aboutsummaryrefslogtreecommitdiffstats
path: root/include/crypto
Commit message (Collapse)AuthorAgeFilesLines
* s390x: Disable mod-expo offloading to a crypto card for small exponentsIngo Franzki2 days1-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new keyword 'cex_min_bits:<bits>' for the OPENSSL_s390xcap environment variable to specify the minimum number of bits that the exponent must have to offload the operation to the crypto card. Operations with smaller exponents fall back to software calculation. Mod-expo operations with small exponents are faster in software than via the crypto card. The default minimum exponent size is 2048 bits, but this can be changed via the OPENSSL_s390xcap environment variable. For mod-expo operations the exponent is checked, and for RSA CRT operations the modulus is checked to have the minimum bit size. RSA public key operations usually have small exponents, so they are most likely always performed in software. Checking the bit size of a BIGNUM may or may not be constant-time, dependent on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit size of the modulus is checked. The modulus is public information, so no constant-time issue here. For mod-expo operations with the public exponent it is also not a constant-time issue, because the public exponent is also public information. For mod-expo operations with the private exponent, the size of the private exponent is usually the same as the size of the modulus, which is public information. For DH mod-expo operations with the private key, the size of the private key is usually dependent on the DH group that is used, and this is also public information. Nevertheless, private exponents better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always done (dh_init() sets the flag unconditionally). Furthermore, flag BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key(). Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Oct 23 15:20:45 2026 (Merged from https://github.com/openssl/openssl/pull/31630)
* Optimize ML-KEM for the s390x architectureTimo Keller2026-09-291-0/+40
| | | | | | | | | | | | | | | | | | | | | | The vectorization is implemented using vector extensions (of gcc/clang) and will work on any architecture with 128 bit vector registers that has suitable builtins like `vec_mulh` for the high part of a multiplication. We also optimize the multiplication in `F_{q^2}` using a twisted Karatsuba multiplication. Bob has only been used for writing the comments based on a formal verification of the code, and for the extraction of the constants at the beginning of `ml_kem_vec128.c`. Enable this for s390x. Signed-off-by: Timo Keller <[email protected]> Assisted-by: IBM Bob:2.0.3 Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 29 16:47:13 2026 Merged-from: https://github.com/openssl/openssl/pull/31929
* ec: make ossl_ec_scalar_mul_ladder() scalar padding constant timeIgor Ustinov2026-09-291-0/+1
| | | | | | | | | Fixes CVE-2026-54872 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alicja Kario <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Tue Sep 29 11:23:53 2026
* Defer computation of relative CRLDP namesViktor Dukhovni2026-09-291-0/+4
| | | | | | | | | | | These are derived just-in-time, during any actual CRL processing. Fixes CVE-2026-35189 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Tue Sep 29 11:11:18 2026
* Re-format code after TypenameMacros and ForEachMacros additionsEugene Syromiatnikov2026-09-241-68/+68
| | | | | | | | | | | | | | | Re-formatting was done using the following command: for i in `git grep -l 'OSSL_LIST\|PRIORITY_QUEUE_OF\|SPARSE_ARRAY_OF' \ -- '*.c' '*.h' '*.c.in' '*.h.in'`; do \ clang-format-21 --style=file:.clang-format -i "$i"; \ done Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 24 09:01:06 2026 Merged-from: https://github.com/openssl/openssl/pull/32304
* aes-ctr-avx512: disable the VAES-512 CTR path for MSVCMadan mohan Manokar2026-09-211-0/+18
| | | | | | | | | | | | | | | | | | | | | | MSVC 14.51 builds of the VAES-512 CTR kernel return a wrong keystream for AES-192 and AES-256 whenever the block count leaves a 4-block (single-zmm) step. The default CTR-DRBG runs on AES-256-CTR, so this also corrupts random byte generation and makes unrelated tests fail. The same code is correct on VAES hardware built with gcc, so keep the hook enabled there and off for MSVC until the code generation issue is found. AES-CBC decryption is unaffected and stays enabled. Hosted runners rarely have AVX-512, so whether CI exercises this path at all depends on which host a job lands on. Run evp_extra_test under Intel SDE as well, where -icx always reports VAES. Refs #32873 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Sep 21 09:57:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32883
