Added new 64-bit implementations of Curve25519 and P-256.
Fixed endianness in Curve25519 implementation (no consequence on security). Also added new Curve25519 code for 64-bit platforms.
Added stand-alone RSA/PSS implementation.
Added SHAKE implementation.
Added generic HKDF implementation.
Added POWER8 implementation for AES/CTR+CBC-MAC (for CCM and EAX modes).
Added support code for RSA and EC key encoding (including reconstruction of all public and private key elements from the private key structure), with raw and PKCS#8 formats, both in DER and PEM.
Added AESCTR_DRBG implementation (beta).
Added RSA key generation code (i15, i31, i62).
Added support for CCM and CCM_8 cipher suites.
Added RSA/OAEP implementation.
Make Rules.mk more compatible with merges and local diffs.
Added generic EAX and CCM implementations.
Added seeder API. Also overhauled compile-time detection of features.
Added Twrch support.
Added ChaCha20 implementation with SSE2 opcodes.
Added general-purpose API for AEAD algorithms, and GCM implementation.
Added implementation of keying material export (RFC 5705) (API for PRF implementations changed, to handle chunked seeds).
Fixed handling of incoming application data after sending a close_notify (data shall be discarded silently, not trigger an error). Also fixed a couple of bugs in the command-line test tool.
New "i62" code for big integers with 64x64->128 opcodes; also improved "i31" modular exponentiation.