- Fix segfault on ec_test.
- Bunch of small fixes.

* opencryptoki 3.7.0
- Update example spec file
- Performance improvement. Moving from mutexes to transactional memory.
- Add ECDSA SHA2 support for EP11 and CCA.
- Fix declaration of inline functions.
- Fix wrong testcase and ber en/decoding for integers.
- Check for 'flex' and 'YACC' on configure.
- EP11 config file rework.
- Add enable-debug on travis build.
- Add testcase for C_GetOperationState/C_SetOperationState.
- Upgrade License to CPL-1.0
- Ica token: fix openssh/ibmpkcs11 engine/libica crash.
- Fix segfault and logic in hardware feature test.
- Fix spelling of documentation and manuals.
- Fix the retrieval of p from a generated rsa key.
- Coverity scan fixes - incompatible pointer type and unused variables.

* opencryptoki 3.6.2
- Support OpenSSL-1.1.
- Add Travis CI support.
- Update autotools scripts and documentation.
- Fix SegFault when a invalid session handle is passed in SC_EncryptUpdate and
SC_DecryptUpdate.

* opencryptoki 3.6.1
- Fix SOFT token implementation of digest functions.
- Replace deprecated OpenSSL interfaces.

* opencryptoki 3.6
- Replace deprecated libica interfaces.
- Performance improvement for ICA.
- Improvement in documentation on system resources.
- Improvement in testcases.
- Added support for rc=8, reasoncode=2028 in icsf token.
- Fix for session handle not set in session issue.
- Multiple fixes for lock and log directories.
- Downgraded a syslog error to warning.
- Multiple fixes based on coverity scan results.
- Added pkcs11 mapping for icsf reason code 72 for return code 8.

* opencryptoki 3.5.1
- Fix Illegal Intruction on pkcscca tool.

* opencryptoki 3.5
- Full Coverity scan fixes.
- Fixes for compiler warnings.
- Added support for C_GetObjectSize in icsf token.
- Various bug fixes and memory leak fixes.
- Removed global read permissions from token files.
- Added missing PKCS#11v2.2 constants.
- Fix for symbol resolution issue seen in Fedora 22 and 23 for
  ep11 and cca tokens.
- Improvements in socket read operation when a token comes up.
- Replaced 32 bit CCA API declarations with latest header from
  version 5.0 libsculcca rpm.

* opencryptoki 3.4.1
- fix 32-bit compiler error for ep11
- fix buffer overflow for cca token
- fix a testcase

* opencryptoki 3.4
- CCA master key migration added to the pkcscca tool. When the masterkey on
  the CCA adapter changes, this allows the token key objects containing
  keys wrapped with the card's former masterkey to be wrapped under the
  card's new masterkey. And thus "migrated".
- AES GCM support added to ica token.
- Ability to generate generic secret keys for CKM_GENERIC_SECRET_KEY_GEN
  added to opencryptoki.
- The soft, cca, ep11, and icsf tokens support HMAC single and multipart for
  SHA1, SHA256, SHA384, and SHA512.
- CCA token, a secure key token, can now import AES, DES3 and
  Generic Secret keys.
- Add -Wall and fix various compiler warnings.
- Coverity scan cleanup.
- Additional test vectors and various testcase improvements made.
- Various bugfixes

* opencryptoki 3.3
- Dynamic tracing introduced via the new environment variable,
  OPENCRYPTOKI_TRACE_LEVEL=<level>. The opencryptoki base as well as all
  tokens changed to use the new tracing.
- Allow root to run pkcs11 commands without being in pkcs11 group.
- EncryptUpdate, DecryptUpdate, DigestUpdate, SignUpdate, VerifyUpdate
  now allow zero length data.
- Refactored ICA token's SHA .
- Various testcase improvements.
- Various bugfixes.

* opencryptoki 3.2
- New pkcscca tool. Currently it assists in migrating cca private token
  objects from opencryptoki version 2 to the clear key encryption method
  used in opencryptoki version 3. Includes a manpage for pkcscca tool.
  Changes to README.cca_stdll to assist in using the CCA token and
  migrating the private token objects.
- Support for CKM_RSA_PKCS_OAEP and CKM_RSA_PKCS_PSS algorithms.
- Various bugfixes.
- New testcases for various crypto algorithms.

* opencryptoki-3.1
- New ep11 token to support IBM Crypto Express adpaters (starting with
  Crypto Express 4S adapters) configured with Enterprise PKCS#11(EP11)
  firmware.
- New pkcsep11_migrate utility (and manpage) to migrate token objects
  when card's masterkey changes.
- Various bugfixes.

