15226 Commits

Author	SHA1	Message	Date
Neil Horman	21980b9813	Move the async-job api to use the new thread-local api ... Make the async-job api use our new thread-local storage api. Not strictly needed, but reduces our OS level key usage Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27794)	2025-06-20 13:01:39 -04:00
Neil Horman	d6d5170ed2	Update ERR lib to use new thread-local storage api ... Move the err lib to use the new thread-local storage api. This isn't strictly needed, as each thread uses the same key for each context, but it does reduce our Os level key count. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27794)	2025-06-20 13:01:39 -04:00
Neil Horman	2e74a3045b	Move thread-event handlers to the new thread-local api ... Thread event handlers in the fips provider create a thread-local storage key per context, meaning we can exhaust our thread-local space quickly by creating lots of contexts. Avoid that by moving to the new thread-local storage api. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27794)	2025-06-20 13:01:39 -04:00
Neil Horman	ce990ce83b	Adjust rand_lib to use new thread-local mgmt api ... Rand instances create a thread-local storage key per context, so we need to move them to the new api to avoid exhausting our thread-local storage space at the Os level Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27794)	2025-06-20 13:01:39 -04:00
Neil Horman	2cb068fb22	update RCU to use the new thread-local key mgmt api ... RCU stores a per-thread local structure per context-thread, making it necessecary to move them to the new api to avoid exhausting our OS level thread-local storage resources when creating lots of contexts Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27794)	2025-06-20 13:01:39 -04:00
Neil Horman	c1c2a333d3	Add new CRYPTO_THREAD_[get|set]_local_ex api ... As opposed to CRYPTO_THREAD_[get|set]_local counterparts These api use an ennumerated set of fixed key ids, that allow for thread-local storage indexed by key AND libctx value. They also store this data against a single OS level thread-local key, reducing the amount of (limited) thread-local key storage space we use Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27794)	2025-06-20 13:01:39 -04:00
JohnnySavages	4a341e0830	Add params precondition in ASN1_STRING_TABLE_add, ASN1_STRING_TABLE_get ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27707)	2025-06-20 15:58:46 +01:00
Viktor Dukhovni	8721def7fc	Report errors in ML-KEM pkey hash ... When on import the public key hash of a private key fails to match the public part, add an appropriate message to the error stack. Previously, the just failed to parse, without a reason. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27352)	2025-06-18 07:03:20 -04:00
Jessica Clarke	6bb81f9294	armv*-mont.pl: Correct a carry flag comment ... On Arm, C is a true carry flag, unlike x86 where CF is a borrow flag for subtraction. That is, for subtraction, it is set if Rn + ~Rm + 1 carries in unsigned arithmetic, and so for subtracting 0, i.e. adding ~0 + 1, it always sets the carry flag. Correct the comment to document what this is actually doing. CLA: trivial Fixes: d1671f4f1a ("bn/asm/armv4-mont.pl: add NEON code path.") Fixes: 1064616012 ("Optimize RSA on armv8") Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27826)	2025-06-18 08:00:06 +10:00
Ingo Franzki	339ced70da	s390x: Fix HMAC to fail update or final call when already finalized ... After commit a5d1eadde1 the test step 'test_hmac_final_update_fail' of 'test_hmac' fails. Return an error when update or final is used after the context has already been finalized. Flag 'iimp' (intermediate-input-message-part) must be 1 to allow an update or final call. If iimp is 0, then the context has already been finalized. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27781)	2025-06-13 10:06:21 +02:00
Viktor Dukhovni	2c74a8d1ef	Allow keygen after dup of minimal PKEY ctx ... It should be possible to repeatedly duplicate a PKEY CTX created via EVP_PKEY_CTX_new_from_name() that has not yet been assigned an "operation" (e.g. via EVP_PKEY_CTX_keygen_init()), and then perform keygen_init() and keygen() on the duplicated copies. When the operation is not yet set, all that's needed is to not try to use the key if one isn't set yet. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27662)	2025-06-10 19:43:56 +02:00
Daniel Van Geest	bef03c6a24	Fix SHAKE AlgorithmIdentifier encodings ... NIST CSOR specifies that the id-shake128 and id-shake256 algorithm identifiers, like the SHA-3 ones, do not carry any parameters. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27190)	2025-06-10 19:42:00 +02:00
Dr. David von Oheimb	c37b9e3425	crypto/evp/ctrl_params_translate.c: prevent clashes of generic names NONE, GET, SET ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27773)	2025-06-09 10:32:39 +02:00
Pauli	a2cd7ecd75	rand: add argument error checking to EVP_RAND_nonce() ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27766)	2025-06-09 10:24:08 +02:00
Pauli	a2b9120d15	rand: produce correct return from EVP_RAND_nonce ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27766)	2025-06-09 10:24:08 +02:00
Neil Horman	b6d01d1b1f	Allow for reuse of thread_local keys in threads_none ... If openssl is configured with no-threads, the implementation has a hard limit of 256 LIB_CTX values, as each LIB_CTX allocates a thread local key, and we never reuse them (like libc does when using pthread_key_create/destroy. Improve the situation by allowing for marking freed keys as unsued and searching for an available key when allocating Fixes #27757 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27775)	2025-06-06 13:49:39 -04:00
Frederik Wedel-Heinen	1c1ce2a6ee	Handle 0 return values from DH key computations as errors ... Returned 0 from ossl_dh_compute_key(), DH_compute_key_padded() and DH_compute_key() needs to be treated as an error. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27673)	2025-06-03 14:26:54 +02:00
