glib2 2.0.2-x86-mingw32 → 2.0.3-x86-mingw32

data/vendor/local/share/info/gnutls.info-1

@@ -1,6 +1,7 @@
 This is gnutls.info, produced by makeinfo version 5.1 from gnutls.texi.
 
-This manual is last updated 24 April 2013 for version 3.1.11 of GnuTLS.
+This manual is last updated 10 November 2013 for version 3.2.7 of
+GnuTLS.
 
 Copyright (C) 2001-2013 Free Software Foundation, Inc.\\ Copyright (C)
 2001-2013 Nikos Mavrogiannopoulos
@@ -32,7 +33,8 @@ File: gnutls.info,  Node: Top,  Next: Preface,  Up: (dir)
 GnuTLS
 ******
 
-This manual is last updated 24 April 2013 for version 3.1.11 of GnuTLS.
+This manual is last updated 10 November 2013 for version 3.2.7 of
+GnuTLS.
 
 Copyright (C) 2001-2013 Free Software Foundation, Inc.\\ Copyright (C)
 2001-2013 Nikos Mavrogiannopoulos
@@ -114,7 +116,7 @@ Important features of the GnuTLS library include:
 
    * Support for TLS 1.2, TLS 1.1, TLS 1.0 and SSL 3.0 protocols.
 
-   * Support for Datagram TLS 1.0.
+   * Support for Datagram TLS 1.0 and 1.2.
 
    * Support for handling and verification of X.509 and OpenPGP
      certificates.
@@ -277,7 +279,7 @@ The handshake protocol is responsible for the security parameters'
 negotiation, the initial key exchange and authentication.  *Note The
 Handshake Protocol::, for more information about the handshake protocol.
 The protocol layering in TLS is shown in *note Figure 3.1:
-fig:tls-layers.
+fig-tls-layers.
 
 [image src="gnutls-layers.png"]
 
@@ -355,9 +357,6 @@ ARCFOUR_128    ARCFOUR_128 is a compatible algorithm with RSA's
                secret.  It is a fast cipher but considered weak
                today.
                
-ARCFOUR_40     This is the ARCFOUR cipher fed with a 40 bit
-               key, which is considered weak.
-               
 AES_CBC        AES or RIJNDAEL is the block cipher algorithm
                that replaces the old DES algorithm.  Has 128
                bits block size and is used in CBC mode.
@@ -373,6 +372,14 @@ CAMELLIA_CBC   This is an 128-bit block cipher developed by
                ciphers of the European NESSIE and Japanese
                CRYPTREC projects.
                
+SALSA20_256    SALSA20_256 is a fast stream cipher.  This is
+               currently a GnuTLS extension.
+               
+ESTREAM_SALSA20_256ESTREAM_SALSA20_256 is a faster variant of
+               SALSA20, and is one of the selected ciphers of
+               the ESTREAM competition.  This is currently a
+               GnuTLS extension.
+               
 
 Table 3.1: Supported ciphers.
 
@@ -389,6 +396,10 @@ MAC_SHA1       An HMAC based on the SHA1 cryptographic hash
 MAC_SHA256     An HMAC based on SHA256.  Outputs 256 bits of
                data.
                
+MAC_UMAC       This is a very fast MAC algorithm based on
+               universal hashing, described in [_RFC4418_].
+               This is currently a GnuTLS extension.
+               
 MAC_AEAD       This indicates that an authenticated encryption
                algorithm, such as GCM, is in use.
                
@@ -563,6 +574,9 @@ GNUTLS_A_UNRECOGNIZED_NAME               112     The server name sent
 GNUTLS_A_UNKNOWN_PSK_IDENTITY            115     The SRP/PSK username
                                                  is missing or not
                                                  known
+GNUTLS_A_NO_APPLICATION_PROTOCOL         120     No supported
+                                                 application protocol
+                                                 could be negotiated
 
 
 File: gnutls.info,  Node: The TLS Handshake Protocol,  Next: TLS Extensions,  Prev: The TLS Alert Protocol,  Up: Introduction to TLS
@@ -660,7 +674,7 @@ of established connections (unless session tickets are used - *note
 Session tickets::).
 
 Session resumption is an integral part of GnuTLS, and *note Session
-resumption::, *note ex:resume-client:: illustrate typical uses of it.
+resumption::, *note ex-resume-client:: illustrate typical uses of it.
 
 
 File: gnutls.info,  Node: TLS Extensions,  Next: How to use TLS in application protocols,  Prev: The TLS Handshake Protocol,  Up: Introduction to TLS
@@ -688,6 +702,7 @@ and they will be discussed in the subsections that follow.
 * Safe renegotiation::
 * OCSP status request::
 * SRTP::
+* Application Layer Protocol Negotiation (ALPN)::
 
 
 File: gnutls.info,  Node: Maximum fragment length negotiation,  Next: Server name indication,  Up: TLS Extensions
@@ -745,14 +760,14 @@ File: gnutls.info,  Node: HeartBeat,  Next: Safe renegotiation,  Prev: Session t
 3.6.4 HeartBeat
 ---------------
 
-This TLS extension allows to ping and receive confirmation from the
-peer, is described in [_RFC6520_].  The extension is disabled by default
-and *note gnutls_heartbeat_enable:: can be used to enable it.  A policy
-may be negotiated to only allow sending heartbeat messages or sending
-and receiving.  The current session policy can be checked with *note
-gnutls_heartbeat_allowed::.  The requests coming from the peer result to
-'GNUTLS_E_HERTBEAT_PING_RECEIVED' being returned from the receive
-function.  Ping requests to peer can be send via *note
+This is a TLS extension that allows to ping and receive confirmation
+from the peer, and is described in [_RFC6520_].  The extension is
+disabled by default and *note gnutls_heartbeat_enable:: can be used to
+enable it.  A policy may be negotiated to only allow sending heartbeat
+messages or sending and receiving.  The current session policy can be
+checked with *note gnutls_heartbeat_allowed::.  The requests coming from
+the peer result to 'GNUTLS_E_HERTBEAT_PING_RECEIVED' being returned from
+the receive function.  Ping requests to peer can be send via *note
 gnutls_heartbeat_ping::.
 
 'INT *note gnutls_heartbeat_allowed:: (gnutls_session_t SESSION, unsigned int TYPE)'
@@ -878,7 +893,7 @@ serve it to the clients.  That way a client avoids an additional
 connection to the OCSP server.
 
 'VOID *note gnutls_certificate_set_ocsp_status_request_function:: (gnutls_certificate_credentials_t SC, gnutls_status_request_ocsp_func OCSP_FUNC, void * PTR)'
-'INT *note gnutls_certificate_set_ocsp_status_request_file:: (gnutls_certificate_credentials_t SC, const char* RESPONSE_FILE, unsigned int FLAGS)'
+'INT *note gnutls_certificate_set_ocsp_status_request_file:: (gnutls_certificate_credentials_t SC, const char * RESPONSE_FILE, unsigned int FLAGS)'
 'INT *note gnutls_ocsp_status_request_enable_client:: (gnutls_session_t SESSION, gnutls_datum_t * RESPONDER_ID, size_t RESPONDER_ID_SIZE, gnutls_datum_t * EXTENSIONS)'
 'INT *note gnutls_ocsp_status_request_is_checked:: (gnutls_session_t SESSION, unsigned int FLAGS)'
 
@@ -893,7 +908,7 @@ Since version 3.1.3 GnuTLS clients transparently support the certificate
 status request.
 
 
-File: gnutls.info,  Node: SRTP,  Prev: OCSP status request,  Up: TLS Extensions
+File: gnutls.info,  Node: SRTP,  Next: Application Layer Protocol Negotiation (ALPN),  Prev: OCSP status request,  Up: TLS Extensions
 
 3.6.7 SRTP
 ----------
@@ -964,6 +979,27 @@ Other helper functions are listed below.
 'CONST CHAR * *note gnutls_srtp_get_profile_name:: (gnutls_srtp_profile_t PROFILE)'
 'INT *note gnutls_srtp_get_profile_id:: (const char * NAME, gnutls_srtp_profile_t * PROFILE)'
 
+
+File: gnutls.info,  Node: Application Layer Protocol Negotiation (ALPN),  Prev: SRTP,  Up: TLS Extensions
+
+3.6.8 Application Layer Protocol Negotiation (ALPN)
+---------------------------------------------------
+
+The TLS protocol was extended in 'draft-ietf-tls-applayerprotoneg-00' to
+provide the application layer a method of negotiating the application
+protocol version.  This allows for negotiation of the application
+protocol during the TLS handshake, thus reducing round-trips.  The
+application protocol is described by an opaque string.  To enable, use
+the following functions.
+
+'INT *note gnutls_alpn_set_protocols:: (gnutls_session_t SESSION, const gnutls_datum_t * PROTOCOLS, unsigned PROTOCOLS_SIZE, unsigned int FLAGS)'
+'INT *note gnutls_alpn_get_selected_protocol:: (gnutls_session_t SESSION, gnutls_datum_t * PROTOCOL)'
+
+Note that you can use these functions with protocols that are registered
+in the Application Layer Protocol Negotiation IANA registry.  If you
+wish to use them for other custom protocols then prefix them with the 3
+characters 'exp' (lower-case).
+
 
 File: gnutls.info,  Node: How to use TLS in application protocols,  Next: On SSL 2 and older protocols,  Prev: TLS Extensions,  Up: Introduction to TLS
 
@@ -1185,12 +1221,6 @@ RSA            The RSA algorithm is used to encrypt a key and
                send it to the peer.  The certificate must allow
                the key to be used for encryption.
                
-RSA_EXPORT     The RSA algorithm is used to encrypt a key and
-               send it to the peer.  In the EXPORT algorithm,
-               the server signs temporary RSA parameters of 512
-               bits -- which are considered weak -- and sends
-               them to the client.
-               
 DHE_RSA        The RSA algorithm is used to sign ephemeral
                Diffie-Hellman parameters which are sent to the
                peer.  The key in the certificate must allow the
@@ -1252,7 +1282,7 @@ Figure 4.1: An example of the X.509 hierarchical trust model.
 
 One needs to trust one or more CAs for his secure communications.  In
 that case only the certificates issued by the trusted authorities are
-acceptable.  The framework is illustrated on *note Figure 4.1: fig:x509.
+acceptable.  The framework is illustrated on *note Figure 4.1: fig-x509.
 
 * Menu:
 
@@ -1372,7 +1402,7 @@ In GnuTLS the X.509 certificate structures are handled using the
 'gnutls_x509_privkey_t' type.  All the available functions for X.509
 certificate handling have their prototypes in 'gnutls/x509.h'.  An
 example program to demonstrate the X.509 parsing capabilities can be
-found in *note ex:x509-info::.
+found in *note ex-x509-info::.
 
 
 File: gnutls.info,  Node: Importing an X.509 certificate,  Next: X.509 distinguished names,  Prev: X.509 certificate structure,  Up: X.509 certificates
@@ -1519,7 +1549,7 @@ following functions.
 
