aboutsummaryrefslogtreecommitdiffstats
path: root/providers/implementations
Commit message (Collapse)AuthorAgeFilesLines
* Restore empty raw PKCS#1 verify-recover behaviorMounir IDRASSI2026-07-241-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EVP_PKEY_verify_recover() with RSA PKCS#1 v1.5 padding and no configured signature digest rejected a valid signature whose recovered payload is empty, instead of returning success with a recovered length of zero. RSA_public_decrypt() returns -1 on error and otherwise the number of recovered bytes, which may legitimately be zero for a raw PKCS#1 v1.5 signature that encodes an empty payload. Pull request #28306 ("Make error checks on RSA_public_decrypt() consistent") changed the error check in the raw, no-digest verify-recover path from "ret < 0" to "ret <= 0", so a valid zero recovered length was mistaken for an error. Restore the "< 0" check in that branch only, leaving the digest-aware PKCS#1, X9.31, PSS and ordinary verification paths untouched. Add test_RSA_verify_recover_empty_payload, which performs a complete zero-length raw PKCS#1 v1.5 sign-and-recover round trip through EVP and fails on the unmodified implementation specifically at the EVP_PKEY_verify_recover() call. OpenSSL 3.0.13 recovers the same signature and reports a zero-byte result. The behavior regressed as a result of #28306. Fixes #32000 Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> MergeDate: Fri Jul 24 13:06:58 2026 (Merged from https://github.com/openssl/openssl/pull/32001)
* Make sure we always check return of CRYPTO_UP_REF which can fail.Frederik Wedel-Heinen2026-07-202-4/+2
| | | | | | | Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 20 11:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31753)
* [providers/implementations/ciphers] GCM-SIV: reject out-of-order update callsBilly Brumley2026-07-201-4/+13
| | | | | | | | | | | | | | | | | | | | | | | For GCM-SIV: 1. AAD must precede the payload 2. the payload must be single shot (2) was already happening, this change moves from a silent fail to an explicit error message for multiple update calls on the payload. For (1), this change unifies the logic for (2) one level up in the wrapper. So the code previously allowed (1), and now errors out after this change. Follow-up to #31906 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Mon Jul 20 06:56:04 2026 (Merged from https://github.com/openssl/openssl/pull/31940)
* poly1305: reject no-key update and NULL key paramsMounir IDRASSI2026-07-131-1/+5
| | | | | | | | | | | | | | | | | | | Poly1305 permits EVP_MAC_init(ctx, NULL, 0, ...) as part of staged initialization. If no key has been installed, update still dispatched into the uninitialized Poly1305 state, which can crash on POLY1305_ASM builds. Guard update with the same key_set check used by final and report no key set. Also reject an explicit OSSL_MAC_PARAM_KEY whose data pointer is NULL before calling Poly1305_Init(), even when the supplied size is POLY1305_KEY_SIZE. Fixes #31332 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 13 15:44:48 2026 (Merged from https://github.com/openssl/openssl/pull/31382)
* [test] check late AAD rejection across AEADsBilly Brumley2026-07-131-1/+4
| | | | | | | | | | | | | | | | A late AAD update (AAD supplied after the payload has started) must be rejected, and reported the same way, for every AEAD. #31673 checked this for ChaCha20-Poly1305 alone, so this change extends it to all AEADs. test_evp_aead_late_aad covers both the encrypt and decrypt directions and asserts ERR_LIB_PROV / PROV_R_UPDATE_CALL_OUT_OF_ORDER on the late update. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Mon Jul 13 15:40:39 2026 (Merged from https://github.com/openssl/openssl/pull/31906)
* FIPS: EC keygen - remove unnecessary self tests.slontis2026-07-131-12/+0
| | | | | | | | | | | | | | | | | | | | In FIPS mode EC keygen was doing 3 self tests. ec_generate_key() was calling both ecdsa_keygen_pairwise_test() and ecdsa_keygen_knownanswer_test(). The KAT did a key recomputation and comparison with the generated key, as per Sp80056Ar3 section 5.6.2.1.4. These tests covered both Keygen PCT for Key Agreement and Signatures. ossl_ec_key_pairwise_check() was also being called from within ec_gen(). The advice from Atsec (lab) is that the sign/verify test within ecdsa_keygen_pairwise_test() is sufficient according to the updated rules in FIPS 140-3 IG 10.3.A Additional comment 1, Since the usage of the generated key is unknown at the time of key generation. Detected during testing of Jipher by Roshith Alankandy (Oracle). Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jul 13 14:47:00 2026 (Merged from https://github.com/openssl/openssl/pull/31761)
