openssl/build.info, branch dependabot/github_actions/actions/setup-python-7

FIPS: Add HMAC key size compliance check to the MAC legacy bridge.

2026-04-28T07:13:23Z

The hmac fips provider implementation used by the EVP_MAC API handles key size checks, but it only does the test for the internal case. Previously HMAC was implemented using EVP_DigestSign related functions, and these are implemented using a mac_legacy_sig bridge, because of this the MAC is external. For external cases the caller is responsible for doing any key checks, so a FIPS indicator has been added. Reported-by: https://github.com/taha2samy Fixes: #30012 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Paul Dale MergeDate: Tue Apr 28 07:13:24 2026 (Merged from https://github.com/openssl/openssl/pull/30150)

Slight enhancement of commentary for exported configurations

2026-03-26T15:14:26Z

There's a misunderstanding regarding the use of .pc and .cmake files found in the top of the build tree vs in its 'exporters' subdirectory. Some added commentary, especially in the files being produced, might help clarify their uses. Resolves: https://github.com/openssl/openssl/issues/28803 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky MergeDate: Thu Mar 26 15:19:09 2026 (Merged from https://github.com/openssl/openssl/pull/28858)

Add IKEV2KDF implementation

2026-03-24T17:21:19Z

In compliance with RFC7296 and SP800-135 Reviewed-by: Neil Horman Reviewed-by: Shane Lontis Reviewed-by: Paul Dale MergeDate: Tue Mar 24 17:21:21 2026 (Merged from https://github.com/openssl/openssl/pull/30121)

Add support for CSHAKE.

2026-01-23T14:07:51Z

Unlike SHAKE this has default values set for the xof length. CSHAKE uses either SHAKE or KECCAK[c] depending on whether custom strings are set or not. If either string is set, it encodes the strings and uses KECCAK[c], otherwise it behaves the same as SHAKE (without the default xof length problem). Reviewed-by: Paul Dale Reviewed-by: Norbert Pocs MergeDate: Fri Jan 23 14:07:53 2026 (Merged from https://github.com/openssl/openssl/pull/28432)

Add SRTPKDF implementation

2026-01-23T10:19:31Z

In compliance with RFC 3711, Section 4.3.3 Reviewed-by: Paul Dale Reviewed-by: Shane Lontis MergeDate: Fri Jan 23 10:19:32 2026 (Merged from https://github.com/openssl/openssl/pull/29435)

KDF: Add configuration options to disable many of the KDF algorithms.

2026-01-19T04:51:45Z

This includes KDF's for ss,x963,hmac-drbg,KB,KRB5,PVK,SNMP,SSH and X942. SSKDF/X963KDF Changes: Modify code to handle algorithms being disabled via configuration options. Reviewed-by: Tim Hudson Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/29576)

ML-DSA: Add a digest that can calculate external mu.

2026-01-14T07:15:12Z

Reviewed-by: Viktor Dukhovni Reviewed-by: Tim Hudson Reviewed-by: Simo Sorce Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/29223)

Remove the c_rehash script

2025-12-19T15:10:24Z

The `openssl rehash` should be used instead. Signed-off-by: Norbert Pocs Reviewed-by: Richard Levitte Reviewed-by: Nikola Pajkovsky Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/29427)

Use generated param decoders in SHA provider

2025-12-12T08:08:34Z

Refactor the SHA provider's context parameter handling in sha2_prov.c to use the generated parameter decoder framework. This change replaces manual parameter lookups using `OSSL_PARAM_locate` and static `OSSL_PARAM` arrays with generated decoder functions and structs. A new template, `sha2_prov.inc.in`, is added to create the necessary decoders during the build. This simplifies the code, reduces boilerplate, and improves type safety. Signed-off-by: Simo Sorce Reviewed-by: Shane Lontis Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/28837)

Add SNMPKDF implementation

2025-12-10T02:21:48Z

In compliance with SP800-135 and RFC7860 Reviewed-by: Shane Lontis Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/29195)