 'INT *note gnutls_x509_privkey_get_pk_algorithm2:: (gnutls_x509_privkey_t KEY, unsigned int * BITS)'
 'INT *note gnutls_x509_privkey_export_rsa_raw2:: (gnutls_x509_privkey_t KEY, gnutls_datum_t * M, gnutls_datum_t * E, gnutls_datum_t * D, gnutls_datum_t * P, gnutls_datum_t * Q, gnutls_datum_t * U, gnutls_datum_t * E1, gnutls_datum_t * E2)'
-'INT *note gnutls_x509_privkey_export_ecc_raw:: (gnutls_x509_privkey_t KEY, gnutls_ecc_curve_t * CURVE, gnutls_datum_t * X, gnutls_datum_t * Y, gnutls_datum_t* K)'
+'INT *note gnutls_x509_privkey_export_ecc_raw:: (gnutls_x509_privkey_t KEY, gnutls_ecc_curve_t * CURVE, gnutls_datum_t * X, gnutls_datum_t * Y, gnutls_datum_t * K)'
 'INT *note gnutls_x509_privkey_export_dsa_raw:: (gnutls_x509_privkey_t KEY, gnutls_datum_t * P, gnutls_datum_t * Q, gnutls_datum_t * G, gnutls_datum_t * Y, gnutls_datum_t * X)'
 'INT *note gnutls_x509_privkey_get_key_id:: (gnutls_x509_privkey_t KEY, unsigned int FLAGS, unsigned char * OUTPUT_DATA, size_t * OUTPUT_DATA_SIZE)'
 
@@ -1631,9 +1661,6 @@ this purpose the following functions are provided.
      its status.  The 'verify' parameter will hold an OR'ed sequence of
      'gnutls_certificate_status_t' flags.
 
-     *Limitation:* Pathlen constraints or key usage flags are not
-     consulted.
-
      *Returns:* On success, 'GNUTLS_E_SUCCESS' (0) is returned,
      otherwise a negative error value.
 
@@ -1672,8 +1699,8 @@ this purpose the following functions are provided.
      *Since:* 3.0
 
  -- Function: int gnutls_x509_trust_list_add_trust_file
-          (gnutls_x509_trust_list_t LIST, const char* CA_FILE, const
-          char* CRL_FILE, gnutls_x509_crt_fmt_t TYPE, unsigned int
+          (gnutls_x509_trust_list_t LIST, const char * CA_FILE, const
+          char * CRL_FILE, gnutls_x509_crt_fmt_t TYPE, unsigned int
           TL_FLAGS, unsigned int TL_VFLAGS)
      LIST: The structure of the list
 
@@ -1784,7 +1811,7 @@ more detailed flags will also be set when appropriate.
 
 Figure 4.2: The 'gnutls_certificate_status_t' enumeration.
 
-An example of certificate verification is shown in *note ex:verify2::.
+An example of certificate verification is shown in *note ex-verify2::.
 It is also possible to have a set of certificates that are trusted for a
 particular server but not to authorize other certificates.  This purpose
 is served by the functions *note gnutls_x509_trust_list_add_named_crt::
@@ -1870,7 +1897,7 @@ allows anyone to sign anyone else's public key.  When Alice signs Bob's
 key, she is introducing Bob's key to anyone who trusts Alice.  If
 someone trusts Alice to introduce keys, then Alice is a trusted
 introducer in the mind of that observer.  For example in *note Figure
-4.4: fig:openpgp, David trusts Alice to be an introducer and Alice
+4.4: fig-openpgp, David trusts Alice to be an introducer and Alice
 signed Bob's key thus Dave trusts Bob's key to be the real one.
 
 [image src="gnutls-pgp.png"]
@@ -2254,7 +2281,7 @@ last step ensures that the requester is in possession of the private
 key.
 
 'INT *note gnutls_x509_crq_set_version:: (gnutls_x509_crq_t CRQ, unsigned int VERSION)'
-'INT *note gnutls_x509_crq_set_dn:: (gnutls_x509_crq_t CRQ, const char * DN, const char** ERR)'
+'INT *note gnutls_x509_crq_set_dn:: (gnutls_x509_crq_t CRQ, const char * DN, const char ** ERR)'
 'INT *note gnutls_x509_crq_set_dn_by_oid:: (gnutls_x509_crq_t CRQ, const char * OID, unsigned int RAW_FLAG, const void * DATA, unsigned int SIZEOF_DATA)'
 'INT *note gnutls_x509_crq_set_key_usage:: (gnutls_x509_crq_t CRQ, unsigned int USAGE)'
 'INT *note gnutls_x509_crq_set_key_purpose_oid:: (gnutls_x509_crq_t CRQ, const void * OID, unsigned int CRITICAL)'
@@ -2324,73 +2351,77 @@ which should return a signed certificate.
  * request.
  */
 
-int
-main (void)
+int main(void)
 {
-  gnutls_x509_crq_t crq;
-  gnutls_x509_privkey_t key;
-  unsigned char buffer[10 * 1024];
-  size_t buffer_size = sizeof (buffer);
-  unsigned int bits;
+        gnutls_x509_crq_t crq;
+        gnutls_x509_privkey_t key;
+        unsigned char buffer[10 * 1024];
+        size_t buffer_size = sizeof(buffer);
+        unsigned int bits;
 
-  gnutls_global_init ();
+        gnutls_global_init();
 
-  /* Initialize an empty certificate request, and
-   * an empty private key.
-   */
-  gnutls_x509_crq_init (&crq);
+        /* Initialize an empty certificate request, and
+         * an empty private key.
+         */
+        gnutls_x509_crq_init(&crq);
 
-  gnutls_x509_privkey_init (&key);
+        gnutls_x509_privkey_init(&key);
 
-  /* Generate an RSA key of moderate security.
-   */
-  bits = gnutls_sec_param_to_pk_bits (GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_NORMAL);
-  gnutls_x509_privkey_generate (key, GNUTLS_PK_RSA, bits, 0);
+        /* Generate an RSA key of moderate security.
+         */
+        bits =
+            gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA,
+                                        GNUTLS_SEC_PARAM_NORMAL);
+        gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, bits, 0);
 
-  /* Add stuff to the distinguished name
-   */
-  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_COUNTRY_NAME,
-                                 0, "GR", 2);
+        /* Add stuff to the distinguished name
+         */
+        gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME,
+                                      0, "GR", 2);
 
-  gnutls_x509_crq_set_dn_by_oid (crq, GNUTLS_OID_X520_COMMON_NAME,
-                                 0, "Nikos", strlen ("Nikos"));
+        gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME,
+                                      0, "Nikos", strlen("Nikos"));
 
-  /* Set the request version.
-   */
-  gnutls_x509_crq_set_version (crq, 1);
+        /* Set the request version.
+         */
+        gnutls_x509_crq_set_version(crq, 1);
 
-  /* Set a challenge password.
-   */
-  gnutls_x509_crq_set_challenge_password (crq, "something to remember here");
+        /* Set a challenge password.
+         */
+        gnutls_x509_crq_set_challenge_password(crq,
+                                               "something to remember here");
 
-  /* Associate the request with the private key
-   */
-  gnutls_x509_crq_set_key (crq, key);
+        /* Associate the request with the private key
+         */
+        gnutls_x509_crq_set_key(crq, key);
 
-  /* Self sign the certificate request.
-   */
-  gnutls_x509_crq_sign2 (crq, key, GNUTLS_DIG_SHA1, 0);
+        /* Self sign the certificate request.
+         */
+        gnutls_x509_crq_sign2(crq, key, GNUTLS_DIG_SHA1, 0);
 
-  /* Export the PEM encoded certificate request, and
-   * display it.
-   */
-  gnutls_x509_crq_export (crq, GNUTLS_X509_FMT_PEM, buffer, &buffer_size);
+        /* Export the PEM encoded certificate request, and
+         * display it.
+         */
+        gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer,
+                               &buffer_size);
 
-  printf ("Certificate Request: \n%s", buffer);
+        printf("Certificate Request: \n%s", buffer);
 
 
-  /* Export the PEM encoded private key, and
-   * display it.
-   */
-  buffer_size = sizeof (buffer);
-  gnutls_x509_privkey_export (key, GNUTLS_X509_FMT_PEM, buffer, &buffer_size);
+        /* Export the PEM encoded private key, and
+         * display it.
+         */
+        buffer_size = sizeof(buffer);
+        gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer,
+                                   &buffer_size);
 
-  printf ("\n\nPrivate key: \n%s", buffer);
+        printf("\n\nPrivate key: \n%s", buffer);
 
-  gnutls_x509_crq_deinit (crq);
-  gnutls_x509_privkey_deinit (key);
+        gnutls_x509_crq_deinit(crq);
+        gnutls_x509_privkey_deinit(key);
 
-  return 0;
+        return 0;
 
 }
 
@@ -2813,7 +2844,7 @@ key format.
 
  -- Function: int gnutls_privkey_import_x509_raw (gnutls_privkey_t PKEY,
           const gnutls_datum_t * DATA, gnutls_x509_crt_fmt_t FORMAT,
-          const char* PASSWORD, unsigned int FLAGS)
+          const char * PASSWORD, unsigned int FLAGS)
      PKEY: The private key
 
      DATA: The private key data to be imported
@@ -2837,7 +2868,7 @@ key format.
 
  -- Function: int gnutls_x509_privkey_import2 (gnutls_x509_privkey_t
           KEY, const gnutls_datum_t * DATA, gnutls_x509_crt_fmt_t
-          FORMAT, const char* PASSWORD, unsigned int FLAGS)
+          FORMAT, const char * PASSWORD, unsigned int FLAGS)
      KEY: The structure to store the parsed key
 
      DATA: The DER or PEM encoded key.
@@ -2995,7 +3026,7 @@ functions below.
 'INT *note gnutls_pkcs12_bag_get_friendly_name:: (gnutls_pkcs12_bag_t BAG, int INDX, char ** NAME)'
 
 The functions below are used to generate a PKCS #12 structure.  An
-example of their usage is shown at *note PKCS #12 structure generation
+example of their usage is shown at *note PKCS12 structure generation
 example::.
 
 'INT *note gnutls_pkcs12_set_bag:: (gnutls_pkcs12_t PKCS12, gnutls_pkcs12_bag_t BAG)'
@@ -3018,7 +3049,7 @@ gnutls_x509_privkey_import_openssl::.
 
  -- Function: int gnutls_x509_privkey_import_openssl
           (gnutls_x509_privkey_t KEY, const gnutls_datum_t * DATA, const
-          char* PASSWORD)
+          char * PASSWORD)
      KEY: The structure to store the parsed key
 
      DATA: The DER or PEM encoded key.
@@ -3051,22 +3082,23 @@ This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'certtool' program.  This software
 is released under the GNU General Public License, version 3 or later.
 
-certtool help/usage (-h)
-........................
+certtool help/usage ('--help')
+..............................
+
+This is the automatically generated usage text for certtool.
 