Dr. David von Oheimb	7c6d9da45f	DOC: update references to obsolete RFC 2459 (updated by RFC 5280 and DSA parts taken over by RFC 3370) ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/27734)	2025-06-03 07:27:57 +02:00
JiashengJiang	00c531a5e3	crypto/property/property.c: Free impl->method to avoid memory leak ... After ossl_method_up_ref() succeeds, impl_free() should be called to free impl->method. Fixes: 860ecfd ("property: check return values from the property locking calls.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27564)	2025-05-29 16:39:51 +02:00
Viktor Dukhovni	005fa3e00e	Note finished state in cipher BIO EOF ... When the cipher BIO encounters a non-retriable EOF (or error), mark the state as "finished", else a subsequent BIO_flush() or attempted read may attempt to finalise the crypto state again, and fail, leading, for example, to users seeing erroneous apparent decryption failure. This is not a new problem, the fix should be backported to all supported releases. It was made more apparent by recent changes to the base64 BIO, which returns a non-retriable EOF when padding is seen at the end of the base64 data, even if the underlying next BIO is "retriable". Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27680)	2025-05-29 16:02:26 +02:00
Tomas Mraz	0873cd1b68	OSSL_CMP_MSG_http_perform(): Remove extraneous %s from debug log print ... Also add missing ":" to another log print. Fixes #27634 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/27635)	2025-05-27 19:50:41 +02:00
JiashengJiang	9882d389df	crypto/pkcs7/pk7_smime.c: Add BIO_free() to avoid memory leak ... Add BIO_free() to free tmpout if OPENSSL_malloc() fails to avoid memory leak. Fixes: 8e70485 ("RT3955: Reduce some stack usage") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27631)	2025-05-27 19:49:07 +02:00
Pauli	8bdb122877	evp: add EVP_PKEY_get_security_category function ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	3b9f957c79	slh-dsa: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	32bc8e3434	ml-kem: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Pauli	64328438f6	ml-dsa: add security category support ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:44 +10:00
Tomas Mraz	52a2b3d82f	Avoid leaking duplicated EVP_PKEY_CTX in case of error ... Fixes Coverity 1647946 1647947 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27686) (cherry picked from commit 240228979b)	2025-05-23 17:39:09 +02:00
widneve	6543f34dda	Fix memory leaks after failure of PKCS7_add_signed_attribute() ... If PKCS7_add_signed_attribute fails, seq never escapes out of the callee and will therefore result in a memory leak. This is similar to ed3d277127. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27670)	2025-05-23 17:36:53 +02:00
Dr. David von Oheimb	8626a716b0	crypto/evp/signature.c: add checks for consistent presence of 'update' and 'final' functions ... Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27367)	2025-05-20 21:19:34 +02:00
Dr. David von Oheimb	4a9a59cb07	crypto/evp/signature.c: add more specific diagnostic data in case provider does not implement functions needed ... Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27367)	2025-05-20 21:19:34 +02:00
Dr. David von Oheimb	3a57fb1386	crypto/evp/signature.c: compensate for providers not adding error queue entries on operation failure ... Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27367)	2025-05-20 21:19:34 +02:00
Dr. David von Oheimb	72351b0d18	crypto/evp: compensate for providers not adding error queue entries for keymgmt, sigver, and asymcipher ... Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27367)	2025-05-20 21:19:34 +02:00
Dr. David von Oheimb	1fc96a3cff	store_result.c: add to error queue which provider failed to load credential and hint on using default provider ... Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27367)	2025-05-20 21:19:34 +02:00
Zhiguo Zhou	b9282ecafa	Check NASM version for {vex} prefix support ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27632)	2025-05-19 16:24:42 +02:00
Zhiguo Zhou	de4a7fad9e	Remove redundant space in effective address ... To have effective address of vmovapd instruction recognized and translated to Intel format by the x86_64 assembler translator. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27632)	2025-05-19 16:24:42 +02:00
Zhiguo Zhou	4189992f5b	Pick up {vex} in x86_64 assembler translator ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27632)	2025-05-19 16:24:42 +02:00
JiashengJiang	5f661e4e96	crypto/x509/v3_lib.c: Free tmpext if X509V3_EXT_add() fails to avoid memory leak ... Add OPENSSL_free to free tmpext if X509V3_EXT_add() fails to avoid memory leak. Fixes: 878dc8dd95 ("Join the x509 and x509v3 directories") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27566)	2025-05-19 16:18:35 +02:00
ztp6893	c54fd95918	Workaround for issue with assembler on OS X 10.4 ... Local labels cannot be used in some circumstances as they might be pointing to wrong locations. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/27017)	2025-05-19 08:59:14 +02:00
Ilie Halip	1094db3c4e	Fix trace output for provider algorithm names ... Use the index variable to print out the provider algorithm details. CLA: trivial Signed-off-by: Ilie Halip <ilie.halip@nxp.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27624)	2025-05-16 10:47:16 +02:00
Dr. David von Oheimb	1a8cc7fab0	asn_mime.c multi_split(): add missing I/O error checking ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:21 +02:00
Dr. David von Oheimb	3f953185b2	SMIME_text(): add missing I/O error checking ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:21 +02:00
Dr. David von Oheimb	1d5d4634ee	SMIME_crlf_copy(): add missing I/O error checking ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:21 +02:00
Dr. David von Oheimb	7084d167aa	PEM_write_bio_ASN1_stream(): complete I/O error checking ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:21 +02:00