* opencryptoki-3.0
- Aggregated source files in common, tpm, and cca directories.
- Re-factored shared memory functions in the stdlls.
- New opencryptoki.conf file to replace pk_config_data and pkcs11_starup.
  The opencryptoki.conf contains slot entry information for tokens.
- New manpage for opencryptoki.conf
- Removed pkcs_slot and pkcs11_startup shell scripts.
- New ICSF token to do remote crypto.
- New pkcsicsf utility to setup the ICSF token.
- New manpage for pkcsicsf utility.
- ICA token supports CKM_DES_OFB64, CKM_DES_CFB8, CKM_DES_CFB6 mechanisms
  using 3DES keys.
- ICA token supports CKM_DES3_MAC and CKM_DES3_MAC_GENERAL mechanisms.
- ICA token supports CKM_AES_OFB, CKM_AES_CFB8, CKM_AES_CFB64, CKM_AES_CFB128,
  CKM_AES_MAC, and CKM_AES_MAC_GENERAL mechanisms.
- Some code cleanup in pkcsslotd.
- pkcsslotd daemon uses a socket rather than shared memory to pass
  slot information to the opencryptoki library.
- New testcases added for various crypto algorithms and pkcs#11 api calls.
- Add README to docs directory for how to setup ICSF token.

* opencryptoki-2.4.3.1 (May 17, 2013)
- Allow imported rsa private keys in cca to also decrypt.

* opencryptoki-2.4.3 (April 29, 2013)
- CKM_SHA256_RSA_PKCS,CKM_SHA384_RSA_PKCS,CKM_SHA512_RSA_PKCS support
  for ICA token.
- Allow import of RSA public and private keys into CCA token.
- Systemd support added.
- Various bugfixes and additional testcases.

* opencryptoki-2.4.2 (April 27, 2012)
- Re-factored spinlocks, such that each token has its own spinlock
  in its own directory relative to /var/locks/opencryptoki.

* opencryptoki-2.4.1 (February 21, 2012)
- SHA256 support added for CCA token
- Several crypto algorithm testcases refactored to include published
  test vectors.
- Testcase directory restructured for future improvements.
- Allow tpm stdll to get SRK passwd and mode from new env variables.
  See [1] for info on how to use this feature and please report any bugs.
- Renamed spinlocks for shared memory to /var/lock dir and did
  some cleanup of unused locking schemes.
- Various bugfixes and cleanup.

[1] http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki;a=blob;f=doc/README.tpm_stdll;h=dda0d2263cfbb3df8c65ebc64b8006e3242f6321;hb=HEAD#l58


* opencryptoki-2.4
- Support for Elliptic Curve Support in CCA token.
- Support for AES CTR in ICA token.
- Session handling refactored from using a reference to memory to
  using a handle that references a binray tree node.
- Cleanup logging. Debug messages now go to a file referenced in
  OPENCRYPTOKI_DEBUG_FILE env variable.
- Various bugfixes and cleanup.

* opencryptoki-2.3.3 (Jan 13 2011)
- Moderate fixes and clean-ups to key unwrapping mechanisms
- several pkcsconf fixes, some minor changes
- Important fix to CCA library name in pkcs11_startup
- PKCS padding length fix for symmetric ciphers
- Better RSA public exponent validations in all supported tokens
- Huge testsuite refactor
- Several other minor fixes and cleanups

* opencryptoki-2.3.2 (Jul 29 2010)
- Significant clean-ups to the building and packaging systems and many
  small fixes by Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
- Various minor fixes to slot daemon and init script by Dan Horák
  <dan@danny.cz>
- Some RSA PKCS#1 v1.5 padding clean-ups by Ramon de Carvalho Valle
  <rcvalle@linux.vnet.ibm.com>
- Human-readable flags output to pkcsconf, some minor soft-token
  fixes by Kent Yoder <key@linux.vnet.ibm.com>
- Improved overall session/object look-up performance. Note that this
  change might crash buggy callers with badly-written session/object
  handle tracking - Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>

* openCryptoki-2.3.1
- Moved ICA token to use libica-2.0, supporting newer hardware and 4K
  RSA modulus. Libica-2.x is now *required* to build the ICA token.
- Moved CCA token to use CCA-4.0, supporting AES, SHA-2 and 4K RSA
  keys in newer hardware. Although not required for building, CCA-4.0
  is *required* for running the CCA token.

* openCryptoki-2.2.5

- Fixed bug in comparison of PINs in pkcsconf.
- Added code to set the encryption and signature schemes of keys imported
into the TPM token.
- Added tpm token message to warn when only owner can read the pub SRK.
- Fixed return code of function failed when it should be buffer too small in
various mech_des.c mech_des3.c and mech_aes.c files.
- Moved doc/*.txt to manpage format and integrated them into the build/install
- Updated testcases to query env vars for PINs and call a set of common
routines for common operations
- Added SHA256 support for all tokens
- Fixed object cleanup when max number of token objects is hit
- Fixed fd exhaustion bug with spin lock fd
- Updated TPM stdll for TSS policy handling changes. Trousers 0.2.9+ now
required with openCryptoki 2.2.5
- Updated TPM stdll to use TSS_TSPATTRIB_KEYINFO_RSA_MODULUS when retrieving
the public modulus
- pkcs11_startup fix for use with s/w fallback support in libica on s390
- Added the CCA secure key token and migration utility
- Replaced bcopy/bzero with memcpy/memset throughout the code
- Removed unused variables throughout the code

* openCryptoki-2.2.4