* NUL-terminate ASN1_STRING data built inside libcryptoBob Beck2026-09-181-0/+22
| | | | | | | | | | | | | | | Add ossl_asn1_string_set1_data() and ossl_asn1_string_set1_string(), copies of the public setters that also write a NUL byte after the data, and switch all libcrypto callers to them. The ecosystem still treats ASN1_STRING data as C strings; this keeps it working while it is fixed. Removing the terminator later is a one-argument change in one function. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Fri Sep 18 09:05:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32829
* Use SipHash for the internal fingerprintBob Beck2026-09-171-12/+34
| | | | | | | | | | | | | Replace SHA-1 with SipHash-2-4 (fixed key, 64-bit output) for the internal X509 and X509_CRL fingerprint. Always build crypto/siphash; no-siphash now only removes the provider MAC. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:35 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Compute X509_get_signature_info() on demand, not in the cacheBob Beck2026-09-171-2/+0
| | | | | | | | | | | | | | | The signature info was computed once by ossl_x509v3_cache_extensions() and stored in X509::siginf. Its security bits depend on a digest fetch under the certificate's libctx/propq, so the cached answer was frozen to the context the certificate was parsed in. Compute it in X509_get_signature_info() instead. The siginf field and ossl_x509_init_sig_info() are removed. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:34 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* Make the cached SHA-1 fingerprint internal-onlyBob Beck2026-09-171-3/+27
| | | | | | | | | | | | | | | | | | | X509::sha1_hash exists only so X509_cmp() can compare certificates by identity, yet X509_digest() handed it to callers when asked for SHA-1, and it was computed under the certificate's libctx/propq, tying an internal value to the context the certificate was parsed in. Compute it with the built-in SHA-1 over the DER encoding instead, via the new ossl_x509_internal_fingerprint(), so it is the same in every library context; the only remaining failure mode is an allocation failure. Drop the X509_digest() shortcut so the cached value is never visible to callers, and rename the field to fingerprint in X509 and X509_CRL. The CRL side gets the same treatment in a following commit. Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:44:33 2026 Merged-from: https://github.com/openssl/openssl/pull/32686
* aes-ctr-avx512: add VAES-512 AES-CTR encryptionMadan mohan Manokar2026-09-171-0/+9
| | | | | | | | | | | | | | | | | | | | | | | Add a VAES-512 accelerated AES-CTR encryption path built on the shared 512-bit primitives. Counter blocks are generated and encrypted 4/8/16 at a time; the low 64-bit counter word is clamped so that a 64-bit carry is handled by a scalar step before VAES resumes, and payloads below the provider threshold fall back to the existing aesni CTR path. The provider gains a CTR hook that routes eligible payloads to the VAES implementation, and aes_platform.h exposes VAES_CTR_ELIGIBLE (aliased to VAES512_ELIGIBLE) with the ossl_aes_ctr_vaes prototypes. The existing CTR known-answer vectors were all below the provider threshold that dispatches to the VAES path, so that code was never exercised. Add NIST SP800-38A 64-byte CTR KATs (AES-128/192/256) and a parametrized C test spanning 64B-5000B across all key sizes and counter-carry boundaries, validated against an independent ECB-based CTR reference. Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:26:00 2026 Merged-from: https://github.com/openssl/openssl/pull/30755
* aes: factor out shared VAES-512 primitivesMadan mohan Manokar2026-09-171-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The VAES-512 AES implementation file will host more than one mode. Rename it to a mode-neutral name ahead of adding the AES-CTR implementation and factoring out the shared VAES-512 primitives. This commit is a pure rename with no content change. Refactor the VAES-512 CBC decryption code to sit on top of a small set of shared 512-bit primitives so that additional AES modes can reuse them: - portable compiler abstractions for ISA targeting and inlining, - OSSL_VAES512_DEFINE_ROUNDS, a macro emitting the 1x/2x/4x parallel 512-bit AES round functions for any round count and direction, - OSSL_VAES512_LOAD_ROUNDKEYS / OSSL_VAES512_CLEAR_ROUNDKEYS helpers, - ossl_vaes512_cpu_capable(), a shared runtime capability check. The generated machine code for CBC decryption is byte-identical to the previous version. aes_platform.h grows a VAES512_ELIGIBLE base guard with VAES_CBC_ELIGIBLE kept as an alias. Rename the assembly cleanup helper and perlasm module from CBC-specific names to shared aes-vaes symbols so additional modes can reuse the same stack scrub routine. Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 16:25:59 2026 Merged-from: https://github.com/openssl/openssl/pull/30755
