15226 Commits

Author	SHA1	Message	Date
qu3ri	78b1fdf4a1	Moved crypto/bn/README.pod to internal manpages ... The new place is doc/internal/man3/bn_mul_words.pod. Also removed outdated information. Implementing the fix from https://github.com/quictls/quictls/pull/214 Fixes #26399 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26597)	2025-03-26 15:49:31 +01:00
Neil Horman	4943ac7b88	Update dead links and e-mails our sources ... http://www.openssl.org/~appro/cryptogams/ is 404, update to https://github.com/dot-asm/cryptogams/ And clean up the boiler plate text around it. Replace stray usage of appro@openssl.org with github url. The email in question here is no longer valid, replace it with the corresponding github id for the user. Replace <appro\@fy.chalmers.se> with <https://github.com/dot-asm> Fix lots more dead emails addresses that we missed Remove reference urls that no longer exist. Just delete urls that 404 now, and have no obvious new link. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27073)	2025-03-26 15:40:02 +01:00
Andrey Tsygunka	3edb1f09c6	Fix return value of the i2d_ASN1_bio_stream() call ... If the flags argument does not contain the SMIME_STREAM bit, the i2d_ASN1_bio_stream() function always returns 1, ignoring the result of the ASN1_item_i2d_bio() call. Fix the return value to the result of the ASN1_item_i2d_bio() call for this case. CLA: trivial Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27106)	2025-03-26 15:27:23 +01:00
Paul Elliott	b6dceb36e8	Enable AES-GCM unroll8/unroll12 for Neoverse N3/V3 ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27112)	2025-03-25 20:19:14 +01:00
Andrey Tsygunka	8e08f9c5a0	Fix NULL pointer dereference in `asn1_ex_i2c()`, crypto/asn1/tasn_enc.c ... Adds handling of V_ASN1_UNDEF to avoid NULL dereference in case ASN1 structure contains an element of type ASN1_TYPE without initializing its value (i.e. default constructed) CLA: trivial Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27100)	2025-03-25 19:53:49 +01:00
Frederik Wedel-Heinen	21b170df9f	Adds the concept of thunks to OPENSSL_sk interface ... This allows applications to call functions of correct signature when free'ing OPENSSL_sk items which UBSan complains about. Related to #22896. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27071)	2025-03-24 15:28:34 +01:00
Daniel Van Geest	c1d27789e9	Fix use of SHAKE as a digest in CMS ... draft-ietf-lamps-cms-sphincs-plus-19 specifies SHAKE as the message digest algorithm for SLH-DSA-SHAKE-* in CMS. SHAKE doesn't have a default digest length, so this adds a SHAKE-specific kludge in CMS. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27087)	2025-03-20 12:20:37 +01:00
Viktor Dukhovni	27b88364e4	Avoid erroneous legacy code path when provided ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27075)	2025-03-20 11:33:23 +01:00
Viktor Dukhovni	064bb16454	Tolerate PKCS#8 V2 with optional public keys ... - Presently any included public key is unused. - We don't check that v1 PKCS#8 structures omit the public key. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27076)	2025-03-19 12:02:31 +01:00
sashan	108079fcbb	require GNU assembler 2.30 or higher to build aesni-xtx-avx512.pl ... The peralsm in aesni-xts-avx512 currently checks for GNU assembler 2.26 or higher. According to reporters it looks like we need 2.30. This PR just attempts fix version check so people with older tool chains can build OpenSSL. Fixes #27049 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27078)	2025-03-19 08:03:50 +11:00
Bernd Edlinger	a532f2302d	Do some more cleanup in the RCU code ... Only a minimum of 2 qp's are necessary: one for the readers, and at least one that writers can wait on for retirement. There is no need for one additional qp that is always unused. Also only one ACQUIRE barrier is necessary in get_hold_current_qp, so the ATOMIC_LOAD of the reader_idx can be changed to RELAXED. And finally clarify some comments. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27012)	2025-03-18 18:52:29 +01:00
Bernd Edlinger	4a1a7fe5ce	Fix a memory order issue with weakly ordered systems ... this adds a dummy atomic release operation to update_qp, which should make sure that the new value of reader_idx is visible in get_hold_current_qp, directly after incrementing the users count. Fixes: #26875 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26964)	2025-03-17 08:01:26 -04:00
Danny Tsen	85cabd9495	Fix Minerva timing side-channel signal for P-384 curve on PPC ... 1. bn_ppc.c: Used bn_mul_mont_int() instead of bn_mul_mont_300_fixed_n6() for Montgomery multiplication. 2. ecp_nistp384-ppc64.pl: - Re-wrote p384_felem_mul and p384_felem_square for easier maintenance with minumum perl wrapper. - Implemented p384_felem_reduce, p384_felem_mul_reduce and p384_felem_square_reduce. - Implemented p384_felem_diff64, felem_diff_128_64 and felem_diff128 in assembly. 3. ecp_nistp384.c: - Added wrapper function for p384_felem_mul_reduce and p384_felem_square_reduce. Signed-off-by: Danny Tsen <dtsen@us.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26709)	2025-03-14 17:20:52 +01:00
Tomas Mraz	c8654f79f4	Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26976)	2025-03-14 09:44:52 +01:00
Andrew Dinh	7097d2e00e	Fix RCU TODOs ... - Update allocate_new_qp_group to take unsigned int - Move id_ctr in rcu_lock_st for better stack alignment Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26972)	2025-03-12 12:07:44 -04:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Michael Schroeder	cad3520bf7	Add support for md-less signature schemes in CMS ... Signature schemes like Ed25519 or ML-DSA use "pure" signing, i.e. they directly sign the tbs data instead of signing a digest. This is already supported in the X509 code, but not in CMS. This commit adds support for such schemes to CMS. This is a minimalistic set of changes, based in the work done by David von Oheimb. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26867)	2025-03-10 14:36:15 +01:00
Bernd Edlinger	6e7be995fd	RCU: Ensure that qp's are actually retired in order ... The current retirement code for rcu qp's has a race condition, which can cause use-after-free errors, but only if more than 3 QPs are allocated, which is not the default configuration. This fixes an oversight in commit 5949918f9a ("Rework and simplify RCU code") Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26952)	2025-03-05 16:04:16 +01:00
Bernd Edlinger	bcb8eae1af	Fix support for windows atomics ... Make CRYPTO_atomic_add consistent with CRYPTO_atomic_load_int and set the reader_idx under write_lock since there is no CRYPTO_atomic_store_int. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26963)	2025-03-05 16:02:47 +01:00
Ivan Stanković	e599893a9f	x509: allow SAN URIs to contain userinfo ... The way we're currently handling SAN URIs does not allow for userinfo, meaning the name constraint check on such URIs will fail. Fix this by skipping over the userinfo component: authority = [ userinfo "@" ] host [ ":" port ] (per RFC 3986). Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25861)	2025-03-04 17:30:34 +01:00
Bartel Artem	d3b6b81eab	X509v3_addr_canonize(): Check whether addr == NULL ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26583)	2025-03-03 09:43:22 +01:00
Jakub Zelenka	5045712d3d	Fix libctx passing for CMS PWRI use ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26937)	2025-03-03 09:26:44 +01:00
Matt Caswell	aaad33c5ac	Move ssl_err.c into libcrypto ... We move ssl_err.c out of libssl and into libcrypto. This file is entirely self contained and is used to load error strings into the libcrypto error tables. By moving this file into libcrypto, libssl can be unloaded safely without having dangling references to this error information. Fixes #26672 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26931)	2025-03-01 14:46:03 -05:00
Viktor Dukhovni	31b5f3f382	Further decoder tuning possibly better perf ... - The decoder should consider fewer options based on more precise tracking of the desired input type (DER, PVK, MSBLOB), algorithm (RSA, EC, ...), input structure (SPKI, P8, ...). How much this affects actual use-cases is harder to estimate, we'll just have to run before/after perf tests. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26927)	2025-03-02 02:04:09 +11:00
Valerii Krygin	f86acc9434	EVP_DecodeUpdate() should not produce padding zeros to the decoded output (Fixes #26677) ... EVP_DecodeUpdate() should not produce zeros for input padding `=` signs to avoid writing to non-allocated memory regions. To achieve this: - Add `eof` parameter to `evp_decodeblock_int` function in `openssl/crypto/evp`. The parameter should either contain the number of the input padding characters to ignore or `-1` if the function has to count them. - Use precalculated `eof` in `EVP_DecodeUpdate` to fix its behaviour. - Use `eof = -1` in `EVP_DecodeFinal` to count it in `evp_decodeblock_int`. - Do not ignore padding in `EVP_DecodeBlock` (`eof = 0`) because it should write padding zeros according to the documentation. - Add the HISTORY section to EVP_EncodeInit documentation to describe the fix. Other changes: - Update AUTHORS.md - Update the copyright date in the documentation. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26678)	2025-02-27 17:38:57 +00:00
dan pittman	ddc8529e87	fix windows calling convention in aesni-xts-avx512 ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26410)	2025-02-27 08:31:16 -05:00
Dan Pittman	b4116b9372	add an AVX-512-optimized ASM XTS implementation for x86_64 ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26410)	2025-02-27 08:31:16 -05:00
slontis	c2f4d7aae1	Encoder : Fix floating pointer when OSSL_ENCODER_to_data() is called ... twice. Fixes #26862 This only happens when using the FIPS provider, since it needs to export the key. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26891)	2025-02-27 12:04:14 +11:00
Andrew Dinh	054f6c0fc1	Optimize ossl_namemap_name2num_n to avoid strndup ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26870)	2025-02-26 13:32:59 -05:00