-This is the automatically generated usage text for certtool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-     certtool - GnuTLS certificate tool - Ver. 3.1.11
-     USAGE:  certtool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+     certtool - GnuTLS certificate tool
+     Usage:  certtool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
 
-        -d, --debug=num            Enable debugging.
-                                     - It must be in the range:
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
                                        0 to 9999
         -V, --verbose              More verbose output
                                      - may appear multiple times
@@ -3080,17 +3112,14 @@ exit with a status code of 0.
         -u, --update-certificate   Update a signed certificate
         -p, --generate-privkey     Generate a private key
         -q, --generate-request     Generate a PKCS #10 certificate request
-                                     - prohibits these options:
-                                     infile
-        -e, --verify-chain         Verify a PEM encoded certificate chain.
-            --verify               Verify a PEM encoded certificate chain using a trusted list.
-                                     - requires these options:
-                                     load-ca-certificate
-            --verify-crl           Verify a CRL using a trusted list.
-                                     - requires these options:
-                                     load-ca-certificate
-            --generate-dh-params   Generate PKCS #3 encoded Diffie-Hellman parameters.
-            --get-dh-params        Get the included PKCS #3 encoded Diffie-Hellman parameters.
+                                     - prohibits the option 'infile'
+        -e, --verify-chain         Verify a PEM encoded certificate chain
+            --verify               Verify a PEM encoded certificate chain using a trusted list
+                                     - requires the option 'load-ca-certificate'
+            --verify-crl           Verify a CRL using a trusted list
+                                     - requires the option 'load-ca-certificate'
+            --generate-dh-params   Generate PKCS #3 encoded Diffie-Hellman parameters
+            --get-dh-params        Get the included PKCS #3 encoded Diffie-Hellman parameters
             --dh-info              Print information PKCS #3 encoded Diffie-Hellman parameters
             --load-privkey=str     Loads a private key file
             --load-pubkey=str      Loads a public key file
@@ -3118,47 +3147,44 @@ exit with a status code of 0.
             --pubkey-info          Print information on a public key
             --v1                   Generate an X.509 version 1 certificate (with no extensions)
             --to-p12               Generate a PKCS #12 structure
-                                     - requires these options:
-                                     load-certificate
+                                     - requires the option 'load-certificate'
             --to-p8                Generate a PKCS #8 structure
         -8, --pkcs8                Use PKCS #8 format for private keys
             --rsa                  Generate RSA key
             --dsa                  Generate DSA key
             --ecc                  Generate ECC (ECDSA) key
-            --ecdsa                This is an alias for 'ecc'
-            --hash=str             Hash algorithm to use for signing.
-            --inder                Use DER format for input certificates and private keys.
-                                     - disabled as --no-inder
-            --inraw                This is an alias for 'inder'
-            --outder               Use DER format for output certificates and private keys
-                                     - disabled as --no-outder
-            --outraw               This is an alias for 'outder'
+            --ecdsa                an alias for the 'ecc' option
+            --hash=str             Hash algorithm to use for signing
+            --inder                Use DER format for input certificates, private keys, and DH parameters
+                                     - disabled as '--no-inder'
+            --inraw                an alias for the 'inder' option
+            --outder               Use DER format for output certificates, private keys, and DH parameters
+                                     - disabled as '--no-outder'
+            --outraw               an alias for the 'outder' option
             --bits=num             Specify the number of bits for key generate
-            --sec-param=str        Specify the security level [low, legacy, normal, high, ultra].
+            --sec-param=str        Specify the security level [low, legacy, normal, high, ultra]
             --disable-quick-random  No effect
             --template=file        Template file to use for non-interactive operation
                                      - file must pre-exist
             --pkcs-cipher=str      Cipher to use for PKCS #8 and #12 operations
-        -v, --version[=arg]        Output version information and exit
-        -h, --help                 Display extended usage information and exit
-        -!, --more-help            Extended usage information passed thru pager
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
 
      Options are specified by doubled hyphens and their name or by a single
      hyphen and the flag character.
 
-
-
      Tool to parse and generate X.509 certificates, requests and private keys.
      It can be used interactively or non interactively by specifying the
      template command line option.
 
-     please send bug reports to:  bug-gnutls@gnu.org
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
 
 generate-request option (-q)
 ............................
@@ -3175,14 +3201,14 @@ use -load-privkey.
 verify-chain option (-e)
 ........................
 
-This is the "verify a pem encoded certificate chain."  option.  The last
+This is the "verify a pem encoded certificate chain" option.  The last
 certificate in the chain must be a self signed one.
 
 verify option
 .............
 
 This is the "verify a pem encoded certificate chain using a trusted
-list."  option.
+list" option.
 
 This option has some usage constraints.  It:
    * must appear in combination with the following options:
@@ -3193,7 +3219,7 @@ The trusted certificate list must be loaded with -load-ca-certificate.
 verify-crl option
 .................
 
-This is the "verify a crl using a trusted list."  option.
+This is the "verify a crl using a trusted list" option.
 
 This option has some usage constraints.  It:
    * must appear in combination with the following options:
@@ -3204,41 +3230,41 @@ The trusted certificate list must be loaded with -load-ca-certificate.
 get-dh-params option
 ....................
 
-This is the "get the included pkcs #3 encoded diffie-hellman
-parameters."  option.  Returns stored DH parameters in GnuTLS. Those
-parameters are used in the SRP protocol.  The parameters returned by
-fresh generation are more efficient since GnuTLS 3.0.9.
+This is the "get the included pkcs #3 encoded diffie-hellman parameters"
+option.  Returns stored DH parameters in GnuTLS. Those parameters are
+used in the SRP protocol.  The parameters returned by fresh generation
+are more efficient since GnuTLS 3.0.9.
 
 load-privkey option
 ...................
 
-This is the "loads a private key file" option.  This option takes an
-argument string.  This can be either a file or a PKCS #11 URL
+This is the "loads a private key file" option.  This option takes a
+string argument.  This can be either a file or a PKCS #11 URL
 
 load-pubkey option
 ..................
 
-This is the "loads a public key file" option.  This option takes an
-argument string.  This can be either a file or a PKCS #11 URL
+This is the "loads a public key file" option.  This option takes a
+string argument.  This can be either a file or a PKCS #11 URL
 
 load-certificate option
 .......................
 
-This is the "loads a certificate file" option.  This option takes an
-argument string.  This can be either a file or a PKCS #11 URL
+This is the "loads a certificate file" option.  This option takes a
+string argument.  This can be either a file or a PKCS #11 URL
 
 load-ca-privkey option
 ......................
 
 This is the "loads the certificate authority's private key file" option.
-This option takes an argument string.  This can be either a file or a
+This option takes a string argument.  This can be either a file or a
 PKCS #11 URL
 
 load-ca-certificate option
 ..........................
 
 This is the "loads the certificate authority's certificate file" option.
-This option takes an argument string.  This can be either a file or a
+This option takes a string argument.  This can be either a file or a
 PKCS #11 URL
 
 cprint option
@@ -3297,55 +3323,65 @@ with ECDSA.
 ecdsa option
 ............
 
-This is an alias for the ecc option, *note the ecc option documentation:
-certtool ecc.
+This is an alias for the 'ecc' option, *note the ecc option
+documentation: certtool ecc.
 
 hash option
 ...........
 
-This is the "hash algorithm to use for signing."  option.  This option
-takes an argument string.  Available hash functions are SHA1, RMD160,
+This is the "hash algorithm to use for signing" option.  This option
+takes a string argument.  Available hash functions are SHA1, RMD160,
 SHA256, SHA384, SHA512.
 
 inder option
 ............
 
-This is the "use der format for input certificates and private keys."
-option.  The input files will be assumed to be in DER or RAW format.
-Unlike options that in PEM input would allow multiple input data (e.g.
+This is the "use der format for input certificates, private keys, and dh
+parameters " option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-inder.
+
+The input files will be assumed to be in DER or RAW format.  Unlike
+options that in PEM input would allow multiple input data (e.g.
 multiple certificates), when reading in DER format a single data
 structure is read.
 
 inraw option
 ............
 
-This is an alias for the inder option, *note the inder option
+This is an alias for the 'inder' option, *note the inder option
 documentation: certtool inder.
 
 outder option
 .............
 
-This is the "use der format for output certificates and private keys"
-option.  The output will be in DER or RAW format.
+This is the "use der format for output certificates, private keys, and
+dh parameters" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-outder.
+
+The output will be in DER or RAW format.
 
 outraw option
 .............
 
-This is an alias for the outder option, *note the outder option
+This is an alias for the 'outder' option, *note the outder option
 documentation: certtool outder.
 
 sec-param option
 ................
 
 This is the "specify the security level [low, legacy, normal, high,
-ultra]."  option.  This option takes an argument string 'Security
+ultra]" option.  This option takes a string argument 'Security
 parameter'.  This is alternative to the bits option.
 
 pkcs-cipher option
 ..................
 
 This is the "cipher to use for pkcs #8 and #12 operations" option.  This
-option takes an argument string 'Cipher'.  Cipher may be one of 3des,
+option takes a string argument 'Cipher'.  Cipher may be one of 3des,
 3des-pkcs12, aes-128, aes-192, aes-256, rc2-40, arcfour.
 
 certtool exit status
@@ -3481,8 +3517,8 @@ A template file can be used to avoid the interactive questions of
 certtool.  Initially create a file named 'cert.cfg' that contains the
 information about the certificate.  The template can be used as below:
 
-     $ certtool --generate-certificate cert.pem --load-privkey key.pem  \
-        --template cert.cfg \
+     $ certtool --generate-certificate --load-privkey key.pem  \
+        --template cert.cfg --outfile cert.pem \
         --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem
 
 An example certtool template file that can be used to generate a
@@ -3544,8 +3580,16 @@ certificate request or a self signed certificate follows.
      serial = 007
 
      # In how many days, counting from today, this certificate will expire.
+     # Use -1 if there is no expiration date.
      expiration_days = 700
 
+     # Alternatively you may set concrete dates and time. The GNU date string
+     # formats are accepted. See:
+     # http://www.gnu.org/software/tar/manual/html_node/Date-input-formats.html
+
+     #activation_date = "2004-02-29 16:21:42"
+     #expiration_date = "2025-02-29 16:24:41"
+
      # X.509 v3 extensions
 
      # A dnsname in case of a WWW server.
@@ -3666,22 +3710,23 @@ This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'ocsptool' program.  This software
 is released under the GNU General Public License, version 3 or later.
 
-ocsptool help/usage (-h)
-........................
+ocsptool help/usage ('--help')
+..............................
+
+This is the automatically generated usage text for ocsptool.
 
-This is the automatically generated usage text for ocsptool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-     ocsptool - GnuTLS OCSP tool - Ver. 3.1.11
-     USAGE:  ocsptool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+     ocsptool - GnuTLS OCSP tool
+     Usage:  ocsptool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
 
-        -d, --debug=num            Enable debugging.
-                                     - It must be in the range:
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
                                        0 to 9999
         -V, --verbose              More verbose output
                                      - may appear multiple times
@@ -3697,50 +3742,46 @@ exit with a status code of 0.
         -j, --response-info        Print information on a OCSP response
         -q, --generate-request     Generate an OCSP request
             --nonce                Don't add nonce to OCSP request
-                                     - disabled as --no-nonce
+                                     - disabled as '--no-nonce'
             --load-issuer=file     Read issuer certificate from file
                                      - file must pre-exist
             --load-cert=file       Read certificate to check from file
                                      - file must pre-exist
             --load-trust=file      Read OCSP trust anchors from file
-                                     - prohibits these options:
-                                     load-signer
+                                     - prohibits the option 'load-signer'
                                      - file must pre-exist
             --load-signer=file     Read OCSP response signer from file
-                                     - prohibits these options:
-                                     load-trust
+                                     - prohibits the option 'load-trust'
                                      - file must pre-exist
             --inder                Use DER format for input certificates and private keys
-                                     - disabled as --no-inder
+                                     - disabled as '--no-inder'
         -Q, --load-request=file    Read DER encoded OCSP request from file
                                      - file must pre-exist
         -S, --load-response=file   Read DER encoded OCSP response from file
                                      - file must pre-exist
-        -v, --version[=arg]        Output version information and exit
-        -h, --help                 Display extended usage information and exit
-        -!, --more-help            Extended usage information passed thru pager
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
 
      Options are specified by doubled hyphens and their name or by a single
      hyphen and the flag character.
 
-
-
      Ocsptool is a program that can parse and print information about OCSP
      requests/responses, generate requests and verify responses.
 
-     please send bug reports to:  bug-gnutls@gnu.org
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
 
 ask option
 ..........
 
 This is the "ask an ocsp/http server on a certificate validity" option.
-This option takes an optional argument string 'server name|url'.
+This option takes an optional string argument 'server name|url'.
 
