950 Commits

Author	SHA1	Message	Date
openssl-machine	486805eb19	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-30 13:03:21 +00:00
Tomas Mraz	abf150f966	krb5kdf.c.in: Check the key size before applying the key ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28663) (cherry picked from commit 3addc8bb3a)	2025-09-26 12:55:04 -04:00
Viktor Dukhovni	05c3778af4	Harden RSA public encrypt ... Check the that the indicated output buffer length is large enough. Fix EVP_SealInit() to initialise the output buffer length to the RSA modulus length, not the input KEK length. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28538)	2025-09-16 10:36:56 -04:00
Pauli	c54f56cedf	hmac: stop using secure memory for the HMAC key ... Secure memory is design for long term storage of private material. HMAC keys are not this. Secure memory use was introduced in July 2020 by commit 3fddbb264e. Fixes #28346 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28412) (cherry picked from commit 8e3c76085f)	2025-09-07 17:20:14 +10:00
Niels Dossche	9e8eaa2cfc	Make error checks on RSA_public_decrypt() consistent ... Some are only checking for a value < 0, some for <= 0, some for == 0, etc. The documentation tells us that -1 is returned on error, so at least the == 0 ones are wrong. In general, the return values are checked inconsistently. This patch makes the return value checks consistent to the form that seems to occur most. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28306) (cherry picked from commit 3e2f54a718)	2025-08-21 20:05:26 +02:00
Alen Yan	ace1418bd9	fix SM2 privatekey decode(PEM format, ECPrivateKey). ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27963) (cherry picked from commit bd172dd0e1)	2025-07-25 09:51:33 +02:00
openssl-machine	e9d98629ed	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 12:04:53 +00:00
Matt Caswell	d5b5c328fd	Allow our *_gen_cleanup functions to tolerate a NULL ctx ... Our *_gen_cleanup functions are essentially "free" functions. Our free functions tolerate NULL being passed. We are being inconsistent with our *_gen_cleanup functions. Some of them tolerate NULL and others do not. We should consistently tolerate NULL. See also #27795 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27813) (cherry picked from commit 743bae4a22)	2025-06-14 10:44:17 -04:00
Bartel Artem	6c93fa3919	return NULL if gctx allocation fails. ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27795) (cherry picked from commit 443298e0f0)	2025-06-12 08:57:20 -04:00
Bartel Artem	5d411df55c	check gctx for NULL before cleanup. ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27795) (cherry picked from commit 02f9c9342d)	2025-06-12 08:55:05 -04:00
Ingo Franzki	3eae15c0b4	Silence -Wstringop-overflow warnings with gcc 14 on s390x ... Compiling OpenSSL on s390x with gcc 14 (i.e. in Fedora 41) shows several -Wstringop-overflow warnings in providers/implementations/rands/drbg_ctr.c and test/params_api_test.c. Add explicit length checks to let the compiler know that it won't overrun the buffer. This also silences the warnings. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27710) (cherry picked from commit 9a788281d9)	2025-06-10 19:49:57 +02:00
Daniel Van Geest	b482ce42e4	Fix SHAKE AlgorithmIdentifier encodings ... NIST CSOR specifies that the id-shake128 and id-shake256 algorithm identifiers, like the SHA-3 ones, do not carry any parameters. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27190) (cherry picked from commit bef03c6a24)	2025-06-10 19:42:31 +02:00
Pauli	64cd33b56e	rand: fix memory overrun bug ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27766) (cherry picked from commit da585e214c)	2025-06-09 10:27:57 +02:00
Pauli	406007f0c0	chacha_poly: fix settable ctx param list ... The settable list used the generic AEAD cipher list which included an extra parameter and omitted the IV length one. The set ctx param call was custom so the errant list didn't directly impact operation. The comment about ignoring OSSL_CIPHER_PARAM_AEAD_MAC_KEY is completely bogus. That parameter isn't accepted either here or by the shared AEAD cipher params. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27534) (cherry picked from commit 1c63382294)	2025-05-09 08:16:54 +10:00
Pauli	a501e9df15	hkdf: allow salt to be set to null ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27305) (cherry picked from commit 12eb6c58ff)	2025-04-18 15:34:09 +01:00
slontis	8fdc75777e	Fix Strict c issue in aes_gcm for armv8 ... Reported by David Makepeace Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27203) (cherry picked from commit 0a78595eac)	2025-04-01 11:38:42 +02:00