Viktor Dukhovni	44a64029c3	Use better data type info in decoders ... The decoders in some cases failed to capture or propagate information about what is being decoded, causing more work happen to try unrelated decoders as a fallback. We now try harder to keep track of the expected object (private key or public key, if known), and the algorithm determined from the OID of a PKCS8 object or SPKI. This leads in many cases to fewer decoder invocations. With so many more algorithms now, trying every decoder is increasingly best avoided. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26892)	2025-02-26 15:13:57 +01:00
SaEvangelista	f11c10d83e	Allow 0 length plaintext and aad for aes-siv ... Test vectors taken from wycheproof: https://github.com/C2SP/wycheproof/blob/master/testvectors/aes_siv_cmac_test.json Fixes #26580 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26658)	2025-02-26 12:21:08 +01:00
Dimitri John Ledkov	aa5f1b4cf5	fips-jitter: Force use jitter entropy in the FIPS 3.0.9 provider callback ... FIPS 3.0.9 provider does not honor runtime seed configuration, thus if one desires to use JITTER entropy source with FIPS 3.0.9 provider something like this needs to be applied to the core (libcrypto) build. Not sure if this is at all suitable for upstream. With fips-jitter (3.5+) config, also ensure that core<->provider callback for entropy uses jitter entropy source, rather than os seed (getrandom syscall). Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25930)	2025-02-25 14:45:57 -05:00
Alexandr Nedvedicky	395a83a617	Fix read out of buffer bounds when dealing with BIO_ADDR ... This issue was discoevered while I was testing SSL_new_from_listener() using a newly created unit test. It has turned out the QUIC stack at few places contain pattern as follows: foo(QUIC_WHATEVER *q, BIO_ADDR *a) { q->a = *a; } The problem is that derefencning a that way is risky. If the address `a` comes from BIO_lookup_ex() it may actually be shorter than sizeof(BIO_ADDR). Using BIO_ADDR_copy() is the right thing to do here. Fixes #26241 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26252)	2025-02-25 15:55:46 +01:00
Niels Dossche	ececabd9ad	Fix potential memory leak in policy_section() ... If sk_POLICYQUALINFO_push() fails, qual is not freed. Fix it by adding POLICYQUALINFO_free() to the error path. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26499)	2025-02-25 15:52:13 +01:00
Niels Dossche	56160f173d	Fix potential leak in error path in cert_response() ... get1_cert_status() returns an object that must be freed, but the error path does not do that. Fix it by adding a call to X509_free() in the error path. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26513)	2025-02-25 15:48:50 +01:00
Andrew Dinh	b4fab70bfb	EVP_PKEY_derive_set_peer_ex(): Don't free peer on error ... In EVP_PKEY_derive_set_peer_ex, don't free peer on error. Revert to existing functionality. Bug was introduced with https://github.com/openssl/openssl/pull/26294 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26823)	2025-02-25 15:47:08 +01:00
Tomas Mraz	87b5aa737d	Rename fnv1a_hash() to ossl_fnv1a_hash() ... It is no longer static. Also add it to libssl only with quic enabled. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26882)	2025-02-25 15:45:42 +01:00
Niels Dossche	8cdba24cee	Fix potential memory leaks in error paths in ossl_rsa_multiprime_derive() ... There are several cases where new BIGNUM instances are created, not using the context, but not freed when an error occurs. Fix this by adding the necessary calls to BN_free(). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26515)	2025-02-25 15:36:43 +01:00
daichengrong	7fb4a323f1	riscv: add dl_hwcap for capability detection ... Availability of ZVK* should be determined with dl_hwcap and hwcap. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26811)	2025-02-25 12:01:59 +01:00
Bernd Edlinger	a6f512a1e6	Revert wrong macos RCU fix ... This reverts #23974 which seems to be no longer needed now, due to other fixes nearby. Most likely the change did just slightly decrease the performance of the reader threads, and did therefore create the wrong impression that it fixed the issue. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26881)	2025-02-25 10:38:26 +01:00
Viktor Dukhovni	64a27c24d8	More seed and private key checks for ML-DSA ... - Check seed/key consistency when generating from a seed and the private key is also given. - Improve error reporting when the private key does not match an explicit public key. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26865)	2025-02-25 12:49:49 +11:00
slontis	6e770d38c7	SLH-DSA - restrict keygen seed length to exact value of 3*n ... It was allowing the seed to be larger, and then just ignoring the trailing bytes. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26858)	2025-02-22 22:46:44 +11:00
Dmitry Belyavskiy	17bbc16383	EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26832)	2025-02-21 17:58:41 +01:00
Bernd Edlinger	3240427a85	Make CRYPTO_atomic_load/store use the same preprocessor guards ... as the other CRYPTO_atomic_X functions. All CRYPTO_atomic functions should use the same logic here, just in case... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26815)	2025-02-21 14:01:51 +01:00
Bernd Edlinger	eacf14594d	Cleanup atomic fallbacks in threads_pthread.c ... the unused atomic stub functions make clang issue unused function warnings -Wunused-function Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26815)	2025-02-21 14:01:51 +01:00
slontis	92159b48e9	SLH-DSA coverity fixes. ... Fixes 1643092 and 1643093 Neither of these are major issues, but fixed anyway.. i.e. 1<<hm is bounded by the parameter set so this is not an issue Not checking an error from WPACKET_memcpy() would also not cause an issue. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26835)	2025-02-21 09:12:02 +11:00
Tomas Mraz	560e586371	Refactor EVP_SKEY initialization ... Enforce that skeymgmt cannot ever be NULL in EVP_SKEY. Also add missing allocation checks. Fixes multiple issues found by Coverity. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/26795)	2025-02-20 20:35:59 +01:00
Dmitry Belyavskiy	c152a94395	Fix coverity finding ... Coverity ID: 1643094 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26831)	2025-02-20 16:28:22 +01:00
Viktor Dukhovni	cab4e7cbd1	Configurable import-time PCT for ML-KEM ... And related cleanup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26789)	2025-02-20 18:21:40 +11:00
Viktor Dukhovni	a4465bf694	More consistent ML-KEM key checks ... - Cross-check seed `z` value on import as well as load. - In import/load When re-generating from a seed, check hash of any explicit private key when both provided. - Avoid leak of expanded key encoding when load fails. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26812)	2025-02-20 09:59:22 +11:00
Neil Horman	20a2f3beba	Fix memory leak in ecdsa_keygen_knownanswer_test ... We allocate an EC_POINT with EC_POINT_new here, but in failing a subsequent check, we don't free it, correct that. Fixes #26779 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26799)	2025-02-19 09:30:25 -05:00
Dmitry Belyavskiy	83ced5e6b1	Fix coverity issues ... Fixes coverity issues 1642964, 1642965, 1642966, 1642968, 1642969 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/26793)	2025-02-18 18:12:10 +01:00
Frederik Wedel-Heinen	00fbc96988	Adds missing checks of return from XXX_up_ref(). ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26294)	2025-02-18 16:32:59 +01:00
Tomas Mraz	e9aac2c2f3	Do not call BIO_printf() from FIPS_MODULE ... Fixes #26743 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26744)	2025-02-18 16:31:45 +01:00
Dr. David von Oheimb	5cba362909	OSSL_CMP_MSG_http_perform(): support using BIO from OSSL_CMP_CTX_set_transfer_cb_arg() ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26628)	2025-02-18 12:19:26 +01:00
slontis	0e43652489	SLH-DSA: Add EVP_PKEY_CTX_dup() support. ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26701)	2025-02-18 10:17:29 +01:00
slontis	3fcefd51a1	SLH_DSA: Make apps.c do_X509_REQ_verify() call work correctly. ... - Added sigid_algs for SLH_DSA such that OBJ_find_sigid_algs() works. - OBJ_sn2nid() was also being called, so the SN form of SLH_DSA algorithms needed to be added to the provider dispatch tables. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26625)	2025-02-18 10:17:29 +01:00
slontis	7389cca079	SLH_DSA: Add support for generating X509 certs via the openssl ... command line app. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26625)	2025-02-18 10:17:29 +01:00
slontis	67d52a555e	SLH-DSA cleanups ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	0f0a836abd	SLH-DSA More fixups ... Also added slh_dsa_key_dup() Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	8f86a75fcf	SLH-DSA: Remove legacy ASN1 method tables for SLH-DSA. Update to use ... custom encoders for SLH_DSA decode_der2key. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	79e7c83711	SLH-DSA cleanups ... Addressed some review comments. - Ref counting has been removed from SLH_DSA_KEY (EVP_PKEY is responsible for the keys ref counting). - Moved constants and prefetched objects into SLH_DSA_KEY. - The SLH_DSA_HASH_CTX is still required since there are multiple contexts that need to propagate to a lot of functions, but it no longer contains the constants. Note that it also holds a pointer to the SLH_DSA_KEY. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	eba0e11c39	Add SLH_DSA key validation. ... The pairwise test requires that the computed PK_ROOT key matches the keys PK_ROOT value. The public and private key tests just require the key elements to exist. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	a25bcde26a	Add SLH-DSA encoder/decoder support. ... This required adding additional EVP_PKEY_ASN1_METHOD methods. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	db5846a7e0	Address style check nits for SLH-DSA ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	148f4d23e1	Update SLH-DSA code to use PACKET and WPACKET. ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:17:29 +01:00
