313 Commits

Author	SHA1	Message	Date
Pauli	106bb67f78	Add OSSL_ prefix back onto param names ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28544)	2025-09-17 08:50:16 +10:00
openssl-machine	e66332418f	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Release: yes	2025-09-02 13:05:45 +00:00
Pauli	53eb2363a1	params: add features to param parser generator ... Support BN as an available type. If a param name is repeated, use the extra fields for the first not the last. Include the parameter name in a comment in the generated parser. This Fixes #28257 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/28273)	2025-08-23 13:31:25 +10:00
Pauli	2b7c555fec	params: fix conditionals in param parser generation script ... These problems only occur in edge cases when using conditional parameters. I.e. not a problem before now. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28243)	2025-08-15 11:03:11 +10:00
GAlvare	7eee9d543e	Fixes for build failures on OS X 10.4 Tiger ... Also added darwin8-ppc-cc and darwin8-ppc64-cc build configurations for handling OS X 10.4 PowerPC specific configuration options, specifically disabling async by default. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27578)	2025-08-08 13:56:02 +02:00
Pauli	85e12cecbb	params: produce an error if a parameter is repeated ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/28163)	2025-08-08 10:33:22 +10:00
Pauli	0c833c46cf	params: add conditional params to the generation script ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/28163)	2025-08-08 10:33:14 +10:00
Eugene Syromiatnikov	8778245052	util/perl/OpenSSL/Test.pm: consistently use 4 spaces for indentation ... While the majority of the file uses 4 spaces for indentation, some parts contain 8-wide tabs. Use the spaces for indentation consistently throughout the file. Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28162)	2025-08-06 08:17:05 +10:00
Pauli	39868ab1bf	params: emit an error if a parameter array overflows ... This is in addition to returning an error code. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:21:25 +02:00
Pauli	454119a625	params: revert error checking when params are duplicated ... This is to avoid a change of behaviour even though it is a result of user error. When params are duplicated, all but the first are ignored and no error is returned. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:21:25 +02:00
Pauli	1d221516cd	params: allow param name aliases ... We allowed multiple names for the same parameter in a number of places. This is best dealt with in the generated code. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:21:25 +02:00
Pauli	b196aa8fa0	paramnames: factor out common code after successful match ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:21:25 +02:00
Pauli	d417579e95	params: add support for 'hidden' parameters ... These are in the name decoder and structure but do not appear in the parameter listing. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:21:25 +02:00
Pauli	439f0243c1	params: update param parser generator script to support duplicated parameters ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:20:48 +02:00
Pauli	e44d7cb43a	params: add additional error checking to generated param name parsers ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:19:39 +02:00
Pauli	a7b9fa8665	params: generated decoder functions return an error state on failure ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27923)	2025-07-31 20:19:39 +02:00
Daniel Van Geest	d0899abb1b	Implement KEMRecipientInfo (RFC9629) in CMS ... Also add support for ML-KEM in CMS (draft-ietf-lamps-cms-kyber). Add the -recip_kdf and -recip_ukm parameters to `openssl cms -encrypt` to allow the user to specify the KDF algorithm and optional user keying material for each recipient. A provider may indicate which RecipientInfo type is supported for a key, otherwise CMS will try to figure it out itself. A provider may also indicate which KDF to use in KEMRecipientInfo if the user hasn't specified one. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27681)	2025-07-30 11:39:04 +02:00
Eugene Syromiatnikov	70c05fcde5	Remove HARNESS_OSSL_PREFIX manipulation in the test harness ... The aim of HARNESS_OSSL_PREFIX environment variable is to avoid contaminating TAP producer's output with stanzas that can be interpreted by a TAP producer by prefixing them with comment; this can be achieved by processing the output within the runner instead, as it already does for non-standard prefixes; it also has the added benefit of alleviating the need to reset it for the external tests in order to avoid messing with their output checks. Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28025)	2025-07-29 13:12:10 -04:00
Norbert Pocs	d05ac3becd	Fix perl warnings on various scripts ... Resolves: https://github.com/openssl/project/issues/1273 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28046)	2025-07-23 08:59:53 -04:00
