aboutsummaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* s390x: Disable mod-expo offloading to a crypto card for small exponentsIngo Franzki2 days1-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new keyword 'cex_min_bits:<bits>' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)
* doc: RAND(7): a restore from a saved image is not detected; reseed after itYuxiang Ji2 days1-0/+13
| | | | | | | | | | | | | | | | | | | | | | | The DRBGs reseed on a change of process ID, on the request count and on the time interval, and have no way to notice that the process or the machine was restored from a snapshot or a checkpoint: copies restored from one image continue from the same state until their next scheduled reseed. Say so in RAND(7) beside the paragraph on automatic reseeding, and tell applications in such environments to reseed after their own restore signal, with RAND_poll(3) as the call that does it. Measured on 3.5.9 and master: two continuations of one QEMU or Firecracker snapshot, or of one CRIU checkpoint, print identical RAND_bytes output block for block (32 of 32, 14 of 14) until the primary DRBG's interval expires; plain fork, _Fork and clone are distinct through the pid check. Assisted-by: Claude Code:claude-fable-5-1 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Fri Oct 23 12:51:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33285
* Document the OSSL_PARAM_merge() entry limitMartin Mirchev2 days1-0/+2
| | | | | | | | | | | | | | OSSL_PARAM_merge() only considers the first 128 entries of each input array and silently ignores the rest. Mention this in the manual page. Signed-off-by: Martin Mirchev <[email protected]> Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Fri Oct 23 12:47:50 2026 Merged-from: https://github.com/openssl/openssl/pull/33244
* doc: replace DES-EDE3-CBC with AES-256-CBC in PEM examplesJWWTSL2 days1-6/+6
| | | | | | | | | | | | | | | | | | | The EXAMPLES section of PEM_read_bio_PrivateKey still showed EVP_des_ede3_cbc() for encrypting private keys, but 3DES is deprecated in OpenSSL 3.x. Replace with EVP_aes_256_cbc() to show a modern cipher, consistent with other man pages. The DEK-Info header in the file format example is left as-is since it documents the actual PEM file structure. Fixes #28665 CLA: trivial Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Merge-date: Fri Oct 23 12:44:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33228
* TLS: Generate the server random before processing ClientHello extensionsDaniel Kubec4 days2-0/+54
| | | | | | | | | | | | | | | | | | | | | | | The server random was only generated after all of the ClientHello extensions had been processed. In (D)TLSv1.3 the PSK callbacks are invoked while the pre_shared_key extension is being parsed, so a call to SSL_get_server_random() from within them returned all zeros. The TLSv1.2 psk_server_callback runs during ClientKeyExchange processing and so already observed the real value, making the behaviour inconsistent between protocol versions. Move the generation of the server random to immediately after the protocol version has been selected and before any of the remaining ClientHello processing. As a result the server random is also visible from the other callbacks invoked during ClientHello processing, such as the session ticket and servername callbacks. Fixes #26404 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Wed Oct 21 16:45:34 2026 Merged-from: https://github.com/openssl/openssl/pull/33102
* Removes clean DES and RC2 as encryption methods for TLS ciphersuites and ↵Frederik Wedel-Heinen4 days1-2/+2
| | | | | | | | | refactors the fetching of NULL cipher to be consistent. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Wed Oct 21 16:22:59 2026 Merged-from: https://github.com/openssl/openssl/pull/32051
* CMS_get0_signers() returns only the signers that passed verificationIgor Ustinov4 days1-1/+5
| | | | | | | | | | | | | | | | | | | | With CMS_VERIFY_PARTIAL, CMS_verify() succeeds as long as at least one SignerInfo verifies, but CMS_get0_signers() still returned the certificate of every SignerInfo, defeating "signed by X" or "signed by N signers" policies. The same applied to the certificates written by "openssl cms -verify -verify_partial -signer". This commit fixes CMS_get0_signers() behaviour returning only certificates of signers that passed verification. Nothing changes if CMS_VERIFY_PARTIAL isn't set. Reported-by: Anthropic OSS scan id ANT-2026-GF4OIPVH Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Wed Oct 21 15:39:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33279
* doc/man3/EC_GROUP_new.pod: document EC_GROUP_get_ecpkparameters functionmkpark7 days1-0/+5
