4287 Commits

Author	SHA1	Message	Date
Norbert Pocs	9919f898b5	Check return code of BIO_ADDR_rawaddress ... Fixes coverity issue: https://scan5.scan.coverity.com/#/project-view/64471/10222?selectedIssue=1666584 Thank you for the report! Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/28751) (cherry picked from commit 7fb9163586)	2025-10-07 12:34:58 -04:00
Eugene Syromiatnikov	7977ce5bb2	apps/storeutl.c: avoid signed integer overflow in indent_printf() ... As two arbitrarily large printf return values can trigger signed integer overflow, rewrite the return value handling to avoid it. Fixes: fb43ddceda "Add a recursive option to 'openssl storeutl'" Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665428 References: https://github.com/openssl/project/issues/1432 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28647) (cherry picked from commit 651abe1eb5)	2025-09-25 16:59:13 +02:00
Eugene Syromiatnikov	2e5885d973	apps: remove chopup_args() ... The last (and only?) user has been removed in commit eca4713913 "APPS: Drop interactive mode in the 'openssl' program". Complements: eca4713913 "APPS: Drop interactive mode in the 'openssl' program" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28441) (cherry picked from commit 3f77491cb3)	2025-09-08 15:18:43 -04:00
Eugene Syromiatnikov	8b690e2818	apps/ocsp.c: avoid using NULL resp ... There are some code paths where resp is used without a previous check for being non-NULL (specifically, OCSP_response_create() can return NULL, and do_responder() can return -1, that would also lead to resp being NULL). Avoid hitting NULL dereferences by wrapping the code that uses resp in "if (resp != NULL)". Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665155 References: https://github.com/openssl/project/issues/1362 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28406)	2025-09-06 10:19:40 -04:00
Eugene Syromiatnikov	96fa1f3284	apps/enc.c: avoid signed integer overflow on bufsize assignment ... The calculated option value, while being long-typed, is not checked for fitting into int-sized bufsize. Avoid overflow by throwing error if it is bigger than INT_MAX and document that behaviour. Fixes: 7e1b748570 "Big apps cleanup (option-parsing, etc)" Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665149 References: https://github.com/openssl/project/issues/1362 Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28406)	2025-09-06 10:19:40 -04:00
Dr. David von Oheimb	3c7812decd	apps/cms.c: add missing error message on error writing CMS output (ret == 6) ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27567)	2025-08-18 18:02:30 +02:00
openssl-machine	8f9d7c283e	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-08-05 12:07:41 +00:00
Saurabh Kushwah	56cc898860	apps/asn1parse.c: correct help text order for -genstr option ... CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28123) (cherry picked from commit eac588ac36)	2025-07-31 20:37:37 +02:00
Daniel Van Geest	64457c59c8	openssl rand command should use the loaded library context ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/28075) (cherry picked from commit e7d5398aa1)	2025-07-24 13:27:15 +02:00
openssl-machine	ed2e04f18a	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 11:50:25 +00:00
Ingo Franzki	28a0b9c797	speed: Increase MAX_SIG_NUM and fix its usage in loopargs_t fields ... Increase the maximum number of signature algorithms. With the introduction of the SignMessage and VerifyMessage API with OpenSSL 3.4 the providers that support combined digest and sign algorithms register quite a lot more signature algorithms, so the current limit of 111 is hit easily. While at it correct the definitions of the signature fields within the loopargs_t structure to use MAX_SIG_NUM instead of MAX_KEM_NUM. Closes: https://github.com/openssl/openssl/issues/27873 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27878) (cherry picked from commit 7bdc0d13d2)	2025-06-26 08:04:45 -04:00
Neil Horman	f6be9aedb0	Fix exit code for s_time when -new command line switch specified ... When operating with the -new switch in apps/openssl s_time, we neglect to set the exit code properly, and so the app exits with a code of 1 rather than 0 as expected Fixes #27856 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27857) (cherry picked from commit b6ff559853)	2025-06-20 15:43:35 -04:00
Bartel Artem	b161761ed0	genpkey.c: Fix filename copy & paste bug in error output ... Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27789) (cherry picked from commit a4c5096d16)	2025-06-10 19:56:11 +02:00
Dr. David von Oheimb	5e5ab0a32f	apps/x509.c: re-add ERR queue printing on errors ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27739) (cherry picked from commit ac85974bc3)	2025-06-04 17:40:49 +02:00
Viktor Dukhovni	5307a21b49	Split arguments taking quotes into account ... CA.pl supports interpolating multiple arguments into the executed commands. Previously these were evaluated by a shell, which supported quoting of values that contain whitespace, backslashes, ... With a shell no longer used (avoid command injection), backwards compatibility requires some similar functionality. The code now handles double and single-quoted strings (shell-style word splitting), but not parameter expansion ($foo remains unexpanded) or command substitution (`cmd` and $(cmd) remain unexpanded). On Windows system(@LIST) does not correctly preserve argv, do our own quoting instead and use system(<$quoted_cmd>). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432) (cherry picked from commit 287bbb28b0)	2025-06-04 17:34:23 +02:00