Martin Oliveira	cb0cada73b	Fix gettable_params() for ECX ... The OSSL_PKEY_PARAM_MANDATORY_DIGEST parameter is only handled by the ed25519_get_params() and ed448_get_params(). The x25519 and x448 versions of get_params() always ignore that parameter, so it should not be in the list of gettable params. Fixes: 1a7328c882 ("PROV: Ensure that ED25519 & ED448 keys have a mandatory digest") cla: trivial Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27043) (cherry picked from commit 482d3f9338)	2025-03-19 10:56:11 +01:00
openssl-machine	45e2b27630	Copyright year updates ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-02-11 14:36:52 +00:00
Tomas Mraz	0a90fca2ce	eddsa_signverify_init(): Avoid memory leak on error ... Add missing WPACKET_cleanup() call. Fixes Coverity 1638693 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26500) (cherry picked from commit abbc407314)	2025-01-23 12:12:03 +01:00
Tomas Mraz	33854e7512	mac_legacy_kmgmt.c: Avoid possible memory leak on error ... Use mac_gen_cleanup() instead of just freeing the gctx. Fixes Coverity 1638702 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26500) (cherry picked from commit 2455ef2112)	2025-01-23 12:11:58 +01:00
Tomas Mraz	f49e56066a	kdf_scrypt_reset(): NULLify freed pointers ... Otherwise doublefree happens with further usage. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26488) (cherry picked from commit 901b108154)	2025-01-23 12:08:06 +01:00
Tomas Mraz	267276932f	scrypt: Do not free the context itself when fetch fails ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26488) (cherry picked from commit 2dded72022)	2025-01-23 12:08:04 +01:00
Зишан Мирза	32203fd307	ec_kem.c: Fix ikmlen check ... This makes `ikmlen` have a length of at least `Nsk`. Closes #26213 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26254) (cherry picked from commit c93f4a1e75)	2024-12-30 17:14:40 +01:00
Niels Dossche	992c998aed	Fix potential memory leak on failure of ecx_gen_init() ... When ecx_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_KDF_PARAM_PROPERTIES already in gctx->propq, leading to a memory leak. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26015) (cherry picked from commit 98be2e8fb6)	2024-11-25 15:18:50 +01:00
Niels Dossche	cb606db0ab	Fix potential memory leak on failure of dsa_gen_init() ... When dsa_gen_set_params() returns 0, it could have duplicated the memory for the parameter OSSL_PKEY_PARAM_FFC_DIGEST already in gctx->mdname, leading to a memory leak. Allocated here: 47a80fd203/providers/implementations/keymgmt/dsa_kmgmt.c (L524) Can return 0 here: 47a80fd203/providers/implementations/keymgmt/dsa_kmgmt.c (L529-L536) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26016) (cherry picked from commit d7e8f6f781)	2024-11-25 15:14:27 +01:00
Taylor R Campbell	24a0aa4591	Avoid undefined behaviour with the <ctype.h> functions. ... fix https://github.com/openssl/openssl/issues/25112 As defined in the C standard: In all cases the argument is an int, the value of which shall be representable as an unsigned char or shall equal the value of the macro EOF. If the argument has any other value, the behavior is undefined. This is because they're designed to work with the int values returned by getc or fgetc; they need extra work to handle a char value. If EOF is -1 (as it almost always is), with 8-bit bytes, the allowed inputs to the ctype.h functions are: {-1, 0, 1, 2, 3, ..., 255}. However, on platforms where char is signed, such as x86 with the usual ABI, code like char *p = ...; ... isspace(*p) ... may pass in values in the range: {-128, -127, -126, ..., -2, -1, 0, 1, ..., 127}. This has two problems: 1. Inputs in the set {-128, -127, -126, ..., -2} are forbidden. 2. The non-EOF byte 0xff is conflated with the value EOF = -1, so even though the input is not forbidden, it may give the wrong answer. Casting char inputs to unsigned char first works around this, by mapping the (non-EOF character) range {-128, -127, ..., -1} to {128, 129, ..., 255}, leaving no collisions with EOF. So the above fragment needs to be: char *p = ...; ... isspace((unsigned char)*p) ... This patch inserts unsigned char casts where necessary. Most of the cases I changed, I compile-tested using -Wchar-subscripts -Werror on NetBSD, which defines the ctype.h functions as macros so that they trigger the warning when the argument has type char. The exceptions are under #ifdef __VMS or #ifdef _WIN32. I left alone calls where the input is int where the cast would obviously be wrong; and I left alone calls where the input is already unsigned char so the cast is unnecessary. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25113) (cherry picked from commit 99548cd16e)	2024-10-10 20:48:28 +02:00