| | | | | | | | | | | Added EC_GROUP_get_ecpkparameters() function description and usage details. Complements: 60b350a3ef96 "RT3676: Expose ECgroup i2d functions" Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sun Oct 18 15:26:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32169
* DTLS listener: make max_pending_conns a combined admission budgetMounir IDRASSI11 days3-18/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pending-connection cap only applied to pending_conns, the table of connections still doing their handshake: the moment a connection passed cookie validation it was moved onto the accept queue (incoming_connections) with no length check and no expiry. A reachable peer completing the ordinary cookie exchange from many source endpoints could accumulate an unbounded, unexpiring queue of listener-owned SSL objects. This is the same missing admission bound as the QUIC listener admission check fixed in [1]; the DTLS listener is new in 4.1 and not in any final release. Mirror the QUIC fix: enforce the bound at admission, in the packet handler, before any per-connection state is allocated. SSL_VALUE_DTLS_LISTENER_MAX_PENDING_CONNS is now a single admission budget covering both listener-owned tables, pending plus accept queue, so listener-owned connections are bounded at N in total, including under SSL_LISTENER_FLAG_NO_VALIDATE. Moving a connection from one table to the other leaves the total unchanged, so a validated connection can always be queued: none is discarded, and no handshake work (cookie exchange, server flight) is spent on an attempt that cannot be admitted. A peer whose datagram is dropped while the budget is exhausted retransmits its ClientHello and is admitted once the application drains the queue; measured on real UDP, such a client completes its handshake about one retransmit interval after the drain. This also aligns the DTLS knob's meaning with the QUIC one ("not yet accepted"), which it was modelled on in [2]. Accept-queue entries still do not expire; a full queue stays full until the application drains it. With the budget, an attacker can pin at most N accept-queue slots, and only after proving return routability - spoofed ClientHellos can still occupy pending slots until the pending timeout reaps them, as before this change - so what remains is a bounded availability concern, not memory exhaustion. [1] https://github.com/openssl/openssl/pull/32052 [2] https://github.com/openssl/openssl/pull/31980 Resolves: https://github.com/openssl/openssl/issues/33172 Assisted-by: Claude Code:moonshotai/kimi-k3 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Oct 14 10:54:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33197
* crypto/x509/x509_lu.c: avoid freeing X509_OBJECTs in X509_STORE_get0_objects()Eugene Syromiatnikov12 days1-1/+2
| | | | | | | | | | | | | | | | The implementation of hash table conversion in commit 04589b59ef50 "x509store: reduce lock contention in X509_STORE" introduced a potential use-after-free condition when X509_STORE_get0_objects() is called during X.509 verification. Avoid that by re-using existing X509_OBJECTs instead of duplicating them. Resolves: https://github.com/openssl/openssl/issues/33063 Fixes: 04589b59ef50 "x509store: reduce lock contention in X509_STORE" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Tue Oct 13 13:45:39 2026 Merged-from: https://github.com/openssl/openssl/pull/33147
* Correct PEM X509 docs regarding TRUSTED CERTIFICATE blockschrissorr14 days1-2/+3
| | | | | | | | | | | | | | The documentation stated that the X509 PEM functions also process trusted certificates, discarding the trust settings. In fact, they reject "TRUSTED CERTIFICATE" blocks; only the X509_AUX functions accept them. Update the text accordingly. Resolves: https://github.com/openssl/openssl/issues/33019 CLA: trivial Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Sun Oct 11 21:31:53 2026 Merged-from: https://github.com/openssl/openssl/pull/33166
* Fix up OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR history documentationEugene Syromiatnikov2026-10-101-3/+0
| | | | | | | | | | | | | | | | | | | The OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR has been actually added in commit 7960dbec6801 " Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)", commit e7d5206e892e "apps/cmp.c: add -ta_in_ip_extracerts permitting non-authenticated trust anchors in IP extracerts according to 3GPP TS 33.310" has only wired up in the openssl command; correct the HISTORY section in doc/man3/OSSL_CMP_CTX_new.pod and the entry in CHANGES.md accordingly. Fixes: cdad6573efed "add HISTORY and CHANGES.md entry for OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR introduced in 4.0" Reported-by: Tomas Mraz <[email protected]> Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Merge-date: Sat Oct 10 15:57:15 2026 Merged-from: https://github.com/openssl/openssl/pull/33167