Neil Horman	b321bf25c8	Fixup non-optional use of IO::Socket::IP ... IO::Socket::IP is an optionally used package in our perl scripts, and a recent change of mine used it unilaterally, causing breakage on older perl installations. Fix it up to use it optionally again, falling back to IO::Socket::INET when needed. Fixes #27940 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27941)	2025-07-09 12:08:37 +02:00
Pauli	08ca4fdf9f	paramnams: add new line to break long function declaration ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27859)	2025-06-25 17:22:07 +10:00
Pauli	effba0ee65	change _ettable to _list ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27847)	2025-06-20 08:39:29 +10:00
Pauli	4b0e0cc84d	params: sort structure fields for repeatability ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27847)	2025-06-20 08:39:29 +10:00
Pauli	f50e9ef510	params: remove obsolete functionality from param generator script ... With the move to structure based parameter decoding, some of the support functions are now unnecessary and are removed. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27847)	2025-06-20 08:39:29 +10:00
Pauli	51425094b5	params: update TRIE builder script to emit structs of param pointers ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27847)	2025-06-20 08:39:17 +10:00
Neil Horman	ae404a9b3b	Fix use of IO::Socket::IP on windows 2025 ... Apparently IO::Socket::IP has several odd behaviors on windows 2025, notably indicating that AF_INET6 isn't a supported family when it clearly is. Follow the pattern in determinig the haveIPV6 variable in Proxy.pm, and record if we determine IPv6 availablity with the IP class or the INET6 class and use the same method when testing port binding Fixes project/#1213 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27780)	2025-06-06 09:38:09 +02:00
Neil Horman	f78f824c8e	Test randomly selected client port for availabilty in sslrecords test ... Encountered this error in a pr today: https://github.com/openssl/openssl/actions/runs/15418713146/job/43387767612 === Proxy started on port [::1]:56662 Engine "ossltest" set. Using default temp DH parameters ACCEPT [::1]:59189 Server responds on [::1]:59189 Engine "ossltest" set. C0774F02907F0000:error:80000062:system library:BIO_bind:Address already in use:crypto/bio/bio_sock2.c:240:calling bind() C0774F02907F0000:error:10000075:BIO routines:BIO_bind:unable to bind socket:crypto/bio/bio_sock2.c:242: connect:errno=98 === Its occuring because we randomly select a port to use for our client connection in the sslrecords test. Thats usually fine, but sometimes, we get unlucky and pick a port thats already in use. This presents as random failures in our CI on this test. So lets try harden ourselves against it. When creating the client connection, test the randomly selected port by trying to bind to it via a call to IO::Socket::IP->new(). If that fails, try a different port number, until we get one that works. If it works, use that port in the assignment for the clients local port value. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27752)	2025-06-05 10:05:48 -04:00
Pauli	973322d672	paramnames: add new function to handle names and types. ... The help generates the ettable table and the TRIE based name decode function. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27747)	2025-06-04 16:48:59 +02:00
Pauli	c58085d4a9	Add security-category param name ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27571)	2025-05-27 18:01:43 +10:00
Pauli	7a10ecd405	params: update generation script to support multiple TRIE output ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27392)	2025-05-07 11:47:24 +02:00
fangming.fang	86408fa8de	Implement interleaving aes-cbc-hmac-sha on aarch64 ... This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha1/256, aes-cbc and hmac-sha1/256 are interleaved to achieve better performance. It only supports non-padding mode that means the length of input data should be multiple of 16 bytes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22949)	2025-04-14 14:53:30 +01:00
Neil Horman	4943ac7b88	Update dead links and e-mails our sources ... http://www.openssl.org/~appro/cryptogams/ is 404, update to https://github.com/dot-asm/cryptogams/ And clean up the boiler plate text around it. Replace stray usage of appro@openssl.org with github url. The email in question here is no longer valid, replace it with the corresponding github id for the user. Replace <appro\@fy.chalmers.se> with <https://github.com/dot-asm> Fix lots more dead emails addresses that we missed Remove reference urls that no longer exist. Just delete urls that 404 now, and have no obvious new link. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27073)	2025-03-26 15:40:02 +01:00