Viktor Dukhovni	332aedad68	Avoid shell commandline processing in CA.pl ... The CA.pl script used to build single-string string commandlines to pass to a shell via `system(command_string)`. That was fragile and not a best practice. This PR replaces `system(command_string)` with `system { executable } @argv`, which avoids the shell whenever possible (at least Unix-like systems and Windows). The only question mark is whether some sort of quoting is needed for VMS to preserve the case of commandline arguments even when processes are spawned directly, rather than via the shell. Unfortunately, given the way that some environment variables and command-line options are used to construct the commands to run, the result is still brittle. The CA.pl utility really should be replaced with something better. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432) (cherry picked from commit 0b1bdef38e)	2025-06-04 17:34:22 +02:00
AntonMoryakov	10412c495d	apps: lib: Prevent potential NULL dereference in init_client() ... apps: lib: Simplify ba_ret handling in init_client() Simplify logic around ba_ret assignment: - Fail early if ba_ret == NULL - Assign directly otherwise, without checking *ba_ret This avoids extra nesting and matches OpenSSL's conventions. CLA: trivial Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com> Co-authored-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26783) (cherry picked from commit 3161f460fa)	2025-05-29 16:38:16 +02:00
JiashengJiang	c58b7e4233	apps/cmp.c: Free bio on error to avoid memory leak ... Call BIO_free() to release bio if ASN1_i2d_bio_of() fails, preventing a memory leak. Fixes: 6a3579e190 ("CMP: add support for requesting cert template using genm/genp") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27647) (cherry picked from commit e0ae801728)	2025-05-27 19:52:16 +02:00
JiashengJiang	fa12ef080f	apps/pkeyutl.c: Add OPENSSL_free() to avoid a memory leak ... If EVP_PKEY_CTX_ctrl_str() fails, the code jumps to 'end' label without freeing passwd, causing a memory leak. Fixes: 9d1bf5f7de ("Add option to read pkeyopts interactively") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27470) (cherry picked from commit 0dc6ea55a1)	2025-05-27 19:47:35 +02:00
Tomas Mraz	e96d22446e	apps/x509.c: Fix the -addreject option adding trust instead of rejection ... Fixes CVE-2025-4575 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27672) (cherry picked from commit 0eb9acc24f)	2025-05-22 10:03:14 +02:00
Dmitriy Denisov	31fe5dfc3c	The condition that is never checked has been removed. ... If criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT, the criterion !=0 condition will be triggered. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27607) (cherry picked from commit 00480f1def)	2025-05-19 16:26:34 +02:00
Dr. David von Oheimb	255386744e	APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN ... Fixes #27572 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27592) (cherry picked from commit 35e431ed6d)	2025-05-13 14:09:04 +02:00
Malcolm Hogan	c124f7f030	Remove DAYS argument ... This commit removes DAYS from certificate requests to avoid the warning 'Ignoring -days without -x509; not generating a certificate' This argument is not needed with the -new argument. Additionally makes sure $1 is handled when -nodes is not given. Preventing an uninitialized value error when the DAYS argument is removed. Fixes #26595 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27277) (cherry picked from commit d890ad2b96)	2025-04-15 15:24:05 +01:00
Matt Caswell	d11ba5d780	Fix a segfault in the pkeyutl command line app ... Don't attempt to deref a pkey that is NULL Fixes #27156 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27228) (cherry picked from commit 3f0f723b52)	2025-04-02 17:28:46 +02:00
JiashengJiang	1201a1cd14	apps/lib/apps.c: Add a check for OPENSSL_strdup() ... Add a check for the return value of OPENSSL_strdup() to guarantee the success of allocation, similar to the other call sites. Fixes: c7d5ea2670 ("Prepare to detect index changes in OCSP responder.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27172) (cherry picked from commit 930c645e6b)	2025-03-28 11:40:18 +01:00
Viktor Dukhovni	c2f50863b5	Fix goto label indents to match style ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27175) (cherry picked from commit 60f2a71400)	2025-03-28 11:37:31 +01:00
Viktor Dukhovni	52413a7bb3	Report s_client chain cert pkey alg correctly ... In particular provided keys are also supported, and for EC keys we report the group rather than the bit count. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27131) (cherry picked from commit aeb797594b)	2025-03-27 10:41:14 +01:00
Viktor Dukhovni	d900467b2a	In s_client report 'long' certificate sigalg name ... This matches the sigalg output format of X509_signature_print(3). Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27130) (cherry picked from commit dc246cec87)	2025-03-26 15:23:40 +01:00
Viktor Dukhovni	4ace4a7166	Report IANA sigalg name in s_client ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27128) (cherry picked from commit 681528cbc4)	2025-03-25 20:06:36 +01:00