* Removes unused foreign member of evp_pkey_stFrederik Wedel-Heinen2026-09-161-1/+0
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Wed Sep 16 14:34:46 2026 Merged-from: https://github.com/openssl/openssl/pull/32820
* Add ASCON-AEAD128 cipher implementation per NIST SP 800-232evil-cry2026-09-161-0/+57
| | | | | | | | | | | | | | | | | | | | | | Integrate ASCON-AEAD128 authenticated encryption cipher into OpenSSL's default provider and libcrypto. ASCON-AEAD128 is specified in NIST SP 800-232 and provides authenticated encryption with associated data (AEAD) using a 128-bit key and 128-bit nonce. Implementation details: - Add cleanroom crypto/ascon implementation - Add provider cipher implementation following OpenSSL stream cipher patterns with generated parameter dispatch tables - Support standard AEAD operations including AAD handling, tag generation/verification, and context reinitialization Fixes: #28271 Co-authored-by: Billy Brumley <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Wed Sep 16 14:25:19 2026 Merged-from: https://github.com/openssl/openssl/pull/29934
* Copyright year updatesopenssl-machine2026-09-0918-18/+18
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Sep 9 13:12:46 2026 Release: yes
* ec: accept duplicate instances of the point format parameterPauli2026-09-071-1/+1
| | | | | | | | | | | | The first value is kept. This is done for compatibility with old FIPS providers from <=4.0 branches. They export two point format parameters with different values. Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Sep 7 18:14:55 2026 Merged-from: https://github.com/openssl/openssl/pull/32675
* Generate the error headers and tables at build timeBob Beck2026-09-0133-946/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Teach util/mkerr.pl two new modes. -emit FILE writes one generated error file to standard output as a pure function of openssl.ec and openssl.txt, with no source scan and no state update; every file in the openssl.ec L table becomes a GENERATE rule driven by it, and the generated error headers join the mandatory generated headers. -state scans the sources and maintains openssl.txt but writes no other files; "make errors" now uses it, so the developer flow only curates the state and the build emits everything else. Reason-code assignment moves out of the header emission into its own pass, the three emitters become subroutines writing to a filehandle, and the up-to-date stamp moves from the statefile's own timestamp to a separate gitignored stamp file, since the statefile is now a build input whose timestamp must track its content. Removing the committed copies also retires 15 that had silently drifted from the generator's output, among them crypto/bio/bio_err.c, which was missing the reason strings for three BIO error codes that exist in the state file. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 14:03:03 2026 Merged-from: https://github.com/openssl/openssl/pull/32243
* Store the CMS created-content state in CMS_ContentInfoBob Beck2026-09-011-8/+0
| | | | | | | | | | | | | | Whether the content octet string was created locally (to be filled in) or read in via d2i is CMS's own state; it was being kept in the ASN1_STRING via ASN1_STRING_FLAG_CONT, of which the only user was CMS. Track it in a CMS_ContentInfo field instead of using ASN1_STRING as a convenient internal state toilet. No change in behaviour. Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 13:56:40 2026 Merged-from: https://github.com/openssl/openssl/pull/32242