slontis	5c2b404241	SLH-DSA clean ups ... - Make slh_dsa_sign() return the siglen when sig is NULL. - Remove the ability in fromdata to generate the public key root given the private key and public key seed. This was messy and can be done by key generation instead. - Add common EVP_PKEY gettablesto SLH_DSA keys (OSSL_PKEY_PARAM_BITS, OSSL_PKEY_PARAM_SECURITY_BITS, and OSSL_PKEY_PARAM_MAX_SIZE). - Update tests based on the above changes. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	ce3acbd07e	Zeorize some secret values in SLH_DSA ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	30a55b0cf1	Added return code checks to SLH_DSA Hash functions and propogated the ... values thru the calling functions. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	5901ca87ba	Add SLH_DSA to the FIPS provider. ... The keygen tests required "entropy" to be added via an additional parameter for ACVP testing. This is required because TEST_RAND cant be used to pass entropy to the FIPS provider, due to it not knowing the lib ctx of the FIPS provider. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	e8457ce077	Add support for all 12 SLH-DSA parameter sets. ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	e240d39c6c	Add SLH-DSA signing. ... Also updated function comments. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	8f53b9b59d	Add SLH-DSA key generation ... Also made fromdata able to generate the public root key if the private key seed + prf as well as the public key seed are passed to from data. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	2f9e152d86	Add SLH_DSA signature verification. ... This uses a SLH_DSA_CTX that is passed to most functions. It contains information related to a parameter set (such as constants, hash functions, prefetched EVP_MD/EVP_MAC objects, as well as ADDRESS functions). This context is seperated from the SLH_DSA_KEY since multiple signature operations could be performed using the same keys. This only implements functions required for SLH-DSA-SHA2-128s Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	34f4cacc8f	Add base code to load a SLH_DSA public key. ... This loads a SLH_DSA public key from data. A simple SLH_DSA keymanager imports this key. Initially this only has a parameter set for SLH-DSA-SHA2-128s Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
Neil Horman	a903be9cae	Fixup error ennumeration ... The merge gives us a conflict on SSL_R_MISSING_QUIC_TLS_FUNCTIONS which conflicted with SSL_R_LISTENER_USE_ONLY. Move the former to ordinal 423 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26762)	2025-02-17 11:27:34 -05:00
Neil Horman	35fb39da76	de-duplicate fnv1a_hash ... I cloned a copy of fnv1a_hash from hashtable.c. Deduplicate that so we have common source code. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:34 -05:00
Matt Caswell	16a19002d8	Add the ablity to set a local address for BIO_dgram_pair ... BIOs created from a BIO_dgram_pair don't normally have a local BIO_ADDR associated with them. This allows us to set one. Fixes openssl/project#933 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26066)	2025-02-17 11:27:33 -05:00
Hugo Landau	745a779fb2	make update ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23334)	2025-02-17 11:27:32 -05:00
Hugo Landau	3a9cedc20f	QUIC APL: Rework QCTX to support listener calls ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23334)	2025-02-17 11:27:32 -05:00
Neil Horman	7d284560a0	Don't use __ATOMIC_ACQ_REL on older compilers ... Older compilers don't always support __ATOMIC_ACQ_REL, use a lock where they don't Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/26747)	2025-02-16 15:09:03 -05:00
Viktor Dukhovni	afc64c240f	Address non-FP coverity nits ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26765)	2025-02-16 14:48:01 -05:00
Simo Sorce	fc00d9b7b1	Add additional EVP_SKEY helpers ... EVP_SKEY_is_a() allows to check if a key is of a specific type. EVP_SKEY_to_provider() provides an easy way to move a key to a different provider. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:31 +01:00
Simo Sorce	71debb7b84	Allow import of unknown keys via generic type ... This allows to use SKEY even w/o a specific skey managment available, however it bears the risk of allowing users to mispell the key type and not see the error of their ways until they expect a specific provider to pick this up and fail. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy	759570bfed	Implement EVP_MAC_init_SKEY ... Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
Simo Sorce	787a083d42	Add skeymgmt helper to fetch from a provider ... This allows to fetch efficiently directly from the same provider that can handle the EVP_SKEY at hand. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy	d46e010cd2	EVP_SKEY implementation for EVP_CIPHER ... Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
slontis	bd8954bfe5	ML-DSA: Change ossl_ml_dsa_key_public_from_private() to check that the ... decoded value of t0 matches the calculated value of t0. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26681)	2025-02-14 18:02:28 +01:00
Pauli	21f92ecf7c	rand: avoid property query manipulations ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26714)	2025-02-14 17:08:42 +01:00
Pauli	b6c5342613	evp: add additional functions for FIPS internal use to support hybrids KEMs ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26714)	2025-02-14 17:08:42 +01:00
Pauli	53e3a54b60	evp: include one shot keygen functions for internal FIPS use ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26714)	2025-02-14 17:08:42 +01:00
Pauli	236d5d8f72	fips: FIPS ignores property queries for internal algorithm fetches ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26714)	2025-02-14 17:08:42 +01:00
Sebastian Andrzej Siewior	c71c65b922	SPARC assembly: Don't file aes-cbc on T4 with small sizes. ... The "openssl speed -testmode -seconds 1 -bytes 1 aes-128-cbc" test revealed that the assembly code is crashing if length is less than 16. The code shifts the provided length by 4 and than subtracts one until the length hits zero. If it was already zero then it underflows the counter and continues until it segfaults on reading or writing. Replace the check against 0 with less than 15. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25637)	2025-02-14 11:42:35 +01:00
Xi Ruoyao	f48c14e94e	LoongArch: Fix output file name detection for Perl scripts ... We were using the first (or second) argument containing a '.' as the output name file, but it may be incorrect as -march=la64v1.0 may be in the command line. If the builder specifies -march=la64v1.0 in the CFLAGS, the script will write to a file named "-march=la64v1.0" and cause a build error with cryptic message: ld: crypto/pem/loader_attic-dso-pvkfmt.o: in function `i2b_PVK': .../openssl-3.4.1/crypto/pem/pvkfmt.c:1070:(.text+0x11a8): undefined reference to `OPENSSL_cleanse' Adapt the approach of ARM and RISC-V (they have similar flags like -march=v8.1-a or -misa-spec=2.2) to fix the issue. Signed-off-by: Xi Ruoyao <xry111@xry111.site> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26717)	2025-02-14 11:35:23 +01:00
Viktor Dukhovni	cedc5bcce2	Post-merge make update ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26715)	2025-02-14 10:50:59 +01:00
Viktor Dukhovni	2ea9903c16	Reject import of private keys that fail PCT ... - Also added a provider "validate" method that wraps the PCT test. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26656)	2025-02-14 10:50:59 +01:00
Viktor Dukhovni	5b2d996f91	Implement seed/key preference when decoding ... - Moved the codec code out of `ml_kem.c` into its own file in the provider tree. Will be easier to share some code with ML-DSA, and possible to use PROV_CTX, to do config lookups directly in the functions doing the work. - Update and fixes of the EVP_PKEY-ML-KEM(8) documentation, which had accumulated some stale/inaccurate material, and needed new text for the "prefer_seed" parameter. - Test the "prefer_seed=no" behaviour. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26569)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	cc5403f33a	Fix code comment typo ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26569)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	318994a121	ASN.1 ML-KEM private key format ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26512)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	869903c07c	Improved import and export ... - On import, if a seed is provided, the keys are regenerated. - The seed is exported as a separate "seed" parameter, when available. The "ml-kem.retain_seed" parameter is also exported, when false. - The seed is optionally dropped after key generation. * When the "ml-kem.retain_seed" keygen parameter is set to zero. * When the "ml-kem.retain_seed" keygen parameter is not set to 1, and the "ml-kem.retain_seed" provider config property is set explictly false. - The exported private key parameter "priv" is always the FIPS 203 |dk|. - Private key decoding from PKCS#8 produces a transient "seed-only" form of the key, in which "retain_seed" is set to false when the "ml-kem.retain_seed" provider config property is set explictly false. The full key is generated during "load" and the seed is retained or not as specified. - Import honours the "ml-kem.retain_seed" parameter when specified, or otherwise honours the provider's "ml-kem.retain_seed" property. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26512)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	9a79d4088f	Zeroise temporary secrets while doing ML-KEM ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26456)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	003309c376	ML-KEM implementation cleanup/speedup ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26341)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	b818a99839	Encoders and Decoders for ML-KEM ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26341)	2025-02-14 10:50:58 +01:00
