openssl/providers/implementations/kem, branch dependabot/github_actions/actions/setup-python-7

Eliminate unnecessary whitespace before a quoted newline

2026-07-08T10:10:54Z

Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jul 8 10:11:22 2026 (Merged from https://github.com/openssl/openssl/pull/31860)

rsa_kem: validate RSA_public_encrypt() result in RSASVE

2026-04-06T19:44:55Z

RSA_public_encrypt() returns the number of bytes written on success and -1 on failure. With the existing `if (ret)` check, a provider-side RSA KEM encapsulation can incorrectly succeed when the underlying RSA public encrypt operation fails. In that case the code reports success, returns lengths as if encapsulation completed normally, and leaves the freshly generated secret available instead of discarding it. Tighten the success condition so RSASVE only succeeds when RSA_public_encrypt() returns a positive value equal to the modulus-sized output expected for RSA_NO_PADDING. Any other return value is treated as failure, and the generated secret is cleansed before returning. Fixes CVE-2026-31790 Signed-off-by: Nikola Pajkovsky Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz MergeDate: Mon Apr 6 19:45:38 2026

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Switch FIPS self tests to deferred execution

2026-02-13T09:53:41Z

Update the FIPS module to run self-tests on demand (deferred) rather than on module load. Change the test definitions in self_test_data.c from SELF_TEST_ONLOAD to SELF_TEST_DEFERRED. Add calls to ossl_deferred_self_test() in the newctx functions for ciphers, digests, signatures, KDFs, KEMs and DRBGs to trigger execution upon first instantiation. Introduce CIPHER_PROV_CHECK and DIGEST_PROV_CHECK macros in common headers to facilitate these checks. Define dependencies for composite tests to ensure prerequisite tests run when needed. Signed-off-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/29222)

4.0-POST-CLANG-FORMAT-WEBKIT

2025-12-09T07:28:19Z

Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Nikola Pajkovsky (Merged from https://github.com/openssl/openssl/pull/29242)

ML_KEM init refactoring, unconditional entropy cleanup

2025-11-18T17:11:54Z

Fixes #27746 Reviewed-by: Viktor Dukhovni Reviewed-by: Shane Lontis Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/29062)

kem: Use include file for generated code

2025-10-20T07:45:53Z

Signed-off-by: Simo Sorce Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/28838)

Add util/codespell-check.sh and run it

2025-09-26T11:58:44Z

Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/28639)

Add OSSL_ prefix back onto param names

2025-09-16T22:49:02Z

Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/28529)

Copyright year updates

2025-09-02T13:05:45Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Release: yes