openssl/providers/implementations/ciphers/cipher_aes_ocb.c, branch master

AES-OCB: reject a NULL input to update

2026-10-21T16:59:44Z

EVP_EncryptUpdate() with a NULL input buffer and a nonzero length read from the NULL pointer in CRYPTO_ocb128_aad(), a NULL-pointer dereference detected by ASan. Reject the call instead. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale Reviewed-by: Neil Horman Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157

AEADs: add an error to the queue on tag mismatch

2026-09-04T17:39:20Z

Decrypt with a wrong tag for each AEAD and inspect the error reason left on the queue. Repeat for ciphertext only, AAD only, and ciphertext + AAD. The tag rejection must fail at EVP_DecryptFinal_ex(), and leave error PROV_R_BAD_DECRYPT on the queue. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Neil Horman Reviewed-by: Daniel Kubec Reviewed-by: Tomas Mraz Merge-date: Fri Sep 4 17:39:21 2026 Merged-from: https://github.com/openssl/openssl/pull/32587

Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs

2026-08-07T13:34:34Z

At the EVP level, for AEADs EVP_Cipher(ctx, out, NULL, 0) performs finalization. For consistency across AEADs (GCM, etc.), on decrypt it must check the tag. OCB and ChaCha20-Poly1305 took an early exit on the empty message (with or without AAD) and returned success without checking, so a forged tag (with or without AAD) was accepted before this change. Follow-up to #31555 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Dmitry Belyavskiy MergeDate: Fri Aug 7 13:34:35 2026 (Merged from https://github.com/openssl/openssl/pull/32173)

[test] check tag abuse for AEAD ciphers

2026-06-30T07:47:01Z

With AEAD ciphers, a tag is an input for decryption (the value to verify) and an output of encryption (the generated value). Therefore: - supplying a tag value while encrypting must fail - reading a tag while decrypting must fail - error codes should be consistent across all AEADs Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Daniel Kubec MergeDate: Tue Jun 30 07:47:03 2026 (Merged from https://github.com/openssl/openssl/pull/31734)

Apply the buffered IV on the AES-OCB EVP_Cipher() path

2026-06-11T15:08:41Z

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:02:00 2026

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Switch FIPS self tests to deferred execution

2026-02-13T09:53:41Z

Update the FIPS module to run self-tests on demand (deferred) rather than on module load. Change the test definitions in self_test_data.c from SELF_TEST_ONLOAD to SELF_TEST_DEFERRED. Add calls to ossl_deferred_self_test() in the newctx functions for ciphers, digests, signatures, KDFs, KEMs and DRBGs to trigger execution upon first instantiation. Introduce CIPHER_PROV_CHECK and DIGEST_PROV_CHECK macros in common headers to facilitate these checks. Define dependencies for composite tests to ensure prerequisite tests run when needed. Signed-off-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/29222)

Redo source reformatting with the TypeNames added

2025-12-17T15:19:43Z

This resulted in some source reformatting becoming a bit less trippy This is the script I used to run clang-format appropriately enough: #! /bin/bash include_re=$(yq -r '.repos.[].hooks.[] | select(.id == "clang-format") | .files' < .pre-commit-config.yaml) known_generated=( crypto/bn/bn_prime.h crypto/objects/obj_dat.h crypto/objects/obj_xref.h include/openssl/obj_mac.h crypto/conf/conf_def.h crypto/asn1/charmap.h '*_err.c' '*err.h' ) exclusions=() for g in "${known_generated[@]}"; do # Convert pattern to a regex g=${g//\./\\.} g=${g//\*/.\*} exclusions+=( "^${g}\$" ) done # Join all exclusions into one regex exclude_re=$(IFS='|'; echo "${exclusions[*]}") (set -x; git ls-files | grep -E $include_re | grep -Ev $exclude_re | xargs clang-format -i) Reviewed-by: Paul Yang Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/29383)

4.0-POST-CLANG-FORMAT-WEBKIT

2025-12-09T07:28:19Z

Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Nikola Pajkovsky (Merged from https://github.com/openssl/openssl/pull/29242)

ciphers: Use include file for generated code

2025-10-20T07:45:53Z

Signed-off-by: Simo Sorce Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/28838)