aboutsummaryrefslogtreecommitdiffstats
path: root/util/libcrypto.num
Commit message (Collapse)AuthorAgeFilesLines
* Prepare a now opaque ASN1_STRING for the size_t rapture.Bob Beck2026-07-181-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that ASN1_STRING is opaque, we can finally move away from an int for the length internally. The remaining problematic piece for this is that ASN1_STRING_length() returns an int and is public API. Therefore, we deprecate ASN1_STRING_length() and provide a replacement ASN1_STRING_length_ex() that returns a size_t length. We also provide setting functions that take size_t lengths, they are ASN1_STRING_set_data() which takes a uint8_t data pointer and a size_t length, and ASN1_STRING_set_string() which takes a argument that must be a c string and will use strlen to determine the length. (This replaces th previous arcane behaviour of calling "strlen" on a magical input length value of -1, which leads to bugs.) We then deprecate ASN1_STRING_set(). ASN1_STRING_set_string() requires a valid C string argument that may not be NULL - refer to the documentation. Both new functions do not magically add 0 bytes on the end of values, as ASN1_STRING has already been documented for a long time to not depend on this behaviour. Both new functions do not allow the setting of values on an ASN1_BIT_STRING, as ASN1_BIT_STRING_set1 must be used for that. Note that this does *NOT* yet change ASN1_STRING to use size_t internally, this must wait until the integer-returning ASN1_STRING_length() has been deprecated, and then removed in future major. Once ASN1_STRING_length() has been removed then ASN1_STRING internally can change to using a size_t for the length of the data. (And the setters will no longer return an error if the provided size_t length exceeds INT_MAX) Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Sat Jul 18 13:01:15 2026 (Merged from https://github.com/openssl/openssl/pull/31194)
* Add EVP_KDF_CTX_get0_kdf and EVP_KDF_CTX_get1_kdf, deprecate EVP_KDF_CTX_kdfLeon Timmermans2026-07-021-1/+3
| | | | | | | | | Resolves: https://github.com/openssl/openssl/issues/28327 Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Thu Jul 2 07:24:22 2026 (Merged from https://github.com/openssl/openssl/pull/28954)
* Provide ASN1_STRING_new_not_owned()Bob Beck2026-06-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This function provides the ability to construct an ASN1_STRING containing data that is not owned by the constructed ASN1_STRING. The resulting ASN1_STRING, when freed, will not free the data, and it is the caller's resposibility to ensure that the data lives past the lifetime of any returned ASN1_STRING. Why? you may ask? Many places where ->data and ->length were used directly in the past before the opaquification of ASN1_STRING were for this purpose, whether used for actual static data, or to turn bytes created by and in control of the caller into an ASN1_STRING for temporary use as an input. This function makes this easier to do without making copies. The function deliberately does not allow the creation of a BIT_STRING as this would require also always providing unused bits, which is annoying and unnecessary for almost all potential use cases. For: https://github.com/openssl/openssl/issues/29861 For: https://github.com/openssl/openssl/issues/30162 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Wed Jun 3 11:42:49 2026 (Merged from https://github.com/openssl/openssl/pull/30964)
* stack: use a copy thunk for typed stack deep copiesNikola Pajkovsky2026-05-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | typed safestack wrappers pass type-specific copy callbacks such as TYPE *(*)(const TYPE *) to OPENSSL_sk_deep_copy(). The generic stack code then called those callbacks through OPENSSL_sk_copyfunc, void *(*)(const void *), which is an incompatible function pointer type and triggers UBSan. Add an OPENSSL_sk_copyfunc_thunk and store it on typed stacks, mirroring the existing compare/free thunk pattern. Generated safestack helpers now install a per-type copy thunk when constructing a stack, and internal_copy() uses that thunk when deep-copying typed stacks. This preserves the generic stack API while ensuring typed copy callbacks are invoked through their real signature. Fixes: https://github.com/openssl/project/issues/1951 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Wed May 20 15:53:45 2026 (Merged from https://github.com/openssl/openssl/pull/31151)
* Deprecate UTF8_putc/getc() and use uint32_t for unicodeBob Beck2026-05-181-2/+2
| | | | | | | | | | | | Unicode codepoints fit in 32 bits so we can use uint32_t instead of unsigned long. Also use OPENSSL_load_XX_be instead of manual shifting. Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon May 18 11:02:37 2026 (Merged from https://github.com/openssl/openssl/pull/30967)
* Deprecate the ASN1_BIT_STRING name related funcitons.Bob Beck2026-05-111-3/+3