openssl-machine	b17e3bb6ce	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes	2025-03-25 14:59:38 +00:00
Ankit Kekre	195d67780e	apps/cms.c, apps/ocsp.c: Added NULL pointer checks ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27059) (cherry picked from commit 952d9b83b2)	2025-03-20 11:31:39 +01:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Dr. David von Oheimb	1d3da367ab	minor doc fixes for CMP and HTTP ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26924)	2025-03-04 13:58:37 +01:00
Tomas Mraz	2411f9b662	apps: Escape control characters in DNs by default ... When displaying distinguished names the control characters are escaped by default. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26932)	2025-03-03 09:08:34 +01:00
Viktor Dukhovni	31b5f3f382	Further decoder tuning possibly better perf ... - The decoder should consider fewer options based on more precise tracking of the desired input type (DER, PVK, MSBLOB), algorithm (RSA, EC, ...), input structure (SPKI, P8, ...). How much this affects actual use-cases is harder to estimate, we'll just have to run before/after perf tests. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26927)	2025-03-02 02:04:09 +11:00
Shakti Shah	c9e56da777	Make org.openssl.winstore: work in openssl-ts ... Fixes #26739 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26833)	2025-02-20 20:24:45 +01:00
otherddn1978	e1a501a433	EC_get_buildin_curves does not return an error, this check is unnecessary. ... Found by Linux Verification Center (linuxtesting.org) with SVACE. unused code has been removed delete whitespace Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26719)	2025-02-20 15:15:46 +01:00
Frederik Wedel-Heinen	00fbc96988	Adds missing checks of return from XXX_up_ref(). ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26294)	2025-02-18 16:32:59 +01:00
Viktor Dukhovni	594cef49b4	Accessors for the IANA signature scheme name ... This is the official name of the signature algorithm(s) used by the peer and/or local end of the connection, and should be available, e.g. for logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26738)	2025-02-17 15:08:25 +11:00
Viktor Dukhovni	afc64c240f	Address non-FP coverity nits ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26765)	2025-02-16 14:48:01 -05:00
Dmitry Belyavskiy	df93d1327a	skeyutl command line utility ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy	00bdee8974	Opaque keys support for the openssl command line ... Support EVP_SKEY object for the `enc` command. Support EVP_SKEYMGMT for the `list` command. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
slontis	7cf5300e6b	dgst commandline support for one shot signing algorithms ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26697)	2025-02-14 18:22:01 +01:00
Viktor Dukhovni	a39dc27c25	Log name of provided peer temp keys ... Log the peer's temp key name when it is from a provider. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26734)	2025-02-14 17:14:53 +01:00
Viktor Dukhovni	4b1c73d2dd	ML-KEM hybrids for TLS ... - When used as KEMs in TLS the ECDHE algorithms are NOT subjected to HPKE Extract/Expand key derivation. Instead the TLS HKDF is used as usual. - Consequently these KEMs are just the usual ECDHE key exchange operations, be it with the encap ECDH private key unavoidably ephemeral. - A new "MLX" KEM provider is added that supports four hybrids of EC/ECX DH with ML-KEM: * ML-KEM-768 + X25519 * ML-KEM-1024 + X448 * P-256 + ML-KEM-768 * P-384 + ML-KEM-1024 - Support listing of implemented TLS groups. The SSL_CTX_get0_implemented_groups() function and new `openssl list -tls-groups` and `openssl list -all-tls-groups` commands make it possible to determine which groups are implemented by the SSL library for a particular TLS version or range of versions matching an SSL_CTX. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26220)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	63e9a3b1f3	Fix code and docs of pkeyutl en/decapsulation ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26281)	2025-02-14 10:50:57 +01:00
Viktor Dukhovni	5421423ef9	Flexible encoders for ML-DSA ... - Same UX as ML-KEM. The main ASN.1 private key syntax is the one from Russ Housley's post on the LAMPS list, subsequently amended to tag the seed instead of the key (each of the three parameter sets will have a fixed size for the `expandedKey`): ML-DSA-PrivateKey ::= CHOICE { seed [0] IMPLICIT OCTET STRING SIZE (32), expandedKey OCTET STRING SIZE (2560 | 4032 | 4896) both SEQUENCE { seed OCTET STRING SIZE (32), expandedKey OCTET STRING SIZE (2560 | 4032 | 4896) } } Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26638)	2025-02-14 10:46:04 +01:00
Tomas Mraz	8f416ba9b0	ecparam: process -list_curves before reading input ... Fixes #26519 This is a regression from commit 1dbb67c4 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26525)	2025-02-13 11:19:02 +01:00
Rajeev Ranjan	0048817523	CMP: add support for central key generation ... - add testcase for central keygen - add documentation Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25132)	2025-01-27 08:56:46 +01:00
Frederik Wedel-Heinen	bd0a2e0c1e	Check returns of sk_X509_CRL_push and handle appropriately. ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26234)	2025-01-24 13:37:38 +01:00