 This option has some usage constraints.  It:
    * must appear in combination with the following options: load-cert,
@@ -3893,22 +3934,23 @@ This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'danetool' program.  This software
 is released under the GNU General Public License, version 3 or later.
 
-danetool help/usage (-h)
-........................
+danetool help/usage ('--help')
+..............................
 
-This is the automatically generated usage text for danetool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+This is the automatically generated usage text for danetool.
 
-     danetool - GnuTLS DANE tool - Ver. 3.1.11
-     USAGE:  danetool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-        -d, --debug=num            Enable debugging.
-                                     - It must be in the range:
+     danetool - GnuTLS DANE tool
+     Usage:  danetool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
                                        0 to 9999
         -V, --verbose              More verbose output
                                      - may appear multiple times
@@ -3918,122 +3960,127 @@ exit with a status code of 0.
             --load-pubkey=str      Loads a public key file
             --load-certificate=str Loads a certificate file
             --dlv=str              Sets a DLV file
-            --hash=str             Hash algorithm to use for signing.
-            --check=str            Check a host's DANE TLSA entry.
-            --check-ee             Check only the end-entity's certificate.
-            --check-ca             Check only the CA's certificate.
-            --insecure             Do not verify any DNSSEC signature.
-            --local-dns            Use the local DNS server for DNSSEC resolving.
-                                     - disabled as --no-local-dns
-            --inder                Use DER format for input certificates and private keys.
-                                     - disabled as --no-inder
-            --inraw                This is an alias for 'inder'
+            --hash=str             Hash algorithm to use for signing
+            --check=str            Check a host's DANE TLSA entry
+            --check-ee             Check only the end-entity's certificate
+            --check-ca             Check only the CA's certificate
+            --insecure             Do not verify any DNSSEC signature
+            --local-dns            Use the local DNS server for DNSSEC resolving
+                                     - disabled as '--no-local-dns'
+            --inder                Use DER format for input certificates and private keys
+                                     - disabled as '--no-inder'
+            --inraw                an alias for the 'inder' option
             --tlsa-rr              Print the DANE RR data on a certificate or public key
-                                     - requires these options:
-                                     host
+                                     - requires the option 'host'
             --host=str             Specify the hostname to be used in the DANE RR
             --proto=str            The protocol set for DANE data (tcp, udp etc.)
-            --port=num             Specify the port number for the DANE data.
+            --port=num             Specify the port number for the DANE data
             --ca                   Whether the provided certificate or public key is a Certificate
-     Authority.
-            --x509                 Use the hash of the X.509 certificate, rather than the public key.
-            --local                This is an alias for 'domain'
+     Authority
+            --x509                 Use the hash of the X.509 certificate, rather than the public key
+            --local                an alias for the 'domain' option
                                      - enabled by default
-            --domain               The provided certificate or public key is issued by the local domain.
-                                     - disabled as --no-domain
+            --domain               The provided certificate or public key is issued by the local domain
+                                     - disabled as '--no-domain'
                                      - enabled by default
-        -v, --version[=arg]        Output version information and exit
-        -h, --help                 Display extended usage information and exit
-        -!, --more-help            Extended usage information passed thru pager
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
 
      Options are specified by doubled hyphens and their name or by a single
      hyphen and the flag character.
 
-
-
      Tool to generate and check DNS resource records for the DANE protocol.
 
-     please send bug reports to:  bug-gnutls@gnu.org
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
 
 load-pubkey option
 ..................
 
-This is the "loads a public key file" option.  This option takes an
-argument string.  This can be either a file or a PKCS #11 URL
+This is the "loads a public key file" option.  This option takes a
+string argument.  This can be either a file or a PKCS #11 URL
 
 load-certificate option
 .......................
 
-This is the "loads a certificate file" option.  This option takes an
-argument string.  This can be either a file or a PKCS #11 URL
+This is the "loads a certificate file" option.  This option takes a
+string argument.  This can be either a file or a PKCS #11 URL
 
 dlv option
 ..........
 
-This is the "sets a dlv file" option.  This option takes an argument
-string.  This sets a DLV file to be used for DNSSEC verification.
+This is the "sets a dlv file" option.  This option takes a string
+argument.  This sets a DLV file to be used for DNSSEC verification.
 
 hash option
 ...........
 
-This is the "hash algorithm to use for signing."  option.  This option
-takes an argument string.  Available hash functions are SHA1, RMD160,
+This is the "hash algorithm to use for signing" option.  This option
+takes a string argument.  Available hash functions are SHA1, RMD160,
 SHA256, SHA384, SHA512.
 
 check option
 ............
 
-This is the "check a host's dane tlsa entry."  option.  This option
-takes an argument string.  Obtains the DANE TLSA entry from the given
-hostname and prints information.  Note that the actual certificate of
-the host has to be provided using -load-certificate.
+This is the "check a host's dane tlsa entry" option.  This option takes
+a string argument.  Obtains the DANE TLSA entry from the given hostname
+and prints information.  Note that the actual certificate of the host
+has to be provided using -load-certificate.
 
 check-ee option
 ...............
 
-This is the "check only the end-entity's certificate."  option.  Checks
+This is the "check only the end-entity's certificate" option.  Checks
 the end-entity's certificate only.  Trust anchors or CAs are not
 considered.
 
 check-ca option
 ...............
 
-This is the "check only the ca's certificate."  option.  Checks the
-trust anchor's and CA's certificate only.  End-entities are not
-considered.
+This is the "check only the ca's certificate" option.  Checks the trust
+anchor's and CA's certificate only.  End-entities are not considered.
 
 insecure option
 ...............
 
-This is the "do not verify any dnssec signature."  option.  Ignores any
+This is the "do not verify any dnssec signature" option.  Ignores any
 DNSSEC signature verification results.
 
 local-dns option
 ................
 
-This is the "use the local dns server for dnssec resolving."  option.
+This is the "use the local dns server for dnssec resolving" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-local-dns.
+
 This option will use the local DNS server for DNSSEC. This is disabled
 by default due to many servers not allowing DNSSEC.
 
 inder option
 ............
 
-This is the "use der format for input certificates and private keys."
-option.  The input files will be assumed to be in DER or RAW format.
-Unlike options that in PEM input would allow multiple input data (e.g.
+This is the "use der format for input certificates and private keys"
+option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-inder.
+
+The input files will be assumed to be in DER or RAW format.  Unlike
+options that in PEM input would allow multiple input data (e.g.
 multiple certificates), when reading in DER format a single data
 structure is read.
 
 inraw option
 ............
 
-This is an alias for the inder option, *note the inder option
+This is an alias for the 'inder' option, *note the inder option
 documentation: danetool inder.
 
 tlsa-rr option
@@ -4052,45 +4099,46 @@ host option
 ...........
 
 This is the "specify the hostname to be used in the dane rr" option.
-This option takes an argument string 'Hostname'.  This command sets the
+This option takes a string argument 'Hostname'.  This command sets the
 hostname for the DANE RR.
 
 proto option
 ............
 
 This is the "the protocol set for dane data (tcp, udp etc.)"  option.
-This option takes an argument string 'Protocol'.  This command specifies
+This option takes a string argument 'Protocol'.  This command specifies
 the protocol for the service set in the DANE data.
 
 ca option
 .........
 
 This is the "whether the provided certificate or public key is a
-certificate authority."  option.  Marks the DANE RR as a CA certificate
-if specified.
+certificate authority" option.  Marks the DANE RR as a CA certificate if
+specified.
 
 x509 option
 ...........
 
 This is the "use the hash of the x.509 certificate, rather than the
-public key."  option.  This option forces the generated record to
-contain the hash of the full X.509 certificate.  By default only the
-hash of the public key is used.
+public key" option.  This option forces the generated record to contain
+the hash of the full X.509 certificate.  By default only the hash of the
+public key is used.
 
 local option
 ............
 
-This is an alias for the domain option, *note the domain option
+This is an alias for the 'domain' option, *note the domain option
 documentation: danetool domain.
 
 domain option
 .............
 
 This is the "the provided certificate or public key is issued by the
-local domain."  option.
+local domain" option.
 
 This option has some usage constraints.  It:
-   * is enabled by default.
+   * can be disabled with -no-domain.
+   * It is enabled by default.
 
 DANE distinguishes certificates and public keys offered via the DNSSEC
 to trusted and local entities.  This flag indicates that this is a
@@ -4260,39 +4308,38 @@ This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'srptool' program.  This software is
 released under the GNU General Public License, version 3 or later.
 
-srptool help/usage (-h)
-.......................
+srptool help/usage ('--help')
+.............................
+
+This is the automatically generated usage text for srptool.
 
-This is the automatically generated usage text for srptool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-     srptool - GnuTLS SRP tool - Ver. 3.1.11
-     USAGE:  srptool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+     srptool - GnuTLS SRP tool
+     Usage:  srptool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
 
-        -d, --debug=num            Enable debugging.
-                                     - It must be in the range:
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
                                        0 to 9999
-        -i, --index                specify the index of the group parameters in tpasswd.conf to use.
+        -i, --index=num            specify the index of the group parameters in tpasswd.conf to use
         -u, --username=str         specify a username
-        -p, --passwd=str           specify a password file.
-        -s, --salt=num             specify salt size.
+        -p, --passwd=str           specify a password file
+        -s, --salt=num             specify salt size
             --verify               just verify the password.
         -v, --passwd-conf=str      specify a password conf file.
             --create-conf=str      Generate a password configuration file.
-        -v, --version[=arg]        Output version information and exit
-        -h, --help                 Display extended usage information and exit
-        -!, --more-help            Extended usage information passed thru pager
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
 
      Options are specified by doubled hyphens and their name or by a single
      hyphen and the flag character.
 
-
-
      Simple program that emulates the programs in the Stanford SRP (Secure
      Remote Password) libraries using GnuTLS.  It is intended for use in places
      where you don't expect SRP authentication to be the used for system users.
@@ -4301,13 +4348,13 @@ exit with a status code of 0.
      file that holds the users and the verifiers associated with them and the
      configuration file to hold the group parameters (called tpasswd.conf).
 
-     please send bug reports to:  bug-gnutls@gnu.org
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
 
 verify option
 .............
@@ -4319,16 +4366,15 @@ passwd-conf option (-v)
 .......................
 
 This is the "specify a password conf file."  option.  This option takes
-an argument string.  Specify a filename or a PKCS #11 URL to read the
-CAs from.
+a string argument.  Specify a filename or a PKCS #11 URL to read the CAs
+from.
 
 create-conf option
 ..................
 
 This is the "generate a password configuration file."  option.  This
-option takes an argument string.  This generates a password
-configuration file (tpasswd.conf) containing the required for TLS
-parameters.
+option takes a string argument.  This generates a password configuration
+file (tpasswd.conf) containing the required for TLS parameters.
 
 srptool exit status
 ...................
@@ -4398,6 +4444,10 @@ key exchange methods are:
      Diffie-Hellman key exchange.  This method offers perfect forward
      secrecy.
 
+'RSA-PSK:'
+     Authentication using the PSK protocol for the client and an RSA
+     certificate for the server.
+
 Helper functions to generate and maintain PSK keys are also included in
 GnuTLS.
 
@@ -4418,47 +4468,46 @@ This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'psktool' program.  This software is
 released under the GNU General Public License, version 3 or later.
 
-psktool help/usage (-h)
-.......................
+psktool help/usage ('--help')
+.............................
+
+This is the automatically generated usage text for psktool.
 