Pauli	289c168996	update build infrastructure for ML-KEM in the FIPS provider ... Also avoid a file name conflict when adding ML-KEM to the FIPS provider. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26338)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	4b1c73d2dd	ML-KEM hybrids for TLS ... - When used as KEMs in TLS the ECDHE algorithms are NOT subjected to HPKE Extract/Expand key derivation. Instead the TLS HKDF is used as usual. - Consequently these KEMs are just the usual ECDHE key exchange operations, be it with the encap ECDH private key unavoidably ephemeral. - A new "MLX" KEM provider is added that supports four hybrids of EC/ECX DH with ML-KEM: * ML-KEM-768 + X25519 * ML-KEM-1024 + X448 * P-256 + ML-KEM-768 * P-384 + ML-KEM-1024 - Support listing of implemented TLS groups. The SSL_CTX_get0_implemented_groups() function and new `openssl list -tls-groups` and `openssl list -all-tls-groups` commands make it possible to determine which groups are implemented by the SSL library for a particular TLS version or range of versions matching an SSL_CTX. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26220)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	95d764a044	Prepare to detect side-channels in compiled ML-KEM code ... Loosely based on similar code in BoringSSL. Added the valgrind macros necessary to mark secret inputs as uninitialised on entry to the ML-KEM keygen, encap and decap functions. The inputs and outputs are then untagged before control returns to the caller, where, at least in the case of tests and protocols that check whether the derived keys succeeded in decoding a key-confirmation message, there will at some point be a branch based on the *content* of the compute shared secret. When a build is configured with `-DOPENSSL_CONSTANT_TIME_VALIDATION`, and various tests that use ML-KEM are run under: $ valgrind --tool=memcheck --error-exitcode=1 --exit-on-first-error=yes cmd [args] any internal secret-data-dependent branches added by a mis-optimising compiler, or inadvertently introduced into the source code would cause the tests to fail, exposing the side channel. Since the side-channels are liable to depend on the compiler and selected optimisation flags, tests would need to cover a few combinations. * clang vs. gcc * debug builds * default builds * -O2 * -O3 -fno-vectorise (a problem with clang in "clangover") * -Os (was a problem with clang in "clangover") ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26270)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	653fc2189d	ML-KEM libcrypto implementation polish ... * Core ML_KEM constants in new <openssl/ml_kem.h> * Renamed variant ordinals to ML_KEM_<bits>_VARIANT, freeing up the unadorned ML_KEM_<bits> names. * Fewer/cleaner macros in <crypto/ml_kem.h> * Fewer/cleaner macros for setting up the ML_KEM_VINFO table. * Made (d, z) be separate inputs to the now single key generation function. Both or neither have to be NULL. This supports potential future callers that store them in a different order, or in separate buffers. - Random values are chosen when both are NULL, we never return the generated seeds, rather we may, when/if (d, z) private key support is added, store these in the expanded key, and make them available for import/export. * No need for a stand-by keygen encoded public key buffer when the caller does not provide one (will ask for it later if needed). New `hash_h_pubkey` function can compute the public hash from the expanded form in constant space (384 bytes for 12-bit encoded scalar). * Simplified code in `scalar_mult`. * New `scalar_mult_add` adds the product to an existing scalar. Used in new `matrix_mult_transpose_add` replacing `matrix_mult_transpose`. * Unrolled loop in `encode_12`. * Folded decompression and inverse NTT into vecode_decode, the three were always used together. * Folded inverse NTT into former `matrix_mult` as `matrix_mult_intt`, always used together. * New gencbd_vector_ntt combines CBD vector generation with inverse NTT in one pass. * All this makes for more readable code in `decrypt_cpa` and especially `genkey()`, which no longer requires caller-allocated variant-specific temporary storage (just a single EVP_MD_CTX is still needed). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26236)	2025-02-14 10:50:57 +01:00
Viktor Dukhovni	d2136d9e73	Multi-variant ML-KEM ... This introduces support for ML-KEM-512 and ML-KEM-1024 using the same underlying implementation parameterised by a few macros for the associated types and constants. KAT tests are added for ML-KEM 512 and 1024, to complement the previous tests for ML-KEM-768. MLKEM{512,768,1024} TLS "group" codepoints are updated to match the final IANA assigments and to make the additional KEMs known to the TLS layer. The pure-QC MLKEMs are not in the default list of supported groups, and need to be explicitly enabled by the application. Future work will introduce support for hybrids, and for more fine-grained policy of which keyshares a client should send by default, and when a server should request (HRR) a new mutually-supported group that was not sent. Tests for ML-KEM key exchange added to sslapitest to make sure that our TLS client MLKEM{512,768,1024} implementations interoperate with our TLS server, and that MLKEM* are not negotiated in TLS 1.2. Tests also added to excercise non-derandomised ML-KEM APIs, both directly (bypassing the provider layer), and through the generic EVP KEM API (exercising the provider). These make sure that RNG input is used correctly (KAT tests bypass the RNG by specifying seeds). The API interface to the provider takes an "const ML_KEM_VINFO" pointer, (obtained from ossl_ml_kem_get_vinfo()). This checks input and output buffer sizes before passing control to internal code that assumes correctly sized (for each variant) buffers. The original BoringSSL API was refactored to eliminate the opaque public/private key structure wrappers, since these structures are an internal detail between libcrypto and the provider, they are not part of the public (EVP) API. New "clangover" counter-measures added, refined with much appreciated input from David Benjamin (Chromium). The internal steps of "encrypt_cpa" were reordered to reduce the working-set size of the algorithm, now needs space for just two temporary "vectors" rather than three. The "decap" function now process the decrypted message in one call, rather than three separate calls to scalar_decode_1, scalar_decompress and scalar_add. Some loops were unrolled, improving performance of en/decapsulate (pre-expanded vectors and matrix) by around 5%. To handle, however unlikely, the SHA3 primitives not behaving like "pure" functions and failing, the implementation of `decap` was modifed: - To use the KDF to compute the Fujisaki-Okamoto (FO) failure secret first thing, and if that fails, bail out returning an error, a shared secret is still returned at random from the RNG, but it is OK for the caller to not use it. - If any of the subsequently used hash primitives fail, use the computed FO failure secret (OK, despite no longer constant-time) and return success (otherwise the RNG would replace the result). - We quite reasonably assume that chosen-ciphertext attacks (of the correct length) cannot cause hash functions to fail in a manner the depends on the private key content. Support for ML-KEM-512 required adding a centered binomial distribution helper function to deal with η_1 == 3 in just that variant. Some additional comments were added to highlight how the code relates to the ML-KEM specification in FIPS 203. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26172)	2025-02-14 10:50:57 +01:00
Andrew Dinh	42436eb53e	Add ML-KEM-768 KATs from BoringSSL ... Add KATs for ML-KEM-768 under CCLA from https://boringssl.googlesource.com/boringssl/ These KATs test key generation, encapsulation, and decapsulation for the ML-KEM-768 algorithm. Relevant notes: - Added functionality to the ML-KEM key management to export/import. These may not be fully implemented yet (see openssl/openssl#25885) - Exposed some more low-level ML-KEM API's to the provider implementation to allow for deterministic encapsulation/key generation - Actually run 'mlkem_internal_test' with `make test` Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25938)	2025-02-14 10:50:57 +01:00
Michael Baentsch	96a079a03f	Add ML-KEM-768 implementation ... Based on code from BoringSSL covered under Google CCLA Original code at https://boringssl.googlesource.com/boringssl/+/HEAD/crypto/mlkem - VSCode automatic formatting (andrewd@openssl.org) - Just do some basic formatting to make diffs easier to read later: convert from 2 to 4 spaces, add newlines after function declarations, and move function open curly brace to new line (andrewd@openssl.org) - Move variable init to beginning of each function (andrewd@openssl.org) - Replace CBB API - Fixing up constants and parameter lists - Replace BORINGSSL_keccak calls with EVP calls - Added library symbols and low-level test case - Switch boringssl constant time routines for OpenSSL ones - Data type assertion and negative test added - Moved mlkem.h to include/crypto - Changed function naming to be in line with ossl convention - Remove Google license terms based on CCLA - Add constant_time_lt_32 - Convert asserts to ossl_asserts where possible - Add bssl keccak, pubK recreation, formatting - Add provider interface to utilize mlkem768 code enabling TLS1.3 use - Revert to OpenSSL DigestXOF - Use EVP_MD_xof() to determine digest finalisation (pauli@openssl.org) - Change APIs to return error codes; reference new IANA number; move static asserts to one place - Remove boringssl keccak for good - Fix coding style and return value checks - ANSI C compatibility changes - Remove static cache objects - All internal retval functions used leading to some new retval functions Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25848)	2025-02-14 10:47:46 +01:00
Viktor Dukhovni	605b82d7ee	Post-merge make update ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26715)	2025-02-14 10:46:04 +01:00