* rand: add seed_strict option enforcing the configured seed sourceJakub Zelenka2026-09-011-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a provider requests seeding material via the get_user_entropy or get_user_nonce core callbacks before the primary DRBG was created, the request silently falls back to the operating system entropy sources, because the seed source EVP_RAND_CTX only comes into existence as a side effect of creating the primary DRBG. Whether a configured seed source is used therefore depends on operation order: for example with the FIPS provider, genrsa happened to use the configured source while ecparam -genkey did not. This fallback is acceptable for most setups, but not when the seed source selection is meant to be a guarantee, for example for compliance reasons. Add a seed_strict option to the [random] configuration section which makes the callbacks instantiate the seed source on demand and turns an unusable seed source into an error rather than a silent fallback. The option is off by default with two exceptions: selecting the JITTER seed source, at runtime or at build time via -DOPENSSL_DEFAULT_SEED_SRC, seeds strictly unless the option disables it, and enable-fips-jitter builds always seed strictly. The boolean value parsing is shared with the provider section by factoring the existing parser out into ossl_conf_parse_bool(). A build time default property query can now be set with -DOPENSSL_DEFAULT_SEED_PROPQ. Add a regression test covering the on-demand creation and the no fallback behaviour on the strict provider seeding path, a test for the default non-strict fallback behaviour including the JITTER strictness default, and [random] seed configuration coverage in the rand config test recipe. Fixes #25941 Assisted-by: Claude:claude-fable-5 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Sep 1 12:07:39 2026 Merged-from: https://github.com/openssl/openssl/pull/31939
* ec_params: add include guard to crypto/ec_params.h.inPauli2026-09-011-0/+5
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* rsa: use selection-specific import decodersPauli2026-09-011-22/+62
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* ec: name generated parameter groupsPauli2026-09-011-35/+109
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* providers: convert EC keymgmt parameter parsingPauli2026-09-011-15/+20
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* ec: define generated parameter triesPauli2026-09-012-1/+241
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* rsa: define generated parameter triesPauli2026-09-012-4/+271
| | | | | | | | Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32502)
* Add OPENSSL_NONSTRING and apply it to ASN1_STRING's data fieldBob Beck2026-08-271-1/+1
| | | | | | | | | | | | | | | | | OPENSSL_NONSTRING expands to __attribute__((nonstring)) where the compiler supports it and to nothing otherwise. ASN1_STRING data has an explicit length and is not necessarily NUL terminated, so marking the field lets GCC diagnose direct use of it with C string functions such as strlen(), strcpy() or "%s". The diagnostic fires only on GCC under an optimised build; other compilers, including current Clang, accept the attribute but do not warn. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Aug 27 13:52:51 2026 Merged-from: https://github.com/openssl/openssl/pull/32178
* Reject duplicate fields in X509v3 configGreensi72026-08-091-1/+1
| | | | | | | | | | | | Reject repeated fields in policyConstraints, basicConstraints and basicAttConstraints instead of silently accepting the last value. Assisted-by: ChatGPT:gpt-5.6 Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Sun Aug 9 04:06:37 2026 (Merged from https://github.com/openssl/openssl/pull/32181)
* GCM/ghash specialization for the e2kv6 (Elbrus2000) archAlexander Troosh2026-07-311-1/+4
| | | | | | | | | Co-authored-by: Gleb Popov <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> MergeDate: Fri Jul 31 16:49:56 2026 (Merged from https://github.com/openssl/openssl/pull/31269)
* md32_common.h: Add Elbrus2000-specific version of ROTATEGleb Popov2026-07-311-0/+5
| | | | | | | Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> MergeDate: Fri Jul 31 16:49:30 2026 (Merged from https://github.com/openssl/openssl/pull/31269)
* Add AVX-512/VAES optimized AES-CBC decryptionMadan mohan Manokar2026-07-311-0/+17
| | | | | | | | | | | | | | | | | | | | | | | Implement an AVX-512 VAES-based bulk path for AES-CBC decryption that processes multiple blocks in parallel, improving decryption performance for large inputs (1024 bytes or more) by 3.5x to 3.8x. - Add the VAES CBC decrypt intrinsic implementation (crypto/aes/aes_cbc_vaes_intrinsic.c) and wire it into the AES-NI provider cipher path. - Centralize the VAES_CBC_ELIGIBLE eligibility guard in include/crypto/aes_platform.h to keep the header and implementation in sync, and drop the redundant AES_BLOCK_SIZE define. - Guard the intrinsics with refined gcc, clang, and msvc compiler-version checks, ensuring clean builds in no-asm, no-deprecated, and Windows (shared/minimal) configurations. - Add an EVP-level AES-CBC decrypt test exercising the VAES bulk path across AES-128/192/256 and a range of input lengths. Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Fri Jul 31 16:33:35 2026 (Merged from https://github.com/openssl/openssl/pull/30902)