| | | | | | | | | | | These seem to have been from something long long ago that nothing uses anymore. It seems like this is just something we should not be doing in this way. Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon May 11 09:23:13 2026 (Merged from https://github.com/openssl/openssl/pull/30853)
* Deprecate the X509_check_{email,host,ip,ip_asc} family of functionsBob Beck2026-05-111-4/+4
| | | | | | | | | | | | | | | | Our own documentation for quite some time has indicated that you should call X509_verify_cert() instead of using these. Actually deprecate them and make apps not use the now deprecated functions. Resolves: https://github.com/openssl/project/issues/1899 References: https://github.com/openssl/project/issues/1897 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon May 11 00:08:33 2026 (Merged from https://github.com/openssl/openssl/pull/30403)
* Added the EVP_EC_affine2oct() helper functionIgor Ustinov2026-05-061-0/+1
| | | | | | | | | | | | This function converts affine coordinates of an EC point to an octet string conforming to Sec. 2.3.4 of the SECG SEC 1 ("Elliptic Curve Cryptography") standard. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Simo Sorce <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed May 6 16:47:57 2026 (Merged from https://github.com/openssl/openssl/pull/30597)
* Touch the perl miasma in self defense.Bob Beck2026-05-011-2/+2
| | | | | | | | | | | | | | | The symbol presence test fails for NO_DEPRECATED builds if you use modern CPP practices for definitions. This is the result of my accepting that doing so will be as PTSD inducing as walking into my parents bedroom at an inopportune time, and fixing it. Better me who has less time left to live with the mental trauma than a younger developer. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Fri May 1 11:01:46 2026 (Merged from https://github.com/openssl/openssl/pull/31016)
* Deprecate ASN1_BIT_STRING_set()Norbert Pocs2026-04-261-1/+1
| | | | | | | | | | | Replacement: ASN1_BIT_STRING_set1 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Richard Levitte <[email protected]> MergeDate: Sun Apr 26 11:45:27 2026 (Merged from https://github.com/openssl/openssl/pull/30692)
* Run make updateNeil Horman2026-04-141-0/+3
| | | | | | | | | | Adds CRYPTO_atomic_load_ptr, CRYPTO_atomic_store_ptr and CRYPTO_atomic_cmp_exch_ptr Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Tue Apr 14 08:29:32 2026 (Merged from https://github.com/openssl/openssl/pull/30670)
* Deprecate EVP_CIPHER_CTX_get_num() and EVP_CIPHER_CTX_set_num().slontis2026-04-081-2/+2
| | | | | | | | | | | | | | Suggested to be added in OpenSSL 4.1. Since engines have been removed, these are redundant functions. End users should not generally be accessing this internal field. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Apr 8 10:02:58 2026 (Merged from https://github.com/openssl/openssl/pull/30335)
* Update ordinals from 4.0.0-beta1openssl-machine2026-03-271-5718/+5718
| | | | | | | | | | | | | This is a partial forward-port of commit 3c4194022cc4 "make update" from the openssl-4.0 branch, that includes updates to util/libcrypto.num and util/libssl.num files. References: 3c4194022cc4 "make update" Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Fri Mar 27 16:52:22 2026 (Merged from https://github.com/openssl/openssl/pull/30555)
* Add CTLOG_STORE_add0_log() to add CTLOGs to a store programmaticallyTim Perry2026-03-191-0/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Thu Mar 19 20:45:34 2026 (Merged from https://github.com/openssl/openssl/pull/30427)
* Revert "Make X509_up_ref and X509_free take const X509 *"Bob Beck2026-03-061-5/+5
| | | | | | | | | | | | | | | This reverts commit ae8d50f211231c8aa9fcb3bd0a6c38604dbd6de4. Fixes: https://github.com/openssl/project/issues/1893 messing with free is a bridge too far Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Fri Mar 6 17:50:22 2026 (Merged from https://github.com/openssl/openssl/pull/30273)
* Some more X509 extension add/del polishViktor Dukhovni2026-03-051-0/+1
| | | | | | | | | | | | | | | | | | | | | | | - In various structures with optional X.509 extensions, deallocate and NULL out the extensions pointer when the extensions become empty after an extension is deleted. This uses a new X509v3_delete_extension() helper function. Added corresponding docs. - Do the same in X509V3_EXT_add_nconf_sk() if after processing all the pending updates the stack becomes empty. - Handle resulting NULL stack in X509V3_EXT_REQ_add_nconf() and update_req_extensions(). - Improved testing of certificate SKID/AKID addition and implicit removal via "none" value. Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Mar 5 17:40:10 2026 (Merged from https://github.com/openssl/openssl/pull/30252)
* Make X509_up_ref and X509_free take const X509 *Bob Beck2026-03-041-5/+5
| | | | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Mar 4 16:43:39 2026 (Merged from https://github.com/openssl/openssl/pull/30235)
* Deprecate ASN1_OBJECT_new().Frederik Wedel-Heinen2026-02-251-1/+1