Dr. David von Oheimb	ea7b971563	fix asn1_write_micalg() in asn_mime.c on GostR3411 and SHAKE, also return 0 on I/O errors ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	d8e87f9c2f	SMIME_write_ASN1_ex() used for CMS: add error checking for calls to BIO_printf(), BIO_puts(), and asn1_write_micalg() ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Jakub Zelenka	4eb3eea7a3	Check rand_meth_lock existence before trying to lock it ... There are situations during exit clean up where dependent libraries might be using TLS to finalize stuff but that might crash because the rand_meth_lock can get freed and there is still an attempt to get rand bytes. This change makes sure that things fail nicely. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27119)	2025-05-13 11:38:29 +02:00
Stanciu, Adrian	ce76714966	SHA512/x86_64: Fix SIGSEGV on $avx=0 path ... Fixes #27555 When $avx>1, codegen is: lea OPENSSL_ia32cap_P(%rip),%r10 mov 0(%r10),%r9 mov 8(%r10),%r11d mov 20(%r10),%r10d When $avx is true, codegen was: lea OPENSSL_ia32cap_P(%rip),%r10 mov 0(%r10),%r9 mov 8(%r10),%r11d mov 20(%r10),%r10d # not used by dispatcher When $avx=0, codegen was: mov 20(%r10),%r10d # %r10 not initalized, causing SIGSEGV After fix, `mov 20(%r10),%r10d` is only included when $avx>1 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27574)	2025-05-09 09:33:37 +10:00
JiashengJiang	9884f1dc11	crypto/provider_conf.c: Fix possible memory leak ... Assign the return value of ossl_provider_info_add_to_store to added instead of setting it directly to 1, in order to avoid a memory leak caused by entry not being freed if ossl_provider_info_add_to_store() fails. Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27472)	2025-05-07 11:49:06 +02:00
Pauli	9d80e50df5	params: don't build global param name TRIE ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
Aleksander Jan Bajkowski	fda4777c14	Enable AES and SHA3 optimisations on Qualcomm Snapdragon X systems ... For larger data blocks, AES gets performance gains of up to 26.5%, and SHA3 up to 15%. Tested on a Dell 9345 with Snapdragon X1E-80-100. Below are detailed data. Before: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-128-GCM 176805.90k 677599.17k 1932362.15k 4803628.03k 7696804.52k 8036674.22k AES-192-GCM 178621.88k 673165.14k 1884515.41k 4690465.11k 7669383.17k 8021562.71k AES-256-GCM 177187.09k 668302.19k 1843664.13k 4405732.35k 6911937.19k 7201800.19k sha3-224 71694.30k 286854.87k 686716.67k 784932.86k 922643.11k 926182.06k sha3-256 71997.70k 288208.13k 688777.98k 786555.22k 865192.62k 874643.46k sha3-384 72167.35k 287085.80k 487257.00k 639260.33k 673180.33k 675108.18k sha3-512 71581.52k 287953.09k 378381.31k 436353.02k 471433.22k 472804.01k After: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-128-GCM 177140.20k 674365.06k 1928108.37k 5285980.84k 9581854.72k 10167205.89k AES-192-GCM 178512.57k 669584.09k 1890147.75k 5052911.96k 8831027.88k 9337787.73k AES-256-GCM 177685.05k 664798.83k 1844782.17k 4816555.35k 8176435.20k 8592359.42k sha3-224 71444.47k 286178.99k 747224.32k 911052.46k 1063985.15k 1067712.51k sha3-256 71188.32k 285318.74k 746304.34k 903716.52k 984566.44k 997430.61k sha3-384 71715.30k 285965.27k 546631.59k 733781.67k 766448.98k 768262.14k sha3-512 70853.85k 284883.33k 427553.71k 489698.99k 520415.91k 520743.59k Change: type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes AES-128-GCM +0.2 % -0.5 % -0.2 % +10.0 % +24.5 % +26.5 % AES-192-GCM -0.1 % -0.5 % +0.3 % +7.7 % +15.1 % +16.4 % AES-256-GCM +0.3 % -0.5 % +0.1 % +9.3 % +18.3 % +19.3 % sha3-224 -0.3 % -0.2 % +8.8 % +16.1 % +15.3 % +15.3 % sha3-256 -1.1 % -1.0 % +8.4 % +14.9 % +13.8 % +14.0 % sha3-384 -0.6 % -0.4 % +12.2 % +14.8 % +13.9 % +13.8 % sha3-512 -1.0 % -1.1 % +13.0 % +12.2 % +10.4 % +10.1 % Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27503)	2025-05-07 11:17:48 +10:00
Julian Zhu	49a3e7adc3	RISC-V: Provide generic optimized SHA-256 implementation for rv64gc ... Signed-off-by: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27381)	2025-05-06 11:57:24 +02:00
Richard Levitte	af5952d533	Drop "by store"'s by_store_subject_ex() ... It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27529)	2025-05-04 08:55:15 +02:00
Richard Levitte	0c48ee2bf5	Rework the "by store" X509_LOOKUP method to open the given URI early ... The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes #27461 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27529)	2025-05-04 08:55:15 +02:00
Kenjiro Nakayama	305bbc1837	bio_b64.c: Replace OPENSSL_assert() calls with ossl_assert() ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27401)	2025-04-30 15:53:44 +02:00
Matt Caswell	01ea080498	Fix a deadlock while attempting to get the Primary EVP_RAND_CTX ... When only the FIPS provider was loaded we could get a deadlock when calling RAND_get0_primary() due to attempting to obtain a recursive lock. We reduce the scope of the locks that we hold to avoid this. Fixes #27391 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27408)	2025-04-30 10:55:44 +02:00
Matt Caswell	6ff4c1d874	Ensure that our fips internal provider is always loaded ... The fips provider has an internal provider. In some circumstances we could end up trying to find it, but failing because it hasn't been loaded yet. We just always ensure it is loaded early to avoid this. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27408)	2025-04-30 10:55:44 +02:00
Matt Caswell	606de509e3	Assert that we successfully obtained a lock ... We should never fail to obtain a lock, so assert that we are successful Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27408)	2025-04-30 10:55:44 +02:00
Arne Schwabe	77624f0c5b	Fix aesv8 arm assembler code not working on 32 bit Android ... OpenSSL uses 'void' as perlasm for the 32 bit armeabi-arm target, which most notably lacks a 32 or 64 in its name. So while most code that is targeted for 32 uses !~ /64/ there is one instance that uses ~= /32/, introduced by commit 8e69c18 between 3.4.0 and 3.5.0. This leaves out that line on 32 bit android causing a segfault. This fixes the compilation issue by replacing the ~= /32/ with !~ /64/ compilation taget (see 15-android.conf) Signed-off-by: Arne Schwabe <arne@rfc2549.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27510)	2025-04-29 19:41:53 +02:00
