openssl/providers, branch dependabot/github_actions/actions/setup-python-7

Restore empty raw PKCS#1 verify-recover behavior

2026-07-24T13:06:51Z

EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured signature digest rejected a valid signature whose recovered payload is empty, instead of returning success with a recovered length of zero. RSA_public_decrypt() returns -1 on error and otherwise the number of recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5 signature that encodes an empty payload. Pull request #28306 ("Make error checks on RSA_public_decrypt() consistent") changed the error check in the raw, no-digest verify-recover path from "ret < 0" to "ret <= 0", so a valid zero recovered length was mistaken for an error. Restore the "< 0" check in that branch only, leaving the digest-aware PKCS#1, X9.31, PSS and ordinary verification paths untouched. Add test_RSA_verify_recover_empty_payload, which performs a complete zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and fails on the unmodified implementation specifically at the EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same signature and reports a zero-byte result. The behavior regressed as a result of #28306. Fixes #32000 Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Paul Dale Reviewed-by: Jakub Zelenka MergeDate: Fri Jul 24 13:06:58 2026 (Merged from https://github.com/openssl/openssl/pull/32001)

Make sure we always check return of CRYPTO_UP_REF which can fail.

2026-07-20T11:13:57Z

Reviewed-by: Kurt Roeckx Reviewed-by: Paul Dale MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)

[providers/implementations/ciphers] GCM-SIV: reject out-of-order update calls

2026-07-20T06:55:44Z

For GCM-SIV: 1. AAD must precede the payload 2. the payload must be single shot (2) was already happening, this change moves from a silent fail to an explicit error message for multiple update calls on the payload. For (1), this change unifies the logic for (2) one level up in the wrapper. So the code previously allowed (1), and now errors out after this change. Follow-up to #31906 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky Reviewed-by: Daniel Kubec Reviewed-by: Bob Beck MergeDate: Mon Jul 20 06:56:04 2026 (Merged from https://github.com/openssl/openssl/pull/31940)

ML-DSA: Add AVX512VL SHAKE x4 multi-buffer integration

2026-07-13T15:55:51Z

Changes: - Adds new SHAKE x4 API to perform 4 SHAKE operations in parallel when AVX512VL is supported. - Adds AVX512VL Keccak x4 assembly module (keccak1600x4-avx512vl). - Adds internal SHA3 x4 APIs/context in sha3.h and wrappers in sha3_x4.c modules. - Adds runtime dispatch for ML-DSA sample operations with an OSSL_ML_DSA_SAMPLE_OPS vtable. Callers obtain the correct implementation via ossl_ml_dsa_sample_ops(), which returns either the generic scalar ops functions, or the AVX512VL multi-buffer ops depending on the build and CPU capabilities. - Adds x86-64 multi-buffer function implementation into ml_dsa_sample_hw_x86_64.inc, included in ml_dsa_sample.c when KECCAK1600_ASM and x86_64 are defined. Co-authored-by: Tomasz Kantecki Signed-off-by: Marcel Cornu Reviewed-by: Viktor Dukhovni Reviewed-by: Neil Horman Reviewed-by: Shane Lontis MergeDate: Mon Jul 13 15:55:54 2026 (Merged from https://github.com/openssl/openssl/pull/31090)

poly1305: reject no-key update and NULL key params

2026-07-13T15:43:51Z

Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged initialization. If no key has been installed, update still dispatched into the uninitialized Poly1305 state, which can crash on POLY1305_ASM builds. Guard update with the same key_set check used by final and report no key set. Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE. Fixes #31332 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Daniel Kubec MergeDate: Mon Jul 13 15:44:48 2026 (Merged from https://github.com/openssl/openssl/pull/31382)

[test] check late AAD rejection across AEADs

2026-07-13T15:40:37Z

A late AAD update (AAD supplied after the payload has started) must be rejected, and reported the same way, for every AEAD. #31673 checked this for ChaCha20-Poly1305 alone, so this change extends it to all AEADs. test_evp_aead_late_aad covers both the encrypt and decrypt directions and asserts ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER on the late update. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec Reviewed-by: Paul Dale MergeDate: Mon Jul 13 15:40:39 2026 (Merged from https://github.com/openssl/openssl/pull/31906)

FIPS: EC keygen - remove unnecessary self tests.

2026-07-13T14:46:54Z

In FIPS mode EC keygen was doing 3 self tests. ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4. These tests covered both Keygen PCT for Key Agreement and Signatures. ossl_ec_key_pairwise_check() was also being called from within ec_gen(). The advice from Atsec (lab) is that the sign/verify test within ecdsa_keygen_pairwise_test() is sufficient according to the updated rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of the generated key is unknown at the time of key generation. Detected during testing of Jipher by Roshith Alankandy (Oracle). Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Mon Jul 13 14:47:00 2026 (Merged from https://github.com/openssl/openssl/pull/31761)

test-rng: handle nonce length query in generate mode

2026-07-10T15:47:09Z

The DRBG instantiation probes the parent nonce callback with a NULL output buffer to obtain the nonce length before requesting the actual nonce. The generate mode branch of test_rng_nonce() wrote the bytes without checking the output pointer, crashing when TEST-RAND with generate=1 is used as a DRBG parent. The entropy-buffer branch already handles a NULL output correctly. Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky MergeDate: Fri Jul 10 15:47:15 2026 (Merged from https://github.com/openssl/openssl/pull/31885)

Allow MinGW-w64 builds to use BCryptGenRandom

2026-07-10T12:05:02Z

MinGW-w64 has provided bcrypt headers and import libraries since version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding path for supported MSVC builds. Enable the existing direct BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or newer, and link MinGW builds with bcrypt alongside the other Windows import libraries. Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined by both the 32-bit and 64-bit MinGW-w64 toolchains. Builds targeting older Windows versions keep the CryptoAPI fallback because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is below 0x0600. Fixes #13878 Reviewed-by: Milan Broz Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman MergeDate: Fri Jul 10 12:05:09 2026 (Merged from https://github.com/openssl/openssl/pull/13882)

We no longer need to test for GCC versions this old

2026-07-10T11:47:13Z

The minimum gcc to compile our code appears to be version 9, and we are now C99. All these older checks become a tautology on anything that will build a modern OpenSSL tree, so clean this up. Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz Reviewed-by: Neil Horman MergeDate: Fri Jul 10 11:47:17 2026 (Merged from https://github.com/openssl/openssl/pull/31677)