| | | | | | | | | | Fixes #16862 Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Wed Feb 25 10:37:27 2026 (Merged from https://github.com/openssl/openssl/pull/30011)
* Let's support multiple names for certificate verificationBob Beck2026-02-241-0/+10
| | | | | | | | | | | | | | | | | | | This adds the functionality to VERIFY_PARAM to separately add multiple ip's and email addresses for verification purposes. We then mark the unfortunate SSL_add1_host API which unfortunately aquired a confusing "maybe add an IP address" behaviour as deprecated. We replace this with SSL_set1_<dnsname, email, ip, ip_asc> and SSL_add1_<dnsname, email, ip, ip_asc> to set the things in the SSL corresponding to the VERIFY_PARAM funcitons. Fixes: https://github.com/openssl/openssl/issues/28418 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> MergeDate: Tue Feb 24 14:03:42 2026 (Merged from https://github.com/openssl/openssl/pull/29612)
* Added BIO_set_send_flags() function to set flags passed to send(), sendto(), ↵Igor Ustinov2026-02-231-0/+1
| | | | | | | | | | | | | and sendmsg(). The main intention is to allow setting the MSG_NOSIGNAL flag to avoid a crash on receiving the SIGPIPE signal. Fixes #16399 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/30044)
* Make FIPS self test state access atomicSimo Sorce2026-02-191-0/+1
| | | | | | | | | | | | | | | | | Direct access to the FIPS self-test state array caused race conditions in multi-threaded environments when checking or updating test status. Introduce atomic accessor functions `ossl_get_self_test_state` and `ossl_set_self_test_state`, backed by a global lock, to ensure thread-safe state transitions. Replace all direct structure accesses with these new functions. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/30009)
* Use the appropriate libctx when executing CMS_SignerInfo_verifyNeil Horman2026-02-181-0/+1
| | | | | | | | | | | | | | | | | | | | | @beldmit found some odd fips behavior when running cms tests after attempting to remove the EVP_get_digestbyname call from the find routine in cms when doing certificate signer validation. It was occuring because the cms app, being an applet in openssl uses the app libctx to load all the provided configuration, which implies the fips and base providers are loaded to that ctx. However, in the find routine (part of cms), it only ever fetches algorithms from the default libctx, leading to failed lookups, and consequently, CMS errors. Fix it by using the appropriate libctx, which in this case can be fetched from the SignerInfo data, which initializes its libctx member to the app libctx in all cases. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Wed Feb 18 16:28:44 2026 (Merged from https://github.com/openssl/openssl/pull/30034)
* Deprecate X509_NAME_get_text_by NID and X509_NAME_get_text_by_OBJBob Beck2026-02-181-2/+2
| | | | | | | | | | | As they were already documented as "should be considered deprecated". Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Feb 18 13:06:18 2026 (Merged from https://github.com/openssl/openssl/pull/30031)
* Make ERR_STATE opaque and remove related deprecated functionsTomas Mraz2026-02-131-3/+0
| | | | | | | | | | | | | ERR_get_state(), ERR_remove_state() and ERR_remove_thread_state() and useless SYS_F_ macros are removed. Fixes #4654 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Sat Feb 14 23:07:56 2026 (Merged from https://github.com/openssl/openssl/pull/30005)
* Provide ASN1_BIT_STRING_set1()Theo Buehler2026-02-121-0/+1
| | | | | | | | | | | | Mostly work by @botovq with tests adapted to openssl by @bob-beck Fixes: https://github.com/openssl/openssl/issues/29185 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Feb 12 20:41:13 2026 (Merged from https://github.com/openssl/openssl/pull/29926)
* Fix the converters between the old and new BIO_read functions to handleIgor Ustinov2026-02-121-0/+1
| | | | | | | | | | | end-of-file state properly. Related to openssl/project#1745 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Thu Feb 12 08:34:31 2026 (Merged from https://github.com/openssl/openssl/pull/29290)
* Remove OPENSSL_atexit();Bob Beck2026-02-111-1/+0
| | | | | | | | | | | | | | | | | | | | | OSSLINAPPL (OpenSSL Is Not A Public Portability Layer) I blame @nhorman and @sashan, who made me update the adjacent documentation, and it was sitting there like an unloved and ignored chronically ill pet with no hope for any future quality of life. Since this really does not need an alternative API or a deprecation stragegy, we can simply remove it. Anyone who was using this can use libc atexit() if they must. Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> MergeDate: Wed Feb 11 17:37:33 2026 (Merged from https://github.com/openssl/openssl/pull/29874)