Hongren Zheng	1d770fc6a9	Make cpuid_setup non-constructor ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27466)	2025-04-29 14:19:51 +02:00
Tomas Mraz	56c739816f	BIO_dump_indent_cb(): Check for negative return from BIO_snprintf() ... In practice this cannot happen but Coverity complains. Fixes Coverity 1646683 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27493)	2025-04-28 17:29:17 +02:00
Bernd Edlinger	b56dd5bfec	Fix also BIO_printf formatting for INF and NAN ... Avoid infinite loooooooops in %e and %g formatting for +/-INF and make the invalid value at least visible by using '?' as signvalue. Fixes #26973 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27491)	2025-04-28 17:27:59 +02:00
yexiaochuan	406ce5909b	Fix typo in SHA256 RISC-V64 Zbb comments: Sigma0 -> Sum0 ... This corrects a misleading comment in sha256-riscv64-zbb.pl. The rotation operation corresponds to the Sum0 function as defined in the FIPS 180-4 standard, not Sigma0. CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27480)	2025-04-28 17:24:53 +02:00
Richard Levitte	9123684c81	Add verbose output to 'openssl list -store-loaders' ... The provider based STORE loaders do have settable parameters, so they should be displayed when '-verbose' is given, just like for any other list. Out of necessity, this also introduces OSSL_STORE_LOADER_settable_ctx_params() Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26437)	2025-04-28 17:19:55 +02:00
Dr. David von Oheimb	a6f858b191	by_store.c: suppress in cache_objects() likely non-relevant error queue entries calling OSSL_STORE_find() ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27498)	2025-04-26 15:22:58 +02:00
A. Wilcox	29864f2b0f	Fix P-384 curve on lower-than-P9 PPC64 targets ... The change adding an asm implementation of p384_felem_reduce incorrectly uses the accelerated version on both targets that support the intrinsics *and* targets that don't, instead of falling back to the generics on older targets. This results in crashes when trying to use P-384 on < Power9. Signed-off-by: Anna Wilcox <AWilcox@Wilcox-Tech.com> Closes: #27350 Fixes: 85cabd94 ("Fix Minerva timing side-channel signal for P-384 curve on PPC") Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27429)	2025-04-25 20:04:31 +02:00
Joachim Vandersmissen	5d44f67aaf	Properly zeroize ML-KEM z and d values ... Ensure z and d are actually zeroized by cleansing the full size of s, rather than just vector_bytes. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27437)	2025-04-25 09:47:10 +02:00
Richard Levitte	fb555eb7a1	Fix BIO_printf formatting for negative numbers formatted with %e ... Some parts of the formatting code assumed that the input number is positive. This is fixed by working on its absolute value. test/bioprinttest.c is amended to test the output of negative numbers as well. Fixes #26973 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27478)	2025-04-24 16:01:43 +02:00
Luke Kurlandski	0efc439a3b	Improved error message for X509_V_ERR_CERT_NOT_YET_VALID ... In addition to an invalid certificate, it is not unlikely that this exact error (case X509_V_ERR_CERT_NOT_YET_VALID) is caused by an incorrect system clock. This cannot be trivially fixed, so for now, we simply improve the quality of the error message. Fixes #14771 CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27141)	2025-04-24 14:37:39 +02:00
Simo Sorce	341f1b7f70	Add ml_dsa msg_update functions to provider code ... Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27342)	2025-04-23 13:35:03 +02:00
Simo Sorce	5c16db8cdc	Make public ml_dsa_mu_.. helpers ... Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27342)	2025-04-23 13:35:03 +02:00
Simo Sorce	90f0137453	Split the ML-DSA internal sigver functions ... Deconstruct the functions into 2 parts: - mu computation (if needed) - actual signing/verification Adds helper to compute mu that is split in 3 parts (init/update/finalize) where the update part can be used to feed the message to be signed or verified in chunks of any size. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27342)	2025-04-23 13:35:03 +02:00
olszomal	56910e7211	Fix URL parsing to handle missing ports and ISO 8601 timestamps in paths ... Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26303)	2025-04-23 11:27:01 +02:00
Ingo Franzki	bab1e882a9	s390x: Add new machine generation z17 ... Allow to specify "z17" as machine generation in environment variable OPENSSL_s390xcap. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27383)	2025-04-23 11:24:41 +02:00
Pauli	ac01b9a9fd	params: refactor some of the param helper code ... Unifies some duplicated code. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27221)	2025-04-18 15:23:42 +01:00
Nicolas Blais-Miko	a0ff819e53	Fix silent error in EVP_CIPHER_CTX_get_updated_iv. ... Added new params API function OSSL_PARAM_set_octet_string_or_ptr to only call the correct setter for OSSL_CIPHER_PARAM_IV and OSSL_CIPHER_PARAM_UPDATED_IV. Both OSSL_PARAM_set_octet_string and OSSL_PARAM_set_octet_ptr could be called with only one expected to succeed. This would put a silent error on the error stack when calling EVP_CIPHER_CTX_get_updated_iv. Fixes #27117 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27120)	2025-04-16 08:44:12 +01:00
Teddy Engel	24bc185439	Remove unused assembly function OPENSSL_wipe_cpu ... CLA: trivial Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27362)	2025-04-16 08:24:19 +10:00
slontis	3c22da7346	Fix EVP_PKEY_CTX_dup() so that it copies the keymanager. ... A call to EVP_PKEY_CTX_new() creates a keymgmt pointer internally, but EVP_PKEY_CTX_dup() does not copy this field. Calling EVP_PKEY_derive_set_peer_ex() after EVP_PKEY_CTX_dup() resulted in a segfault because it tried to access this pointer. EVP_PKEY_CTX_dup() has been updated to copy the keymanager (and upref it). Reported by Eamon ODea (Oracle). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27304)	2025-04-15 15:44:58 +01:00