Frederik Wedel-Heinen	21b170df9f	Adds the concept of thunks to OPENSSL_sk interface ... This allows applications to call functions of correct signature when free'ing OPENSSL_sk items which UBSan complains about. Related to #22896. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27071)	2025-03-24 15:28:34 +01:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Viktor Dukhovni	bcff020c36	Refactor sigalg handling ... - The default sigalg list now puts ML-DSA-65 first, then ML-DSA-87 and then ML-DSA-44. (87 vs. 44 Subject to bikeshedding). - The mintls and maxtls versions are now taken into account for both built-in and provided algorithms. - Some algorithms have a separate TLSv1.2-specific name for future reporting via openssl-list(1). - ML-DSA aside, any new provided algorithms go at the end of the default list (backwards-compatible inclusion). - The built-in algorithms now also have min/max DTLS versions. Though the provider TLS-SIGALG capability was extended to also report the DTLS version range, the minimum supported DTLS is 1.3, which we don't yet have, so it is not yet possible to add DTLS sigalgs via a provider - The TLS 1.3 brainpool sigalgs got their correct IANA names, with the legacy names as purported TLS 1.2 alternatives, but since these are for TLS 1.3 and up those names are for matching only, the reported value will still be the 1.3 name. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26975)	2025-03-09 23:19:37 +01:00
Viktor Dukhovni	44a64029c3	Use better data type info in decoders ... The decoders in some cases failed to capture or propagate information about what is being decoded, causing more work happen to try unrelated decoders as a fallback. We now try harder to keep track of the expected object (private key or public key, if known), and the algorithm determined from the OID of a PKCS8 object or SPKI. This leads in many cases to fewer decoder invocations. With so many more algorithms now, trying every decoder is increasingly best avoided. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26892)	2025-02-26 15:13:57 +01:00
Viktor Dukhovni	cab4e7cbd1	Configurable import-time PCT for ML-KEM ... And related cleanup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26789)	2025-02-20 18:21:40 +11:00
Pauli	73e01df48d	slh-dsa: change the seed parameter name from entropy to seed ... This brings it inline with the same parameter for ML-KEM and ML-DSA. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26750)	2025-02-20 11:17:40 +11:00
slontis	5c2b404241	SLH-DSA clean ups ... - Make slh_dsa_sign() return the siglen when sig is NULL. - Remove the ability in fromdata to generate the public key root given the private key and public key seed. This was messy and can be done by key generation instead. - Add common EVP_PKEY gettablesto SLH_DSA keys (OSSL_PKEY_PARAM_BITS, OSSL_PKEY_PARAM_SECURITY_BITS, and OSSL_PKEY_PARAM_MAX_SIZE). - Update tests based on the above changes. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	5901ca87ba	Add SLH_DSA to the FIPS provider. ... The keygen tests required "entropy" to be added via an additional parameter for ACVP testing. This is required because TEST_RAND cant be used to pass entropy to the FIPS provider, due to it not knowing the lib ctx of the FIPS provider. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	e240d39c6c	Add SLH-DSA signing. ... Also updated function comments. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	8f53b9b59d	Add SLH-DSA key generation ... Also made fromdata able to generate the public root key if the private key seed + prf as well as the public key seed are passed to from data. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
Dmitry Belyavskiy	d46e010cd2	EVP_SKEY implementation for EVP_CIPHER ... Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
Viktor Dukhovni	5b2d996f91	Implement seed/key preference when decoding ... - Moved the codec code out of `ml_kem.c` into its own file in the provider tree. Will be easier to share some code with ML-DSA, and possible to use PROV_CTX, to do config lookups directly in the functions doing the work. - Update and fixes of the EVP_PKEY-ML-KEM(8) documentation, which had accumulated some stale/inaccurate material, and needed new text for the "prefer_seed" parameter. - Test the "prefer_seed=no" behaviour. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26569)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	318994a121	ASN.1 ML-KEM private key format ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26512)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	869903c07c	Improved import and export ... - On import, if a seed is provided, the keys are regenerated. - The seed is exported as a separate "seed" parameter, when available. The "ml-kem.retain_seed" parameter is also exported, when false. - The seed is optionally dropped after key generation. * When the "ml-kem.retain_seed" keygen parameter is set to zero. * When the "ml-kem.retain_seed" keygen parameter is not set to 1, and the "ml-kem.retain_seed" provider config property is set explictly false. - The exported private key parameter "priv" is always the FIPS 203 |dk|. - Private key decoding from PKCS#8 produces a transient "seed-only" form of the key, in which "retain_seed" is set to false when the "ml-kem.retain_seed" provider config property is set explictly false. The full key is generated during "load" and the seed is retained or not as specified. - Import honours the "ml-kem.retain_seed" parameter when specified, or otherwise honours the provider's "ml-kem.retain_seed" property. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26512)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	b818a99839	Encoders and Decoders for ML-KEM ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26341)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	d2136d9e73	Multi-variant ML-KEM ... This introduces support for ML-KEM-512 and ML-KEM-1024 using the same underlying implementation parameterised by a few macros for the associated types and constants. KAT tests are added for ML-KEM 512 and 1024, to complement the previous tests for ML-KEM-768. MLKEM{512,768,1024} TLS "group" codepoints are updated to match the final IANA assigments and to make the additional KEMs known to the TLS layer. The pure-QC MLKEMs are not in the default list of supported groups, and need to be explicitly enabled by the application. Future work will introduce support for hybrids, and for more fine-grained policy of which keyshares a client should send by default, and when a server should request (HRR) a new mutually-supported group that was not sent. Tests for ML-KEM key exchange added to sslapitest to make sure that our TLS client MLKEM{512,768,1024} implementations interoperate with our TLS server, and that MLKEM* are not negotiated in TLS 1.2. Tests also added to excercise non-derandomised ML-KEM APIs, both directly (bypassing the provider layer), and through the generic EVP KEM API (exercising the provider). These make sure that RNG input is used correctly (KAT tests bypass the RNG by specifying seeds). The API interface to the provider takes an "const ML_KEM_VINFO" pointer, (obtained from ossl_ml_kem_get_vinfo()). This checks input and output buffer sizes before passing control to internal code that assumes correctly sized (for each variant) buffers. The original BoringSSL API was refactored to eliminate the opaque public/private key structure wrappers, since these structures are an internal detail between libcrypto and the provider, they are not part of the public (EVP) API. New "clangover" counter-measures added, refined with much appreciated input from David Benjamin (Chromium). The internal steps of "encrypt_cpa" were reordered to reduce the working-set size of the algorithm, now needs space for just two temporary "vectors" rather than three. The "decap" function now process the decrypted message in one call, rather than three separate calls to scalar_decode_1, scalar_decompress and scalar_add. Some loops were unrolled, improving performance of en/decapsulate (pre-expanded vectors and matrix) by around 5%. To handle, however unlikely, the SHA3 primitives not behaving like "pure" functions and failing, the implementation of `decap` was modifed: - To use the KDF to compute the Fujisaki-Okamoto (FO) failure secret first thing, and if that fails, bail out returning an error, a shared secret is still returned at random from the RNG, but it is OK for the caller to not use it. - If any of the subsequently used hash primitives fail, use the computed FO failure secret (OK, despite no longer constant-time) and return success (otherwise the RNG would replace the result). - We quite reasonably assume that chosen-ciphertext attacks (of the correct length) cannot cause hash functions to fail in a manner the depends on the private key content. Support for ML-KEM-512 required adding a centered binomial distribution helper function to deal with η_1 == 3 in just that variant. Some additional comments were added to highlight how the code relates to the ML-KEM specification in FIPS 203. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26172)	2025-02-14 10:50:57 +01:00
Andrew Dinh	42436eb53e	Add ML-KEM-768 KATs from BoringSSL ... Add KATs for ML-KEM-768 under CCLA from https://boringssl.googlesource.com/boringssl/ These KATs test key generation, encapsulation, and decapsulation for the ML-KEM-768 algorithm. Relevant notes: - Added functionality to the ML-KEM key management to export/import. These may not be fully implemented yet (see openssl/openssl#25885) - Exposed some more low-level ML-KEM API's to the provider implementation to allow for deterministic encapsulation/key generation - Actually run 'mlkem_internal_test' with `make test` Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25938)	2025-02-14 10:50:57 +01:00
Pauli	e2323b1a13	params: add OSSL_SIGNATURE_PARAM_MU to param names ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26637)	2025-02-14 10:46:04 +01:00