-This is the automatically generated usage text for psktool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-     psktool - GnuTLS PSK tool - Ver. 3.1.11
-     USAGE:  psktool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+     psktool - GnuTLS PSK tool
+     Usage:  psktool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
 
-        -d, --debug=num            Enable debugging.
-                                     - It must be in the range:
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
                                        0 to 9999
         -s, --keysize=num          specify the key size in bytes
-                                     - It must be in the range:
+                                     - it must be in the range:
                                        0 to 512
         -u, --username=str         specify a username
-        -p, --passwd=str           specify a password file.
-        -v, --version[=arg]        Output version information and exit
-        -h, --help                 Display extended usage information and exit
-        -!, --more-help            Extended usage information passed thru pager
+        -p, --passwd=str           specify a password file
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
 
      Options are specified by doubled hyphens and their name or by a single
      hyphen and the flag character.
 
-
-
      Program that generates random keys for use with TLS-PSK.  The keys are
      stored in hexadecimal format in a key file.
 
-     please send bug reports to:  bug-gnutls@gnu.org
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
 
 psktool exit status
 ...................
@@ -4497,9 +4546,13 @@ File: gnutls.info,  Node: Anonymous authentication,  Prev: PSK authentication,
 The anonymous key exchange offers encryption without any indication of
 the peer's identity.  This kind of authentication is vulnerable to a man
 in the middle attack, but can be used even if there is no prior
-communication or shared trusted parties with the peer.  Moreover it is
-useful when complete anonymity is required.  Unless in one of the above
-cases, do not use anonymous authentication.
+communication or shared trusted parties with the peer.  Nevertheless it
+is useful when complete anonymity is required.
+
+Unless in the above case, it is not recommended to use anonymous
+authentication.  An alternative with better properties is trust on first
+use (see *note Verifying a certificate using trust on first use
+authentication::).
 
 The available key exchange algorithms for anonymous authentication are
 shown below, but note that few public servers support them.  They
@@ -4725,7 +4778,7 @@ import public keys from URLs that identify objects stored in tokens (see
 function to check for a supported by GnuTLS URL is *note
 gnutls_url_is_supported::.
 
- -- Function: int gnutls_url_is_supported (const char* URL)
+ -- Function: int gnutls_url_is_supported (const char * URL)
      URL: A PKCS 11 url
 
      Check whether url is supported.  Depending on the system libraries
@@ -4749,7 +4802,7 @@ digest on a part of the subjectPublicKeyInfo object.
 'INT *note gnutls_pubkey_get_pk_algorithm:: (gnutls_pubkey_t KEY, unsigned int * BITS)'
 'INT *note gnutls_pubkey_get_preferred_hash_algorithm:: (gnutls_pubkey_t KEY, gnutls_digest_algorithm_t * HASH, unsigned int * MAND)'
 'INT *note gnutls_pubkey_get_key_id:: (gnutls_pubkey_t KEY, unsigned int FLAGS, unsigned char * OUTPUT_DATA, size_t * OUTPUT_DATA_SIZE)'
-'INT *note gnutls_random_art:: (gnutls_random_art_t TYPE, const char* KEY_TYPE, unsigned int KEY_SIZE, void * FPR, size_t FPR_SIZE, gnutls_datum_t* ART)'
+'INT *note gnutls_random_art:: (gnutls_random_art_t TYPE, const char * KEY_TYPE, unsigned int KEY_SIZE, void * FPR, size_t FPR_SIZE, gnutls_datum_t * ART)'
 
 To export the key-specific parameters, or obtain a unique key ID the
 following functions are provided.
@@ -4757,7 +4810,7 @@ following functions are provided.
 'INT *note gnutls_pubkey_get_pk_rsa_raw:: (gnutls_pubkey_t KEY, gnutls_datum_t * M, gnutls_datum_t * E)'
 'INT *note gnutls_pubkey_get_pk_dsa_raw:: (gnutls_pubkey_t KEY, gnutls_datum_t * P, gnutls_datum_t * Q, gnutls_datum_t * G, gnutls_datum_t * Y)'
 'INT *note gnutls_pubkey_get_pk_ecc_raw:: (gnutls_pubkey_t KEY, gnutls_ecc_curve_t * CURVE, gnutls_datum_t * X, gnutls_datum_t * Y)'
-'INT *note gnutls_pubkey_get_pk_ecc_x962:: (gnutls_pubkey_t KEY, gnutls_datum_t* PARAMETERS, gnutls_datum_t * ECPOINT)'
+'INT *note gnutls_pubkey_get_pk_ecc_x962:: (gnutls_pubkey_t KEY, gnutls_datum_t * PARAMETERS, gnutls_datum_t * ECPOINT)'
 
 
 File: gnutls.info,  Node: Abstract private keys,  Next: Operations,  Prev: Abstract public keys,  Up: Abstract key types
@@ -4779,8 +4832,8 @@ Other helper functions that allow directly importing from raw X.509 or
 OpenPGP structures are shown below.  Again, as with public keys, private
 keys can be imported from a hardware module using URLs.
 
-'INT *note gnutls_privkey_import_x509_raw:: (gnutls_privkey_t PKEY, const gnutls_datum_t * DATA, gnutls_x509_crt_fmt_t FORMAT, const char* PASSWORD, unsigned int FLAGS)'
-'INT *note gnutls_privkey_import_openpgp_raw:: (gnutls_privkey_t PKEY, const gnutls_datum_t * DATA, gnutls_openpgp_crt_fmt_t FORMAT, const gnutls_openpgp_keyid_t KEYID, const char* PASSWORD)'
+'INT *note gnutls_privkey_import_x509_raw:: (gnutls_privkey_t PKEY, const gnutls_datum_t * DATA, gnutls_x509_crt_fmt_t FORMAT, const char * PASSWORD, unsigned int FLAGS)'
+'INT *note gnutls_privkey_import_openpgp_raw:: (gnutls_privkey_t PKEY, const gnutls_datum_t * DATA, gnutls_openpgp_crt_fmt_t FORMAT, const gnutls_openpgp_keyid_t KEYID, const char * PASSWORD)'
 
  -- Function: int gnutls_privkey_import_url (gnutls_privkey_t KEY, const
           char * URL, unsigned int FLAGS)
@@ -4808,7 +4861,7 @@ following function is provided.  This allows for a simple extensibility
 API without resorting to PKCS #11.
 
  -- Function: int gnutls_privkey_import_ext2 (gnutls_privkey_t PKEY,
-          gnutls_pk_algorithm_t PK, void* USERDATA,
+          gnutls_pk_algorithm_t PK, void * USERDATA,
           gnutls_privkey_sign_func SIGN_FUNC,
           gnutls_privkey_decrypt_func DECRYPT_FUNC,
           gnutls_privkey_deinit_func DEINIT_FUNC, unsigned int FLAGS)
@@ -4832,7 +4885,9 @@ API without resorting to PKCS #11.
      flags is assumed to contain 'GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE' .
 
      Note that the signing function is supposed to "raw" sign data,
-     i.e., without any hashing or preprocessing.
+     i.e., without any hashing or preprocessing.  In case of RSA the
+     DigestInfo will be provided, and the signing function is expected
+     to do the PKCS '1' 1.5 padding and the exponentiation.
 
      *Returns:* On success, 'GNUTLS_E_SUCCESS' (0) is returned,
      otherwise a negative error value.
@@ -4855,7 +4910,7 @@ verification operations with the underlying keys.
 
      ALGO: The signature algorithm used
 
-     FLAGS: Zero or on of 'gnutls_pubkey_flags_t'
+     FLAGS: Zero or one of 'gnutls_pubkey_flags_t'
 
      DATA: holds the signed data
 
@@ -4877,7 +4932,7 @@ verification operations with the underlying keys.
 
      ALGO: The signature algorithm used
 
-     FLAGS: Zero or on of 'gnutls_pubkey_flags_t'
+     FLAGS: Zero or one of 'gnutls_pubkey_flags_t'
 
      HASH: holds the hash digest to be verified
 
@@ -4917,7 +4972,7 @@ verification operations with the underlying keys.
 
      HASH: should be a digest algorithm
 
-     FLAGS: Zero or on of 'gnutls_privkey_flags_t'
+     FLAGS: Zero or one of 'gnutls_privkey_flags_t'
 
      DATA: holds the data to be signed
 
@@ -4945,7 +5000,7 @@ verification operations with the underlying keys.
 
      HASH_ALGO: The hash algorithm used
 
-     FLAGS: Zero or on of 'gnutls_privkey_flags_t'
+     FLAGS: Zero or one of 'gnutls_privkey_flags_t'
 
      HASH_DATA: holds the data to be signed
 
@@ -4960,6 +5015,10 @@ verification operations with the underlying keys.
      You may use 'gnutls_pubkey_get_preferred_hash_algorithm()' to
      determine the hash algorithm.
 
+     Note that if 'GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA' flag is specified
+     this function will ignore 'hash_algo' and perform a raw PKCS1
+     signature.
+
      *Returns:* On success, 'GNUTLS_E_SUCCESS' (0) is returned,
      otherwise a negative error value.
 
@@ -5049,7 +5108,7 @@ functionality is available in 'gnutls/pkcs11.h'.
 
 Moreover PKCS #11 can be (ab)used to allow all applications in the same
 operating system to access shared cryptographic keys and certificates in
-a uniform way, as in *note Figure 5.1: fig:pkcs11-vision.  That way
+a uniform way, as in *note Figure 5.1: fig-pkcs11-vision.  That way
 applications could load their trusted certificate list, as well as user
 certificates from a common PKCS #11 module.  Such a provider exists in
 the Gnome system, being the Gnome Keyring.
@@ -5298,47 +5357,45 @@ private key.
 
 #define URL "pkcs11:URL"
 
-int
-main (int argc, char** argv)
+int main(int argc, char **argv)
 {
-  gnutls_pkcs11_obj_t *obj_list;
-  gnutls_x509_crt_t xcrt;
-  unsigned int obj_list_size = 0;
-  gnutls_datum_t cinfo;
-  int ret;
-  unsigned int i;
-
-  obj_list_size = 0;
-  ret = gnutls_pkcs11_obj_list_import_url (NULL, &obj_list_size, URL,
-                                       GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY,
-                                       0);
-  if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
-    return -1;
+        gnutls_pkcs11_obj_t *obj_list;
+        gnutls_x509_crt_t xcrt;
+        unsigned int obj_list_size = 0;
+        gnutls_datum_t cinfo;
+        int ret;
+        unsigned int i;
+
+        obj_list_size = 0;
+        ret = gnutls_pkcs11_obj_list_import_url(NULL, &obj_list_size, URL,
+                                                GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY,
+                                                0);
+        if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
+                return -1;
 
 /* no error checking from now on */
-  obj_list = malloc (sizeof (*obj_list) * obj_list_size);
+        obj_list = malloc(sizeof(*obj_list) * obj_list_size);
 
-  gnutls_pkcs11_obj_list_import_url (obj_list, &obj_list_size, URL,
-                                     GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY,
-                                     0);
+        gnutls_pkcs11_obj_list_import_url(obj_list, &obj_list_size, URL,
+                                          GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY,
+                                          0);
 
 /* now all certificates are in obj_list */
-  for (i = 0; i < obj_list_size; i++)
-    {
+        for (i = 0; i < obj_list_size; i++) {
 
-      gnutls_x509_crt_init (&xcrt);
+                gnutls_x509_crt_init(&xcrt);
 
-      gnutls_x509_crt_import_pkcs11 (xcrt, obj_list[i]);
+                gnutls_x509_crt_import_pkcs11(xcrt, obj_list[i]);
 
-      gnutls_x509_crt_print (xcrt, GNUTLS_CRT_PRINT_FULL, &cinfo);
+                gnutls_x509_crt_print(xcrt, GNUTLS_CRT_PRINT_FULL, &cinfo);
 
-      fprintf (stdout, "cert[%d]:\n %s\n\n", i, cinfo.data);
+                fprintf(stdout, "cert[%d]:\n %s\n\n", i, cinfo.data);
 
-      gnutls_free (cinfo.data);
-      gnutls_x509_crt_deinit (xcrt);
-    }
+                gnutls_free(cinfo.data);
+                gnutls_x509_crt_deinit(xcrt);
+        }
 
-  return 0;
+        return 0;
 }
 
 
@@ -5417,12 +5474,12 @@ File: gnutls.info,  Node: Using a PKCS11 token with TLS,  Next: p11tool Invocati
 -------------------------------------
 
 It is possible to use a PKCS #11 token to a TLS session, as shown in
-*note ex:pkcs11-client::.  In addition the following functions can be
+*note ex-pkcs11-client::.  In addition the following functions can be
 used to load PKCS #11 key and certificates by specifying a PKCS #11 URL
 instead of a filename.
 