Kenzlee51	cb3fde9728	Update cms_pwri.c ... CLA: trivial When entering the branch (pbe_nid <= 0), line 66 assigns new values ​​to the variable of line 67 (pbe_nid = NID_id_pbkdf2). However, it is not used anywhere in the future. For this reason, lines 66 and 67 were removed. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27296)	2025-04-15 15:42:50 +01:00
Gerd Hoffmann	57f9447806	crypto: disable OSSL_PARAM_REAL on UEFI ... Floating point types like double can't be used on UEFI. Fix build on UEFI by disabling the OSSL_PARAM_REAL branch. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27284)	2025-04-15 15:27:38 +01:00
Bernd Edlinger	1a81d509a0	Fix test failures on big endian ARMv9 target ... This fixes a couple of big-endian issues in the assembler code of chacha, SM3 and SM4. Fixes #27197 Tested-by: @zeldin Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27252)	2025-04-14 15:43:58 +01:00
JiashengJiang	8f06efe234	crypto/ui/ui_lib.c: Add OPENSSL_free to avoid memory leaks ... Add OPENSSL_free() if general_allocate_boolean() or general_allocate_string fails to avoid memory leaks. Fixes: a63d5eaab2 ("Add a general user interface API. This is designed to replace things like des_read_password and friends (backward compatibility functions using this new API are provided). The purpose is to remove prompting functions from the DES code section as well as provide for prompting through dialog boxes in a window system and the like.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27218)	2025-04-14 15:17:29 +01:00
aaSchwager	7bf52a6f6f	fixed multiline output bug in crl command, ensuring use of global variable to set changes ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27124)	2025-04-14 15:10:20 +01:00
fangming.fang	24f32f14e9	Implement AES-CBC-HMAC-SHA512 on aarch64 ... This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha512 on aarch64, aes-cbc and hmac-sha512 are interleaved to achieve better performance.It only supports non-padding mode that means the length of input data should be multiple of 16 bytes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22949)	2025-04-14 14:53:30 +01:00
fangming.fang	86408fa8de	Implement interleaving aes-cbc-hmac-sha on aarch64 ... This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha1/256, aes-cbc and hmac-sha1/256 are interleaved to achieve better performance. It only supports non-padding mode that means the length of input data should be multiple of 16 bytes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22949)	2025-04-14 14:53:30 +01:00
Viktor Dukhovni	8d2e4d6d8c	Implement i2d_PKCS8PrivateKey ... Added `i2d_PKCS8PrivateKey(3)` API to complement `i2d_PrivateKey(3)`, the former always outputs PKCS#8. Extended endecoder_test.c to check that `i2d_PKCS8PrivateKey()` produces the expected PKCS#8 output. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27309)	2025-04-11 11:00:27 +01:00
Stanciu, Adrian	196b36f0d0	Enable x86-64 SHA-512 family optimizations with SHA512 ISA extension ... The SHA-256 (SZ=4) and SHA-512 (SZ=8) dispatcher paths have been separated while keeping the SHA-256 path unmodified. Due to early constraints in register availability, two 32-bit `OPENSSL_ia32cap_P` reads have been coalesced into one. As a consequence, several bit positions used in feature checks have gained a 32 bits offset. Replaced `test` with `bt` to allow use of 64-bit immediate indices in CPUID feature checks. Split the SHA512 BMI2+AVX2+BMI1 dispatcher branch into: - AVX2+SHA512: high priority, with SHA512 ISA extension - AVX2+BMI2+BMI1: fallback The added implementation has its own copy of `K512` without duplicated elements every 16 bytes. Shuffle indices have been reused from `K512`. Added binary translators for `vsha512msg1`, `vsha512msg2`, `vsha512rnds2` for older assemblers. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26147)	2025-04-03 11:14:42 +11:00
Elizarova, Alina	e1eb6fdb3a	Enable x86-64 SM3 optimizations with SM3 ISA extension ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26196)	2025-04-03 10:11:07 +11:00
Elizarova Alina	b12cd40e8b	Enable x86-64 SM4 optimizations with SM4 ISA extension ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26664)	2025-04-03 10:09:04 +11:00
Dan Pittman	8ca8f9afbb	fix OOB issue in AVX-512 XTS decryption ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27216)	2025-04-02 08:39:56 +02:00
dare3path	6d3202e20f	move BIO_err_is_non_fatal() to bio_lib.c ... done this without running mkerr.pl otherwise this is what mkerr.pl would do: * remove BIO_err_is_non_fatal from bio_err.c * remove duplicate BIO_R_PORT_MISMATCH * reorder/sort 3 things * update copyright year from 2022 to 2025 see #27183 CLA: trivial Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27191)	2025-04-01 18:56:13 +02:00
slontis	b8860598d2	Fix cpp comment in windows build ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27188)	2025-04-01 11:52:30 +02:00
slontis	ea77608920	Fix c++ comment in ec code. ... This is a 9 month old change, so I am not sure why it is only causing a compile issue now. Reported by David Makepeace Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27186)	2025-03-31 14:03:38 +02:00
Branden Clark	908e0f3728	Fix probing the registry for configuration ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26566)	2025-03-31 13:58:06 +02:00
Hugo Beauzée-Luyssen	0e38f78dca	crypto: windows: use LPCTSTR for the temp registry buffer ... mingw-w64 only defines LPCTCH when UNICODE isn't defined crypto/defaults.c: In function 'get_windows_regdirs': crypto/defaults.c:72:5: error: unknown type name 'LPCTCH'; did you mean 'LPTCH'? 72 | LPCTCH tempstr = NULL; | ^~~~~~ | LPTCH Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26566)	2025-03-31 13:58:06 +02:00
Hugo Beauzée-Luyssen	ed3876adb1	crypto: fix preprocessor concatenation ... String litteral don't need the '##' operator, which causes build failures: crypto/defaults.c:kepi:23: error: pasting ""SOFTWARE\\WOW6432Node\\OpenSSL"" and ""-"" does not give a valid preprocessing token Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26566)	2025-03-31 13:58:06 +02:00