* test-rng: handle nonce length query in generate modeJakub Zelenka2026-07-101-2/+3
| | | | | | | | | | | | | | | | The DRBG instantiation probes the parent nonce callback with a NULL output buffer to obtain the nonce length before requesting the actual nonce. The generate mode branch of test_rng_nonce() wrote the bytes without checking the output pointer, crashing when TEST-RAND with generate=1 is used as a DRBG parent. The entropy-buffer branch already handles a NULL output correctly. Assisted-by: Claude:claude-fable-5 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Fri Jul 10 15:47:15 2026 (Merged from https://github.com/openssl/openssl/pull/31885)
* Allow MinGW-w64 builds to use BCryptGenRandomMounir IDRASSI2026-07-101-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | MinGW-w64 has provided bcrypt headers and import libraries since version 2.0, but OpenSSL only enabled the BCryptGenRandom seeding path for supported MSVC builds. Enable the existing direct BCryptGenRandom flow for MinGW-w64 when targeting Windows Vista or newer, and link MinGW builds with bcrypt alongside the other Windows import libraries. Use __MINGW64_VERSION_MAJOR to detect MinGW-w64 because it is defined by both the 32-bit and 64-bit MinGW-w64 toolchains. Builds targeting older Windows versions keep the CryptoAPI fallback because USE_BCRYPTGENRANDOM remains disabled when _WIN32_WINNT is below 0x0600. Fixes #13878 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 12:05:09 2026 (Merged from https://github.com/openssl/openssl/pull/13882)
* We no longer need to test for GCC versions this oldBob Beck2026-07-101-1/+1
| | | | | | | | | | | | | | The minimum gcc to compile our code appears to be version 9, and we are now C99. All these older checks become a tautology on anything that will build a modern OpenSSL tree, so clean this up. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Jul 10 11:47:17 2026 (Merged from https://github.com/openssl/openssl/pull/31677)
* EC: make the group the single source of the point conversion formViktor Dukhovni2026-07-101-20/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The point conversion form (compressed, uncompressed, or hybrid) was kept both on the key and on the group, and the two could disagree -- a key imported as compressed could re-encode as uncompressed. The group is now the single source of truth: encoding, parameter output, and the legacy lookup all read it from the group, and decoding (PEM, DER, or raw parameters) records it there, so the form round-trips faithfully. Generated keys are always uncompressed; the point-format option at key generation is now a documented no-op (it had had no effect for several releases), and the unused form field on the keygen context is dropped. Imported keys still keep their form, and the deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still work. EVP_PKEY_fromdata() and openssl pkey -text now report the form a loaded EC key actually has, and re-encoding via PEM or DER preserves it. Docs drop a stale note about a compile-time macro for compressed points on binary curves, and the EC tests now exercise both the affine and the compressed/hybrid binary formats unconditionally (fixing a latent bug in the compressed/hybrid form tests that were never exercised by CI). Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Jul 10 09:21:29 2026 (Merged from https://github.com/openssl/openssl/pull/30940)
* Reject AES-XTS operations without an IVMounir IDRASSI2026-07-081-1/+2
| | | | | | | | | | | | | | | | | Commit 774525b38bd4 moved AES-XTS to an implementation-specific cipher function but did not carry over the generic iv_set guard. This allowed AES-XTS operations initialized with a NULL IV to proceed. Restore the missing iv_set check before processing input and add an evp_extra_test regression covering both a valid-IV control and the missing-IV failure case. Fixes #31755 Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Wed Jul 8 18:16:55 2026 (Merged from https://github.com/openssl/openssl/pull/31756)
