openssl/include/arch, branch master

s390x: Disable mod-expo offloading to a crypto card for small exponents

2026-10-23T15:19:37Z

Add a new keyword 'cex_min_bits:' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

Remove VXE from requirements of S390X_VX_CAPABLE

2026-09-29T16:46:54Z

Note that in all instances where we check for VX using S390X_VX_CAPABLE for s390x, we do not need VXE. Signed-off-by: Timo Keller Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 16:47:12 2026 Merged-from: https://github.com/openssl/openssl/pull/31929

Copyright year updates

2026-09-09T13:12:46Z

Reviewed-by: Daniel Kubec Reviewed-by: Eugene Syromiatnikov Merge-date: Wed Sep 9 13:12:46 2026 Release: yes

aarch64: Declare support for Armv9.4-A GCS in assembly

2026-09-01T13:43:52Z

Guarded Control Stack (FEAT_GCS) is an architectural feature introduced in Armv9.4-A and is optionally supported by Armv9.3-A implementations. Signal that AArch64 assembly code is compliant with the Armv9.4-A GCS feature by emitting the appropriate .gnu.note.property. GCS can be turned on using the toolchain flag -mbranch-protection=standard with Clang 18+ and GCC 15+. The only requirement for assembly code to be compatible with GCS is that functions return to the address from which they were called. GCS enforces this requirement at run time using a protected shadow stack. Signed-off-by: Guillaume Gardet Signed-off-by: Gowtham Suresh Kumar Reviewed-by: Simo Sorce Reviewed-by: Tom Cosgrove Merge-date: Tue Sep 1 13:44:18 2026 Merged-from: https://github.com/openssl/openssl/pull/31162

Vectorize (inverse) NTT in ML-DSA

2026-06-10T09:25:56Z

The vectorization is implemented using vector extensions (of gcc/clang) and will work on any architecture with 128 bit vector registers that has the builtin `vec_mulh` for the high part of a multiplication. Enable this for s390x. The speed-up factor on z17 is around 2--3.4. Signed-off-by: Timo Keller Reviewed-by: Shane Lontis Reviewed-by: Saša Nedvědický MergeDate: Wed Jun 10 09:25:58 2026 (Merged from https://github.com/openssl/openssl/pull/30812)

Move *_arch.h to include/arch

2026-05-10T09:53:33Z

Move all the architecture specific header files under a single directory in include/ Signed-off-by: Norbert Pocs Reviewed-by: Nikola Pajkovsky Reviewed-by: Eugene Syromiatnikov MergeDate: Sun May 10 09:53:34 2026 (Merged from https://github.com/openssl/openssl/pull/30751)