* add a compare thunk function to the STACK of macrosNeil Horman2026-02-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that ossl_bsearch is capable of using a thunking function, lets create a thunking function to use for the STACK_OF macros. The problem we're addressing is one that gives rise to ubsan issues. clang-16 forward have a ubsan test that confirms that the target symbol that we call through a pointer matches the type of the pointer itself. for instance int foo(void *a, void *b) { ... } int (*fooptr)(char *ac, int *bc) = foo; fooptr(&charval, &intval); is strictly speaking in C undefined behavior (even though in normal operation this works as expected). Newer compilers are strict about this however, as several security frameworks operate with an expectation that this constraint is met. See https://github.com/openssl/openssl/issues/22896#issuecomment-1837266357 for details. So we need to create a thunking function. The sole purpose of this thunking function is to accept the "real" comparison function for the STACK_OF macros, along with the two items to compare of the type that they are passed as from the calling function, and do the convervsion of both the comparison function and the data pointers to the types that the real comparison function expects So we: 1) Modify the DEFINE_STACK_OF macros to create this thunking function 2) Add an OPENSSL_sk_set_cmp_thunks api to set the comparison function 3) modify the requisite places in the stack code to use the thunking function when available Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Sat Feb 7 18:11:14 2026 (Merged from https://github.com/openssl/openssl/pull/29640)
* Expose and report EC curve field degreesViktor Dukhovni2026-01-151-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Expose the EC field degree as a gettable parameter for both provided and legacy EC keys. In the latter case, drop a spurious assertion, since even in debug builds an application may try to get an unknown parameter, and this should return an error rather than abort. In the EC `TEXT` encoding format, instead of reporting the bit count of the group order, report the field degree (which matches the size number in the curve's name when present) and also the symmetric-equivalent security-bits (adjusted down the the standard numbers (80, 112, 128, 192, 256). Along the way, add a missing getter method for the EC_GROUP security bits. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Thu Jan 15 16:10:26 2026 (Merged from https://github.com/openssl/openssl/pull/29539)
* Remove the ability to create a custom EVP_PKEY_ASN1_METHODMatt Caswell2026-01-091-18/+0
| | | | | | | | | | Now that the ability to register a custom EVP_PKEY_ASN1_METHOD has been removed in an earlier commit, we can now remove the functions that are used to create a custom EVP_PKEY_ASN1_METHOD. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29405)
* Remove the ability to query the internal EVP_PKEY_ASN1_METHODsMatt Caswell2026-01-091-6/+0
| | | | | | | | | | Previously there were a few functions where you could obtain a handle on registered EVP_PKEY_ASN1_METHODs and query information about them. We remove the capability. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29405)
* Remove EVP_PKEY_asn1_add0()Matt Caswell2026-01-091-2/+0
| | | | | | | | | | We remove the ability to add application defined EVP_PKEY_ASN1_METHODs via the `EVP_PKEY_asn1_add0()` function. We also remove the related function `EVP_PKEY_asn1_add_alias()`. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29405)
* Remove some legacy fields from the EVP_MD_CTX structureMatt Caswell2026-01-091-3/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29460)
* Remove BIO_f_reliable() as it is brokenTomas Mraz2025-12-211-1/+0
| | | | | | | | | | | | | | | It was broken since the OpenSSL 3.0 release and nobody complained. Apparently nobody is using it. It would be practically impossible to reimplement it with the provided EVP_MDs in backwards-compatible manner. Fixes #29413 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29445)
* Add ASN1_BIT_STRING_get_length()Theo Buehler2025-12-201-0/+1
| | | | | | | | | | | From [email protected] with tests adapted by beck for OpenSSL. Fixes: https://github.com/openssl/openssl/issues/29184 Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29387)
* Add new public API for checking certificate times.Bob Beck2025-12-181-3/+4
| | | | | | | | | | | | | | | | Fixes: #1631 This changes the previously internal ossl_x509_check_certificate_times() to be the public X509_check_certificate_times(). It adds documentation for the new function and marks X509_cmp_time, X509_cmp_timeframe, and X509_cmp_current_time as deprecated in 4.0, as discussed in #1631. Since the function is now public, we can replace the remaining uses of deprecated stuff with this function. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29152)
* Remove custom EVP_PKEY_METHODsMatt Caswell2025-12-181-49/+0
| | | | | | | | | We retain custom EVP_PKEY_ASN1_METHODs for now - to be removed in some subsequent PR. Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Yang <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29384)