* Allow `getentropy` for EmscriptenSteven WdV2026-07-081-1/+1
| | | | | | | | | | | | | | | | | | | | | Usually Emscripten emulates `/dev/urandom`, but in some cases, like with `-sNODERAWFS`, it doesn't. This means that on non-Unix platforms, where `/dev/urandom` does not exist on the host, OpenSSL will fail to seed its PRNG. This fixes that by instead using the POSIX function it implements, like which was already done for WASI. See https://github.com/emscripten-core/emscripten/issues/9628#issuecomment-4892658766 for more context. CLA: trivial Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jul 8 17:50:39 2026 (Merged from https://github.com/openssl/openssl/pull/31882) (cherry picked from commit dc219a04088d08de7df5afdb14263b3e9a4c7915)
* Fix typosDimitri Papadopoulos2026-07-081-2/+2
| | | | | | | | | | | | | | | | Found by typos[1]. [1] https://github.com/crate-ci/typos CLA: trivial Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:46:01 2026 (Merged from https://github.com/openssl/openssl/pull/31858)
* Eliminate unnecessary whitespace before a quoted newlineDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:22 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* Removes two unused macros: MAX_RESEED_INTERVAL and MAX_RESEED_TIME_INTERVAL.Frederik Wedel-Heinen2026-07-031-4/+0
| | | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Fri Jul 3 19:29:48 2026 (Merged from https://github.com/openssl/openssl/pull/31745)
* Remove internal-only DRBG_STATUS enumFrederik Wedel-Heinen2026-07-031-8/+5
| | | | | | | | | | Changed internal prov_drbg_st member variable from DRBG_STATUS to int to reflect how it was actually used. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Fri Jul 3 19:29:47 2026 (Merged from https://github.com/openssl/openssl/pull/31745)
* Extend refcounting on evp objects to provider requesed no-cachingNeil Horman2026-07-022-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | We recently removed reference counting for EVP objects, but kept the refcounting when we build with no-cached-fetch. There is a corner case in which providers in builds that do caching may still request non-caching by setting *no_cache = 1 in their query operations. OQS tripped over this here: https://github.com/open-quantum-safe/oqs-provider/pull/787 When a provider requests no caching, we need to treat those algorithms as though we are running in a no-cached-fetch build and still do ref counting on them. Teach our algorithms implementation to understand when a provider is requesting non-caching, mark them as such and ref count only those. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Thu Jul 2 14:24:13 2026 (Merged from https://github.com/openssl/openssl/pull/31782)
* Fix use of BCryptGenRandomMilan Broz2026-07-011-1/+1
| | | | | | | | | | | | | | | | | Current path for Windows RNG (for Vista and above) should use BCryptGenRandom() function but the symbol is not included in platform_symbols. The issue was hidden before commit 1eaf29ef6c reordered Windows header inclusion. Moreover, a cast to ULONG is required for strict warnings build. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed Jul 1 09:14:17 2026 (Merged from https://github.com/openssl/openssl/pull/31774)
* s390x: Fix AES-XTS hardware acceleration in IBM z17Ingo Franzki2026-07-012-23/+24
| | | | | | | | | | | | | | | | | | | | | | For the re-init case where only the IV is specified, but no key, the 'nap' field must also be initialized. Instead of setting the s390 specific fields in a special case block, call ctx->hw->init() also in this case. It performs the necessary setup already (when the KM function code was once set already). Adjust the cipher_hw_aes_xts_s390x_initkey() function so that it can also be called with a NULL key. It then only performs the IV setup as well as setting up the 'nap'. Closes: https://github.com/openssl/openssl/issues/31766 Signed-off-by: Ingo Franzki <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Wed Jul 1 09:12:26 2026 (Merged from https://github.com/openssl/openssl/pull/31775)
* Removes some stale SSLv3 support around the code and updated documentation ↵Frederik Wedel-Heinen2026-06-304-19/+6
| | | | | | | | | | to reflect removal. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Tue Jun 30 11:04:18 2026 (Merged from https://github.com/openssl/openssl/pull/30824)
