openssl/providers/implementations/keymgmt, branch dependabot/github_actions/actions/setup-python-7

Make sure we always check return of CRYPTO_UP_REF which can fail.

2026-07-20T11:13:57Z

Reviewed-by: Kurt Roeckx Reviewed-by: Paul Dale MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)

FIPS: EC keygen - remove unnecessary self tests.

2026-07-13T14:46:54Z

In FIPS mode EC keygen was doing 3 self tests. ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4. These tests covered both Keygen PCT for Key Agreement and Signatures. ossl_ec_key_pairwise_check() was also being called from within ec_gen(). The advice from Atsec (lab) is that the sign/verify test within ecdsa_keygen_pairwise_test() is sufficient according to the updated rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of the generated key is unknown at the time of key generation. Detected during testing of Jipher by Roshith Alankandy (Oracle). Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Mon Jul 13 14:47:00 2026 (Merged from https://github.com/openssl/openssl/pull/31761)

EC: make the group the single source of the point conversion form

2026-07-10T09:21:28Z

The point conversion form (compressed, uncompressed, or hybrid) was kept both on the key and on the group, and the two could disagree -- a key imported as compressed could re-encode as uncompressed. The group is now the single source of truth: encoding, parameter output, and the legacy lookup all read it from the group, and decoding (PEM, DER, or raw parameters) records it there, so the form round-trips faithfully. Generated keys are always uncompressed; the point-format option at key generation is now a documented no-op (it had had no effect for several releases), and the unused form field on the keygen context is dropped. Imported keys still keep their form, and the deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still work. EVP_PKEY_fromdata() and openssl pkey -text now report the form a loaded EC key actually has, and re-encoding via PEM or DER preserves it. Docs drop a stale note about a compile-time macro for compressed points on binary curves, and the EC tests now exercise both the affine and the compressed/hybrid binary formats unconditionally (fixing a latent bug in the compressed/hybrid form tests that were never exercised by CI). Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Fri Jul 10 09:21:29 2026 (Merged from https://github.com/openssl/openssl/pull/30940)

Once initialised, ML-DSA keys should be immutable

2026-06-25T02:03:26Z

ML-DSA keys should become immutable once key material has been added. This is already the case for at least ML-KEM keys, and should generally be the case across all key types. - Added the requisite check in the key management provider ml_dsa_import() function. - Also, consolidated the ML-KEM checks in ml_kem_import(). These were previously partly in ml_kem_key_fromdata(). Reviewed-by: Shane Lontis Reviewed-by: Paul Dale MergeDate: Thu Jun 25 02:03:35 2026 (Merged from https://github.com/openssl/openssl/pull/30421)

FIPS: Make keygen PCT failures recoverable

2026-06-11T16:01:55Z

Key generation pairwise consistency tests (PCT) no longer cause the FIPS provider to enter a non recoverable error state. Originally I considered that the pairwise tests should never fail, so a failure was considered as a fatal error. Unfortunately this is not true, since the RSA pairwise test was changed to call rsa_ossl_public_encrypt(). This function can return -1 based on the values of n and e, resulting in a DOS for bad inputs. Under NIST FIPS 186-5, the public exponent (e) must be an odd positive integer greater than (e > 65536) and less than 2^256. The OpenSSL code however returns an error if e > 2^64 when n > 3072. (This check was added to prevent a CVE DOS). While FIPS 140-3 mandates that a module must transition into an error state upon self-test failures, a PCT is classified as a conditional self-test, not a pre-operational self-test (like an integrity test or a Known Answer Test) The cryptographic module is only required to immediately discard the faulty key pair and output a local error. The module is allowed to immediately attempt generating a new key pair using fresh entropy, without needing a full system reboot or module reset. Detected by Oracle during Jipher testing. Reviewed-by: Simo Sorce Reviewed-by: Paul Dale MergeDate: Thu Jun 11 16:03:42 2026 (Merged from https://github.com/openssl/openssl/pull/31359)

Fix missing dependency on ml_kem_keymgmt.c

2026-06-09T17:49:22Z

ml_kem_keymgmt.c includes der_wrap.h, which is a generated file, but doesn't include a depdency in its build.info file, meaning that if the dependencies aren't run in the right order, ml_kem_keymgmt.c gets compiled before der_wrap.h is generated, leading to a build break. Fix it by including the needed dependency. Fixes #31379 Reviewed-by: Alicja Kario Reviewed-by: Eugene Syromiatnikov Reviewed-by: Bob Beck Reviewed-by: Paul Dale MergeDate: Tue Jun 9 17:49:28 2026 (Merged from https://github.com/openssl/openssl/pull/31385)

