openssl/crypto/encode_decode, branch feature/evp_skey

Fix missing unlock in decoder_pkey.c

2025-08-12T18:15:50Z

We hit an assertion failure during a call to CRYPTO_THREAD_read_lock during memfail testing. This was caused by us attempting to take a read lock in the same thread that already held the same lock for writing resulting in an EBUSY return. This occured because we triggered a memory failure path in DECODER_new_for_pkey, which never unlocked a write lock we were holding. Fix it by ensuring the lock is released in the error path. Reviewed-by: Tomas Mraz Reviewed-by: Saša Nedvědický (Merged from https://github.com/openssl/openssl/pull/28216)

crypto: use array memory (re)allocation routines

2025-08-08T16:22:10Z

Co-Authored-by: Alexandr Nedvedicky Signed-off-by: Eugene Syromiatnikov Reviewed-by: Saša Nedvědický Reviewed-by: Matt Caswell Reviewed-by: Paul Dale Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/28059)

libapps + libcrypto: Silence warnings on Win64 builds

2025-07-02T15:26:26Z

Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/27806)

decoders: Fix prioritization of decoders via property query

2025-07-01T17:06:57Z

When a property query string was used, it was not being applied to decoders. When multiple providers supporting the same algorithm were loaded, it was undefined which provider would be used when decoding a key, even when a propquery string was provided. This fix scores decoder instances based on property query matching and selects the highest scored decoder instance when building the decoder chain. The fake_rsa test provider is updated to support basic encoding and decoding. A test is added using the fake_rsa provider to ensure that property query strings are respected when loading decoders. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/27876)

Copyright year updates

2025-03-12T13:35:59Z

Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Release: yes

Further decoder tuning possibly better perf

2025-03-01T15:04:09Z

- The decoder should consider fewer options based on more precise tracking of the desired input type (DER, PVK, MSBLOB), algorithm (RSA, EC, ...), input structure (SPKI, P8, ...). How much this affects actual use-cases is harder to estimate, we'll just have to run before/after perf tests. Reviewed-by: Tomas Mraz Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/26927)

Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called

2025-02-27T01:04:14Z

twice. Fixes #26862 This only happens when using the FIPS provider, since it needs to export the key. Reviewed-by: Tim Hudson Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/26891)

Use better data type info in decoders

2025-02-26T14:13:57Z

The decoders in some cases failed to capture or propagate information about what is being decoded, causing more work happen to try unrelated decoders as a fallback. We now try harder to keep track of the expected object (private key or public key, if known), and the algorithm determined from the OID of a PKCS8 object or SPKI. This leads in many cases to fewer decoder invocations. With so many more algorithms now, trying every decoder is increasingly best avoided. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/26892)

More consistent ML-KEM key checks

2025-02-19T22:59:22Z

- Cross-check seed `z` value on import as well as load. - In import/load When re-generating from a seed, check hash of any explicit private key when both provided. - Avoid leak of expanded key encoding when load fails. Reviewed-by: Tomas Mraz Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/26812)

Reject import of private keys that fail PCT

2025-02-14T09:50:59Z

- Also added a provider "validate" method that wraps the PCT test. Reviewed-by: Shane Lontis Reviewed-by: Tim Hudson Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/26656)