* [test] check tag abuse for AEAD ciphersBilly Brumley2026-06-303-6/+20
| | | | | | | | | | | | | | | With AEAD ciphers, a tag is an input for decryption (the value to verify) and an output of encryption (the generated value). Therefore: - supplying a tag value while encrypting must fail - reading a tag while decrypting must fail - error codes should be consistent across all AEADs Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Tue Jun 30 07:47:03 2026 (Merged from https://github.com/openssl/openssl/pull/31734)
* Expand AES mode macro into explicit functionsSimo Sorce2026-06-271-12/+33
| | | | | | | | | | | | | | | | | | This removes the PROV_CIPHER_HW_aes_mode macro and replaces it with explicitly written function definitions for each AES mode (ECB, CBC, CFB128, CFB8, CFB1, OFB128, CTR). Expanding macro-generated functions improves overall code readability, allows code navigation tools to properly index the function signatures, and provides clearer stack traces during debugging. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:06:05 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Prefix internal AES-GCM functions with ossl_Simo Sorce2026-06-278-34/+34
| | | | | | | | | | | | | | | | | The `aes_gcm_hw_initkey` and `generic_aes_gcm_cipher_update` functions are shared across multiple hardware-specific provider implementations but lacked the internal `ossl_` prefix. They have been renamed to `ossl_aes_gcm_hw_initkey` and `ossl_generic_aes_gcm_cipher_update` respectively to follow OpenSSL naming conventions and prevent potential namespace collisions. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:06:03 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Consolidate SPARC T4 AES implementationsSimo Sorce2026-06-2712-152/+121
| | | | | | | | | | | | | | | | | | Move SPARC T4-specific AES hardware implementations (GCM, CCM, and XTS) from individual mode-specific files into a single unified file (cipher_aes_hw_t4.c). This consolidates the architecture-specific logic to improve code organization and maintainability. Additionally, this change removes the unused `keybits` parameter from several SPARC T4 hardware initialization routines to clean up the internal API. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:06:01 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Consolidate s390x AES hardware implementationsSimo Sorce2026-06-276-734/+709
| | | | | | | | | | | | | | | Move the s390x hardware-accelerated AES mode implementations (GCM, CCM, and XTS) from their respective files into a single `cipher_aes_hw_s390x.c` file. Centralizing the platform-specific logic simplifies the code structure and improves maintainability. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:58 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Extract Zvkned key length check to helperSimo Sorce2026-06-271-9/+18
| | | | | | | | | | | | | | | | | | A new helper function, zvkned_key_schedule_supported, is introduced to centralize the verification of 128-bit and 256-bit key lengths. This replaces multiple duplicated, hardcoded checks across the RISC-V AES implementations to improve code readability and maintainability. It also ensures consistent check handling for XTS mode by correctly evaluating half the key length. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:56 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Consolidate RISC-V 64 AES hardware codeSimo Sorce2026-06-2712-256/+226
| | | | | | | | | | | | | | | | | | Merge the RISC-V 64 hardware-accelerated AES mode implementations (GCM, CCM, and XTS) into a single file (`cipher_aes_hw_rv64i.c`). This removes the need for separate files for GCM and CCM, and extracts RV64-specific XTS code from the generic XTS hardware file, improving code organization. Additionally, remove the unused `keybits` parameter from the RV64 AES hardware retrieval functions. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:54 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Consolidate RV32I AES hardware implementationsSimo Sorce2026-06-2712-171/+118