* threads_pthread: make lock contention log location configurableAnatolii Ohorodnyk2026-10-091-0/+13
| | | | | | | | | | | | | Add support for OPENSSL_LOCK_CONTENTION_DIR environment variable to specify the directory for lock contention log files. If not set, logs are written to the current directory (existing behavior). Resolves: https://github.com/openssl/openssl/issues/27975 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Fri Oct 9 19:08:15 2026 Merged-from: https://github.com/openssl/openssl/pull/29526
* util/libcrypto.num, doc/man3/X509_dup.pod: fix version for IPAddrBlock functionsEugene Syromiatnikov2026-10-091-1/+1
| | | | | | | | | | | | These have ultimately been introduced during OpenSSL 4.2 development time frame. Fixes: f08174e91476 "Add public API for IPAddrBlocks (RFC 3779)" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Merge-date: Fri Oct 9 18:33:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32956
* PSK documentation polishViktor Dukhovni2026-10-094-28/+75
| | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 9 13:56:10 2026 Merged-from: https://github.com/openssl/openssl/pull/31925
* Fix ECH server verify_result misuseViktor Dukhovni2026-10-091-1/+1
| | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 9 13:56:06 2026 Merged-from: https://github.com/openssl/openssl/pull/31925
* Test PHA verification results across session resumptionMounir IDRASSI2026-10-081-7/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An application verification callback may accept a nonempty client certificate or RPK while retaining a nonzero verification error. That result must survive post-handshake authentication and resumption, without changing the previously published session. Expand pending-identity coverage to exercise X.509 and RPK replacement with successful and callback-accepted error results, using stateful and stateless refreshed tickets. Check the replacement identity and result on the live connection and session, then on a resumed connection. Also check that the retained cache-owned session remains unchanged. Start empty-RPK tests with a nonzero prior verification result. An optional empty response must remove that stale result, while a required empty response must fail without replacing the previous session state. Document that the empty-response helper retains the SSL_get_verify_result() semantics for an absent peer certificate: X509_V_OK does not establish authentication. The helper does not clear errors for supplied credentials. Remove two unused local pointer resets immediately before successful parse returns. No library verification-result behavior is changed. Validation: debug --strict-warnings build; test_sslapi, test_rpk, test_dtls and test_dtls13_internal all pass (no-fips). Assisted-by: Codex:gpt-6-astra Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Oct 8 16:16:17 2026 Merged-from: https://github.com/openssl/openssl/pull/32638
* fix typo (s/suppresion/suppression)Alexandr Nedvedicky2026-10-071-1/+1
| | | | | | | | | | Fixes: 817c105ec63b "doc/man7/openssl_user_macros.pod.in: document OPENSSL_SUPPRESS_DEPRECATED" Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Oct 7 15:39:22 2026 Merged-from: https://github.com/openssl/openssl/pull/33137
* dtls: honour SSL_OP_COOKIE_EXCHANGE for DTLS 1.3Jakub Zelenka2026-10-063-23/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Setting SSL_OP_COOKIE_EXCHANGE on a server connection only ever produced a HelloVerifyRequest, so once the peer negotiated DTLS 1.3 the option was silently ignored and the client was accepted without any address validation. The HelloRetryRequest cookie code was gated purely on the internal stateless flag, which only SSL_stateless() and the DTLS listener set, leaving no way for an application driving its own per-peer SSL objects with SSL_accept() to get a cookie exchange. Treat the option as "a cookie is required" for DTLS 1.3 as well. A ClientHello without a valid cookie is answered with a HelloRetryRequest carrying one, and the handshake continues only once it is echoed back. The stateless cookie callbacks are used for the application part of the cookie, falling back to the HelloVerifyRequest callbacks so existing servers written for DTLS 1.2 keep working unchanged. A client that repeats its ClientHello after the HelloRetryRequest and still presents no valid cookie now gets an illegal_parameter alert rather than tripping an internal error. The listener is unaffected since it sets both the flag and the option. s_server always sets the option for DTLS, so teach the TLSProxy handshake checker that every DTLS handshake now starts with a cookie round trip. Add a test covering the 1.2 and 1.3 paths, the callback fallback, the missing-callback failure and the PSK-only resumption, and make the dtlsecho demo server validate its peer this way. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 14:46:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33093