* rand: fix jitter seed macro logicJakub Zelenka2026-07-171-0/+10
| | | | | | | | | | | | | | The seeding macro logic was mixed up and incompletely applied. The macro logic was also cleaned up. Co-authored-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Fri Jul 17 04:47:07 2026 (Merged from https://github.com/openssl/openssl/pull/31970)
* Drop missed unneded GNUC>=2 checkBob Beck2026-07-101-1/+1
| | | | | | | | | | Spotted by idrassi on review. thanks! Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 11:47:21 2026 (Merged from https://github.com/openssl/openssl/pull/31677)
* We no longer need to test for GCC versions this oldBob Beck2026-07-101-1/+1
| | | | | | | | | | | | | | The minimum gcc to compile our code appears to be version 9, and we are now C99. All these older checks become a tautology on anything that will build a modern OpenSSL tree, so clean this up. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 11:47:17 2026 (Merged from https://github.com/openssl/openssl/pull/31677)
* Extend refcounting on evp objects to provider requesed no-cachingNeil Horman2026-07-022-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | We recently removed reference counting for EVP objects, but kept the refcounting when we build with no-cached-fetch. There is a corner case in which providers in builds that do caching may still request non-caching by setting *no_cache = 1 in their query operations. OQS tripped over this here: https://github.com/open-quantum-safe/oqs-provider/pull/787 When a provider requests no caching, we need to treat those algorithms as though we are running in a no-cached-fetch build and still do ref counting on them. Teach our algorithms implementation to understand when a provider is requesting non-caching, mark them as such and ref count only those. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Thu Jul 2 14:24:13 2026 (Merged from https://github.com/openssl/openssl/pull/31782)
* Refactor AES hardware cipher implementationsSimo Sorce2026-06-271-0/+6
| | | | | | | | | | | | | | | | | | | | Replace architecture-specific `.inc` files with standalone `.c` files for AES ciphers and consolidate CFB mode logic into these new modules. This eliminates the direct inclusion of source files and compiles each hardware implementation as a separate translation unit. This refactoring simplifies code organization and remove macro complexity that makes it hard to understand what is implemented and where enhancing maintainability. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:40 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Provide ASN1_STRING_new_not_owned()Bob Beck2026-06-031-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | This function provides the ability to construct an ASN1_STRING containing data that is not owned by the constructed ASN1_STRING. The resulting ASN1_STRING, when freed, will not free the data, and it is the caller's resposibility to ensure that the data lives past the lifetime of any returned ASN1_STRING. Why? you may ask? Many places where ->data and ->length were used directly in the past before the opaquification of ASN1_STRING were for this purpose, whether used for actual static data, or to turn bytes created by and in control of the caller into an ASN1_STRING for temporary use as an input. This function makes this easier to do without making copies. The function deliberately does not allow the creation of a BIT_STRING as this would require also always providing unused bits, which is annoying and unnecessary for almost all potential use cases. For: https://github.com/openssl/openssl/issues/29861 For: https://github.com/openssl/openssl/issues/30162 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Wed Jun 3 11:42:49 2026 (Merged from https://github.com/openssl/openssl/pull/30964)
* Convert use of artisinally made hand crafted integer typesBob Beck2026-05-271-12/+12
| | | | | | | | | to use the stdint.h ones. Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed May 27 09:09:41 2026 (Merged from https://github.com/openssl/openssl/pull/31254)
* use stdint in modes.hBob Beck2026-05-271-46/+39
| | | | | | | Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed May 27 09:09:41 2026 (Merged from https://github.com/openssl/openssl/pull/31254)
* Deprecate UTF8_putc/getc() and use uint32_t for unicodeBob Beck2026-05-181-0/+3
| | | | | | | | | | | | Unicode codepoints fit in 32 bits so we can use uint32_t instead of unsigned long. Also use OPENSSL_load_XX_be instead of manual shifting. Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon May 18 11:02:37 2026 (Merged from https://github.com/openssl/openssl/pull/30967)
