openssl/doc, branch master

s390x: Disable mod-expo offloading to a crypto card for small exponents

2026-10-23T15:19:37Z

Add a new keyword 'cex_min_bits:' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

doc: RAND(7): a restore from a saved image is not detected; reseed after it

2026-10-23T12:51:41Z

The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Viktor Dukhovni Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285

Document the OSSL_PARAM_merge() entry limit

2026-10-23T12:47:43Z

OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244

doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examples

2026-10-23T12:44:46Z

The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Shane Lontis Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228

TLS: Generate the server random before processing ClientHello extensions

2026-10-21T16:45:28Z

The server random was only generated after all of the ClientHello extensions had been processed. In (D)TLSv1.3 the PSK callbacks are invoked while the pre_shared_key extension is being parsed, so a call to SSL_get_server_random() from within them returned all zeros. The TLSv1.2 psk_server_callback runs during ClientKeyExchange processing and so already observed the real value, making the behaviour inconsistent between protocol versions. Move the generation of the server random to immediately after the protocol version has been selected and before any of the remaining ClientHello processing. As a result the server random is also visible from the other callbacks invoked during ClientHello processing, such as the session ticket and servername callbacks. Fixes #26404 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Tomas Mraz Reviewed-by: Frederik Wedel-Heinen Merge-date: Wed Oct 21 16:45:34 2026 Merged-from: https://github.com/openssl/openssl/pull/33102

Removes clean DES and RC2 as encryption methods for TLS ciphersuites and refactors the fetching of NULL cipher to be consistent.

2026-10-21T16:22:53Z

Reviewed-by: Mounir Idrassi Reviewed-by: Dmitry Belyavskiy Merge-date: Wed Oct 21 16:22:59 2026 Merged-from: https://github.com/openssl/openssl/pull/32051

CMS_get0_signers() returns only the signers that passed verification

2026-10-21T15:38:13Z

With CMS_VERIFY_PARTIAL, CMS_verify() succeeds as long as at least one SignerInfo verifies, but CMS_get0_signers() still returned the certificate of every SignerInfo, defeating "signed by X" or "signed by N signers" policies. The same applied to the certificates written by "openssl cms -verify -verify_partial -signer". This commit fixes CMS_get0_signers() behaviour returning only certificates of signers that passed verification. Nothing changes if CMS_VERIFY_PARTIAL isn't set. Reported-by: Anthropic OSS scan id ANT-2026-GF4OIPVH Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Merge-date: Wed Oct 21 15:39:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33279

doc/man3/EC_GROUP_new.pod: document EC_GROUP_get_ecpkparameters function

2026-10-18T15:25:49Z

Added EC_GROUP_get_ecpkparameters() function description and usage details. Complements: 60b350a3ef96 "RT3676: Expose ECgroup i2d functions" Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 18 15:26:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32169

DTLS listener: make max_pending_conns a combined admission budget

2026-10-14T10:51:10Z

The pending-connection cap only applied to pending_conns, the table of connections still doing their handshake: the moment a connection passed cookie validation it was moved onto the accept queue (incoming_connections) with no length check and no expiry. A reachable peer completing the ordinary cookie exchange from many source endpoints could accumulate an unbounded, unexpiring queue of listener-owned SSL objects. This is the same missing admission bound as the QUIC listener admission check fixed in [1]; the DTLS listener is new in 4.1 and not in any final release. Mirror the QUIC fix: enforce the bound at admission, in the packet handler, before any per-connection state is allocated. SSL_VALUE_DTLS_LISTENER_MAX_PENDING_CONNS is now a single admission budget covering both listener-owned tables, pending plus accept queue, so listener-owned connections are bounded at N in total, including under SSL_LISTENER_FLAG_NO_VALIDATE. Moving a connection from one table to the other leaves the total unchanged, so a validated connection can always be queued: none is discarded, and no handshake work (cookie exchange, server flight) is spent on an attempt that cannot be admitted. A peer whose datagram is dropped while the budget is exhausted retransmits its ClientHello and is admitted once the application drains the queue; measured on real UDP, such a client completes its handshake about one retransmit interval after the drain. This also aligns the DTLS knob's meaning with the QUIC one ("not yet accepted"), which it was modelled on in [2]. Accept-queue entries still do not expire; a full queue stays full until the application drains it. With the budget, an attacker can pin at most N accept-queue slots, and only after proving return routability - spoofed ClientHellos can still occupy pending slots until the pending timeout reaps them, as before this change - so what remains is a bounded availability concern, not memory exhaustion. [1] https://github.com/openssl/openssl/pull/32052 [2] https://github.com/openssl/openssl/pull/31980 Resolves: https://github.com/openssl/openssl/issues/33172 Assisted-by: Claude Code:moonshotai/kimi-k3 Reviewed-by: Tomas Mraz Reviewed-by: Ryan Hooper Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Oct 14 10:54:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33197

crypto/x509/x509_lu.c: avoid freeing X509_OBJECTs in X509_STORE_get0_objects()

2026-10-13T13:45:08Z

The implementation of hash table conversion in commit 04589b59ef50 "x509store: reduce lock contention in X509_STORE" introduced a potential use-after-free condition when X509_STORE_get0_objects() is called during X.509 verification. Avoid that by re-using existing X509_OBJECTs instead of duplicating them. Resolves: https://github.com/openssl/openssl/issues/33063 Fixes: 04589b59ef50 "x509store: reduce lock contention in X509_STORE" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Tue Oct 13 13:45:39 2026 Merged-from: https://github.com/openssl/openssl/pull/33147