Viktor Dukhovni	60f2a71400	Fix goto label indents to match style ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27175)	2025-03-28 11:37:12 +01:00
Julian Zhu	08c8dd6b8c	RISC-V: Provide optimized SHA-256 implementation using Zbb extension ... Signed-off-by: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27011)	2025-03-28 11:22:58 +01:00
Julian Zhu	a41f9135f0	RISC-V: Provide optimized SHA-512 implementation using Zbb extension ... Signed-off-by: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27161)	2025-03-28 11:17:35 +01:00
Julian Zhu	f04fdd908c	RISC-V: Add Zbb rori opcode in riscv.pm ... Signed-off-by: Julian Zhu <julian.oerv@isrc.iscas.ac.cn> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27161)	2025-03-28 11:16:18 +01:00
sashan	7fa51041e4	Use OPENSSL_strdup() for strings freed by OPENSSL_free() ... Things can get messy when application decides to use it's own memory allocation functions using CRYPTO_set_mem_functions(3ossl) Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27163)	2025-03-27 12:03:55 +01:00
qu3ri	78b1fdf4a1	Moved crypto/bn/README.pod to internal manpages ... The new place is doc/internal/man3/bn_mul_words.pod. Also removed outdated information. Implementing the fix from https://github.com/quictls/quictls/pull/214 Fixes #26399 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26597)	2025-03-26 15:49:31 +01:00
Neil Horman	4943ac7b88	Update dead links and e-mails our sources ... http://www.openssl.org/~appro/cryptogams/ is 404, update to https://github.com/dot-asm/cryptogams/ And clean up the boiler plate text around it. Replace stray usage of appro@openssl.org with github url. The email in question here is no longer valid, replace it with the corresponding github id for the user. Replace <appro\@fy.chalmers.se> with <https://github.com/dot-asm> Fix lots more dead emails addresses that we missed Remove reference urls that no longer exist. Just delete urls that 404 now, and have no obvious new link. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27073)	2025-03-26 15:40:02 +01:00
Andrey Tsygunka	3edb1f09c6	Fix return value of the i2d_ASN1_bio_stream() call ... If the flags argument does not contain the SMIME_STREAM bit, the i2d_ASN1_bio_stream() function always returns 1, ignoring the result of the ASN1_item_i2d_bio() call. Fix the return value to the result of the ASN1_item_i2d_bio() call for this case. CLA: trivial Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27106)	2025-03-26 15:27:23 +01:00
Paul Elliott	b6dceb36e8	Enable AES-GCM unroll8/unroll12 for Neoverse N3/V3 ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27112)	2025-03-25 20:19:14 +01:00
Andrey Tsygunka	8e08f9c5a0	Fix NULL pointer dereference in `asn1_ex_i2c()`, crypto/asn1/tasn_enc.c ... Adds handling of V_ASN1_UNDEF to avoid NULL dereference in case ASN1 structure contains an element of type ASN1_TYPE without initializing its value (i.e. default constructed) CLA: trivial Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27100)	2025-03-25 19:53:49 +01:00
Frederik Wedel-Heinen	21b170df9f	Adds the concept of thunks to OPENSSL_sk interface ... This allows applications to call functions of correct signature when free'ing OPENSSL_sk items which UBSan complains about. Related to #22896. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27071)	2025-03-24 15:28:34 +01:00
Daniel Van Geest	c1d27789e9	Fix use of SHAKE as a digest in CMS ... draft-ietf-lamps-cms-sphincs-plus-19 specifies SHAKE as the message digest algorithm for SLH-DSA-SHAKE-* in CMS. SHAKE doesn't have a default digest length, so this adds a SHAKE-specific kludge in CMS. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27087)	2025-03-20 12:20:37 +01:00
Viktor Dukhovni	27b88364e4	Avoid erroneous legacy code path when provided ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27075)	2025-03-20 11:33:23 +01:00
Viktor Dukhovni	064bb16454	Tolerate PKCS#8 V2 with optional public keys ... - Presently any included public key is unused. - We don't check that v1 PKCS#8 structures omit the public key. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27076)	2025-03-19 12:02:31 +01:00
sashan	108079fcbb	require GNU assembler 2.30 or higher to build aesni-xtx-avx512.pl ... The peralsm in aesni-xts-avx512 currently checks for GNU assembler 2.26 or higher. According to reporters it looks like we need 2.30. This PR just attempts fix version check so people with older tool chains can build OpenSSL. Fixes #27049 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27078)	2025-03-19 08:03:50 +11:00
Bernd Edlinger	a532f2302d	Do some more cleanup in the RCU code ... Only a minimum of 2 qp's are necessary: one for the readers, and at least one that writers can wait on for retirement. There is no need for one additional qp that is always unused. Also only one ACQUIRE barrier is necessary in get_hold_current_qp, so the ATOMIC_LOAD of the reader_idx can be changed to RELAXED. And finally clarify some comments. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27012)	2025-03-18 18:52:29 +01:00
Bernd Edlinger	4a1a7fe5ce	Fix a memory order issue with weakly ordered systems ... this adds a dummy atomic release operation to update_qp, which should make sure that the new value of reader_idx is visible in get_hold_current_qp, directly after incrementing the users count. Fixes: #26875 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26964)	2025-03-17 08:01:26 -04:00
Danny Tsen	85cabd9495	Fix Minerva timing side-channel signal for P-384 curve on PPC ... 1. bn_ppc.c: Used bn_mul_mont_int() instead of bn_mul_mont_300_fixed_n6() for Montgomery multiplication. 2. ecp_nistp384-ppc64.pl: - Re-wrote p384_felem_mul and p384_felem_square for easier maintenance with minumum perl wrapper. - Implemented p384_felem_reduce, p384_felem_mul_reduce and p384_felem_square_reduce. - Implemented p384_felem_diff64, felem_diff_128_64 and felem_diff128 in assembly. 3. ecp_nistp384.c: - Added wrapper function for p384_felem_mul_reduce and p384_felem_square_reduce. Signed-off-by: Danny Tsen <dtsen@us.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26709)	2025-03-14 17:20:52 +01:00
