Document the hexadecimal casing thing in

mab@ seems to be dealing with a fair number of these, so it's probably worth
adding to the list.

Change-Id: Ifaea3c96e7b089f28a87c7728ceb8c671786eb27
Reviewed-by: Adam Langley <>
diff --git a/ b/
index 70b67cc..04b28fa 100644
--- a/
+++ b/
@@ -123,6 +123,12 @@
 * If a HelloRequest is received while `SSL_write` has unsent application data,
   the renegotiation is rejected.
+### Lowercase hexadecimal
+BoringSSL's `BN_bn2hex` function uses lowercase hexadecimal digits instead of
+uppercase. Some code may require changes to avoid being sensitive to this
 ## Optional BoringSSL-specific simplifications