* New -encopt option for pkey(1) and genpkey(1)Viktor Dukhovni2025-12-171-0/+1
| | | | | | | | | | This allows setting the ML-KEM and ML-DSA output formats. At the same fixing surprising lack of password encryption of PKCS#8 private keys in DER output form in the CLI apps. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29324)
* Remove support for custom MD methodsMatt Caswell2025-12-171-23/+0
| | | | | | | | | | | Custom MD methods are considered legacy and have been deprecated since 3.0. With the removal of ENGINEs they become a lot less useful and add significant complexity to the code. We should therefore remove them in 4.0. Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29366)
* Remove support for custom cipher methodsMatt Caswell2025-12-121-18/+0
| | | | | | | | | | | Custom cipher methods are considered legacy and have been deprecated since 3.0. With the removal of ENGINEs they become a lot less useful and add significant complexity to the code. We should therefore remove them in 4.0. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29299)
* Add EVP digest context serializationSimo Sorce2025-12-121-0/+2
| | | | | | | | | | | | | | | | | | | | | This commit introduces two new functions, EVP_MD_CTX_serialize and EVP_MD_CTX_deserialize, to the EVP digest API. These functions allow an application to save the state of a digest context (EVP_MD_CTX) and restore it later. This is useful for checkpointing long-running computations, enabling them to be paused and resumed without starting over. The implementation adds the OSSL_FUNC_DIGEST_SERIALIZE and OSSL_FUNC_DIGEST_DESERIALIZE dispatch functions for providers to supply this functionality. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28837)
* Implementing store support for EVP_SKEYDmitry Belyavskiy2025-12-101-0/+3
| | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Simo Sorce <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28278)
* Clarify/fix encoder/decoder context docs and codeViktor Dukhovni2025-12-051-4/+0
| | | | | | | | | | | | | | | | | | | | | In was premature to make OSSL_(EN|DE)CODER_CTX_[sg]et_finalized() be public interfaces. Forunately, these have not yet appeared outside the "master" branch, so we can still retract them. Also, in the case of decoders, the implementation failed to take into account that the context was duplicated before it was returned to the user, and the duplicated copy failed to copy the "finalized" field. This commit also renames "finalized" to "frozen", because finalisation is a misleading term in this context, it suggests resource reclamation during garbage collection or deallocation, not marking a structure partly immutable. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29206)
* Remove *_get0_engine() API callsMilan Broz2025-12-041-5/+0
| | | | | | | | | | | | | | Resolves: https://github.com/openssl/project/issues/1337 Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Remove ENGINE symbols from API.Milan Broz2025-12-041-122/+0
| | | | | | | | | | | | | | | Note, that engine.h now does not contain any real forward declarations, so it should be excluded from the symbols parsing. Signed-off-by: Milan Broz <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Update symbols after OPENSSL_NO_ENGINE clearupNorbert Pocs2025-12-041-6/+0
| | | | | | | | | | | | Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29305)
* Removed ASN1_STRING_data()Bob Beck2025-11-241-1/+0
| | | | | | | | | | | | This has been deprecated since 1.1.0 and is in the way for improvements that could make ASN1_STRING opaque. (#29177) Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29149)
* Added finalized flag to the OSSL_ENCODER/DECODER_CTX structuresIgor Ustinov2025-11-181-0/+4
| | | | | | | | | | | After this flag is set, the generic OSSL_ENCODER/DECODER_CTX_set_*() functions shouldn't be called anymore, so they return error in this case. Fixes #28249 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29120)
* Implement EVP_SIGNATURE_hash_message_update() and use itStefan Berger2025-11-181-0/+1
| | | | | | | | | | | | Implement EVP_SIGNATURE_hash_message_update() to check for support of EVP_PKEY_sign_message_update() and EVP_PKEY_verify_message_update() and use this function to replace the has_msg_update column in CMS. Signed-off-by: Stefan Berger <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28923)
* cms: Enable signature verification for no-attribute case (hashless signing)Stefan Berger2025-11-181-0/+1
| | | | | | | | | | | | | | Enable signature verification for hashless signing schemes, such as ML-DSA and EdDSA, for the non-attribute case of CMS. Also in this case the BIO with the plain input data needs to be passed through to the signature verification function so that the pure-mode signature verification method can hash the plain data itself. Signed-off-by: Stefan Berger <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28923)
generated by cgit (git 2.51.2) at 2026-10-25 16:05:23 +0100