* Allow EVP_SKEY_get0_raw_key() to return only the key lengthIva Marinova2026-10-052-1/+12
| | | | | | | | | | | | | | | | | | | | There was no way to learn the length of an opaque EVP_SKEY without exporting the raw key, which is impossible for non-exportable keys (e.g. keys held in hardware). Let EVP_SKEY_get0_raw_key() accept a NULL key pointer, in which case only the length is returned. It is read from the OSSL_SKEY_PARAM_KEY_LENGTH key parameter, exported with OSSL_SKEYMGMT_SELECT_PARAMETERS, so the secret key is never exported. The built-in generic and AES key managements now report that parameter. Fixes: https://github.com/openssl/openssl/issues/32998 Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Mon Oct 5 10:28:09 2026 Merged-from: https://github.com/openssl/openssl/pull/33035
* Limit proxy pathlen to 0..255Bob Beck2026-10-051-2/+7
| | | | | | | | | | | Treat an out-of-range pcPathLengthConstraint as invalid, as already done for basicConstraints. X509_set_proxy_pathlen() now rejects out-of-range values, failing closed to 0. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Mon Oct 5 10:17:27 2026 Merged-from: https://github.com/openssl/openssl/pull/32471
* Limit certificate path length to a reasonable value.Bob Beck2026-10-051-2/+8
| | | | | | | | | | | | | | | | In theory, this can be the limit of an ASN1 integer, in practice that's utterly silly, as setting no limit already means it is unlimited, and large chains are already ridiculously expensive. While a practical limit likely never to be seen might be 64, There seems to be precedent in other places (Chromium and others) to limit this to the range of 0-255. Let's do that. Nothing non-synthetic will ever hit this. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Mon Oct 5 10:17:26 2026 Merged-from: https://github.com/openssl/openssl/pull/32471
* doc/man1/openssl-rand.pod.in: mention that -n affects only hex outputEugene Syromiatnikov2026-10-021-1/+1
| | | | | | | | | | | Neither base64 nor binary output are affected by it. Complements: a3b7e0911492 "Add -n option to openssl-rand to not output the trailing newline" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 08:28:52 2026 Merged-from: https://github.com/openssl/openssl/pull/33054
* Deprecate X509_OBJECT_up_ref_count()Daniel Kubec2026-10-021-0/+17
| | | | | | | | | | | | | | | Despite its name, X509_OBJECT_up_ref_count() does not reference count the X509_OBJECT itself. With X509_OBJECT being opaque there is nothing useful an application can do with it. Assisted-by: Claude:claude-fable-5-1 Fixes #21121 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Oct 2 08:09:09 2026 Merged-from: https://github.com/openssl/openssl/pull/32823
* doc/man3/OPENSSL_FILE.pod: refer OPENSSL_{NO,SUPPRESS}_DEPRECATEDEugene Syromiatnikov2026-10-021-1/+3
| | | | | | | | Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 07:30:41 2026 Merged-from: https://github.com/openssl/openssl/pull/32154
* doc/man7/openssl_user_macros.pod.in: document OPENSSL_SUPPRESS_DEPRECATEDEugene Syromiatnikov2026-10-021-1/+14
| | | | | | | | Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 07:30:41 2026 Merged-from: https://github.com/openssl/openssl/pull/32154
* doc/man7/openssl_user_macros.pod.in: mention OPENSSL_ENGINE_STUBS in NAMEEugene Syromiatnikov2026-10-021-1/+4
| | | | | | | | Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 07:30:40 2026 Merged-from: https://github.com/openssl/openssl/pull/32154
* doc/man7/openssl_user_macros.pod.in: sort sections in lexicographical orderEugene Syromiatnikov2026-10-021-7/+7
| | | | | | | | Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 07:30:39 2026 Merged-from: https://github.com/openssl/openssl/pull/32154
* doc/man7/openssl_user_macros.pod.in: tuning of OPENSSL_ENGINE_STUBS descriptionEugene Syromiatnikov2026-10-021-5/+6
| | | | | | | | | | | | Change "help the easy transition" to "help to ease the transition" (seems to be a typo), update wrapping/spacing slightly, change "the removed API" to "the removed API functionality". Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Oct 2 07:30:38 2026 Merged-from: https://github.com/openssl/openssl/pull/32154
* Add Deprecation Macros for 4.2Bob Beck2026-10-011-0/+1
| | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Merge-date: Thu Oct 1 08:21:23 2026 Merged-from: https://github.com/openssl/openssl/pull/33039
* GCM: reject out-of-order update callsBilly Brumley2026-09-301-0/+4
