653 Commits

Author	SHA1	Message	Date
openssl-machine	486805eb19	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-30 13:03:21 +00:00
Jakub Jelen	ae87f1c32e	doc: Add missing commas ... CLA: trivial Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28493) (cherry picked from commit 1199882de6)	2025-09-11 16:04:19 +10:00
openssl-machine	e9d98629ed	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 12:04:53 +00:00
Tomas Mraz	9d3fc3caa2	Document that FIPS provider cannot be used by multiple libcryptos ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27702) (cherry picked from commit 08b2042a20)	2025-05-30 08:09:35 +10:00
Norbert Pocs	254bce41f2	Document EVP_CIPHER failure for missing provider function ... When writing a new CIPHER implementation the OSSL_FUNC_cipher_get_params must be present, otherwise the fetch fails. This behaviour is seen in function evp_cipher_cache_constants@crypto/evp/evp_lib.c. Resolves: #25801 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27696) (cherry picked from commit 3423c30db3)	2025-05-28 10:36:25 +02:00
Christian Wansart	3a687986ad	Typo in TLS introduction ... CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27455) (cherry picked from commit 9eb2c13432)	2025-04-23 11:22:14 +02:00
Dr. David von Oheimb	77e6bf0f20	provider-signature.pod: fix typos (digeset -> digest) ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27372) (cherry picked from commit 7d14d1c46a)	2025-04-18 15:41:05 +01:00
Dr. David von Oheimb	fc76ef9108	provider-signature.pod: fix doc of OSSL_SIGNATURE_PARAM_ALGORITHM_ID, describing its relevance ... This provides a fix for the documentation part of #22932. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27372) (cherry picked from commit 23e3b3c0c5)	2025-04-18 15:41:05 +01:00
Mironenko	8f7f53da4e	Fix OSSL_FUNC_keymgmt_load declaration in man7/provider-keymgmt ... OSSL_FUNC_keymgmt_load prototype declared in man7 does not match the actual OSSL_FUNC_keymgmt_load prototype declared in include/openssl/core_dispatch.h. This commit fixes the prototype in man7. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27189) (cherry picked from commit ada231523f)	2025-04-16 09:50:40 +01:00
Richard Levitte	a0a3a99e46	In doc/man7/provider-{en,de}coder.pod, clarify where properties are defined ... Fixes #27126 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27132) (cherry picked from commit a006b0a089)	2025-03-26 14:05:26 +01:00
Jon Ericson	55fb1f23c5	Change documentation to point to new wiki location ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27081) (cherry picked from commit da8de0e8dd)	2025-03-25 20:25:46 +01:00
Pauli	5264f24a5e	doc: document that the FIPS provider doesn't support deterministic ECDSA sigs ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26880) (cherry picked from commit 53c54b13ac)	2025-02-25 10:42:14 +01:00
openssl-machine	45e2b27630	Copyright year updates ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-02-11 14:36:52 +00:00
Richard Levitte	5a673cc9e7	Fix documentation of OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION ... This drops OSSL_PKEY_PARAM_IMPLICIT_REJECTION - which is a meaningless name - everywhere apart from still existing (for API stability, in case someone uses that macro). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26421) (cherry picked from commit 1df07c761b)	2025-01-17 18:55:18 +01:00
Michael Baentsch	52ddc94db9	Improve documentation about duplicate algorithm registrations ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25624) (cherry picked from commit 37aa1143c3)	2024-10-23 15:12:26 +02:00
Dr. David von Oheimb	bd25f5e127	improve and move text on OPENSSL_TRACE from doc/man1/openssl.pod to doc/man7/openssl-env.pod ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25540) (cherry picked from commit ee0bf38e87)	2024-10-09 12:11:22 +02:00
Dimitri John Ledkov	67f36a8fb6	doc: EVP_KDF document the semantic meaning of output ... Explicitely document what semantic meaning do various EVP_KDF algorithms produce. PBKDF2 produces cryptographic keys that are subject to cryptographic security measures, for example as defined in NIST SP 800-132. All other algorithms produce keying material, not subject to explicit output length checks in any known standards. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25610) (cherry picked from commit 6f08353a4b)	2024-10-08 16:06:29 +02:00
Vladimir Kotal	23d307f01b	document the format of DSA signature ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23762) (cherry picked from commit e7abc2118f)	2024-09-23 22:37:33 +02:00
Michael Baentsch	fd055ddc40	document provider dependency handling ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24884) (cherry picked from commit e8498dc645)	2024-09-11 09:33:58 +02:00