| | | | | | | | | | | | | | | | | Move the RISC-V 32-bit hardware-accelerated AES implementations for GCM, CCM, and XTS modes into a single file (`cipher_aes_hw_rv32i.c`). This removes the need for separate files (`cipher_aes_gcm_hw_rv32i.c` and `cipher_aes_ccm_hw_rv32i.c`) and simplifies the build process. Additionally, unused `keybits` parameters are removed from the provider hardware initialization functions to clean up the code. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:52 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Consolidate ARMv8 AES hardware implementationsSimo Sorce2026-06-278-124/+110
| | | | | | | | | | | | | | | | | Move the ARMv8-specific hardware implementations for AES GCM into a single consolidated file (`cipher_aes_hw_armv8.c`). This groups architecture-specific optimizations together to improve code organization and maintainability. Additionally, remove the unused `keybits` parameter from the ARMv8 provider functions to simplify the function signatures. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:50 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Consolidate AESNI hardware implementationsSimo Sorce2026-06-2712-359/+341
| | | | | | | | | | | | | | | | | | | Move the AES-NI specific hardware implementations for GCM, CCM, and XTS modes from individual mode files into a single consolidated file (`cipher_aes_hw_aesni.c`). This groups architecture-specific optimizations together, improving code organization and maintainability. As part of this refactoring, the unused `keybits` parameter was removed from several AES-NI provider functions, and necessary XTS initialization and context copy functions were exported for shared use. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:48 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Migrate s390x AES-XTS to standard HW interfaceSimo Sorce2026-06-274-194/+175
| | | | | | | | | | | | | | | | | | | | Move the s390x-specific AES-XTS implementation from `cipher_aes_xts_s390x.inc` to `cipher_aes_xts_hw.c`, adapting it to use the standard `PROV_CIPHER_HW` dispatch structure. This refactoring removes standalone initialization wrappers and integrates the s390x hardware backend more cleanly with the generic AES-XTS provider code. It also reduces code duplication by relying on the generic layer for common validations (such as the maximum blocks per data unit limit) before invoking the hardware-specific stream cipher. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:46 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Refactor AES XTS hardware key initializationSimo Sorce2026-06-271-178/+152
| | | | | | | | | | | | | | | | | | | | Replace complex AES XTS initialization and hardware selection macros (`XTS_SET_KEY_FN`, `PROV_CIPHER_HW_declare_xts`, and `PROV_CIPHER_HW_select_xts`) with standard C functions. Architecture-specific initializers, particularly for RISC-V, are consolidated to evaluate CPU capabilities within dedicated initialization functions rather than relying on macro expansion. This refactoring improves overall code readability, maintainability, and simplifies debugging by eliminating opaque multi-statement macros. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:44 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Convert AES CCM .inc files to separate .c filesSimo Sorce2026-06-278-120/+177
| | | | | | | | | | | | | | | | | | | | The hardware-specific AES CCM implementations were previously included directly as `.inc` files into `cipher_aes_ccm_hw.c`. This commit renames them to standalone `.c` files and updates the build configuration, improving modularity by treating them as separate compilation units. Additionally, the `AES_HW_CCM_SET_KEY_FN` macro is replaced with a new `ossl_cipher_set_ccm_aes_initkey` helper function. This reduces code duplication, removes unsafe macro logic, and introduces proper error handling during provider key initialization. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:42 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Refactor AES hardware cipher implementationsSimo Sorce2026-06-2721-1031/+1117
| | | | | | | | | | | | | | | | | | | | Replace architecture-specific `.inc` files with standalone `.c` files for AES ciphers and consolidate CFB mode logic into these new modules. This eliminates the direct inclusion of source files and compiles each hardware implementation as a separate translation unit. This refactoring simplifies code organization and remove macro complexity that makes it hard to understand what is implemented and where enhancing maintainability. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:40 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Replace GCM_HW_SET_KEY_CTR_FN with a functionSimo Sorce2026-06-2710-87/+80