| | | | | | | | | | | | | | | | For GCM, AAD must precede the payload. The lib was already rejecting late AAD, but this allows distinguishing the error PROV_R_UPDATE_CALL_OUT_OF_ORDER from the generic error PROV_R_CIPHER_OPERATION_FAILED. Follow-up to #31906 Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Wed Sep 30 12:10:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32011
* Fix NULL dereference in SSL_get0_group_name() before a handshakeAlberto Maschietto2026-09-291-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL_get0_group_name() falls back to sc->session->kex_group whenever the connection is not a TLSv1.3 one that has already done a key exchange. On a connection that has not started (or completed) a handshake yet, sc->session is still NULL, so the fallback crashes instead of returning NULL as the manual page promises. This is the same problem that was fixed for SSL_get_negotiated_group() in commit 4ca80d3941, and the fix here mirrors it: only consult the session when there is one, and report "no group" otherwise. It affects TLS, DTLS and QUIC connections, and every branch since the accessor was added in 3.2. The RETURN VALUES section said a NULL return meant an error occurred. That is not accurate: NULL simply means no group is available, which is the normal answer before a handshake or after one that used no key agreement group. Reword it accordingly. Add a regression test that calls both group accessors on a fresh SSL object. Without the fix it segfaults; with it, SSL_get0_group_name() returns NULL and SSL_get_negotiated_group() returns NID_undef. Fixes #32379 Assisted-by: Claude Code:claude-opus-5 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 17:04:02 2026 Merged-from: https://github.com/openssl/openssl/pull/32437
* FIPS: Changes FIPS indicators so that all approved algorithms have a ↵slontis2026-09-2629-16/+301
| | | | | | | | | | | | | | | gettable indicator If there is no indicator then an algorithm is not approved. This diverges from the previous definition which was if an algorithm had "fips=yes" and had no indicator it was approved. Assisted-by: OpenAI Codex:gpt-5.6-sol Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Sat Sep 26 21:24:10 2026 Merged-from: https://github.com/openssl/openssl/pull/32910
* Provide metadata for symmetric keys when parsing pkcs#12 filesDmitry Belyavskiy2026-09-242-7/+94
| | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 24 07:34:27 2026 (Merged from https://github.com/openssl/openssl/pull/30937)
* Add documentation for PKCS#12 symmetric key supportDmitry Belyavskiy2026-09-244-13/+165
| | | | | | | | | Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 24 07:34:26 2026 (Merged from https://github.com/openssl/openssl/pull/30937)
* Add design doc for PKCS#12 symmetric key support (v2 approach)Dmitry Belyavskiy2026-09-241-0/+148
| | | | | | | | | | | | Describes an alternative API design using PKCS12_PARSE_CTX opaque context and public PKCS12_SAFEBAG_get1_skey() for Java keytool PKCS#12 files. Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Thu Sep 24 07:34:20 2026 (Merged from https://github.com/openssl/openssl/pull/30937)
* Suppress unusable PSK offers and 0-RTT client-sideViktor Dukhovni2026-09-231-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check that offered PSKs and early data can actually be used before sending them, rather than offering them and letting the server refuse. - Offer a resumption ticket or accept a psk_use_session callback PSK only if some offered TLS 1.3 ciphersuite shares the PSK's handshake digest. Otherwise the PSK is unusable: retire the ticket (falling through to the next candidate) or drop the callback PSK. - Attempt 0-RTT only when the first-offered PSK's exact ciphersuite is offered and its ALPN, if any, is among those offered; otherwise suppress early data but keep the PSK for a 1-RTT handshake. An ALPN inconsistency detected by the client was previously fatal (SSL_R_INCONSISTENT_EARLY_DATA_ALPN); it now suppresses 0-RTT only. - Reject a psk_use_session callback PSK with an empty master key with SSL_R_BAD_PSK instead of failing later in binder computation. Along the way, to compare handshake digests, factor the digest lookup out of SSL_CIPHER_get_handshake_digest() into a new internal helper ssl_cipher_get_handshake_digest_nid(). The client now declines PSKs and 0-RTT it cannot use, so several sslapitest early data tests are adjusted to offer a client configuration under which 0-RTT still proceeds, keeping their tests of server-side rejection effective. Also add test_tls13_ticket_cipher_mismatch_reject_early_data, covering server-side 0-RTT rejection on a cipher mismatch with a resumption ticket; only the external-PSK cipher mismatch was previously tested. All the while keep the client's PSK and 0-RTT offer self-consistent: When