Neil Horman	1717fd9858	Add some documentation to describe the encap/decap requirements ... Document the fact that we now require unwrappedlen/wrappedlen to be set to the size of the unwrapped/wrapped buffers Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25522) (cherry picked from commit 1c1223ff53)	2024-10-07 17:48:12 +02:00
Neil Horman	ba943eb89b	Update rsasve_recover to properly store outlen on success ... Outlen was never validated in this function prior to use, nor is it set to the decrypted value on sucess. Add both of those operations Fixes #25509 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25522) (cherry picked from commit 0f9516855e)	2024-10-07 17:48:09 +02:00
Simo Sorce	27fd9ed3e3	Use the correct length value for input salt ... In this function the salt can be either a zero buffer of exactly mdlen length, or an arbitrary salt of prevsecretlen length. Although in practice OpenSSL will always pass in a salt of mdlen size bytes in the current TLS 1.3 code, the openssl kdf command can pass in arbitrary values (I did it for testing), and a future change in the higher layer code could also result in unmatched lengths. If prevsecretlen is > mdlen this will cause incorrect salt expansion, if prevsecretlen < mdlen this could cause a crash or reading random information. Inboth case the generated output would be incorrect. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25579) (cherry picked from commit 5c91f70ba8)	2024-10-02 12:09:12 +02:00
erbsland-dev	a5170a8249	Add Missing Error Messages for AES-OCB Tag Length Validation ... Related to #8331 Addressing found issues by adding specific error messages to improve feedback when tag length checks fail for the `EVP_CTRL_AEAD_SET_TAG` parameter in the AES-OCB algorithm. - Added PROV_R_INVALID_TAG_LENGTH error to indicate when the current tag length exceeds the maximum tag length of the algorithm. - Added `PROV_R_INVALID_TAG_LENGTH` error to indicate when the current tag length in the context does not match a custom tag length provided as a parameter. - Added `ERR_R_PASSED_INVALID_ARGUMENT` error to handle cases where an invalid pointer is passed in encryption mode. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25425) (cherry picked from commit 645edf50f0)	2024-09-13 10:13:16 +02:00
Matt Caswell	5a3d15807c	Don't restrict the ECDSA settable ctx params unnecessarily ... We just allow all possible settables all the time. Some things like the digest name can't actually be changed in some circumstances - but we already have checks for those things. It's still possible to pass a digest of the same name to one that's already been set for example. Fixes #25012 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25057) (cherry picked from commit d244abb651)	2024-09-09 09:52:45 +02:00
Matt Caswell	86bb4340c6	Complain about a missing digest when doing deterministic ECDSA ... We need a digest for the none when doing deterministic ECDSA. Give a better error message if one hasn't been supplied. See openssl/openssl#25012 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25057) (cherry picked from commit 8cc0a97d60)	2024-09-09 09:52:44 +02:00
PIums	94a0fcc2af	argon2: Fixed an thread availability error string ... Correctly display the number of requested threads and the number of available threads. CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25375) (cherry picked from commit 60725f8511)	2024-09-05 17:34:46 +02:00
Tomas Mraz	5fca53d7ba	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-09-03 14:50:21 +02:00
Jamie Cui	90d40badbe	Fix decoder error on SM2 private key ... Added sm2 testcases to endecode_test.c. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25266) (cherry picked from commit 25bd0c77bf)	2024-08-29 15:29:39 +02:00
Tomas Mraz	40617be299	rsa_pss_compute_saltlen(): Avoid integer overflows and check MD and RSA sizes ... Fixes Coverity 1604651 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/25085) (cherry picked from commit 217e215e99)	2024-08-07 19:42:08 +02:00
Pauli	eadf6912fa	Fix kbkdf bug if MAC is set to KMAC and then something else ... A context that is set to KMAC sets the is_kmac flag and this cannot be reset. So a user that does kbkdf using KMAC and then wants to use HMAC or CMAC will experience a failure. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24883) (cherry picked from commit f35fc4f184)	2024-07-17 14:15:45 +10:00