slontis	dd1d010130	MLDSA: Fix no-ml-dsa configure option. ... Added to 'bulk' group and CI Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26654)	2025-02-14 10:46:04 +01:00
Pauli	55738c1520	ml-dsa: allow signature operations to be provided a μ value ... The μ value replaces the message and avoids some of the preliminary processes. This is part of FIPS 204. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26637)	2025-02-14 10:46:04 +01:00
Viktor Dukhovni	8cc7ebf6fe	Reject private keys with an incorrect pk hash ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26674)	2025-02-14 10:46:04 +01:00
Viktor Dukhovni	5421423ef9	Flexible encoders for ML-DSA ... - Same UX as ML-KEM. The main ASN.1 private key syntax is the one from Russ Housley's post on the LAMPS list, subsequently amended to tag the seed instead of the key (each of the three parameter sets will have a fixed size for the `expandedKey`): ML-DSA-PrivateKey ::= CHOICE { seed [0] IMPLICIT OCTET STRING SIZE (32), expandedKey OCTET STRING SIZE (2560 | 4032 | 4896) both SEQUENCE { seed OCTET STRING SIZE (32), expandedKey OCTET STRING SIZE (2560 | 4032 | 4896) } } Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26638)	2025-02-14 10:46:04 +01:00
slontis	1036be4384	ML_DSA: Make apps.c do_X509_REQ_verify() call work correctly. ... - Added sigid_algs for ML_DSA such that OBJ_find_sigid_algs() works. - OBJ_sn2nid() was also being called, so the SN form of ML_DSA algorithms needed to be added to the provider dispatch tables. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26636)	2025-02-14 10:46:04 +01:00
Pauli	a8956e22d9	ml-dsa: add to FIPS provider ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26548)	2025-02-14 10:46:04 +01:00
Pauli	29d14eeb2e	ml-dsa: add more to internal header ... The ossl_ml_dsa_key_get0_libctx() and the various size macros are better in the intneral header Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26548)	2025-02-14 10:46:04 +01:00
slontis	c83e6c0a2c	ML-DSA Updates to encoders required because of changes on the master ... branch. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26575)	2025-02-14 10:46:03 +01:00
slontis	d9ffc11939	Add ML_DSA encoders ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26575)	2025-02-14 10:46:03 +01:00
slontis	30b6650e1d	ML-DSA: coverage testing fixups ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26505)	2025-02-14 10:46:03 +01:00
slontis	aabb69b8ba	ML-DSA: Fix endian issue in ossl_ml_dsa_poly_sample_in_ball(). ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26451)	2025-02-14 10:46:03 +01:00
slontis	c848506cd4	ML-DSA: Add support for dup. ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26451)	2025-02-14 10:46:03 +01:00
slontis	2cb4b0c781	ML_DSA: Fix partially uninitialised hint buffer. ... The encoded hint data consists of omega + k bytes. The bytes at the end of omega section of the buffer may be 0, so the buffer must be cleared initially. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26451)	2025-02-14 10:46:03 +01:00
slontis	df231a88ab	Add ML_DSA encoders ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26451)	2025-02-14 10:46:03 +01:00
slontis	fcffbbe192	ML-DSA fixups ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26127)	2025-02-14 10:46:03 +01:00
Viktor Dukhovni	a2391f3aa5	Add ML-DSA-44 and ML-DSA-87, fix endian issues & add fixups ... - Make data encoding work on big-endian systems. - Fix some ML-DSA-44 specific bugs related to w1-vector bits per-coefficient, overall size and high-bits rounding. - Use "do { ... } while (pointer < end)" style consistently. - Drop redundant reference counting of provided keys. - Add parameter blocks for ML-DSA-44 and ML-DSA-87 and turn on associated provider glue. These now pass both keygen and siggen tests (to be added separately). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26127)	2025-02-14 10:46:03 +01:00
slontis	3ab7409f3d	Add ML-DSA sign/verify ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26127)	2025-02-14 10:46:03 +01:00
slontis	efd7c96856	ML_DSA: Use pointers instead of arrays for polynomials in Vectors and Matrix. ... A DSA_KEY when created will alloc enough space to hold its k & l vectors and then just set the vectors to point to the allocated blob. Local Vectors and Matricies can then be initialised in a similar way by passing them an array of Polnomials that are on the local stack. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26127)	2025-02-14 10:46:03 +01:00
slontis	d3a7ae64b3	Add ML-DSA Keygen support ... The key generation algorithm requires a significant portion of the many algorithms present in FIPS 204. This work is derived from the BoringSSL code located at https://boringssl.googlesource.com/boringssl/+/refs/heads/master/crypto/mldsa/mldsa.cc Instead of c++ templates it uses an ML_DSA_PARAMS object to store constants such as k & l. To perform hash operations a temporary EVP_MD_CTX object is used, which is supplied with a prefetched EVP_MD shake128 or shake256 object that reside in the ML_DSA_KEY object. The ML_DSA_KEY object stores the encoded public and/or private key whenever a key is loaded or generated. A public key is always present if the private key component exists. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26127)	2025-02-14 10:46:03 +01:00
Bernd Edlinger	5949918f9a	Rework and simplify RCU code ... Use __ATOMIC_RELAXED where possible. Dont store additional values in the users field. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26690)	2025-02-13 20:23:48 +01:00
Bernd Edlinger	65787e2dc2	Revert "rcu: Ensure that updates to the ID field of a qp don't lose refs" ... This reverts commit fbd34c03e3. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26690)	2025-02-13 20:23:33 +01:00
Alexey Moksyakov	e4b899f53c	[vpsm4_ex][aarch64] Move constant to .rodata section ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Alexey Moksyakov	110f1afd12	[vpsm4][aarch64] Move constant to .rodata section ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Alexey Moksyakov	1e42e76dda	[sm3][aarch64] Move constant to .rodata section ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Alexey Moksyakov	85a8e97a76	[poly1305][aarch64] Extend address range by adrp + add ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Alexey Moksyakov	45579e8e58	[bsaes][aarch64] Move constant to .rodata section ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Alexey Moksyakov	15b011e0be	[chacha_sve][aarch64] Move constant to .rodata section ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Alexey Moksyakov	d5c208b610	[sm4][aarch64] Move constant to .rodata section ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26509)	2025-02-13 09:51:37 +01:00
Tomas Mraz	dfd177b776	ossl_rand_ctx_new(): Use OPENSSL_strdup instead of strdup ... Fixes Coverity 1642620 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26641)	2025-02-12 17:44:51 +01:00
Dr. David von Oheimb	b45e035bf7	X509_STORE_CTX_get1_issuer(): make happy path quicker again ... Fixes #26588 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26600)	2025-02-12 08:07:57 -05:00
Dr. David von Oheimb	5ebd6d26a8	x509_vfy.c: refactor parameter of get0_best_issuer_sk() and adapt its use by build_chain() ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26600)	2025-02-12 08:07:57 -05:00
Dr. David von Oheimb	c8932aa94f	http_client.c: fix error and default case handling in OSSL_HTTP_REQ_CTX_nbio() state machine ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25541)	2025-02-11 22:11:03 +01:00
Dr. David von Oheimb	64b478419a	http_client.c: fix OSSL_HTTP_REQ_CTX_nbio() to return content on non-fatal HTTP status code >=400 ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25541)	2025-02-11 22:10:43 +01:00
Dr. David von Oheimb	6de09ebe13	http_client.c: fix redirection in OSSL_HTTP_REQ_CTX_nbio() when non-ASN.1 content is expected ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25541)	2025-02-11 22:10:43 +01:00
Dr. David von Oheimb	efb621941a	http_client.c: distinguish better between request/response header and body, in particular when tracing ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25541)	2025-02-11 22:10:41 +01:00
Dr. David von Oheimb	91114d53b0	http_client.c,OSSL_HTTP_REQ_CTX.pod,http.h: fixups for PR #23781 on max_response_hdr_lines ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25541)	2025-02-11 22:09:40 +01:00
Simo Sorce	d037551ee3	Change also other DRBG's algorithm fetching ... - DRBG_HASH - DRBG_HMAC Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26542)	2025-02-11 21:48:15 +01:00
Simo Sorce	c9a2ce6111	Prefer DRBG ciphers from the same provider ... Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26542)	2025-02-11 21:48:15 +01:00
Matt Caswell	3cf15554f2	Add an API for other QUIC stacks to use our TLS implementation ... We provide some callbacks for third party QUIC stacks to use in order to be able to reuse the OpenSSL TLS implementation in that stack. This is essentially a thin wrapper around the same API that OpenSSL's own QUIC stack uses in order to integrate TLS. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26683)	2025-02-11 17:17:10 +00:00
Zhiguo Zhou	0f6a3b8ef6	Remove unnecessary flag clearance in crypto/x86_64cpuid.pl ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25751)	2025-02-10 15:14:33 +08:00
Zhiguo Zhou	b41e0bf168	Fix the checks of factor_size/modulus_bitsize ... The factor_size/modulus_bitsize are required to be 1024/1536/2048. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25751)	2025-02-10 15:14:33 +08:00
Zhiguo Zhou	c18b6f4c52	Dual 1024/1536/2048-bit exponentiation optimization for Intel Sierra Forest CPU ... It optimizes the RSA-2k/3k/4k via the AVXIFMA ISA on Sierra Forest. The performance improvements of 1.8x-2.2x are observed in the speed tests of sign and decryption operations on this CPU. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25751)	2025-02-10 15:14:33 +08:00