resuming with a PSK and offering 0-RTT early data, the client decided the same things in more than one place: whether the resumption ticket is usable, which PSK it offers first, and whether that PSK's cipher is actually on the wire. These were worked out separately while building the early_data and pre_shared_key parts of the ClientHello and could disagree -- notably when the application's security callback does not give the same answer each time it is consulted. That disagreement could break confidentiality. If early data was set up against the resumption ticket but the ticket was then dropped while the pre_shared_key extension was built, its binder never ran, the early secret was left all zero, and the client still encrypted its 0-RTT data under keys derived from that zero value -- which a passive observer can reconstruct from the visible ClientHello alone. Decide once and reuse the result: - Settle whether the ticket is offered when early data is prepared, and have the pre_shared_key extension follow that decision instead of computing it again. - Do not install the client's 0-RTT keys unless the first offered PSK actually derived the early secret during this handshake, so 0-RTT is never protected by an all-zero key. - Count a cipher as offered only if it was placed in the ClientHello, so 0-RTT is not advertised for a cipher the security callback kept off the wire. - After a HelloRetryRequest, do not add a PSK the first ClientHello did not carry. Add tests for the suppressed-0-RTT and HelloRetryRequest cases. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Sep 23 14:44:15 2026 (Merged from https://github.com/openssl/openssl/pull/32542)
* ML-KEM-512 hybrid TLS KEMsViktor Dukhovni2026-09-235-12/+77
| | | | | | | | | | Per the new codepoints assigned by IANA for draft-rosomakho-tls-ecdhe-mlkem512-00. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Mon Sep 21 11:52:03 2026 (Merged from https://github.com/openssl/openssl/pull/32670)
* Document when X509_cmp() and X509_CRL_match() order objectsBob Beck2026-09-171-6/+7
| | | | | | | | | | | | | Their result orders objects consistently only while none has been modified since it was signed or decoded and each has its internal hash; a modified object is unequal to everything but two modified objects are not ordered with respect to each other. Say so instead of claiming the sign always orders the objects. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:36 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Use SipHash for the internal fingerprintBob Beck2026-09-171-3/+3
| | | | | | | | | | | | | Replace SHA-1 with SipHash-2-4 (fixed key, 64-bit output) for the internal X509 and X509_CRL fingerprint. Always build crypto/siphash; no-siphash now only removes the provider MAC. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Compute X509_get_signature_info() on demand, not in the cacheBob Beck2026-09-171-2/+0
| | | | | | | | | | | | | | | The signature info was computed once by ossl_x509v3_cache_extensions() and stored in X509::siginf. Its security bits depend on a digest fetch under the certificate's libctx/propq, so the cached answer was frozen to the context the certificate was parsed in. Compute it in X509_get_signature_info() instead. The siginf field and ossl_x509_init_sig_info() are removed. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:34 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Make the cached SHA-1 fingerprint internal-onlyBob Beck2026-09-172-5/+10
| | | | | | | | | | | | | | | | | | | X509::sha1_hash exists only so X509_cmp() can compare certificates by identity, yet X509_digest() handed it to callers when asked for SHA-1, and it was computed under the certificate's libctx/propq, tying an internal value to the context the certificate was parsed in. Compute it with the built-in SHA-1 over the DER encoding instead, via the new ossl_x509_internal_fingerprint(), so it is the same in every library context; the only remaining failure mode is an allocation failure. Drop the X509_digest() shortcut so the cached value is never visible to callers, and rename the field to fingerprint in X509 and X509_CRL. The CRL side gets the same treatment in a following commit. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Treat a modified certificate or CRL as equal only to itselfBob Beck2026-09-171-1/+6
| | | | | | | | | | | | | | | | X509_cmp() and X509_CRL_match() skipped the encoding comparison when either object had been modified since it was signed or decoded, and returned the result of comparing cached hashes that a modification does not refresh. A modified copy of a certificate therefore compared equal to the original. Return unequal as soon as either object is modified, with the modified one sorting last, and always compare the encodings otherwise. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:32 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Fall back to comparing the encoding in X509_CRL_match()Bob Beck2026-09-171-1/+3