Pauli	7582ad23b1	Clarify DRBG seeding. ... There is a legacy code path that OpenSSL won't use anymore but applications could. Add a comment indicating this to avoid confusion for people not intimately conversant with the nuances in the RNG code. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24745) (cherry picked from commit 1eb122aa0c)	2024-06-29 14:12:32 +10:00
Tomas Mraz	91bcb1668d	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-06-04 14:58:30 +02:00
Todd Short	50edd7f623	Fix EVP_PKEY_CTX_add1_hkdf_info() behavior ... Fix #23448 `EVP_PKEY_CTX_add1_hkdf_info()` behaves like a `set1` function. Fix the setting of the parameter in the params code. Update the TLS_PRF code to also use the params code. Add tests. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23456) (cherry picked from commit 6b566687b5)	2024-04-09 20:21:43 +02:00
Jakov Smolić	df7166fa3a	riscv: Fix remaining asm checks ... There are additional asm checks which don't check for OPENSSL_CPUID_OBJ causing the build to still fail on riscv [1], so fix them in the same manner as ff27959769 [1] https://bugs.gentoo.org/923956 Fixes: https://github.com/openssl/openssl/issues/22871 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23752) (cherry picked from commit daf1f8d64f)	2024-03-22 11:03:49 +01:00
Tomas Mraz	c10ae451f3	Fix memory leaks on error cases during drbg initializations ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23503) (cherry picked from commit cb4f7a6ee0)	2024-02-09 10:36:50 +01:00
Matt Caswell	1460485811	Copyright year updates ... Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes	2024-01-30 13:13:27 +00:00
Richard Levitte	5572a1beee	Fix the encoding of SM2 keys ... OpenSSL's encoding of SM2 keys used the SM2 OID for the algorithm OID where an AlgorithmIdentifier is encoded (for encoding into the structures PrivateKeyInfo and SubjectPublicKeyInfo). Such keys should be encoded as ECC keys. Fixes #22184 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22529) (cherry picked from commit 1d490694df)	2024-01-12 11:08:08 +01:00
Holger Dengler	8887efa223	Fix partial block encryption in cfb and ofb for s390x ... Use the number of processed bytes information (num) from the generic cipher context for the partial block handling in cfb and ofb, instead of keep this information in the s390x-specific part of the cipher context. The information in the generic context is reset properly, even if the context is re-initialized without resetting the key or iv. Fixes: #23175 Signed-off-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23201) (cherry picked from commit 576a3572be)	2024-01-12 10:35:27 +01:00
Neil Horman	e6c14133c1	cleanse stack variable in kdf_pbkdf1_do_derive ... kdf_pbkdf1_do_derive stores key derivation information in a stack variable, which is left uncleansed prior to returning. Ensure that the stack information is zeroed prior to return to avoid potential leaks of key information Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23194) (cherry picked from commit 5963aa8c19)	2024-01-05 14:41:33 -05:00
Neil Horman	d8bb9b7b91	cleanse stack variable in blake2[b|s] finalization ... If the output of a blake2[b|s] digest isn't a multipl of 8, then a stack buffer is used to compute the final output, which is left un-zeroed prior to return, allowing the potential leak of key data. Ensure that, if the stack variable is used, it gets cleared prior to return. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23173) (cherry picked from commit 8b9cf1bc2c)	2024-01-03 12:56:41 -05:00
Neil Horman	12fe0d5958	validate requested key length in kdf_pbkdf1_do_derive ... When using pbkdf1 key deriviation, it is possible to request a key length larger than the maximum digest size a given digest can produce, leading to a read of random stack memory. fix it by returning an error if the requested key size n is larger than the EVP_MD_size of the digest Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23174) (cherry picked from commit 8d89050f0f)	2024-01-03 10:20:59 -05:00
Grant Nichol	a95748e35b	riscv: Fix mispelling of extension test macro ... When refactoring the riscv extension test macros, RISCV_HAS_ZKND_AND_ZKNE was mispelled. CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23139) (cherry picked from commit d8fa4cf763)	2024-01-02 11:40:00 +01:00
slontis	2ff8012fd0	Add missing settable entry OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS for RSA asym ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20319) (cherry picked from commit 26183614ed)	2023-12-29 10:42:15 +01:00