sashan	fd6f27bdd5	perlasm: Replace .previous with the actual previous section ... Older versions of darwin (10.8 and earlier) don't understand .previous. this tweak emits the previous section directive which preceeds the rodata (for example .text) instead of using .previous. We use the same for mingw. Fixes #26447 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26585)	2025-02-06 17:25:15 +01:00
Pauli	b1cca25999	Add support for random provider ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24498)	2025-02-05 07:20:22 +11:00
Pauli	4636a39503	Add RAND_set1_random_provider() API ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24498)	2025-02-05 07:20:10 +11:00
Pauli	37172e2ab8	Add a new provider API to generate random numbers. ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24498)	2025-02-05 07:20:10 +11:00
Kazuki Yamaguchi	aa52ec9b0a	Use ASN1_INTEGER_get_int64() in ossl_serial_number_print() ... A -1 return from ASN1_INTEGER_get() indicates both success and error. Our man page calls out this ambiguity. Use ASN1_INTEGER_get_int64() instead, which has a better error reporting and also a platform independent behavior with respect to sizeof(long). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26557)	2025-01-28 21:06:51 +01:00
Kazuki Yamaguchi	6f1dbaf7d2	Fix pretty-printing empty serial number in ossl_serial_number_print() ... Fix a crash when the ASN1_INTEGER has empty content. While it is illegal, this is the initial state of the serialNumber field when an X509 object is allocated by X509_new(). X509_print*() should be able to process an incomplete X509 object too. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26557)	2025-01-28 21:06:51 +01:00
Bartel Artem	93d366bea6	EVP_DigestSign(): Check pctx != NULL ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26551)	2025-01-28 21:03:46 +01:00
Josh Cooper	4f20de0c8a	Open pem files in binary mode ... In order to avoid an MSVCRT bug affecting ftell and text mode[1], open PEM files in binary mode. The PEM parser already handles CRLF translation[2]. [1] 8300a8742b [2] https://github.com/openssl/openssl/pull/24249#issuecomment-2192025429 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25716)	2025-01-28 20:57:14 +01:00
Josh Cooper	ed3ce75457	Revert "Work around Windows ftell() bug as per Microsoft engineering's suggestion" ... This reverts commit 8300a8742b. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25716)	2025-01-28 20:57:14 +01:00
Viktor Dukhovni	a69288d04a	Clarify docs of EVP_CIPHER*_get_block_size ... Also, tolerate NULL input ctx, just like NULL cipher. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26561)	2025-01-28 23:09:15 +11:00
Viktor Dukhovni	de578a8a6a	ossl_provider_prov_ctx is redundant ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26564)	2025-01-28 20:10:44 +11:00
Michael Baentsch	6ab286f9eb	Add version field check to PKCS8 decoder ... Fixes #26459 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26464)	2025-01-27 09:24:56 +01:00
Dmitry Belyavskiy	40c01d8ddc	Expanding trace of providers algorithms fetching/caching/etc ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26543)	2025-01-27 09:07:48 +01:00
Rajeev Ranjan	24b7c27250	Add function X509_VERIFY_PARAM_get_purpose() ... Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25132)	2025-01-27 08:57:30 +01:00
Rajeev Ranjan	0048817523	CMP: add support for central key generation ... - add testcase for central keygen - add documentation Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25132)	2025-01-27 08:56:46 +01:00
Frederik Wedel-Heinen	35b97122ea	Fixes some memory leaks when errors occur in ossl_cmp_rp_new(). ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26235)	2025-01-27 08:17:27 +01:00
Sean Kannanaikal	a59efbfc7e	Fix magic + 20 in PEM_ASN1_write_bio ... Fixes #26476 In the file crypto/pem/pem_lib.c the function had a +20 to account for padding in the data size, however this was recognized to not be up to standard quality. Instead it has now been updated to use the static maximum block size and uses that for the calculation as opposed to a +20. CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26526)	2025-01-24 17:14:39 +01:00
Frederik Wedel-Heinen	bd0a2e0c1e	Check returns of sk_X509_CRL_push and handle appropriately. ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26234)	2025-01-24 13:37:38 +01:00
Viktor Dukhovni	3a9e3b1fb0	Don't lose config infopairs of built-in providers ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26520)	2025-01-24 22:49:08 +11:00
Stas Cymbalov	7262c0bcc4	Fix data race in asn1_str2tag() on tntmp which was accidentally made static ... Variables tntmp and tnst are declared in the same declaration and thus share storage class specifiers (static). This is unfortunate as tntmp is used during iteration through tnst array and shouldn't be static. In particular this leads to two problems that may arise when multiple threads are executing asn1_str2tag() concurrently: 1. asn1_str2tag() might return value that doesn't correspond to tagstr parameter. This can happen if other thread modifies tntmp to point to a different tnst element right after a successful name check in the if statement. 2. asn1_str2tag() might perform an out-of-bounds read of tnst array. This can happen when multiple threads all first execute tntmp = tnst; line and then start executing the loop. If that case those threads can end up incrementing tntmp past the end of tnst array. CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26504)	2025-01-23 12:13:42 +01:00
Neil Horman	fbd34c03e3	rcu: Ensure that updates to the ID field of a qp don't lose refs ... ppc64le occasionally still fails the threadstest on __rcu_torture From several days of debugging, I think I've landed on the problem. Occasionally, under high load I observe the following pattern CPU0 CPU1 update_qp get_hold_current_qp atomic_and_fetch(qp->users, ID_MASK, RELEASE) atomic_add_fetch(qp->users, 1, RELEASE atomic_or_fetch(qp->users, ID_VAL++, RELEASE) When this pattern occurs, the atomic or operation fails to see the published value of CPU1 and when the or-ed value is written back to ram, the incremented value in get_hold_current_qp is overwritten, meaning the hold that the reader placed on the rcu lock is lost, allowing the writer to complete early, freeing memory before a reader is done reading any held memory. Why this is only observed on ppc64le I'm not sure, but it seems like a pretty clear problem. fix it by implementing ATOMIC_COMPARE_EXCHANGE_N, so that, on the write side in update_qp, we can ensure that updates are only done if the read side hasn't changed anything. If it has, retry the operation. With this fix, I'm able to run the threads test overnight (4000 iterations and counting) without failure. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26478)	2025-01-22 20:16:11 +01:00
Michael Baentsch	c81ff97866	Improve ASN1_TIME_print documentation and output ... This adds missing GMT indication when printing the local time as it is converted to the UTC timezone before printing. Also fixing the fractional seconds printing on EBCDIC platforms. Fixes #26313 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26344)	2025-01-22 11:28:31 +01:00
Viktor Dukhovni	e6855e1d79	Support boolean queries against provider config ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26455)	2025-01-22 14:52:26 +11:00
Alexey Moksyakov	908bc0994d	Revert "Move rodata to .rodata section for armv8" ... This reverts commit 5b36728d97. Issue #26458 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26498)	2025-01-21 18:21:19 +01:00
Julian Andres Klode	5261f3ca41	Restore correct registers in aarch64 AES-CTR code ... Commit 1d1ca79fe3 introduced save and restore for the registers, saving them as stp d8,d9,[sp, #16] stp d10,d11,[sp, #32] stp d12,d13,[sp, #48] stp d14,d15,[sp, #64] But the restore code was inadvertently typoed: ldp d8,d9,[sp, #16] ldp d10,d11,[sp, #32] ldp d12,d13,[sp, #48] ldp d15,d16,[sp, #64] Restoring [sp, #64] into d15,d16 instead of d14,d15. Fixes: #26466 CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26469)	2025-01-21 10:55:56 +01:00
Viktor Dukhovni	c374f79549	Move some encode helpers to crypt/encode_decode/ ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26487)	2025-01-21 20:09:57 +11:00
Viktor Dukhovni	1dafff06ca	Don't promise a non-zero return size in error cases. ... When a requested parameter has a non-NULL result pointer, and the error isn't simply that the result buffer is too small, don't return a non-zero result size. Returning a non-zero result size that isn't larger than the user's provided space is an indication that a result of that size was actually written, inviting trouble if the error indication was inadvertenly lost. Also, in such cases (wrong type, data can't be converted to the requested type when otherwise supported, ...) there is nothing useful to be done with the return size value, it can't help to address the problem. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26436)	2025-01-21 17:21:52 +11:00
Viktor Dukhovni	35f6e7ea02	Make the provider context available to encoders ... At the moment the provider context is only available to encoders that encrypt, but it is useful more generally. A similar change has already been merged to "master" on the decoder side, this is the mirror change for encoders. The only significant difference is that PEM_ASN1_write_bio needed to be "extended" (cloned) to allow it to pass the provider context down to the `k2d` function it uses to encode the data. I had to "hold my nose" and live with the random "20" added to the data size in order to accomodate encryption with padding, which may produce one more cipher block than the input length. This really should ask the EVP layer about the block length of the cipher, and allocate the right amount. This should be a separate fix for both the old PEM_ASN1_write_bio() and the new PEM_ASN1_write_bio_ctx(). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26475)	2025-01-21 17:19:07 +11:00
Tomas Mraz	63c40a66c5	Fix timing side-channel in ECDSA signature computation ... There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. Attacks on ECDSA nonce are also known as Minerva attack. Fixes CVE-2024-13176 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26429)	2025-01-20 09:30:48 +01:00