 'INT *note gnutls_certificate_set_x509_trust_file:: (gnutls_certificate_credentials_t CRED, const char * CAFILE, gnutls_x509_crt_fmt_t TYPE)'
-'INT *note gnutls_certificate_set_x509_key_file2:: (gnutls_certificate_credentials_t RES, const char * CERTFILE, const char * KEYFILE, gnutls_x509_crt_fmt_t TYPE, const char* PASS, unsigned int FLAGS)'
+'INT *note gnutls_certificate_set_x509_key_file2:: (gnutls_certificate_credentials_t RES, const char * CERTFILE, const char * KEYFILE, gnutls_x509_crt_fmt_t TYPE, const char * PASS, unsigned int FLAGS)'
 
  -- Function: int gnutls_certificate_set_x509_system_trust
           (gnutls_certificate_credentials_t CRED)
@@ -5450,32 +5507,38 @@ modules.
 
 To use PKCS #11 tokens with gnutls the configuration file
 /etc/gnutls/pkcs11.conf has to exist and contain a number of lines of
-the form 'load=/usr/lib/opensc-pkcs11.so'.
+the form 'load=/usr/lib/opensc-pkcs11.so'.  Alternatively the p11-kit
+configuration files have to be setup.
+
+To provide the PIN for all the operations below use the environment
+variable GNUTLS_PIN.
 
 This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'p11tool' program.  This software is
 released under the GNU General Public License, version 3 or later.
 
-p11tool help/usage (-h)
-.......................
+p11tool help/usage ('--help')
+.............................
 
-This is the automatically generated usage text for p11tool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+This is the automatically generated usage text for p11tool.
 
-     p11tool - GnuTLS PKCS #11 tool - Ver. 3.1.11
-     USAGE:  p11tool [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [url]
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-        -d, --debug=num            Enable debugging.
-                                     - It must be in the range:
+     p11tool - GnuTLS PKCS #11 tool
+     Usage:  p11tool [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [url]
+
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
                                        0 to 9999
             --outfile=str          Output file
             --list-tokens          List all available tokens
             --export               Export the object specified by the URL
+            --export-chain         Export the certificate specified by the URL and its chain of trust
             --list-mechanisms      List all available mechanisms in a token
             --list-all             List all available objects in a token
             --list-all-certs       List all available certificates in a token
@@ -5485,19 +5548,20 @@ exit with a status code of 0.
             --initialize           Initializes a PKCS #11 token
             --write                Writes the loaded objects to a PKCS #11 token
             --delete               Deletes the objects matching the PKCS #11 URL
+            --generate-random=num  Generate random data
             --generate-rsa         Generate an RSA private-public key pair
             --generate-dsa         Generate an RSA private-public key pair
             --generate-ecc         Generate an RSA private-public key pair
             --label=str            Sets a label for the write operation
             --trusted              Marks the object to be written as trusted
-                                     - disabled as --no-trusted
+                                     - disabled as '--no-trusted'
             --private              Marks the object to be written as private
-                                     - disabled as --no-private
+                                     - disabled as '--no-private'
                                      - enabled by default
             --login                Force login to token
-                                     - disabled as --no-login
+                                     - disabled as '--no-login'
             --detailed-url         Print detailed URLs
-                                     - disabled as --no-detailed-url
+                                     - disabled as '--no-detailed-url'
             --secret-key=str       Provide a hex encoded secret key
             --load-privkey=file    Private key file to use
                                      - file must pre-exist
@@ -5509,34 +5573,47 @@ exit with a status code of 0.
             --bits=num             Specify the number of bits for key generate
             --sec-param=str        Specify the security level
             --inder                Use DER/RAW format for input
-                                     - disabled as --no-inder
-            --inraw                This is an alias for 'inder'
+                                     - disabled as '--no-inder'
+            --inraw                an alias for the 'inder' option
+            --outder               Use DER format for output certificates, private keys, and DH parameters
+                                     - disabled as '--no-outder'
+            --outraw               an alias for the 'outder' option
             --provider=file        Specify the PKCS #11 provider library
                                      - file must pre-exist
-        -v, --version[=arg]        Output version information and exit
-        -h, --help                 Display extended usage information and exit
-        -!, --more-help            Extended usage information passed thru pager
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
 
      Options are specified by doubled hyphens and their name or by a single
      hyphen and the flag character.
      Operands and options may be intermixed.  They will be reordered.
 
-
-
      Program that allows handling data from PKCS #11 smart cards and security
      modules.
 
      To use PKCS #11 tokens with gnutls the configuration file
      /etc/gnutls/pkcs11.conf has to exist and contain a number of lines of the
-     form 'load=/usr/lib/opensc-pkcs11.so'.
+     form 'load=/usr/lib/opensc-pkcs11.so'.  Alternatively the p11-kit
+     configuration files have to be setup.
 
-     please send bug reports to:  bug-gnutls@gnu.org
+     To provide the PIN for all the operations below use the environment
+     variable GNUTLS_PIN.
+
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
+
+export-chain option
+...................
+
+This is the "export the certificate specified by the url and its chain
+of trust" option.  Exports the certificate specified by the URL and
+generates its chain of trust based on the stored certificates in the
+module.
 
 write option
 ............
@@ -5545,6 +5622,12 @@ This is the "writes the loaded objects to a pkcs #11 token" option.  It
 can be used to write private keys, certificates or secret keys to a
 token.
 
+generate-random option
+......................
+
+This is the "generate random data" option.  This option takes a number
+argument.  Asks the token to generate a number of bytes of random bytes.
+
 generate-rsa option
 ...................
 
@@ -5569,34 +5652,56 @@ private option
 This is the "marks the object to be written as private" option.
 
 This option has some usage constraints.  It:
-   * is enabled by default.
+   * can be disabled with -no-private.
+   * It is enabled by default.
 
 The written object will require a PIN to be used.
 
 sec-param option
 ................
 
-This is the "specify the security level" option.  This option takes an
-argument string 'Security parameter'.  This is alternative to the bits
+This is the "specify the security level" option.  This option takes a
+string argument 'Security parameter'.  This is alternative to the bits
 option.  Available options are [low, legacy, normal, high, ultra].
 
 inder option
 ............
 
-This is the "use der/raw format for input" option.  Use DER/RAW format
-for input certificates and private keys.
+This is the "use der/raw format for input" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-inder.
+
+Use DER/RAW format for input certificates and private keys.
 
 inraw option
 ............
 
-This is an alias for the inder option, *note the inder option
+This is an alias for the 'inder' option, *note the inder option
 documentation: p11tool inder.
 
+outder option
+.............
+
+This is the "use der format for output certificates, private keys, and
+dh parameters" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-outder.
+
+The output will be in DER or RAW format.
+
+outraw option
+.............
+
+This is an alias for the 'outder' option, *note the outder option
+documentation: p11tool outder.
+
 provider option
 ...............
 
 This is the "specify the pkcs #11 provider library" option.  This option
-takes an argument file.  This will override the default options in
+takes a file argument.  This will override the default options in
 /etc/gnutls/pkcs11.conf
 
 p11tool exit status
@@ -5647,19 +5752,18 @@ File: gnutls.info,  Node: Trusted Platform Module,  Prev: Smart cards and HSMs,
 =================================
 
 In this section we present the Trusted Platform Module (TPM) support in
-GnuTLS.  Note that this functionality is disabled by default because the
-'trousers' libraries GnuTLS depends on for that functionality are under
-the Common Public License which is not compatible with the GPL license.
+GnuTLS.
 
 There was a big hype when the TPM chip was introduced into computers.
 Briefly it is a co-processor in your PC that allows it to perform
 calculations independently of the main processor.  This has good and bad
-side-effects.  In this section we focus on the good ones, which are the
-fact that you can use it to perform cryptographic operations the
-similarly to a PKCS #11 smart card.  It allows for storing and using RSA
-keys but with slight differences from a PKCS #11 module that require
-different handling.  The basic operations supported, and used by GnuTLS,
-are key generation and signing.
+side-effects.  In this section we focus on the good ones; these are the
+fact that you can use the TPM chip to perform cryptographic operations
+on keys stored in it, without accessing them.  That is very similar to
+the operation of a PKCS #11 smart card.  The chip allows for storage and
+usage of RSA keys, but has quite some operational differences from PKCS
+#11 module, and thus require different handling.  The basic TPM
+operations supported and used by GnuTLS, are key generation and signing.
 
 In GnuTLS the TPM functionality is available in 'gnutls/tpm.h'.
 
@@ -5679,7 +5783,7 @@ File: gnutls.info,  Node: Keys in TPM,  Next: Key generation,  Up: Trusted Platf
 The RSA keys in the TPM module may either be stored in a flash memory
 within TPM or stored in a file in disk.  In the former case the key can
 provide operations as with PKCS #11 and is identified by a URL. The URL
-is described in [_TPMURI_] and are of the following form.
+is described in [_TPMURI_] and is of the following form.
 tpmkey:uuid=42309df8-d101-11e1-a89a-97bb33c23ad1;storage=user
 
 It consists from a unique identifier of the key as well as the part of
@@ -5711,10 +5815,10 @@ All keys used by the TPM must be generated by the TPM. This can be done
 using *note gnutls_tpm_privkey_generate::.
 
  -- Function: int gnutls_tpm_privkey_generate (gnutls_pk_algorithm_t PK,
-          unsigned int BITS, const char* SRK_PASSWORD, const char*
+          unsigned int BITS, const char * SRK_PASSWORD, const char *
           KEY_PASSWORD, gnutls_tpmkey_fmt_t FORMAT,
-          gnutls_x509_crt_fmt_t PUB_FORMAT, gnutls_datum_t* PRIVKEY,
-          gnutls_datum_t* PUBKEY, unsigned int FLAGS)
+          gnutls_x509_crt_fmt_t PUB_FORMAT, gnutls_datum_t * PRIVKEY,
+          gnutls_datum_t * PUBKEY, unsigned int FLAGS)
      PK: the public key algorithm
 
      BITS: the security bits
@@ -5751,10 +5855,10 @@ using *note gnutls_tpm_privkey_generate::.
 
