openssl/crypto/evp, branch master

Make it clear that chacha20 is a stream cipher

2026-10-19T06:04:41Z

by explicitly using the define EVP_CIPH_STREAM_CIPHER instead of the value 0 for the mode parameter. Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Merge-date: Mon Oct 19 06:04:43 2026 Merged-from: https://github.com/openssl/openssl/pull/32393

Allow EVP_SKEY_get0_raw_key() to return only the key length

2026-10-05T10:27:11Z

There was no way to learn the length of an opaque EVP_SKEY without exporting the raw key, which is impossible for non-exportable keys (e.g. keys held in hardware). Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case only the length is returned. It is read from the OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported. The built-in generic and AES key managements now report that parameter. Fixes: https://github.com/openssl/openssl/issues/32998 Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy Merge-date: Mon Oct 5 10:28:09 2026 Merged-from: https://github.com/openssl/openssl/pull/33035

Add AVX2 base64 decoder for EVP_DecodeUpdate/EVP_DecodeBlock

2026-10-02T07:12:45Z

Fixes #29739 Reviewed-by: Paul Dale Reviewed-by: Mounir Idrassi Merge-date: Fri Oct 2 07:13:32 2026 Merged-from: https://github.com/openssl/openssl/pull/30115

Fix base64 BIO write retry handling

2026-09-25T11:02:38Z

Commit 3a69b19028 changed b64_write from chunked ctx->buf output to a dynamic encoded_buf. The new buffer was scratch-only, so retryable downstream failures or positive short writes could drop encoded output while still reporting the input bytes as consumed. Track encoded_buf as pending output with offset and length, include it in BIO_wpending, and write any pending output before accepting more input. Add tests for retry via -1, retry via 0, positive short writes, and short writes followed by retry, with and without BIO_FLAGS_BASE64_NO_NL, across both aligned input and final-tail input. Reviewed-by: Tomas Mraz Reviewed-by: Viktor Dukhovni Merge-date: Fri Sep 25 11:02:43 2026 Merged-from: https://github.com/openssl/openssl/pull/31000

Disable AVX2 base64 codec for MinGW GCC builds

2026-09-24T09:13:04Z

Fixes: https://github.com/openssl/openssl/issues/31672 Signed-off-by: Nikola Pajkovsky Reviewed-by: Milan Broz Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs Merge-date: Thu Sep 24 09:13:10 2026 Merged-from: https://github.com/openssl/openssl/pull/32899

Removes unused foreign member of evp_pkey_st

2026-09-16T14:34:42Z

Reviewed-by: Matt Caswell Reviewed-by: Dmitry Belyavskiy Merge-date: Wed Sep 16 14:34:46 2026 Merged-from: https://github.com/openssl/openssl/pull/32820

Copyright year updates

2026-09-09T13:12:46Z

Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Sep 9 13:12:46 2026 Release: yes

Pass parameters to evp_keymgmt_newdata

2026-09-07T18:53:05Z

Update EVP keymgmt utility and export functions to pass provided parameters, such as property queries, to evp_keymgmt_newdata() instead of NULL. Implement OSSL_FUNC_KEYMGMT_NEW_EX in the ML-DSA key management implementation to parse and apply property query parameters during key allocation, and add corresponding test coverage. Assisted-by: Gemini:Gemini 3.7 Flash Signed-off-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy Reviewed-by: Paul Dale Merge-date: Mon Sep 7 18:53:10 2026 Merged-from: https://github.com/openssl/openssl/pull/32636

Add metadata support to EVP_SKEY objects

2026-09-05T17:06:10Z

Assisted-by: Claude Opus 4.6 Reviewed-by: Mounir Idrassi Reviewed-by: Simo Sorce MergeDate: Sat Sep 5 17:06:55 2026 (Merged from https://github.com/openssl/openssl/pull/32644)

We don't need linking s_lib into FIPS provider

2026-09-02T15:03:50Z

Reviewed-by: Igor Ustinov Reviewed-by: Paul Dale Reviewed-by: Simo Sorce MergeDate: Wed Sep 2 15:04:35 2026 (Merged from https://github.com/openssl/openssl/pull/32626)