Dr. David von Oheimb	3294dcdbc2	fix X509_PURPOSE_add() to take |sname| as primary key and handle |id| in a backwd compat way for new purpose ... Fixes #25873 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26221)	2025-01-20 08:41:19 +01:00
Dr. David von Oheimb	b48ed24737	fix X509_PURPOSE_set() to support clearing the purpose requirement as needed for X509_VERIFY_PARAM_set_purpose() ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26221)	2025-01-20 08:41:02 +01:00
otherddn1978	3c7db9e0fd	If you call X509_add_cert with cert == NULL and the X509_ADD_FLAG_UP_REF ... flag, it will сrash to X509_up_ref. Passing NULL here is not valid, return 0 if cert == NULL. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26267)	2025-01-20 18:22:48 +11:00
Jonathan M. Wilbur	0d8cc7c699	feat: support the aAissuingDistributionPoint X.509v3 extension ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26174)	2025-01-17 18:39:24 +01:00
Viktor Dukhovni	38a0926528	Support CLI and API setting of provider configuration parameters ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26427)	2025-01-18 03:46:37 +11:00
Alexandr Nedvedicky	42aced5c9f	Work around to get llvm-mingw working on aarch64 ... It looks like llvm-mingw tool chain does not understand `.previous` asm directive (see https://sourceware.org/binutils/docs/as/Previous.html). As a workaround for win64 flavor (llvm-mingw toolchain) we let xlate to emit .text instead of emitting .previous. We also need to revisit usage of win64 flavor here in aarch64. We should perhaps introduce a mingw flavour on aarch64 as well. win assembly flavour should be used for microsoft assembler. Fixes #26415 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26428)	2025-01-17 17:43:39 +01:00
Alexey Moksyakov	5b36728d97	Move rodata to .rodata section for armv8 ... Adds missing files where asm code is generated by perl scripts and read only constant is used PR #24137 closes #23312 Signed-off-by: Alexey Moksyakov <yavtuk@yandex.ru> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26440)	2025-01-17 17:33:41 +01:00
onexyoung	8fb6c8154b	provider_deactivate(): Check return value of CRYPTO_atomic_add() ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26249)	2025-01-17 11:36:26 +01:00
Nikolay Nikolaev	b26894ec69	Workaround for RSA on AArch64 Big Endian ... 1064616012 introduced and optimized RSA NEON implementation for AArch64 architecture, namely Cortex-A72 and Neoverse N1. This implementation is broken in Big Endian mode, which is not widely used, therefore not properly verified. Here we disable this optimized implementation when Big Endian platform is used. Fixes: #22687 CLA: trivial Signed-off-by: Nikolay Nikolaev <nicknickolaev@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26257)	2025-01-15 17:52:29 +01:00
Peter Bierma	0b1d3ebb70	Remove non-existing error code. ... CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26389)	2025-01-15 16:22:39 +01:00
Peter Bierma	5b81f942d5	Synchronize openssl.txt with comperr.h ... CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26389)	2025-01-15 16:22:39 +01:00
sashan	8e69c18828	Finishing touch to perlasm update to make it work on OpenBSD ... This changeset brings a finishing touch to stuff we got from botovoq@ Changes to `crypto/perlasm/arm-xlate.pl` deal with verious assembler flavours to keep various assembler compilers happy. We also need to keep original code for 32-bit flavour in `crypto/aes/asm/aesv8-armx.pl`. Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24137)	2025-01-14 12:15:13 +01:00
Theo Buehler	c6e65c1f8e	Make it able to run asm code on OpenBSD (arm64) ... In order to get asm code running on OpenBSD we must place all constants into .rodata sections. The change to crypto/perlasm/arm-xlate.pl adjusts changes from Theo for additional assembler variants/flavours we use for building OpenSSL. Fixes #23312 Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24137)	2025-01-14 12:14:27 +01:00
Wang Xin	dd7a79fc6f	LoongArch: we should access global symbol by la.global instead of ... la.pcrel openssl will not be built successfully with binutils-2.43.50.20241230 which checks if global symbols are accessed by PC-relative in shared library. CLA: trivial Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26336)	2025-01-14 12:02:45 +01:00
Neil Horman	25f8e2c15b	Fix premature reuse of qp's in rcu locks ... An intermittent failure was noted on our new ppc64le CI runner, in which what appeared to be a corrupted or invalid value getting returned from a shared pointer under rcu protection Investigation showed that the problem was with our small number of qp's in a lock, and slightly incorrect accounting of the number of qp's available we were prematurely recycling qp's, which led in turn to premature completion of synchronization states, resulting in readers reading memory that may have already been freed. Fix it by: a) Ensuring that we account for the fact that the first qp in an rcu lock is allocated at the time the lock is created and b) Ensuring that we have a minimum number of 3 qp's: 1 that is free for write side allocation 1 that is in use by the write side currently 1 "next" qp that the read side can update while the prior qp is being retired With this change, the rcu threadstest runs indefinately in my testing Fixes #26356 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26384)	2025-01-13 17:13:48 -05:00
Viktor Dukhovni	b049ce0e35	Tweak case of [fs] variant letter in SLH-DSA algorithms ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26359)	2025-01-11 14:39:03 +11:00
Michael Baentsch	3cfcf820bd	Update error codes in "crypto/err/openssl.txt" ... Fixes #26316 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26330)	2025-01-09 15:44:18 +01:00
Richard Levitte	6a2472fb3e	Fix the use of OPENSSL_HTTP_PROXY / OPENSSL_HTTPS_PROXY ... Fixes #26337 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26340)	2025-01-09 12:03:52 +01:00
Frederik Wedel-Heinen	2457fc4816	Free data if sk_OPENSSL_STRING_push fails. ... Fixes #26203 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26227)	2025-01-08 11:25:30 +01:00
Frederik Wedel-Heinen	dfce0d7418	Return NULL from ossl_lib_ctx_get_concrete() when it is uninitialized ... When default_context_inited is set to false we return NULL instead of the global default context. Fixes #25442 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26319)	2025-01-08 11:18:13 +01:00
Frederik Wedel-Heinen	c626fda8a6	Check returns of various sk_*_push functions ... Check returns of sk_POLICY_MAPPING_push, sk_GENERAL_NAME_push, sk_ACCESS_DESCRIPTION_push, sk_X509_push, sk_X509_NAME_push, sk_OPENSSL_CSTRING_push, sk_SCT_push, sk_DIST_POINT_push, sk_OSSL_CMP_CRLSTATUS_push, sk_ASN1_UTF8STRING_push and sk_ASN1_OBJECT_push and handle appropriately. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26240)	2025-01-08 11:11:00 +01:00
Frederik Wedel-Heinen	3ffa64cd45	Pass functions with correct signatures to the evp_generic_fetch_xxx methods ... UBSan complains about functions being called with incorrect signatures. Relates to #22896 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26318)	2025-01-07 21:24:13 +01:00
Viktor Dukhovni	d31fce1972	Some PQ-related CSOR OIDs ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26321)	2025-01-07 23:01:44 +11:00
Niels Dossche	f822a48668	Fix potential memory leak in PKCS12_add_key_ex() ... p8 is allocated using EVP_PKEY2PKCS8(), but when PKCS8_add_keyusage() fails this memory is not freed. Fix this by adding a call to PKCS8_PRIV_KEY_INFO_free(). Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25818)	2025-01-06 21:32:50 +01:00
Job Snijders	2e36bb07b5	Clean up ASN1_STRING comment and improve example in docs ... Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26195)	2025-01-06 20:39:22 +01:00
Jakub Zelenka	894e69e747	Fix CMS encryption with key agreement when originator set ... OpenSSL currently does not support encryption with originator flag so it should fail nicely instead of segfaulting. Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26014)	2025-01-06 11:45:02 +01:00
Jonathan Swinney	ebe34f9a62	Optimize x86/aarch64 MD5 implementation ... As suggested in https://github.com/animetosho/md5-optimisation?tab=readme-ov-file#dependency-shortcut-in-g-function, we can delay the dependency on 'x' by recognizing that ((x & z) | (y & ~z)) is equivalent to ((x & z) + (y + ~z)) in this scenario, and we can perform those additions independently, leaving our dependency on x to the final addition. This speeds it up around 5% on both platforms. Signed-off-by: Oli Gillespie <ogillesp@amazon.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Hugo Landau <hlandau@devever.net> (Merged from https://github.com/openssl/openssl/pull/25737)	2025-01-06 11:43:36 +01:00
Frederik Wedel-Heinen	65db21935a	Avoid leaking memory when realloc fails ... In ossl_property_merge() we can drop the realloc because it just makes the allocation smaller. In quic-hq-interop.c we check the realloc result. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26244)	2025-01-03 15:58:26 +01:00
Jonathan M. Wilbur	9598bc15e9	feat: support the allowedAttributeAssignments X.509v3 extension ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26163)	2025-01-02 20:06:59 +01:00
Niels Dossche	32476957ea	Fix potential memory leak in BIO_get_accept_socket() ... When BIO_parse_hostserv() fails it may still have allocated memory, yet this memory is not freed. Fix it by jumping to the err label. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25817)	2025-01-02 14:06:51 +01:00
Tomas Mraz	0baa3ac736	core_namemap.c: Use OPENSSL_STRING instead of defining STRING type ... Also avoid leak if stack push fails. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26230)	2024-12-31 15:03:13 +01:00
ryuishii	5b33d3e158	X509_ACERT_sign_ctx(): Remove superfluous reference ... CLA: trivial Fixes #26107 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26120)	2024-12-26 19:40:54 +01:00