| | | | | | | | | | | | | | X509_CRL_match() trusted the cached SHA-1 hash alone, and returned -2 when either hash was unavailable. Give it the same fallback X509_cmp() has: when the hashes match or are unavailable, compare the cached encoding of the to-be-signed part, then the signature algorithm and signature value. It no longer returns -2; document that earlier versions did. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:31 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* doc: add reference to how to list EC curve namesKit Dallege2026-09-171-0/+3
| | | | | | | | | | | | | | | | | EVP_PKEY_keygen() and the related keygen helpers take an EC curve name as a string parameter, but the page did not point to any way of discovering the accepted names. Add a reference to EC_get_builtin_curves(3), which lists the built-in curve NIDs, and OSSL_EC_curve_nid2name(3), which converts a NID to the name string accepted by the keygen functions. Co-Authored-By: Claude Opus 4.8 <[email protected]> Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Sep 17 13:45:12 2026 Merged-from: https://github.com/openssl/openssl/pull/29912
* Add ASCON-AEAD128 cipher implementation per NIST SP 800-232evil-cry2026-09-162-0/+88
| | | | | | | | | | | | | | | | | | | | | | Integrate ASCON-AEAD128 authenticated encryption cipher into OpenSSL's default provider and libcrypto. ASCON-AEAD128 is specified in NIST SP 800-232 and provides authenticated encryption with associated data (AEAD) using a 128-bit key and 128-bit nonce. Implementation details: - Add cleanroom crypto/ascon implementation - Add provider cipher implementation following OpenSSL stream cipher patterns with generated parameter dispatch tables - Support standard AEAD operations including AAD handling, tag generation/verification, and context reinitialization Fixes: #28271 Co-authored-by: Billy Brumley <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Wed Sep 16 14:25:19 2026 Merged-from: https://github.com/openssl/openssl/pull/29934
* http: reject HTTPS downgrades after relative redirectsMounir IDRASSI2026-09-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | OSSL_HTTP_get() replaces current_url with a relative Location while reusing the request context. Checking the previous URL's scheme therefore allows a subsequent absolute HTTP redirect to bypass the downgrade guard. Pass the existing use_ssl flag to redirection_ok(). It survives relative redirects and is updated when an absolute URL is parsed, also covering HTTP-to-HTTPS upgrades followed by a relative redirect and an HTTP target. Add a parameterized memory BIO test covering both bypass cases, direct downgrade rejection, and allowed HTTP and HTTPS redirects. Document the existing restriction on redirects from HTTPS to HTTP. Fixes: #32688 Assisted-by: Codex:gpt-6 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Merge-date: Wed Sep 16 09:29:19 2026 Merged-from: https://github.com/openssl/openssl/pull/32694
* Regression test for PKCS12_parseDmitry Belyavskiy2026-09-151-1/+9
| | | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Todd Short <[email protected]> Merge-date: Tue Sep 15 15:23:48 2026 Merged-from: https://github.com/openssl/openssl/pull/32773
* DTLS1.3: disallow TLS_AES_128_CCM_8_SHA256 under DTLS1.3Ryan Hooper2026-09-141-0/+8
| | | | | | | | | | | | | | | | | | | | | | | RFC 9147 requires that TLS_AES_128_CCM_8_SHA256 not be used with DTLS without additional safeguards against forgery, due to its short authentication tag. We implement no such safeguards, so exclude this ciphersuite from DTLS negotiation by clearing its min_dtls/max_dtls bounds in the cipher table. It remains fully available for TLS. Update the existing tests that assumed this cipher was negotiable under DTLS1.3 (test_tls13_ciphersuite, early_data_skip_helper, test_early_data_psk_with_all_ciphers), and add a dedicated regression test confirming a DTLS1.3 connection offering only this ciphersuite fails to find a usable cipher. Document the restriction in the DTLS1.3 guide. Fixes: https://github.com/openssl/openssl/issues/32509 Assisted-by: Claude:claude-sonnet-5 Reviewed-by: Todd Short <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Sep 14 14:04:07 2026 Merged-from: https://github.com/openssl/openssl/pull/32749
* Augment docs for BIO_s_dgram_pairNeil Horman2026-09-111-1/+4
| | | | | | | Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Fri Sep 11 20:51:01 2026 (Merged from https://github.com/openssl/openssl/pull/32498)
generated by cgit (git 2.51.2) at 2026-10-25 17:22:40 +0100