Tomas Mraz	5fca53d7ba	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-09-03 14:50:21 +02:00
Clemens Lang	2ae3b711f3	doc: Document properties param for Argon2 KDF ... The Argon2 KDF uses OSSL_KDF_PARAM_PROPERTIES to fetch implementations of blake2bmac and blake2b512 if ctx->mac and ctx->md are NULL. This isn't documented in the manpage, so users that might, for example, want to fetch an instance of Argon2 with the -fips property query to obtain a working Argon2 KDF even though the default property query requires fips=yes are left wondering why this fails. Fortunately, EVP_KDF(3)/PARAMETERS already explains what the properties are used for, so we really just need to add a single line. Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25306) (cherry picked from commit 6772c2ab1b)	2024-08-29 19:20:36 +02:00
Tomas Mraz	ff9c48be5e	EVP_PKEY-DH.pod: Clarify the manpage in regards to DH and DHX types ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/24819) (cherry picked from commit cf3d65b866)	2024-07-17 16:39:22 +02:00
Tomas Mraz	9f1c127eba	Document that DH and DHX key types cannot be used together in KEX ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/24819) (cherry picked from commit 45611a8a89)	2024-07-17 16:39:20 +02:00
Et7f3	a366b1036d	ossl_store.pod: Correct the example of OSSL_STORE API usage ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24056) (cherry picked from commit d5412c94a3)	2024-06-19 18:57:45 +02:00
Tomas Mraz	91bcb1668d	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-06-04 14:58:30 +02:00
Hubert Kario	6ffb2f0fc2	Be more explicit about RSAES-PKCS#1v1.5 error handling ... And add a note how to perform side-channel free error stack handling. Signed-off-by: Hubert Kario <hkario@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24159) (cherry picked from commit 9816127463)	2024-04-22 15:57:45 +02:00
slontis	cdc5608e8d	Fix migration guide mappings for i2o/o2i_ECPublicKey ... Fixes #23854 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24041) (cherry picked from commit 6594baf645)	2024-04-19 14:31:14 -04:00
Richard Levitte	83ba6e90e0	OSSL_STORE: Add reference docs for the built-in Windows store implementation ... Fixes openssl/project#422 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24170) (cherry picked from commit faa4a10ebe)	2024-04-19 14:23:40 +02:00
Neil Horman	7d2c8fc3be	Add docs noting requirements for SM2 signing ... Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23887) (cherry picked from commit 4feb4a2b2c)	2024-04-09 20:42:02 +02:00
Tomas Mraz	be933cb742	Document the implications of setting engine-based low-level methods ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23063) (cherry picked from commit dbb478a51d)	2024-01-31 18:40:58 +01:00
Matt Caswell	1460485811	Copyright year updates ... Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes	2024-01-30 13:13:27 +00:00
James Muir	8d07eedf49	doc: "digest" must be explicitly set with deterministic ECDSA/DSA ... Fixes #23205 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23250) (cherry picked from commit ff7b32e1d7)	2024-01-11 10:15:33 +01:00
rilysh	8a843dc19b	provider-keymgmt.pod: fix typo ... Fix a typo from asymmmetric to asymmetric CLA: trivial Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23164) (cherry picked from commit cf8fea86f7)	2024-01-03 13:14:46 +01:00
Neil Horman	0f973b9a9b	gate calling of evp_method_id on having a non-zero name id ... If a name is passed to EVP_<OBJ>_fetch of the form: name1:name2:name3 The names are parsed on the separator ':' and added to the store, but during the lookup in inner_evp_generic_fetch, the subsequent search of the store uses the full name1:name2:name3 string, which fails lookup, and causes subsequent assertion failures in evp_method_id. instead catch the failure in inner_evp_generic_fetch and return an error code if the name_id against a colon separated list of names fails. This provides a graceful error return path without asserts, and leaves room for a future feature in which such formatted names can be parsed and searched for iteratively Add a simple test to verify that providing a colon separated name results in an error indicating an invalid lookup. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/23110) (cherry picked from commit 94be985cbc)	2024-01-01 13:28:36 -05:00
Dimitri Papadopoulos	e0f47f88c7	Fix typos found by codespell in man pages ... Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23131) (cherry picked from commit 7deb2b433a)	2023-12-29 10:14:25 +01:00
Tomas Mraz	782a34f76f	AES: Document that the XTS, SIV, WRAP modes do not support streaming ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23028) (cherry picked from commit 8f0f814d79)	2023-12-22 13:43:15 +01:00
