openssl/crypto, branch master

s390x: Display 'cex_min_bits' and 'nocex' as part of CPUINFO

2026-10-23T15:19:41Z

Command 'openssl version -c' as well as other commands (e.g. 'openssl speed') display the CPU information. For s390x, this includes the OPENSSL_s390xcap settings that are currently in place. Also display the 'cex_min_bits:' and 'nocex' settings there. The 'cex_min_bits' setting is always displayed, showing the default value if it was not explicitly specified via the OPENSSL_s390xcap environment variable. The 'nocex' setting is only displayed when it was explicitly set via the OPENSSL_s390xcap environment variable, or if offloading is disabled because no crypto adapters are available or the file descriptor has been closed by other means. Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:46 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

s390x: Disable mod-expo offloading to a crypto card for small exponents

2026-10-23T15:19:37Z

Add a new keyword 'cex_min_bits:' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

poly1305-armv9-sve2.pl: close STDOUT before exiting

2026-10-23T12:49:38Z

The last line of the script was " STDOUT or die ...", without the "close" keyword, so the pipe to arm-xlate.pl was never closed explicitly. Perl could then exit before arm-xlate.pl had written the output file, and make compiled poly1305-armv9-sve2.S before it existed: gcc: error: crypto/poly1305/poly1305-armv9-sve2.S: No such file or directory This was seen on linux-aarch64 builds in the manylinux2014 image (perl 5.16.3) under QEMU. Running the generator alone 5 times in that image, the output file was missing right after perl exited 5 times out of 5; with this change, 0 times out of 5. The other perlasm scripts, for example poly1305-armv8.pl and chacha-armv8-sve.pl, already end with "close STDOUT or die ...". CLA: trivial Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Shane Lontis Reviewed-by: Tom Cosgrove Merge-date: Fri Oct 23 12:49:47 2026 Merged-from: https://github.com/openssl/openssl/pull/33276

ml_kem: add AVX2 base multiplication and accumulation

2026-10-21T16:38:18Z

Use AVX2 NTT-domain multiplication and accumulation for ML-KEM inner products, matrix products, and the transposed matrix product used in key generation. Rename the x86_64 perlasm source to reflect its wider scope. Assisted-by: ChatGPT:gpt-6-Sol Reviewed-by: Neil Horman Reviewed-by: Mounir Idrassi Merge-date: Wed Oct 21 16:38:25 2026 Merged-from: https://github.com/openssl/openssl/pull/33023

ml_kem: add AVX2 NTT and inverse NTT

2026-10-21T16:38:18Z

Implement the FIPS 203 transforms in x86_64 perlasm with AVX2 runtime dispatch. Assisted-by: ChatGPT:gpt-6-Sol Reviewed-by: Neil Horman Reviewed-by: Mounir Idrassi Merge-date: Wed Oct 21 16:38:25 2026 Merged-from: https://github.com/openssl/openssl/pull/33023

aes: fix riscv64 constant-time fallback selection

2026-10-21T16:17:29Z

Reviewed-by: Andrew Dinh Reviewed-by: Mounir Idrassi Merge-date: Wed Oct 21 16:17:44 2026 Merged-from: https://github.com/openssl/openssl/pull/31080

aes: remove unused riscv64 assembly generation

2026-10-21T16:17:29Z

Reviewed-by: Andrew Dinh Reviewed-by: Mounir Idrassi Merge-date: Wed Oct 21 16:17:44 2026 Merged-from: https://github.com/openssl/openssl/pull/31080

aes: make riscv64 no-Zkn fallback constant time

2026-10-21T16:17:28Z

Reviewed-by: Andrew Dinh Reviewed-by: Mounir Idrassi Merge-date: Wed Oct 21 16:17:44 2026 Merged-from: https://github.com/openssl/openssl/pull/31080

x509: key the duplicate-extension hash with SipHash to resist flooding

2026-10-21T15:58:47Z

scan_ext_flags() deduplicates certificate extensions. Standard extensions have an assigned NID and are handled by an O(1) bitset, but unknown or dynamically registered OIDs fall back to an hash table. Hash the OID with SipHash under a random key drawn once per scan, so the bucket an OID lands in is unpredictable to an attacker. This mirrors the existing defense for attacker-controlled keys in ssl/quic/quic_lcidm.c. If the table cannot be set up or an insert fails, fail closed with EXFLAG_INVALID, as ossl_x509v3_cache_extensions() does for any other extension it cannot process. Leaving the loop silently would skip not only the duplicate check but also the unsupported-critical check for this and every later extension. Discovered by Anthropic's OSS Scanner (finding ANT-2026-7UKRZ2MY). Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Merge-date: Wed Oct 21 15:58:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33281

CMS_get0_signers() returns only the signers that passed verification

2026-10-21T15:38:13Z

With CMS_VERIFY_PARTIAL, CMS_verify() succeeds as long as at least one SignerInfo verifies, but CMS_get0_signers() still returned the certificate of every SignerInfo, defeating "signed by X" or "signed by N signers" policies. The same applied to the certificates written by "openssl cms -verify -verify_partial -signer". This commit fixes CMS_get0_signers() behaviour returning only certificates of signers that passed verification. Nothing changes if CMS_VERIFY_PARTIAL isn't set. Reported-by: Anthropic OSS scan id ANT-2026-GF4OIPVH Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Merge-date: Wed Oct 21 15:39:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33279