Fix broken hex data by reformatting

2026-06-03T07:46:03Z

The clang format broke some data in hexadecimal format. To make the tool obedient, the trailing comma needs to be removed, then it interpretes the data differently and therefore does not reformat it. The format can then be changed to the correct form. Fixes: https://github.com/openssl/project/issues/1959 Signed-off-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jun 3 07:46:14 2026 (Merged from https://github.com/openssl/openssl/pull/31350)

Fix function pointer type mismatch when freeing ECX keys

2026-05-14T09:31:27Z

ossl_ecx_key_free is declared as void(ECX_KEY *) but registered directly in the X25519/X448/Ed25519/Ed448 keymgmt OSSL_DISPATCH tables for OSSL_FUNC_KEYMGMT_FREE, which is invoked through a void(*)(void *) pointer in evp_keymgmt_freedata. Calling a function through a pointer to an incompatible function type is undefined behavior and is reported by UndefinedBehaviorSanitizer on every ECX key free: crypto/evp/keymgmt_meth.c:392:5: runtime error: call to function ossl_ecx_key_free through pointer to incorrect function type 'void (*)(void *)' crypto/ec/ecx_key.c:65: note: ossl_ecx_key_free defined here All four algorithms share the same MAKE_KEYMGMT_FUNCTIONS dispatch macro, so they hit the same UB; UBSan just deduplicates the report on the first call. Mirror the wrapper pattern used by ml_kem_free_key, ml_dsa_free_key, slh_dsa_free_key, dsa_freedata, ec_freedata, and lms_free_key: add a small static ecx_free_key with the correct OSSL_FUNC_keymgmt_free_fn signature that forwards to ossl_ecx_key_free, and register the wrapper in the dispatch macro. The existing direct callers of ossl_ecx_key_free in ecx_kmgmt.c are unchanged since they pass a typed ECX_KEY *. CLA: trivial Reviewed-by: Nikola Pajkovsky Reviewed-by: Paul Yang Reviewed-by: Tomas Mraz MergeDate: Thu May 14 09:31:58 2026 (Merged from https://github.com/openssl/openssl/pull/31078)

Fix function pointer type mismatch when freeing ML-KEM keys

2026-05-14T09:31:27Z

ossl_ml_kem_key_free is declared as void(ML_KEM_KEY *) but registered directly in the ML-KEM keymgmt OSSL_DISPATCH table for OSSL_FUNC_KEYMGMT_FREE, which is invoked through a void(*)(void *) pointer in evp_keymgmt_freedata. Calling a function through a pointer to an incompatible function type is undefined behavior and is reported by UndefinedBehaviorSanitizer on every ML-KEM key free: crypto/evp/keymgmt_meth.c:392:5: runtime error: call to function ossl_ml_kem_key_free through pointer to incorrect function type 'void (*)(void *)' crypto/ml_kem/ml_kem.c:1751: note: ossl_ml_kem_key_free defined here Mirror the wrapper pattern used by ml_dsa_free_key, slh_dsa_free_key, dsa_freedata, ec_freedata, and lms_free_key: add a small static ml_kem_free_key with the correct OSSL_FUNC_keymgmt_free_fn signature that forwards to ossl_ml_kem_key_free, and register the wrapper in the dispatch table. The existing direct callers of ossl_ml_kem_key_free in ml_kem_kmgmt.c are unchanged since they pass a typed ML_KEM_KEY *. CLA: trivial Reviewed-by: Nikola Pajkovsky Reviewed-by: Paul Yang Reviewed-by: Tomas Mraz MergeDate: Thu May 14 09:31:57 2026 (Merged from https://github.com/openssl/openssl/pull/31078)

Move *_arch.h to include/arch

2026-05-10T09:53:33Z

Move all the architecture specific header files under a single directory in include/ Signed-off-by: Norbert Pocs Reviewed-by: Nikola Pajkovsky Reviewed-by: Eugene Syromiatnikov MergeDate: Sun May 10 09:53:34 2026 (Merged from https://github.com/openssl/openssl/pull/30751)