Tomas Mraz	141a7389c7	SM4: Document that the XTS mode does not support streaming ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23028) (cherry picked from commit e2f9c2dd37)	2023-12-22 13:43:13 +01:00
Dr. David von Oheimb	ee57bf338f	provider-storemgmt.pod: fix nits (unclosed '<' around name) ... Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22942) (cherry picked from commit a149e8e108)	2023-12-12 19:52:26 +01:00
Matthias St. Pierre	250990ea8e	doc: improve documentation of EVP in-place encryption ... The EVP interface explicitly allows in-place encryption/decryption, but this fact is just 'partially' documented in `EVP_EncryptUpdate(3)` (pun intended): the manual page mentions only operation failure in case of 'partial' overlaps. This is not even correct, because the check for partially overlapping buffers is only implemented in legacy code paths. Currently, in-place encryption/decryption is only documented for RSA (`RSA_public_encrypt(3)`) and DES (`DES_ecb_encrypt(3)`), as well as in the provider interface (`provider-cipher(7)`). This commit amends `EVP_EncryptUpdate(3)` and `provider-cipher(7)` to make the front-end and back-end documentation consistent. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22875) (cherry picked from commit 6ebdbba76a)	2023-12-12 10:42:45 +01:00
James Muir	53f203cbae	doc: improve display of KECCAK-KMAC128, KECCAK-KMAC256 defs ... Do not allow mid-expression line breaks. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22814) (cherry picked from commit 8da20b30da)	2023-12-04 09:34:41 +01:00
James Muir	873a7cff0e	rsa-doc: fix typo ... "d_i in RFC8017" -> "d_i" in RFC8017 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22868) (cherry picked from commit c89b553bdc)	2023-12-01 10:32:03 +01:00
Jamie Cui	115d21eea4	Fix EVP_RAND-SEED-SRC documentation example ... Fixes #22810 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22857) (cherry picked from commit 58d926213f)	2023-11-30 12:34:06 +01:00
Richard Levitte	8bee92a801	Copyright year updates ... Reviewed-by: Hugo Landau <hlandau@openssl.org> Release: yes	2023-11-23 14:18:06 +01:00
James Muir	5647960dd5	doc: fix description of mac "block-size" parameter ... The macro for "block-size" is OSSL_MAC_PARAM_BLOCK_SIZE, and this parameter is not settable. Refer to the "customization string" rather than the "custom value" (in the Blake2 spec, this is called the personalization string). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22763) (cherry picked from commit 1750689767)	2023-11-22 10:52:39 +01:00
James Muir	09adcb0bd5	doc: better description of KECCAK-KMAC XOF ... KECCAK-KMAC-128 and KECCAK-KMAC-256 are extendable output functions that have been defined because they are convenient for implementing KMAC. Give definitions for them so that users aren't left to figure that out themselves. KECCAK-KMAC-128 is very similar to SHAKE-128, and KECCAK-KMAC-256 is very similar to SHAKE-256. Related to #22619. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22755) (cherry picked from commit f1bea887ef)	2023-11-22 10:49:11 +01:00
Matt Caswell	fb61722e9d	Update the provider documentation ... Make the documentation match reality. Add lots of missing algorithms. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22694) (cherry picked from commit ae14f38cc9)	2023-11-22 10:45:30 +01:00
Neil Horman	3b866985ba	augment quic demos to support ipv4/6 connections ... Because the quicserver utility supports expressly listening in ipv4/6 mode, its possible/likely that the server will listen on an ipv4 address, while the clients will connect via ipv6, leading to connection failures. Augment quic demo clients to afford them the same -6 option that the server has so that connection family can be co-ordinated Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22577) (cherry picked from commit 5091aadc22)	2023-11-21 13:07:00 +01:00
Tomas Mraz	aa95fb1400	Properly limit the variable output size for BLAKE2 ... The upper limit of the output size is the default output size of the algorithm. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22661)	2023-11-13 12:29:28 +01:00
Dmitry Belyavskiy	076d4750c8	Use proper KDF SS parameter name ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22636) (cherry picked from commit 1c6a379754)	2023-11-07 12:09:37 +00:00
Michael Hinz	b4081e6ca4	Fix documentation regarding KMAC sizes ... As per recommendation by jfinkhaeuser, this documents the defaults for KMAC-128 as 32 and for KMAC-256 as 64. The code already accomodates for these values, so no changes are needed there. Fixes #22381 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22614) (cherry picked from commit 56d1ab3b6c)	2023-11-06 07:49:42 +00:00