diff --git a/ChangeLog.d/require-matching-hashlen-rsa.txt b/ChangeLog.d/require-matching-hashlen-rsa.txt
new file mode 100644
index 0000000..d1420d1
--- /dev/null
+++ b/ChangeLog.d/require-matching-hashlen-rsa.txt
@@ -0,0 +1,4 @@
+API changes
+   * Functions in the RSA module that accept a hashlen parameter now require
+     it to match the output size of the hash algorithm used, except when
+     signing raw data.