Tomas Mraz	c8654f79f4	Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26976)	2025-03-14 09:44:52 +01:00
Andrew Dinh	7097d2e00e	Fix RCU TODOs ... - Update allocate_new_qp_group to take unsigned int - Move id_ctr in rcu_lock_st for better stack alignment Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26972)	2025-03-12 12:07:44 -04:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Michael Schroeder	cad3520bf7	Add support for md-less signature schemes in CMS ... Signature schemes like Ed25519 or ML-DSA use "pure" signing, i.e. they directly sign the tbs data instead of signing a digest. This is already supported in the X509 code, but not in CMS. This commit adds support for such schemes to CMS. This is a minimalistic set of changes, based in the work done by David von Oheimb. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26867)	2025-03-10 14:36:15 +01:00
Bernd Edlinger	6e7be995fd	RCU: Ensure that qp's are actually retired in order ... The current retirement code for rcu qp's has a race condition, which can cause use-after-free errors, but only if more than 3 QPs are allocated, which is not the default configuration. This fixes an oversight in commit 5949918f9a ("Rework and simplify RCU code") Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26952)	2025-03-05 16:04:16 +01:00
Bernd Edlinger	bcb8eae1af	Fix support for windows atomics ... Make CRYPTO_atomic_add consistent with CRYPTO_atomic_load_int and set the reader_idx under write_lock since there is no CRYPTO_atomic_store_int. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26963)	2025-03-05 16:02:47 +01:00
Ivan Stanković	e599893a9f	x509: allow SAN URIs to contain userinfo ... The way we're currently handling SAN URIs does not allow for userinfo, meaning the name constraint check on such URIs will fail. Fix this by skipping over the userinfo component: authority = [ userinfo "@" ] host [ ":" port ] (per RFC 3986). Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25861)	2025-03-04 17:30:34 +01:00
Bartel Artem	d3b6b81eab	X509v3_addr_canonize(): Check whether addr == NULL ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26583)	2025-03-03 09:43:22 +01:00
Jakub Zelenka	5045712d3d	Fix libctx passing for CMS PWRI use ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26937)	2025-03-03 09:26:44 +01:00
Matt Caswell	aaad33c5ac	Move ssl_err.c into libcrypto ... We move ssl_err.c out of libssl and into libcrypto. This file is entirely self contained and is used to load error strings into the libcrypto error tables. By moving this file into libcrypto, libssl can be unloaded safely without having dangling references to this error information. Fixes #26672 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26931)	2025-03-01 14:46:03 -05:00
Viktor Dukhovni	31b5f3f382	Further decoder tuning possibly better perf ... - The decoder should consider fewer options based on more precise tracking of the desired input type (DER, PVK, MSBLOB), algorithm (RSA, EC, ...), input structure (SPKI, P8, ...). How much this affects actual use-cases is harder to estimate, we'll just have to run before/after perf tests. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26927)	2025-03-02 02:04:09 +11:00
Valerii Krygin	f86acc9434	EVP_DecodeUpdate() should not produce padding zeros to the decoded output (Fixes #26677) ... EVP_DecodeUpdate() should not produce zeros for input padding `=` signs to avoid writing to non-allocated memory regions. To achieve this: - Add `eof` parameter to `evp_decodeblock_int` function in `openssl/crypto/evp`. The parameter should either contain the number of the input padding characters to ignore or `-1` if the function has to count them. - Use precalculated `eof` in `EVP_DecodeUpdate` to fix its behaviour. - Use `eof = -1` in `EVP_DecodeFinal` to count it in `evp_decodeblock_int`. - Do not ignore padding in `EVP_DecodeBlock` (`eof = 0`) because it should write padding zeros according to the documentation. - Add the HISTORY section to EVP_EncodeInit documentation to describe the fix. Other changes: - Update AUTHORS.md - Update the copyright date in the documentation. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26678)	2025-02-27 17:38:57 +00:00
dan pittman	ddc8529e87	fix windows calling convention in aesni-xts-avx512 ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26410)	2025-02-27 08:31:16 -05:00
Dan Pittman	b4116b9372	add an AVX-512-optimized ASM XTS implementation for x86_64 ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26410)	2025-02-27 08:31:16 -05:00
slontis	c2f4d7aae1	Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called ... twice. Fixes #26862 This only happens when using the FIPS provider, since it needs to export the key. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26891)	2025-02-27 12:04:14 +11:00
Andrew Dinh	054f6c0fc1	Optimize ossl_namemap_name2num_n to avoid strndup ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26870)	2025-02-26 13:32:59 -05:00
Viktor Dukhovni	44a64029c3	Use better data type info in decoders ... The decoders in some cases failed to capture or propagate information about what is being decoded, causing more work happen to try unrelated decoders as a fallback. We now try harder to keep track of the expected object (private key or public key, if known), and the algorithm determined from the OID of a PKCS8 object or SPKI. This leads in many cases to fewer decoder invocations. With so many more algorithms now, trying every decoder is increasingly best avoided. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26892)	2025-02-26 15:13:57 +01:00
SaEvangelista	f11c10d83e	Allow 0 length plaintext and aad for aes-siv ... Test vectors taken from wycheproof: https://github.com/C2SP/wycheproof/blob/master/testvectors/aes_siv_cmac_test.json Fixes #26580 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26658)	2025-02-26 12:21:08 +01:00