 'INT *note gnutls_tpm_get_registered:: (gnutls_tpm_key_list_t * LIST)'
 'VOID *note gnutls_tpm_key_list_deinit:: (gnutls_tpm_key_list_t LIST)'
-'INT *note gnutls_tpm_key_list_get_url:: (gnutls_tpm_key_list_t LIST, unsigned int IDX, char** URL, unsigned int FLAGS)'
+'INT *note gnutls_tpm_key_list_get_url:: (gnutls_tpm_key_list_t LIST, unsigned int IDX, char ** URL, unsigned int FLAGS)'
 
- -- Function: int gnutls_tpm_privkey_delete (const char* URL, const
-          char* SRK_PASSWORD)
+ -- Function: int gnutls_tpm_privkey_delete (const char * URL, const
+          char * SRK_PASSWORD)
      URL: the URL describing the key
 
      SRK_PASSWORD: a password for the SRK key
@@ -5783,7 +5887,7 @@ gnutls_certificate_set_x509_key_file2:: can access TPM URLs.
 'INT *note gnutls_pubkey_import_tpm_raw:: (gnutls_pubkey_t PKEY, const gnutls_datum_t * FDATA, gnutls_tpmkey_fmt_t FORMAT, const char * SRK_PASSWORD, unsigned int FLAGS)'
 
  -- Function: int gnutls_privkey_import_tpm_url (gnutls_privkey_t PKEY,
-          const char* URL, const char * SRK_PASSWORD, const char *
+          const char * URL, const char * SRK_PASSWORD, const char *
           KEY_PASSWORD, unsigned int FLAGS)
      PKEY: The private key
 
@@ -5811,7 +5915,7 @@ gnutls_certificate_set_x509_key_file2:: can access TPM URLs.
      *Since:* 3.1.0
 
  -- Function: int gnutls_pubkey_import_tpm_url (gnutls_pubkey_t PKEY,
-          const char* URL, const char * SRK_PASSWORD, unsigned int
+          const char * URL, const char * SRK_PASSWORD, unsigned int
           FLAGS)
      PKEY: The public key
 
@@ -5846,10 +5950,10 @@ gnutls_tpm_privkey_delete::.
 
 'INT *note gnutls_tpm_get_registered:: (gnutls_tpm_key_list_t * LIST)'
 'VOID *note gnutls_tpm_key_list_deinit:: (gnutls_tpm_key_list_t LIST)'
-'INT *note gnutls_tpm_key_list_get_url:: (gnutls_tpm_key_list_t LIST, unsigned int IDX, char** URL, unsigned int FLAGS)'
+'INT *note gnutls_tpm_key_list_get_url:: (gnutls_tpm_key_list_t LIST, unsigned int IDX, char ** URL, unsigned int FLAGS)'
 
- -- Function: int gnutls_tpm_privkey_delete (const char* URL, const
-          char* SRK_PASSWORD)
+ -- Function: int gnutls_tpm_privkey_delete (const char * URL, const
+          char * SRK_PASSWORD)
      URL: the URL describing the key
 
      SRK_PASSWORD: a password for the SRK key
@@ -5873,24 +5977,67 @@ This section was generated by *AutoGen*, using the 'agtexi-cmd' template
 and the option descriptions for the 'tpmtool' program.  This software is
 released under the GNU General Public License, version 3 or later.
 
-tpmtool help/usage (-h)
-.......................
+tpmtool help/usage ('--help')
+.............................
+
+This is the automatically generated usage text for tpmtool.
 
-This is the automatically generated usage text for tpmtool.  The text
-printed is the same whether for the 'help' option (-h) or the
-'more-help' option (-!).  'more-help' will print the usage text by
-passing it through a pager program.  'more-help' is disabled on
-platforms without a working 'fork(2)' function.  The 'PAGER' environment
-variable is used to select the program, defaulting to 'more'.  Both will
-exit with a status code of 0.
+The text printed is the same whether selected with the 'help' option
+('--help') or the 'more-help' option ('--more-help').  'more-help' will
+print the usage text by passing it through a pager program.  'more-help'
+is disabled on platforms without a working 'fork(2)' function.  The
+'PAGER' environment variable is used to select the program, defaulting
+to 'more'.  Both will exit with a status code of 0.
 
-     tpmtool is unavailable - no -h
+     tpmtool - GnuTLS TPM tool
+     Usage:  tpmtool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
+
+        -d, --debug=num            Enable debugging
+                                     - it must be in the range:
+                                       0 to 9999
+            --infile=file          Input file
+                                     - file must pre-exist
+            --outfile=str          Output file
+            --generate-rsa         Generate an RSA private-public key pair
+            --register             Any generated key will be registered in the TPM
+                                     - requires the option 'generate-rsa'
+            --signing              Any generated key will be a signing key
+                                     - requires the option 'generate-rsa'
+                                     -- and prohibits the option 'legacy'
+            --legacy               Any generated key will be a legacy key
+                                     - requires the option 'generate-rsa'
+                                     -- and prohibits the option 'signing'
+            --user                 Any registered key will be a user key
+                                     - requires the option 'register'
+                                     -- and prohibits the option 'system'
+            --system               Any registred key will be a system key
+                                     - requires the option 'register'
+                                     -- and prohibits the option 'user'
+            --pubkey=str           Prints the public key of the provided key
+            --list                 Lists all stored keys in the TPM
+            --delete=str           Delete the key identified by the given URL (UUID).
+            --sec-param=str        Specify the security level [low, legacy, normal, high, ultra].
+            --bits=num             Specify the number of bits for key generate
+            --inder                Use the DER format for keys.
+                                     - disabled as '--no-inder'
+            --outder               Use DER format for output keys
+                                     - disabled as '--no-outder'
+        -v, --version[=arg]        output version information and exit
+        -h, --help                 display extended usage information and exit
+        -!, --more-help            extended usage information passed thru pager
+
+     Options are specified by doubled hyphens and their name or by a single
+     hyphen and the flag character.
+
+     Program that allows handling cryptographic data from the TPM chip.
+
+     Please send bug reports to:  <bugs@gnutls.org>
 
 debug option (-d)
 .................
 
-This is the "enable debugging."  option.  This option takes an argument
-number.  Specifies the debug level.
+This is the "enable debugging" option.  This option takes a number
+argument.  Specifies the debug level.
 
 generate-rsa option
 ...................
@@ -5928,7 +6075,7 @@ sec-param option
 ................
 
 This is the "specify the security level [low, legacy, normal, high,
-ultra]."  option.  This option takes an argument string 'Security
+ultra]."  option.  This option takes a string argument 'Security
 parameter'.  This is alternative to the bits option.  Note however that
 the values allowed by the TPM chip are quantized and given values may be
 rounded up.
@@ -5936,15 +6083,23 @@ rounded up.
 inder option
 ............
 
-This is the "use the der format for keys."  option.  The input files
-will be assumed to be in the portable DER format of TPM. The default
-format is a custom format used by various TPM tools
+This is the "use the der format for keys."  option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-inder.
+
+The input files will be assumed to be in the portable DER format of TPM.
+The default format is a custom format used by various TPM tools
 
 outder option
 .............
 
-This is the "use der format for output keys" option.  The output will be
-in the TPM portable DER format.
+This is the "use der format for output keys" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-outder.
+
+The output will be in the TPM portable DER format.
 
 tpmtool exit status
 ...................
@@ -6027,7 +6182,7 @@ File: gnutls.info,  Node: General idea,  Next: Error handling,  Up: Introduction
 ------------------
 
 A brief description of how GnuTLS sessions operate is shown at *note
-Figure 6.1: fig:gnutls-design.  This section will become more clear when
+Figure 6.1: fig-gnutls-design.  This section will become more clear when
 it is completely read.  As shown in the figure, there is a read-only
 global state that is initialized once by the global initialization
 function.  This global structure, among others, contains the memory
@@ -6140,6 +6295,10 @@ verbose information on the GnuTLS functions internal flow.
 'VOID *note gnutls_global_set_log_level:: (int LEVEL)'
 'VOID *note gnutls_global_set_log_function:: (gnutls_log_func LOG_FUNC)'
 
+Alternatively the environment variable 'GNUTLS_DEBUG_LEVEL' can be set
+to a logging level and GnuTLS will output debugging output to standard
+error.
+
 When debugging is not required, important issues, such as detected
 attacks on the protocol still need to be logged.  This is provided by
 the logging function set by *note
@@ -6152,11 +6311,12 @@ about the peer involved.
           (gnutls_audit_log_func LOG_FUNC)
      LOG_FUNC: it is the audit log function
 
-     This is the function where you set the logging function gnutls is
-     going to use.  This is different from
-     'gnutls_global_set_log_function()' because it will report the
-     session of the event if any.  Note that that session might be null
-     if there is no corresponding TLS session.
+     This is the function to set the audit logging function.  This is a
+     function to report important issues, such as possible attacks in
+     the protocol.  This is different from
+     'gnutls_global_set_log_function()' because it will report also
+     session-specific events.  The session parameter will be null if
+     there is no corresponding TLS session.
 
      'gnutls_audit_log_func' is of the form, void
      (*gnutls_audit_log_func)( gnutls_session_t, const char*);
@@ -6278,10 +6438,12 @@ File: gnutls.info,  Node: Initialization,  Next: Version check,  Prev: Headers,
 --------------------
 
 GnuTLS must be initialized before it can be used.  The library is
-initialized by calling *note gnutls_global_init::.  The resources
-allocated by the initialization process can be released if the
-application no longer has a need to call GnuTLS functions, this is done
-by calling *note gnutls_global_deinit::.
+initialized by calling *note gnutls_global_init::.  That call typically
+enables CPU-specific acceleration, and performs any requires
+precalculations needed by the library.  The resources allocated by the
+initialization process can be released if the application no longer has
+a need to call GnuTLS functions, this is done by calling *note
+gnutls_global_deinit::.
 
 In order to take advantage of the internationalization features in
 GnuTLS, such as translated error messages, the application must set the
@@ -6300,6 +6462,15 @@ dynamic linker an old version is actually used.  So you may want to
 check that the version is okay right after program start-up.  See the
 function *note gnutls_check_version::.
 
+On the other hand, it is often desirable to support more than one
+versions of the library.  In that case you could utilize compile-time
+feature checks using the the 'GNUTLS_VERSION_NUMBER' macro.  For
+example, to conditionally add code for GnuTLS 3.2.1 or later, you may
+use:
+     #if GNUTLS_VERSION_NUMBER >= 0x030201
+      ...
+     #endif
+
 
 File: gnutls.info,  Node: Building the source,  Prev: Version check,  Up: Preparation
 
@@ -6381,6 +6552,10 @@ underlying protocol type, i.e., datagram (UDP) or reliable (TCP).
      also available.  The latter flag will enable a non-blocking
      operation of the DTLS timers.
 
+     The flag 'GNUTLS_NO_REPLAY_PROTECTION' will disable any replay
+     protection in DTLS mode.  That must only used when replay
+     protection is achieved using other means.
+
      Note that since version 3.1.2 this function enables some common TLS
      extensions such as session tickets and OCSP certificate status
      request in client side by default.  To prevent that use the
@@ -6500,9 +6675,9 @@ The certificate chain must be ordered in such way that every certificate
 certifies the one before it.  The trusted authority's certificate need
 not to be included since the peer should possess it already.
 