| | | | | | | | | | | | | | | | | | | The `GCM_HW_SET_KEY_CTR_FN` macro has been removed and replaced with a proper function, `aes_gcm_hw_initkey`, for AES GCM hardware implementations. For ARIA GCM, the macro expansion was manually inlined. This refactoring eliminates a multi-line macro to improve debuggability and type safety. Crucially, the new function checks the return value of the underlying key setup routines, ensuring that key initialization failures are now correctly caught and propagated instead of being ignored. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:38 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* Untangle rats nest of .inc files for AES_GCMSimo Sorce2026-06-2712-274/+328
| | | | | | | | | | | | | These files have no reason not to be just regular .c files. Additionally apply formatting fixes which were not done on .inc files Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Shane Lontis <[email protected]> MergeDate: Sat Jun 27 09:05:35 2026 (Merged from https://github.com/openssl/openssl/pull/31472)
* decode_der2key: wrap key-free callbacks to avoid function pointer castsNikola Pajkovsky2026-06-251-30/+75
| | | | | | | | | Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Thu Jun 25 12:12:55 2026 (Merged from https://github.com/openssl/openssl/pull/31523)
* AEAD: reject late AAD in ChaCha20-Poly1305 after plaintext updateDaniel Kubec2026-06-251-0/+2
| | | | | | | | | | | | | Align behavior with AES GCM, which already rejects this misuse with a hard error, by tracking whether plaintext processing has started and returning an error if AAD is supplied afterwards. Fixes #31188 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Thu Jun 25 07:01:44 2026 (Merged from https://github.com/openssl/openssl/pull/31673)
* Once initialised, ML-DSA keys should be immutableViktor Dukhovni2026-06-252-10/+21
| | | | | | | | | | | | | | | | ML-DSA keys should become immutable once key material has been added. This is already the case for at least ML-KEM keys, and should generally be the case across all key types. - Added the requisite check in the key management provider ml_dsa_import() function. - Also, consolidated the ML-KEM checks in ml_kem_import(). These were previously partly in ml_kem_key_fromdata(). Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Thu Jun 25 02:03:35 2026 (Merged from https://github.com/openssl/openssl/pull/30421)
* Fix key2ms_newctx() pointer type mismatch in MSBLOB/PVK key encoder007bsd2026-06-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | key2ms_newctx() returned struct key2ms_ctx_st *, but is registered as OSSL_FUNC_ENCODER_NEWCTX and called through OSSL_FUNC_encoder_newctx_fn (void *(*)(void *)), which is a case of undefined behavior, flagged by -fsanitize=function. Same class as [1], missed there. Give it the correct signature and add the self-check forward declaration, as key2ms_freectx() already has. [1] https://github.com/openssl/openssl/pull/31078 CLA: trivial Fixes: 0cc0164d193f "PROV: Add MSBLOB and PVK encoders" Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Jun 23 14:45:54 2026 (Merged from https://github.com/openssl/openssl/pull/31189)
* Remove direct includes of windows.h where possibleTomas Mraz2026-06-201-1/+1
| | | | | | | | | | | | It should be included via e_os.h instead. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Sat Jun 20 11:00:42 2026 (Merged from https://github.com/openssl/openssl/pull/31587)
* Revert "convert CRYPTO_THREAD_run_once to use InitOnceExecuteOnce api"Tomas Mraz2026-06-171-1/+1
| | | | | | | | | This reverts commit d053fe41a4add4e55dc5633e8aef6602a6a4b90b. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Jun 17 12:14:58 2026 (Merged from https://github.com/openssl/openssl/pull/31539)
* Fix up mismatched error reason codesJon Spillett2026-06-114-5/+5
| | | | | | | | | | Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jun 11 16:06:41 2026 (Merged from https://github.com/openssl/openssl/pull/31390)
