openssl/providers, branch master

Reject a NULL input to update in the other AEADs

2026-10-21T16:59:44Z

An update with no input buffer and a nonzero length was accepted by the GCM, CCM, SIV, GCM-SIV, ChaCha20-Poly1305 and ASCON implementations. Reject it, except for the CCM message length, which is passed with no input and no output. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale Reviewed-by: Neil Horman Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157

AES-OCB: reject a NULL input to update

2026-10-21T16:59:44Z

EVP_EncryptUpdate() with a NULL input buffer and a nonzero length read from the NULL pointer in CRYPTO_ocb128_aad(), a NULL-pointer dereference detected by ASan. Reject the call instead. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale Reviewed-by: Neil Horman Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157

ml_dsa_mu_prov.c: initialize ML-DSA-MU before empty-message finalization

2026-10-19T11:03:54Z

The ML-DSA-MU digest context was initialized only by mu_update(). Finalizing an empty pure ML-DSA message before any update left ctx->mdctx NULL and crashed in ossl_ml_dsa_mu_finalize(). Call check_init() in mu_final() before finalization, to get the same lazy initialization as the update path. Fixes: 175cda569df9 "ML-DSA: Add a digest that can calculate external mu." Resolves: https://github.com/openssl/openssl/issues/32445 Assisted-by: Claude Code Reviewed-by: Mounir Idrassi Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov Merge-date: Mon Oct 19 11:08:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32447

Make it clear that chacha20 is a stream cipher

2026-10-19T06:04:41Z

by explicitly using the define EVP_CIPH_STREAM_CIPHER instead of the value 0 for the mode parameter. Reviewed-by: Jakub Zelenka Reviewed-by: Frederik Wedel-Heinen Merge-date: Mon Oct 19 06:04:43 2026 Merged-from: https://github.com/openssl/openssl/pull/32393

fips: improve reporting of failure CRNG tests

2026-10-19T01:14:57Z

The CRNG tests occasionally false positive. The error report is unhelpful in determining the underlying cause. Change the error messages to be more informative. Reviewed-by: Mounir Idrassi Reviewed-by: Simo Sorce Merge-date: Mon Oct 19 01:15:08 2026 Merged-from: https://github.com/openssl/openssl/pull/33098

Ensure self test is executed before SLH-DSA KeyGen

2026-10-10T10:28:35Z

Signed-off-by: simo Sorce Reviewed-by: Dmitry Belyavskiy Reviewed-by: Paul Dale MergeDate: Sat Oct 10 10:29:15 2026 (Merged from https://github.com/openssl/openssl/pull/33074)

cipher_aes_hw_aesni.c: fix linux-x32 build failure

2026-10-09T22:26:01Z

The VAES GCM code is enabled by an ISA check (__x86_64__ & co), which the x32 ABI satisfies: x32 is a 64-bit platform with a 32-bit size_t. There, comparing the size_t ivlen against 2^61 is always false, which -Wtype-limits (via --strict-warnings) turns into a build failure. Only perform the check where size_t is wide enough to violate the limit. Fixes: 63b996e752ac "AES-GCM enabled with AVX512 vAES and vPCLMULQDQ." Assisted-by: Pi:moonshotai/kimi-k3 Reviewed-by: Matt Caswell Reviewed-by: Eugene Syromiatnikov Merge-date: Fri Oct 9 22:26:45 2026 Merged-from: https://github.com/openssl/openssl/pull/32925

Allow EVP_SKEY_get0_raw_key() to return only the key length

2026-10-05T10:27:11Z

There was no way to learn the length of an opaque EVP_SKEY without exporting the raw key, which is impossible for non-exportable keys (e.g. keys held in hardware). Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case only the length is returned. It is read from the OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported. The built-in generic and AES key managements now report that parameter. Fixes: https://github.com/openssl/openssl/issues/32998 Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy Merge-date: Mon Oct 5 10:28:09 2026 Merged-from: https://github.com/openssl/openssl/pull/33035

Allow the CCM tag to be fetched more than once after AEAD encryption

2026-10-05T10:23:49Z

Reading the tag out of a CCM context currently resets the context, so a second fetch of the same tag failed. The reset now happens when the encryption completes rather than when the tag is read, so the tag remains available, matching the other AEAD modes. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Merge-date: Mon Oct 5 10:24:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32885

srtpkdf: avoid NULL dereference in size queries

2026-10-02T08:12:09Z

Return an error when the cipher has not been configured instead of passing NULL to EVP_CIPHER_get_key_length(). Add regression coverage for fresh, configured, and reset contexts. Fixes #32945 Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky Merge-date: Fri Oct 2 08:12:15 2026 Merged-from: https://github.com/openssl/openssl/pull/32959