Changes to the dialup.net wolfSSL 5.5.4 Win16 port (WOLFSSL2.DLL)
=================================================================

This tree is https://www.dialup.net/wingpt/download/wolfssl10.zip with the
changes below, made by Joey Castillo with Claude Fable 5.1. Licence: GNU GPL
version 2, as the original. Each modified file carries a notice on its first
line giving the date of change.

Build (OpenWatcom v2, from this directory):
    wmake -h -f watcom16/MAKEFILE
produces watcom16/BUILD/WOLFSSL2.DLL. The author's IDE project files in
watcom16/ are kept unchanged.

The upstream DLL does TLS 1.2 and 1.3 with no certificate verification and
a stub RNG. This one verifies the server's chain against a set of trusted
roots, seeds its DRBG through a callback, and speaks TLS 1.2 only.

While untested on 1990s-era hardware, we expect a Pentium processor or
better will be required for certificate validation to complete before a
TLS timeout.


Certificate verification
------------------------

wolfSSL_CTX_load_verify_buffer and wolfSSL_check_domain_name are marked
WOLFSSL_16BIT_API (__far __pascal __export) in wolfssl/ssl.h and src/ssl.c,
so the DLL exports them, as ordinals 27 and 28.

NO_ASN_TIME is removed, so certificate dates are checked.

P-384 and RSA-4096 roots are supported: user_settings.h adds HAVE_ECC384,
WOLFSSL_SHA384 and WOLFSSL_SHA512, and raises FP_MAX_BITS to 8192.

WOLFSSL_ALT_CERT_CHAINS is added. Where a server ends its chain with a
cross-signed root -- GTS Root R4 signed by GlobalSign Root CA, say, while
the trust store holds only the self-signed R4 -- the cross-signing CA fails
ASN_NO_SIGNER_E and src/internal.c sends a fatal unknown_ca alert before
reaching the leaf. The option skips a CA certificate that fails that way
instead of erroring; the leaf must still chain to a trusted root.


Random number generation
------------------------

The stub RNG in wolfcrypt/src/win16_port.c (hw_rand, my_rng_seed_gen and
my_rng_gen_block: GetTickCount exclusive-ored with a counter) is removed,
with the CUSTOM_RAND_* macros in user_settings.h that selected it.

In its place WC_NO_HASHDRBG is removed and WC_RNG_SEED_CB added, so
wolfSSL's own Hash-DRBG is built and seeded by the calling application
through a callback. wc_SetSeed_Cb is marked WOLFSSL_16BIT_API in
wolfssl/wolfcrypt/random.h and wolfcrypt/src/random.c, ordinal 29.


TLS 1.2 only
------------

WOLFSSL_TLS13 and HAVE_HKDF are removed. Ordinal 18,
wolfTLSv1_3_client_method, is retired and its number left as a gap.

NO_SESSION_CACHE is added: the cache is 22 KB of static data, which a
client that holds one session open does not need.


Bignum arithmetic
-----------------

TFM used 16-bit digits here, since tfm.h chooses them for WC_16BIT_CPU, and
did its multiplies in C. A P-256 ECDSA verify cost 7.8 s on an emulated
Pentium, and a chain of several certificates did not fit inside the 15 s a
server may allow an idle handshake.

TFM_WATCOM386 is a new architecture block in wolfcrypt/src/asm.c, selected
from user_settings.h. It takes 32-bit digits (WOLFSSL_BIGINT_TYPES, fp_digit
unsigned long) and does the comba multiply-accumulate, the squaring steps
and the Montgomery inner loop in OpenWatcom _asm around the 386's 32x32
mul, transliterating wolfSSL's own TFM_X86 sequences. watcom16/MAKEFILE
compiles -3 and -ox where the author had -2 and -od.

TFM_ECC256 and TFM_ECC384 are both defined: with 32-bit digits the unrolled
8- and 12-digit combas are P-256 and P-384.

TFM_NO_ASM is off, and wolfssl/wolfcrypt/tfm.h no longer derives it from
WOLFSSL_NO_ASM, which sp_int.c and siphash.c still need.

The handshake's compute fell from 24.7 s to 6.1 s on the same chain.


Word size
---------

OpenWatcom has a 64-bit long long and SHA-384 needs it, but config.h is
never read under WOLFSSL_USER_SETTINGS, so user_settings.h defines
SIZEOF_LONG 4 and SIZEOF_LONG_LONG 8 by hand. WC_16BIT_WORD64 is new: the
WC_16BIT_CPU branch of wolfssl/wolfcrypt/types.h undefined WORD64_AVAILABLE
unconditionally, and now does so only in its absence.


Build
-----

watcom16/MAKEFILE is new; the author built from the OpenWatcom IDE, whose
project files are kept. It carries his compiler flags plus -zm, which gives
each function its own segment so that the unsplit internal.c links, and
-d0. The module name is WOLFSSL2. Every export is pinned by ordinal in the
generated directive file: 1 to 26 as in the author's DLL, then 27, 28 and
29 above.


Comments
--------

Comments added with these changes follow the style of the surrounding tree:
sited at the line they explain, and silent where the code says it.


Files changed
-------------

    src/ssl.c                          export two verify functions
    wolfcrypt/src/asm.c                TFM_WATCOM386 block
    wolfcrypt/src/random.c             export wc_SetSeed_Cb
    wolfcrypt/src/win16_port.c         stub RNG removed
    wolfssl/ssl.h                      export two verify functions
    wolfssl/wolfcrypt/random.h         export wc_SetSeed_Cb
    wolfssl/wolfcrypt/tfm.h            select TFM_WATCOM386
    wolfssl/wolfcrypt/types.h          WC_16BIT_WORD64
    wolfssl/wolfcrypt/user_settings.h  configuration
    watcom16/MAKEFILE                  new
    CHANGES.TXT                        new


AI usage statement
------------------

Claude Fable was used extensively to implement this patch. This CHANGES file
combines both AI and human contributions, and Joey edited the final text.