-'INT *note gnutls_certificate_set_x509_key_mem2:: (gnutls_certificate_credentials_t RES, const gnutls_datum_t * CERT, const gnutls_datum_t * KEY, gnutls_x509_crt_fmt_t TYPE, const char* PASS, unsigned int FLAGS)'
+'INT *note gnutls_certificate_set_x509_key_mem2:: (gnutls_certificate_credentials_t RES, const gnutls_datum_t * CERT, const gnutls_datum_t * KEY, gnutls_x509_crt_fmt_t TYPE, const char * PASS, unsigned int FLAGS)'
 'INT *note gnutls_certificate_set_x509_key:: (gnutls_certificate_credentials_t RES, gnutls_x509_crt_t * CERT_LIST, int CERT_LIST_SIZE, gnutls_x509_privkey_t KEY)'
-'INT *note gnutls_certificate_set_x509_key_file2:: (gnutls_certificate_credentials_t RES, const char * CERTFILE, const char * KEYFILE, gnutls_x509_crt_fmt_t TYPE, const char* PASS, unsigned int FLAGS)'
+'INT *note gnutls_certificate_set_x509_key_file2:: (gnutls_certificate_credentials_t RES, const char * CERTFILE, const char * KEYFILE, gnutls_x509_crt_fmt_t TYPE, const char * PASS, unsigned int FLAGS)'
 
 'INT *note gnutls_certificate_set_openpgp_key_mem:: (gnutls_certificate_credentials_t RES, const gnutls_datum_t * CERT, const gnutls_datum_t * KEY, gnutls_openpgp_crt_fmt_t FORMAT)'
 'INT *note gnutls_certificate_set_openpgp_key:: (gnutls_certificate_credentials_t RES, gnutls_openpgp_crt_t CRT, gnutls_openpgp_privkey_t PKEY)'
@@ -6540,9 +6715,9 @@ gnutls_pcert_import_x509_raw:: and *note
 gnutls_privkey_import_x509_raw::.
 
  -- Function: int gnutls_certificate_set_key
-          (gnutls_certificate_credentials_t RES, const char** NAMES, int
-          NAMES_SIZE, gnutls_pcert_st * PCERT_LIST, int PCERT_LIST_SIZE,
-          gnutls_privkey_t KEY)
+          (gnutls_certificate_credentials_t RES, const char ** NAMES,
+          int NAMES_SIZE, gnutls_pcert_st * PCERT_LIST, int
+          PCERT_LIST_SIZE, gnutls_privkey_t KEY)
      RES: is a 'gnutls_certificate_credentials_t' structure.
 
      NAMES: is an array of DNS name of the certificate (NULL if none)
@@ -6561,9 +6736,11 @@ gnutls_privkey_import_x509_raw::.
      called more than once, in case multiple keys/certificates exist for
      the server.  For clients that wants to send more than its own end
      entity certificate (e.g., also an intermediate CA cert) then put
-     the certificate chain in 'pcert_list' .  The 'pcert_list' and 'key'
-     will become part of the credentials structure and must not be
-     deallocated.  They will be automatically deallocated when 'res' is
+     the certificate chain in 'pcert_list' .
+
+     Note that the 'pcert_list' and 'key' will become part of the
+     credentials structure and must not be deallocated.  They will be
+     automatically deallocated when the 'res' structure is
      deinitialized.
 
      *Returns:* 'GNUTLS_E_SUCCESS' (0) on success, or a negative error
@@ -6600,10 +6777,10 @@ typedef struct gnutls_pcert_st
   gnutls_certificate_type_t type;
 } gnutls_pcert_st;
 
-'INT *note gnutls_pcert_import_x509:: (gnutls_pcert_st* PCERT, gnutls_x509_crt_t CRT, unsigned int FLAGS)'
-'INT *note gnutls_pcert_import_openpgp:: (gnutls_pcert_st* PCERT, gnutls_openpgp_crt_t CRT, unsigned int FLAGS)'
-'INT *note gnutls_pcert_import_x509_raw:: (gnutls_pcert_st * PCERT, const gnutls_datum_t* CERT, gnutls_x509_crt_fmt_t FORMAT, unsigned int FLAGS)'
-'INT *note gnutls_pcert_import_openpgp_raw:: (gnutls_pcert_st * PCERT, const gnutls_datum_t* CERT, gnutls_openpgp_crt_fmt_t FORMAT, gnutls_openpgp_keyid_t KEYID, unsigned int FLAGS)'
+'INT *note gnutls_pcert_import_x509:: (gnutls_pcert_st * PCERT, gnutls_x509_crt_t CRT, unsigned int FLAGS)'
+'INT *note gnutls_pcert_import_openpgp:: (gnutls_pcert_st * PCERT, gnutls_openpgp_crt_t CRT, unsigned int FLAGS)'
+'INT *note gnutls_pcert_import_x509_raw:: (gnutls_pcert_st * PCERT, const gnutls_datum_t * CERT, gnutls_x509_crt_fmt_t FORMAT, unsigned int FLAGS)'
+'INT *note gnutls_pcert_import_openpgp_raw:: (gnutls_pcert_st * PCERT, const gnutls_datum_t * CERT, gnutls_openpgp_crt_fmt_t FORMAT, gnutls_openpgp_keyid_t KEYID, unsigned int FLAGS)'
 'VOID *note gnutls_pcert_deinit:: (gnutls_pcert_st * PCERT)'
 
 In a handshake, the negotiated cipher suite depends on the certificate's
@@ -6685,7 +6862,7 @@ to obtain the raw certificate of the peer and verify it using the
 functions discussed in *note X.509 certificates::.
 
  -- Function: int gnutls_certificate_verify_peers3 (gnutls_session_t
-          SESSION, const char* HOSTNAME, unsigned int * STATUS)
+          SESSION, const char * HOSTNAME, unsigned int * STATUS)
      SESSION: is a gnutls session
 
      HOSTNAME: is the expected name of the peer; may be 'NULL'
@@ -6823,8 +7000,8 @@ appropriate callback.
      SRP credentials.  The callback's function form is:
 
      int (*callback)(gnutls_session_t, const char* username,
-     gnutls_datum_t* salt, gnutls_datum_t *verifier, gnutls_datum_t* g,
-     gnutls_datum_t* n);
+     gnutls_datum_t* salt, gnutls_datum_t *verifier, gnutls_datum_t*
+     generator, gnutls_datum_t* prime);
 
      'username' contains the actual username.  The 'salt' , 'verifier' ,
      'generator' and 'prime' must be filled in using the
@@ -7115,106 +7292,3 @@ be called again.
 * Asynchronous operation::
 * DTLS sessions::
 
-
-File: gnutls.info,  Node: Asynchronous operation,  Next: DTLS sessions,  Up: Setting up the transport layer
-
-6.5.1 Asynchronous operation
-----------------------------
-
-GnuTLS can be used with asynchronous socket or event-driven programming.
-The approach is similar to using Berkeley sockets under such an
-environment.  The blocking, due to network interaction, calls such as
-*note gnutls_handshake::, *note gnutls_record_recv::, can be set to
-non-blocking by setting the underlying sockets to non-blocking.  If
-other push and pull functions are setup, then they should behave the
-same way as 'recv' and 'send' when used in a non-blocking way, i.e., set
-errno to 'EAGAIN'.  Since, during a TLS protocol session GnuTLS does not
-block except for network interaction, the non blocking 'EAGAIN' errno
-will be propagated and GnuTLS functions will return the 'GNUTLS_E_AGAIN'
-error code.  Such calls can be resumed the same way as a system call
-would.  The only exception is *note gnutls_record_send::, which if
-interrupted subsequent calls need not to include the data to be sent
-(can be called with NULL argument).
-
-The 'select' system call can also be used in combination with the GnuTLS
-functions.  'select' allows monitoring of sockets and notifies on them
-being ready for reading or writing data.  Note however that this system
-call cannot notify on data present in GnuTLS read buffers, it is only
-applicable to the kernel sockets API. Thus if you are using it for
-reading from a GnuTLS session, make sure that any cached data are read
-completely.  That can be achieved by checking there are no data waiting
-to be read (using *note gnutls_record_check_pending::), either before
-the 'select' system call, or after a call to *note gnutls_record_recv::.
-GnuTLS does not keep a write buffer, thus when writing no additional
-actions are required.
-
-Although in the TLS protocol implementation each call to receive or send
-function implies to restoring the same function that was interrupted, in
-the DTLS protocol this requirement isn't true.  There are cases where a
-retransmission is required, which are indicated by a received message
-and thus *note gnutls_record_get_direction:: must be called to decide
-which direction to check prior to restoring a function call.
-
- -- Function: int gnutls_record_get_direction (gnutls_session_t SESSION)
-     SESSION: is a 'gnutls_session_t' structure.
-
-     This function provides information about the internals of the
-     record protocol and is only useful if a prior gnutls function call
-     (e.g.  'gnutls_handshake()' ) was interrupted for some reason, that
-     is, if a function returned 'GNUTLS_E_INTERRUPTED' or
-     'GNUTLS_E_AGAIN' .  In such a case, you might want to call
-     'select()' or 'poll()' before calling the interrupted gnutls
-     function again.  To tell you whether a file descriptor should be
-     selected for either reading or writing,
-     'gnutls_record_get_direction()' returns 0 if the interrupted
-     function was trying to read data, and 1 if it was trying to write
-     data.
-
-     *Returns:* 0 if trying to read data, 1 if trying to write data.
-
-Moreover, to prevent blocking from DTLS' retransmission timers to block
-a handshake, the *note gnutls_init:: function should be called with the
-'GNUTLS_NONBLOCK' flag set (see *note Session initialization::).
-
-
-File: gnutls.info,  Node: DTLS sessions,  Prev: Asynchronous operation,  Up: Setting up the transport layer
-
-6.5.2 DTLS sessions
--------------------
-
-Because datagram TLS can operate over connections where the peer of a
-server cannot be reliably verified, functionality is available to
-prevent denial of service attacks.  GnuTLS requires a server to generate
-a secret key that is used to sign a cookie(1).  That cookie is sent to
-the client using *note gnutls_dtls_cookie_send::, and the client must
-reply using the correct cookie.  The server side should verify the
-initial message sent by client using *note gnutls_dtls_cookie_verify::.
-If successful the session should be initialized and associated with the
-cookie using *note gnutls_dtls_prestate_set::, before proceeding to the
-handshake.
-
-'INT *note gnutls_key_generate:: (gnutls_datum_t * KEY, unsigned int KEY_SIZE)'
-'INT *note gnutls_dtls_cookie_send:: (gnutls_datum_t* KEY, void* CLIENT_DATA, size_t CLIENT_DATA_SIZE, gnutls_dtls_prestate_st* PRESTATE, gnutls_transport_ptr_t PTR, gnutls_push_func PUSH_FUNC)'
-'INT *note gnutls_dtls_cookie_verify:: (gnutls_datum_t* KEY, void* CLIENT_DATA, size_t CLIENT_DATA_SIZE, void* _MSG, size_t MSG_SIZE, gnutls_dtls_prestate_st* PRESTATE)'
-'VOID *note gnutls_dtls_prestate_set:: (gnutls_session_t SESSION, gnutls_dtls_prestate_st* PRESTATE)'
-
-Note that the above apply to server side only and they are not mandatory
-to be used.  Not using them, however, allows denial of service attacks.
-The client side cookie handling is part of *note gnutls_handshake::.
-
-Datagrams are typically restricted by a maximum transfer unit (MTU). For
-that both client and server side should set the correct maximum transfer
-unit for the layer underneath GnuTLS.  This will allow proper
-fragmentation of DTLS messages and prevent messages from being silently
-discarded by the transport layer.  The "correct" maximum transfer unit
-can be obtained through a path MTU discovery mechanism [_RFC4821_].
-
-'VOID *note gnutls_dtls_set_mtu:: (gnutls_session_t SESSION, unsigned int MTU)'
-'UNSIGNED INT *note gnutls_dtls_get_mtu:: (gnutls_session_t SESSION)'
-'UNSIGNED INT *note gnutls_dtls_get_data_mtu:: (gnutls_session_t SESSION)'
-
-   ---------- Footnotes ----------
-
-   (1) A key of 128 bits or 16 bytes should be sufficient for this
-purpose.
-