Peter Juhasz	34ea176abf	Add CMS_NO_SIGNING_TIME flag to CMS_sign(), CMS_add1_signer() ... Previously there was no way to create a CMS SignedData signature without a signing time attribute, because CMS_SignerInfo_sign added it unconditionally. However, there is a use case (PAdES signatures) where this attribute is not allowed, so this commit introduces a new flag to the CMS API that causes this attribute to be omitted at signing time. Also add -no_signing_time option to cms command. Fixes #15777 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15783)	2024-12-26 19:33:42 +01:00
Jonathan M. Wilbur	93b5275f6b	feat: support the attributeMappings X.509v3 extension ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26157)	2024-12-23 09:58:15 +00:00
Dmitry Belyavskiy	b3bb214720	Take into account no_store when pushing algorithm ... When we put algorithm to the store, we have a fallback to the OSSL_LIB_CTX level store when store is NULL. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26197)	2024-12-20 18:20:17 +01:00
Andrey Tsygunka	bf2dea0e2c	ossl_i2c_ASN1_BIT_STRING(): Fix a possible heap buffer overflow ... When data contains only zero values a buffer overflow happens. CLA: trivial Signed-off-by: Andrey Tsygunka <aitsygunka@yandex.ru> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26190)	2024-12-20 09:47:34 +01:00
otherddn1978	82e7a1130a	Check whether ctx->pctx != NULL ... If it is NULL, ctx->pctx->pmeth dereference will cause a crash. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26176)	2024-12-17 14:53:14 +01:00
Ramkumar	ef7967d0b4	feat: add EVP APIs for cipher pipelining ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24636)	2024-12-17 11:59:32 +00:00
Tomas Mraz	79c9cbbe1f	Fix breakage on arm64_32 platforms ... We just avoid the special handling needed for Apple M1. Fixes #26135 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/26145)	2024-12-13 15:05:21 +01:00
Elizarova, Alina	acc2655236	Extension of OPENSSL_ia32cap to accommodate additional CPUID bits ... bits 128 - 191 CPUID.(EAX=07H,ECX=0H).EDX and CPUID.(EAX=07H,ECX=1H).EAX bits 192 - 255 CPUID.(EAX=07H,ECX=1H).EDX and CPUID.(EAX=07H,ECX=1H).EBX bits 256 - 319 CPUID.(EAX=07H,ECX=1H).ECX and CPUID.(EAX=24H,ECX=0H).EBX Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25709)	2024-12-13 14:51:22 +01:00
Jonathan M. Wilbur	70b17e5a00	feat: support the timeSpecification X.509v3 extension ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25476)	2024-12-11 18:26:37 +01:00
Shakti Shah	02e72ccffa	dh_cms_set_peerkey(): Fix the incorrect condition ... Only absent parameters allowed in RFC 3370. Fixes #25824 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26058)	2024-12-11 18:03:34 +01:00
Tomas Mraz	d992e8729e	Add function to mix in an additional input into a RAND_POOL ... It will be just xor-ed over the existing entropy in the pool. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26128)	2024-12-10 19:04:29 +01:00
Neil Horman	dc10ffc283	Fix potential use-after-free in REF_PRINT_COUNT ... We use REF_PRINT_COUNT to dump out the value of various reference counters in our code However, we commonly use this macro after an increment or decrement. On increment its fine, but on decrement its not, because the macro dereferences the object holding the counter value, which may be freed by another thread, as we've given up our ref count to it prior to using the macro. The rule is that we can't reference memory for an object once we've released our reference, so lets fix this by altering REF_PRINT_COUNT to accept the value returned by CRYPTO_[UP|DOWN]_REF instead. The eliminates the need to dereference the memory the object points to an allows us to use the call after we release our reference count Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25664)	2024-12-10 14:58:08 +01:00
Tomas Mraz	c4b30d9c6d	ossl_cms_get1_crls_ex(): Avoid doublefree if CRL up ref fails ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/26100) (cherry picked from commit ef0be53f90)	2024-12-10 10:52:54 +01:00
Tomas Mraz	e2ffc9e7d0	Revert the behavior change of CMS_get1_certs() and CMS_get1_crls() ... Fixes #26079 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/26100) (cherry picked from commit afd36cbef8)	2024-12-10 10:52:52 +01:00
willmafh	2e407ea5c6	Code & comments changes to make them in consistent ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)	2024-12-06 15:27:51 +01:00
willmafh	df6a69a850	one more empty line for code style consistency ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)	2024-12-06 15:27:51 +01:00
willmafh	8a74ed5619	Change all one's complement to ones' complement for consistency ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)	2024-12-06 15:26:36 +01:00
willmafh	a1f07a0049	BN_secure_new function indentation correction ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)	2024-12-06 15:26:36 +01:00
willmafh	c77d9fcf8e	Delete redundant parentheses for code consistency ... CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26095)	2024-12-06 15:26:27 +01:00
Joachim Vandersmissen	04812ed1de	fips: zeroization of ECX public keys ... Commit fa338aa7cd added zeroization of public security parameters as required by ISO 19790:2012/Cor.1:2015 7.9. However, that commit overlooked ECX keys, which are used for EdDSA and X25519/X448. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25807)	2024-12-03 10:37:14 +01:00
Tomas Mraz	f2348f1f84	Avoid NULL dereference with PKCS7_OP_SET_DETACHED_SIGNATURE ... We would dereference p7->d.sign pointer which can be NULL. Reported by Han Zheng. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26078)	2024-12-02 09:44:58 +01:00
slontis	79c98fc6cc	Fix EVP_PKEY_print_private() so that it works with non default providers. ... At some point in time it was decided that the EC keymanagers ec_export() function would only allow the selection to be both the public + private parts. If just the private element is selected it returns an error. Many openssl commandline apps use EVP_PKEY_print_private() which passes EVP_PKEY_PRIVATE_KEY to the encoder. This selection propagates to encoder_construct_pkey(). For external providers (such as the fips provider this will call the keymanagers export() with the selection set to just the private part. So we either need to 1) change the selection in EVP_PKEY_print_private() or 2) modify the selection used in the export used in encoder_construct_pkey 3) Change the ec_export to allow this. I have chosen 2) but I am not sure if this is the correct thing to do or whether it should conditionally do this when the output_type == 'text'. Issue was reported by Ilia Okomin (Oracle). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26004)	2024-11-29 17:11:23 +01:00
Neil Horman	4c04a19860	Fix solaris build in CRYPTO_atomic_store api ... Misnamed variable, just correct it to dst Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26075)	2024-11-29 12:08:10 +01:00
sftcd	740668f0b5	Use static array (length 256) for copy of OPENSSL_MALLOC_FAILURES ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26039)	2024-11-28 17:01:28 +01:00
Tomas Mraz	0bba821881	Deprecate all BIO_meth_get_*() functions ... Their use by applications is inherently unsafe. Fixes #26047 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/26056)	2024-11-28 16:48:43 +01:00
Niels Dossche	a64d26ac02	Use sk_X509_ATTRIBUTE_deep_copy() to copy attribute stacks in pk7_doit.c ... Clean up the code by using the dedicated stack copy function. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25713)	2024-11-28 15:27:08 +01:00
Pauli	e73c1faa53	rsa: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)	2024-11-28 15:13:35 +01:00
Pauli	de22c10b97	ffc: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)	2024-11-28 15:13:35 +01:00
Pauli	f471061721	ec: change FIPS zeroization to use the OPENSSL_PEDANTIC_ZEROIZATION define ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26068)	2024-11-28 15:13:35 +01:00
Tom Cosgrove	ea5817854c	Enable AES and SHA3 optimisations on Apple Silicon M4-based macOS systems ... AES gets a performance enhancement of 7-33%. Tested on an M4 Pro, but the CPU cores are the same on M4 and M4 Max. Change-Id: I634c03f1d2b50fa5f8ca97dd65975e49d970c72b Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/25940)	2024-11-22 14:56:04 +01:00
Peiwei Hu	8baf61d51b	Fix wrong return value checks for some functions ... - in particular in use of X509_LOOKUP_load_file, EVP_PKEY_print_params, EVP_PKEY_keygen, X509_CRL_add1_ext_i2d, EVP_PKEY_keygen_init Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)	2024-11-22 12:10:26 +01:00
Peiwei Hu	1273fae170	Fix multiple wrong checks of EVP_PKEY_set1_encoded_public_key ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25811)	2024-11-22 12:09:38 +01:00
Kai Pastor	e131868678	Mark OPENSSL_armcap_P .hidden in arm asm ... Fixes #25601 Fixes #22414 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22181)	2024-11-22 11:22:00 +01:00
Tomas Mraz	93bfe97c5b	sm2_sig_verify(): Do not call BN_CTX_end() without BN_CTX_start() ... In case of memory allocation failure this could happen. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25994)	2024-11-21 11:13:56 +01:00
wangcheng	4c41aa4b33	Add CTX copy function for EVP_MD to optimize the performance of EVP_MD_CTX_copy_ex. ... 1. Add OSSL_FUNC_digest_copyctx_fn function for EVP_MD, which is used to copy algctx from the old EVP_MD_CTX to the new one. 2. Add implementation of OSSL_FUNC_digest_copyctx_fn function for default providers. 3. Modify EVP_MD_CTX_copy_ex: When the fetched digest is the same in in and out contexts, use the copy function to copy the members in EVP_MD_CTX if the OSSL_FUNC_digest_copyctx_fn function exists. Otherwise, use the previous method to copy. 4. Add documentation for OSSL_FUNC_digest_copyctx function in doc/man7/provider-digest.pod. 5. Add testcase. Fixes #25703 Signed-off-by: wangcheng <bangwangnj@163.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25726)	2024-11-20 14:12:53 +01:00
Dr. David von Oheimb	9ca66fc273	x509_vfy.c and x509_lu.c: refactor find_issuer(), X509_STORE_CTX_get1_issuer(), etc. ... Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18762)	2024-11-20 12:48:24 +01:00