Dimitri John Ledkov	aa5f1b4cf5	fips-jitter: Force use jitter entropy in the FIPS 3.0.9 provider callback ... FIPS 3.0.9 provider does not honor runtime seed configuration, thus if one desires to use JITTER entropy source with FIPS 3.0.9 provider something like this needs to be applied to the core (libcrypto) build. Not sure if this is at all suitable for upstream. With fips-jitter (3.5+) config, also ensure that core<->provider callback for entropy uses jitter entropy source, rather than os seed (getrandom syscall). Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25930)	2025-02-25 14:45:57 -05:00
Alexandr Nedvedicky	395a83a617	Fix read out of buffer bounds when dealing with BIO_ADDR ... This issue was discoevered while I was testing SSL_new_from_listener() using a newly created unit test. It has turned out the QUIC stack at few places contain pattern as follows: foo(QUIC_WHATEVER *q, BIO_ADDR *a) { q->a = *a; } The problem is that derefencning a that way is risky. If the address `a` comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR). Using BIO_ADDR_copy() is the right thing to do here. Fixes #26241 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26252)	2025-02-25 15:55:46 +01:00
Niels Dossche	ececabd9ad	Fix potential memory leak in policy_section() ... If sk_POLICYQUALINFO_push() fails, qual is not freed. Fix it by adding POLICYQUALINFO_free() to the error path. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26499)	2025-02-25 15:52:13 +01:00
Niels Dossche	56160f173d	Fix potential leak in error path in cert_response() ... get1_cert_status() returns an object that must be freed, but the error path does not do that. Fix it by adding a call to X509_free() in the error path. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26513)	2025-02-25 15:48:50 +01:00
Andrew Dinh	b4fab70bfb	EVP_PKEY_derive_set_peer_ex(): Don't free peer on error ... In EVP_PKEY_derive_set_peer_ex, don't free peer on error. Revert to existing functionality. Bug was introduced with https://github.com/openssl/openssl/pull/26294 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26823)	2025-02-25 15:47:08 +01:00
Tomas Mraz	87b5aa737d	Rename fnv1a_hash() to ossl_fnv1a_hash() ... It is no longer static. Also add it to libssl only with quic enabled. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26882)	2025-02-25 15:45:42 +01:00
Niels Dossche	8cdba24cee	Fix potential memory leaks in error paths in ossl_rsa_multiprime_derive() ... There are several cases where new BIGNUM instances are created, not using the context, but not freed when an error occurs. Fix this by adding the necessary calls to BN_free(). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26515)	2025-02-25 15:36:43 +01:00
daichengrong	7fb4a323f1	riscv: add dl_hwcap for capability detection ... Availability of ZVK* should be determined with dl_hwcap and hwcap. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26811)	2025-02-25 12:01:59 +01:00
Bernd Edlinger	a6f512a1e6	Revert wrong macos RCU fix ... This reverts #23974 which seems to be no longer needed now, due to other fixes nearby. Most likely the change did just slightly decrease the performance of the reader threads, and did therefore create the wrong impression that it fixed the issue. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26881)	2025-02-25 10:38:26 +01:00
Viktor Dukhovni	64a27c24d8	More seed and private key checks for ML-DSA ... - Check seed/key consistency when generating from a seed and the private key is also given. - Improve error reporting when the private key does not match an explicit public key. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26865)	2025-02-25 12:49:49 +11:00
slontis	6e770d38c7	SLH-DSA - restrict keygen seed length to exact value of 3*n ... It was allowing the seed to be larger, and then just ignoring the trailing bytes. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26858)	2025-02-22 22:46:44 +11:00
Dmitry Belyavskiy	17bbc16383	EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26832)	2025-02-21 17:58:41 +01:00
Bernd Edlinger	3240427a85	Make CRYPTO_atomic_load/store use the same preprocessor guards ... as the other CRYPTO_atomic_X functions. All CRYPTO_atomic functions should use the same logic here, just in case... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26815)	2025-02-21 14:01:51 +01:00
Bernd Edlinger	eacf14594d	Cleanup atomic fallbacks in threads_pthread.c ... the unused atomic stub functions make clang issue unused function warnings -Wunused-function Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26815)	2025-02-21 14:01:51 +01:00
slontis	92159b48e9	SLH-DSA coverity fixes. ... Fixes 1643092 and 1643093 Neither of these are major issues, but fixed anyway.. i.e. 1<<hm is bounded by the parameter set so this is not an issue Not checking an error from WPACKET_memcpy() would also not cause an issue. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26835)	2025-02-21 09:12:02 +11:00
Tomas Mraz	560e586371	Refactor EVP_SKEY initialization ... Enforce that skeymgmt cannot ever be NULL in EVP_SKEY. Also add missing allocation checks. Fixes multiple issues found by Coverity. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/26795)	2025-02-20 20:35:59 +01:00
Dmitry Belyavskiy	c152a94395	Fix coverity finding ... Coverity ID: 1643094 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26831)	2025-02-20 16:28:22 +01:00
Viktor Dukhovni	cab4e7cbd1	Configurable import-time PCT for ML-KEM ... And related cleanup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26789)	2025-02-20 18:21:40 +11:00
Viktor Dukhovni	a4465bf694	More consistent ML-KEM key checks ... - Cross-check seed `z` value on import as well as load. - In import/load When re-generating from a seed, check hash of any explicit private key when both provided. - Avoid leak of expanded key encoding when load fails. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26812)	2025-02-20 09:59:22 +11:00