* Deprecate the X509_check_{email,host,ip,ip_asc} family of functionsBob Beck2026-05-111-0/+4
| | | | | | | | | | | | | | | | Our own documentation for quite some time has indicated that you should call X509_verify_cert() instead of using these. Actually deprecate them and make apps not use the now deprecated functions. Resolves: https://github.com/openssl/project/issues/1899 References: https://github.com/openssl/project/issues/1897 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon May 11 00:08:33 2026 (Merged from https://github.com/openssl/openssl/pull/30403)
* Move *_arch.h to include/archNorbert Pocs2026-05-108-363/+11
| | | | | | | | | | | | Move all the architecture specific header files under a single directory in include/ Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Sun May 10 09:53:34 2026 (Merged from https://github.com/openssl/openssl/pull/30751)
* Make the crypto includes self-containedBob Beck2026-05-061-0/+1
| | | | | | | | | | Except for obj_dat.h and obj_xref.h which need perl mungery Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:57 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* make includes self-containedBob Beck2026-05-068-0/+25
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:48 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* Add missing include guards in includeBob Beck2026-05-065-0/+25
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:47 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* md32_common.h is not a self contained header fileBob Beck2026-05-061-0/+0
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:44 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* sparse_array: avoid ubsan violation in typed doallNikola Pajkovsky2026-05-031-3/+25
| | | | | | | | | | | | | | | | | | | | | | | | clang-22 with enable-asan and enable-ubsan enabled fails with error crypto/sparse_array.c:93:21: runtime error: call to function alg_copy through pointer to incorrect function type 'void (*)(unsigned long, void *, void *)' ossl_sa_##type##_doall(const SPARSE_ARRAY_OF(type) * sa, void (*leaf)(ossl_uintmax_t, type *)) { ossl_sa_doall((OPENSSL_SA *)sa, (void (*)(ossl_uintmax_t, void *))leaf); } typed doall(_arg) expect leaf to have type, but generic code is using void *, and the type-casting cases the error. Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Sun May 3 15:17:58 2026 (Merged from https://github.com/openssl/openssl/pull/31035)
* riscv: fix IS_IN_DEPEND_VECTOR range checkChristoph Müllner2026-04-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The macro checked (ZVX_MIN >= offset) which is equivalent to (offset <= ZVX_MIN), making it true for offsets 0-15 instead of the intended range [ZVX_MIN, ZVX_MAX] = [15, 23]. The practical effect in hwprobe_to_cap() was inverted: - Scalar extensions (ZBA..ZKT, offsets 0-14) were incorrectly treated as vector-dependent and suppressed when VECTOR_CAPABLE was false, preventing their detection via hwprobe. - Vector extensions ZVBC..ZVKSH (offsets 16-23) were not treated as vector-dependent, allowing them to be enabled via hwprobe even when the V extension was absent. Fix by changing >= to <= so the macro correctly tests whether offset falls in [ZVX_MIN, ZVX_MAX]. Signed-off-by: Christoph Müllner <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Apr 16 17:03:40 2026 (Merged from https://github.com/openssl/openssl/pull/30713)
* Rename ossl_asn1_string_set_bits_left to something more expressiveNorbert Pocs2026-04-131-1/+1
| | | | | | | | | | Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Mon Apr 13 07:11:11 2026 (Merged from https://github.com/openssl/openssl/pull/30746)
* ML_DSA/ML_KEM: Add fromdata property query support.slontis2026-03-132-0/+3
| | | | | | | | | | | | | | | | This allows ML_KEM/ML_DSA keys to set a "properties" value that is used to refetch the digests. This may be used when doing an import using EVP_PKEY_fromdata(). Note that this is not used by EVP_PKEY_new_raw_private_key_ex() or EVP_PKEY_new_raw_public_key_ex() since the propq used here is associated with the keymanager (i.e. via EVP_PKEY_CTX_new_from_name()) not the propq associated with internal fetches used by the key to fetch digest algorithms. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Fri Mar 13 17:24:41 2026 (Merged from https://github.com/openssl/openssl/pull/30243)
* Copyright year updatesopenssl-machine2026-03-1015-15/+15
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Tue Mar 10 14:37:54 2026 Release: yes
generated by cgit (git 2.51.2) at 2026-10-25 17:21:51 +0100