openssl/test/evp_aead_test.c, branch master

Migrate test_gcm_reinit from evp_extra_test.c to evp_aead_test.c

2026-10-23T20:40:10Z

Reviewed-by: Neil Horman Reviewed-by: Bob Beck Merge-date: Fri Oct 23 20:40:17 2026 Merged-from: https://github.com/openssl/openssl/pull/33308

Add test for an update with no input

2026-10-21T16:59:44Z

An update with no input and a nonzero length must fail, except for the CCM message length. test_evp_aead_update_null_input checks this for every AEAD, and that a rejected update writes no output. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Paul Dale Reviewed-by: Neil Horman Merge-date: Wed Oct 21 16:59:57 2026 Merged-from: https://github.com/openssl/openssl/pull/33157

AEAD regression test for EVP_CIPHER_do_all_provided

2026-10-13T15:22:01Z

... combined with a sanity check for expected AEAD algs in a static list. - every cipher in aead_algs[] must be discovered - every discovered cipher must be in aead_algs[] Meant to catch: - ciphers falling out of dynamic discovery for unexpected reasons - ciphers discovered dynamically for unexpected reasons Could happen for reasons like build system errors, flags shifting, etc. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Eugene Syromiatnikov Merge-date: Tue Oct 13 15:22:55 2026 Merged-from: https://github.com/openssl/openssl/pull/32842

test: migrate test_aes_siv_ctx_enc_retval from evp_extra_test.c to evp_aead_test.c

2026-10-12T13:14:27Z

Move test_aes_siv_ctx_enc_retval() out of test/evp_extra_test.c into test/evp_aead_test.c, rename it to test_evp_aead_enc_retval() and run it over aead_list instead of only AES-128-SIV. The check is that after a completed encrypt, a further EVP_EncryptUpdate() on the same context is rejected, and the EVP_EncryptFinal_ex() that follows fails as well, instead of reporting the earlier success. GCM, OCB and ASCON mark the context finished. SIV stores the result of the last operation, so a rejected Update makes the following Final fail. CCM, GCM-SIV and ChaCha20-Poly1305 are skipped: Final currently succeeds after the rejected Update, and what it should do is not settled yet. ChaCha20-Poly1305 reports the same mode as ASCON, so it is matched by name. Key and IV are sized from the resolved cipher parameters, the context is set up with EVP_EncryptInit_ex2(), and the tag is fetched after Final with OSSL_PARAM. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman Reviewed-by: Nikola Pajkovsky Reviewed-by: Eugene Syromiatnikov Merge-date: Mon Oct 12 13:15:18 2026 Merged-from: https://github.com/openssl/openssl/pull/33135

Migrate test_evp_final_no_tag to evp_aead_test.c

2026-10-11T22:26:39Z

Move test_evp_final_no_tag out of evp_extra_test.c into evp_aead_test.c and run it over every AEAD in aead_list instead of a hardcoded pair of ciphers. The check is that EVP_DecryptFinal_ex() refuses to finalize a decrypt when no tag has been set. CCM, OCB, SIV and GCM-SIV are skipped for now. Those modes either require the tag and payload length to be declared before the payload update, or verify inside the payload update rather than in final, so the check as written does not apply to them. How the interface should behave for these modes is still under discussion. Key and IV buffers are sized to EVP_MAX_KEY_LENGTH and EVP_MAX_IV_LENGTH so ciphers with longer keys, such as AES-256-SIV, stay in bounds, and the keylen, ivlen and taglen of each cipher are checked against those buffers. Encryption and decryption use separate contexts, initialized with EVP_*Init_ex2(), and the decrypt final writes to the plaintext buffer. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Eugene Syromiatnikov Merge-date: Sun Oct 11 22:27:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32907

Add pairwise AEAD tag retrieval test

2026-10-05T10:23:49Z

Read the tag from an AEAD encrypt context via both the ctrl and params interfaces and check they agree. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Merge-date: Mon Oct 5 10:24:04 2026 Merged-from: https://github.com/openssl/openssl/pull/32885

check that AEADs reject Update after Final

2026-10-01T19:07:24Z

Once Final has run, feeding more data to the same context must fail in both directions. This was only checked for a handful of ciphers in evp_extra_test.c; run it against every AEAD exposed by the lib. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Daniel Kubec Reviewed-by: Neil Horman Reviewed-by: Paul Dale Merge-date: Thu Oct 1 19:07:26 2026 Merged-from: https://github.com/openssl/openssl/pull/32875

test AEAD cipher parameters against the provider

2026-10-01T14:56:31Z

Add a test that checks the EVP accessors for key length, IV length, mode and tag length agree with the provider's own parameters, and use the values to drive the other tests. Covers all AEAD ciphers. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Daniel Kubec Reviewed-by: Neil Horman Merge-date: Thu Oct 1 14:56:41 2026 Merged-from: https://github.com/openssl/openssl/pull/32833

GCM: reject out-of-order update calls

2026-09-30T12:10:18Z

For GCM, AAD must precede the payload. The lib was already rejecting late AAD, but this allows distinguishing the error PROV_R_UPDATE_CALL_OUT_OF_ORDER from the generic error PROV_R_CIPHER_OPERATION_FAILED. Follow-up to #31906 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Mounir Idrassi Reviewed-by: Neil Horman Merge-date: Wed Sep 30 12:10:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32011

Migrate test_evp_oneshot_aead_zerolen to new evp_aead_test.c

2026-09-29T18:45:42Z

Introduces evp_aead_test.c, modeled on evp_xof_test.c, with a dynamically-populated aead_list (mirroring cipher_list in evp_extra_test.c) scoped to AEAD ciphers only. Unlike cipher_list, EVP_CIPH_SIV_MODE is not excluded here. Migrates test_evp_oneshot_aead_zerolen and its prepare_ccm_no_payload helper out of evp_extra_test.c as the first test in an incremental, one-test-per-PR migration. Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Neil Horman Reviewed-by: Andrew Dinh Merge-date: Tue Sep 29 18:45:50 2026 Merged-from: https://github.com/openssl/openssl/pull/32803