openssl/include/crypto, branch master

s390x: Disable mod-expo offloading to a crypto card for small exponents

2026-10-23T15:19:37Z

Add a new keyword 'cex_min_bits:' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki Reviewed-by: Dmitry Belyavskiy Reviewed-by: Neil Horman MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)

Optimize ML-KEM for the s390x architecture

2026-09-29T16:46:54Z

The vectorization is implemented using vector extensions (of gcc/clang) and will work on any architecture with 128 bit vector registers that has suitable builtins like `vec_mulh` for the high part of a multiplication. We also optimize the multiplication in `F_{q^2}` using a twisted Karatsuba multiplication. Bob has only been used for writing the comments based on a formal verification of the code, and for the extraction of the constants at the beginning of `ml_kem_vec128.c`. Enable this for s390x. Signed-off-by: Timo Keller Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 16:47:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31929

ec: make ossl_ec_scalar_mul_ladder() scalar padding constant time

2026-09-29T11:23:48Z

Fixes CVE-2026-54872 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alicja Kario Reviewed-by: Viktor Dukhovni Merge-date: Tue Sep 29 11:23:53 2026

Defer computation of relative CRLDP names

2026-09-29T11:11:17Z

These are derived just-in-time, during any actual CRL processing. Fixes CVE-2026-35189 Reviewed-by: Tomas Mraz Reviewed-by: Bob Beck Reviewed-by: Norbert Pocs Merge-date: Tue Sep 29 11:11:18 2026

Re-format code after TypenameMacros and ForEachMacros additions

2026-09-24T09:00:53Z

Re-formatting was done using the following command: for i in `git grep -l 'OSSL_LIST\|PRIORITY_QUEUE_OF\|SPARSE_ARRAY_OF' \ -- '*.c' '*.h' '*.c.in' '*.h.in'`; do \ clang-format-21 --style=file:.clang-format -i "$i"; \ done Signed-off-by: Eugene Syromiatnikov Reviewed-by: Milan Broz Reviewed-by: Nikola Pajkovsky Merge-date: Thu Sep 24 09:01:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32304

aes-ctr-avx512: disable the VAES-512 CTR path for MSVC

2026-09-21T09:57:30Z

MSVC 14.51 builds of the VAES-512 CTR kernel return a wrong keystream for AES-192 and AES-256 whenever the block count leaves a 4-block (single-zmm) step. The default CTR-DRBG runs on AES-256-CTR, so this also corrupts random byte generation and makes unrelated tests fail. The same code is correct on VAES hardware built with gcc, so keep the hook enabled there and off for MSVC until the code generation issue is found. AES-CBC decryption is unaffected and stays enabled. Hosted runners rarely have AVX-512, so whether CI exercises this path at all depends on which host a job lands on. Run evp_extra_test under Intel SDE as well, where -icx always reports VAES. Refs #32873 Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Merge-date: Mon Sep 21 09:57:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32883

NUL-terminate ASN1_STRING data built inside libcrypto

2026-09-18T09:05:47Z

Add ossl_asn1_string_set1_data() and ossl_asn1_string_set1_string(), copies of the public setters that also write a NUL byte after the data, and switch all libcrypto callers to them. The ecosystem still treats ASN1_STRING data as C strings; this keeps it working while it is fixed. Removing the terminator later is a one-argument change in one function. Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Merge-date: Fri Sep 18 09:05:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32829

Use SipHash for the internal fingerprint

2026-09-17T16:44:11Z

Replace SHA-1 with SipHash-2-4 (fixed key, 64-bit output) for the internal X509 and X509_CRL fingerprint. Always build crypto/siphash; no-siphash now only removes the provider MAC. Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Thu Sep 17 16:44:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32686

Compute X509_get_signature_info() on demand, not in the cache

2026-09-17T16:44:11Z

The signature info was computed once by ossl_x509v3_cache_extensions() and stored in X509::siginf. Its security bits depend on a digest fetch under the certificate's libctx/propq, so the cached answer was frozen to the context the certificate was parsed in. Compute it in X509_get_signature_info() instead. The siginf field and ossl_x509_init_sig_info() are removed. Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Thu Sep 17 16:44:34 2026 Merged-from: https://github.com/openssl/openssl/pull/32686

Make the cached SHA-1 fingerprint internal-only

2026-09-17T16:44:11Z

X509::sha1_hash exists only so X509_cmp() can compare certificates by identity, yet X509_digest() handed it to callers when asked for SHA-1, and it was computed under the certificate's libctx/propq, tying an internal value to the context the certificate was parsed in. Compute it with the built-in SHA-1 over the DER encoding instead, via the new ossl_x509_internal_fingerprint(), so it is the same in every library context; the only remaining failure mode is an allocation failure. Drop the X509_digest() shortcut so the cached value is never visible to callers, and rename the field to fingerprint in X509 and X509_CRL. The CRL side gets the same treatment in a following commit. Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Merge-date: Thu Sep 17 16:44:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32686