* FIPS: Make keygen PCT failures recoverableslontis2026-06-116-21/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Key generation pairwise consistency tests (PCT) no longer cause the FIPS provider to enter a non recoverable error state. Originally I considered that the pairwise tests should never fail, so a failure was considered as a fatal error. Unfortunately this is not true, since the RSA pairwise test was changed to call rsa_ossl_public_encrypt(). This function can return -1 based on the values of n and e, resulting in a DOS for bad inputs. Under NIST FIPS 186-5, the public exponent (e) must be an odd positive integer greater than (e > 65536) and less than 2^256. The OpenSSL code however returns an error if e > 2^64 when n > 3072. (This check was added to prevent a CVE DOS). While FIPS 140-3 mandates that a module must transition into an error state upon self-test failures, a PCT is classified as a conditional self-test, not a pre-operational self-test (like an integrity test or a Known Answer Test) The cryptographic module is only required to immediately discard the faulty key pair and output a local error. The module is allowed to immediately attempt generating a new key pair using fresh entropy, without needing a full system reboot or module reset. Detected by Oracle during Jipher testing. Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Thu Jun 11 16:03:42 2026 (Merged from https://github.com/openssl/openssl/pull/31359)
* Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIVDmitry Belyavskiy2026-06-112-11/+19
| | | | | | | | | | | | | | | AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext Messages. AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext Messages on context reuse. Fixes CVE-2026-45446 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:12:25 2026
* Apply the buffered IV on the AES-OCB EVP_Cipher() pathViktor Dukhovni2026-06-111-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:02:00 2026
* Match the local q DHX parameter against the peer's qNorbert Pocs2026-06-111-1/+4
| | | | | | | | | | | | | | As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:56:27 2026
* convert CRYPTO_THREAD_run_once to use InitOnceExecuteOnce apiNeil Horman2026-06-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Issue #22059 reported a race condition in CRYPTO_THREAD_run_once on windows platforms. The most correct fix for this is to convert the windows run_once implementation to use the Win32 InitOnceRunOnce interface. Doing so requires at least Windows Vista/Windows Server 2008 to be available, and because WinXP hasn't built since 3.0 released, it seems sensible to bump our minimal NT version to be 0x600 (Vista/2008) Also, while we're at it, this change caught a bad programming practice in the rio_notifier code, which attempts to reset the once variable during shutdown. The windows static initalizer macro for this api is constructed such that attempting to do so causes a build break. Since once variables are not meant to be reset (since they are only triggered once), remove that reset code to avoid the breakage. Note that this problem was independently found and fixed in #30198. We're taking the fix from this pr (as they are effectively identical), and using that PR to add some much needed tests to the rio code. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Bob Beck <[email protected]> MergeDate: Wed Jun 10 19:44:19 2026 (Merged from https://github.com/openssl/openssl/pull/31339)
* Fix macro staircase formatting issueNorbert Pocs2026-06-104-21/+21
| | | | | | | | | | | | | When the macro contains a comma (',') as a trailer character, then clang-format doesn't get the correct formatting Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jun 10 13:24:44 2026 (Merged from https://github.com/openssl/openssl/pull/31386)
* Fix missing dependency on ml_kem_keymgmt.cNeil Horman2026-06-091-1/+1
| | | | | | | | | | | | | | | | | | ml_kem_keymgmt.c includes der_wrap.h, which is a generated file, but doesn't include a depdency in its build.info file, meaning that if the dependencies aren't run in the right order, ml_kem_keymgmt.c gets compiled before der_wrap.h is generated, leading to a build break. Fix it by including the needed dependency. Fixes #31379 Reviewed-by: Alicja Kario <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Tue Jun 9 17:49:28 2026 (Merged from https://github.com/openssl/openssl/pull/31385)
generated by cgit (git 2.51.2) at 2026-10-25 17:06:38 +0100