3126 Commits

Author	SHA1	Message	Date
Neil Horman	7cdd6976cc	Fixup non-optional use of IO::Socket::IP ... IO::Socket::IP is an optionally used package in our perl scripts, and a recent change of mine used it unilaterally, causing breakage on older perl installations. Fix it up to use it optionally again, falling back to IO::Socket::INET when needed. Fixes #27940 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27941) (cherry picked from commit b321bf25c8)	2025-07-09 12:08:54 +02:00
openssl-machine	ed2e04f18a	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 11:50:25 +00:00
Tomas Mraz	48eddcbf78	Add strlen to symbols allowed on Windows ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27854) (cherry picked from commit c296e1ce24)	2025-06-19 16:00:42 +02:00
Dr. David von Oheimb	297a87cf13	check-format.pl: prevent false positive on typedef with space and '(' after type name ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27836) (cherry picked from commit 4a3809f705)	2025-06-17 15:33:21 -04:00
Dr. David von Oheimb	26d835f8fd	check-format-test-negatives.c: add 2nd macro indent test and hint on how known false positives are marked ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27836) (cherry picked from commit e925b99f94)	2025-06-17 15:33:20 -04:00
Dr. David von Oheimb	c72f3a9293	check-format.pl: prevent reporting "{ 1 stmt }" on "else if" branch unless -1 or --1-stmt option is given ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27836) (cherry picked from commit f21a8391dd)	2025-06-17 15:33:20 -04:00
Dr. David von Oheimb	aa47158382	check-format.pl: allow block for switch case/default ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27836) (cherry picked from commit 560ea7ffbf)	2025-06-17 15:33:19 -04:00
Dr. David von Oheimb	a4937b1272	check-format-test-positives.c slightly improve comment describing the '*@' tags ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27836) (cherry picked from commit 58eb08985c)	2025-06-17 15:33:18 -04:00
Dr. David von Oheimb	51e649c713	adapt check-format-test-positives.c for too long lines after limit was relaxed from 80 to 100 ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27836) (cherry picked from commit e6476de58d)	2025-06-17 15:33:17 -04:00
Neil Horman	0b374f7cb1	Fix use of IO::Socket::IP on windows 2025 ... Apparently IO::Socket::IP has several odd behaviors on windows 2025, notably indicating that AF_INET6 isn't a supported family when it clearly is. Follow the pattern in determinig the haveIPV6 variable in Proxy.pm, and record if we determine IPv6 availablity with the IP class or the INET6 class and use the same method when testing port binding Fixes project/#1213 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/27780) (cherry picked from commit ae404a9b3b)	2025-06-06 09:38:29 +02:00
Neil Horman	6d72e42523	Test randomly selected client port for availabilty in sslrecords test ... Encountered this error in a pr today: https://github.com/openssl/openssl/actions/runs/15418713146/job/43387767612 === Proxy started on port [::1]:56662 Engine "ossltest" set. Using default temp DH parameters ACCEPT [::1]:59189 Server responds on [::1]:59189 Engine "ossltest" set. C0774F02907F0000:error:80000062:system library:BIO_bind:Address already in use:crypto/bio/bio_sock2.c:240:calling bind() C0774F02907F0000:error:10000075:BIO routines:BIO_bind:unable to bind socket:crypto/bio/bio_sock2.c:242: connect:errno=98 === Its occuring because we randomly select a port to use for our client connection in the sslrecords test. Thats usually fine, but sometimes, we get unlucky and pick a port thats already in use. This presents as random failures in our CI on this test. So lets try harden ourselves against it. When creating the client connection, test the randomly selected port by trying to bind to it via a call to IO::Socket::IP->new(). If that fails, try a different port number, until we get one that works. If it works, use that port in the assignment for the clients local port value. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27752) (cherry picked from commit f78f824c8e)	2025-06-05 10:30:19 -04:00
Viktor Dukhovni	5307a21b49	Split arguments taking quotes into account ... CA.pl supports interpolating multiple arguments into the executed commands. Previously these were evaluated by a shell, which supported quoting of values that contain whitespace, backslashes, ... With a shell no longer used (avoid command injection), backwards compatibility requires some similar functionality. The code now handles double and single-quoted strings (shell-style word splitting), but not parameter expansion ($foo remains unexpanded) or command substitution (`cmd` and $(cmd) remain unexpanded). On Windows system(@LIST) does not correctly preserve argv, do our own quoting instead and use system(<$quoted_cmd>). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432) (cherry picked from commit 287bbb28b0)	2025-06-04 17:34:23 +02:00
olszomal	3b613fcf9d	Fix URL parsing to handle missing ports and ISO 8601 timestamps in paths ... Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26303) (cherry picked from commit 56910e7211)	2025-04-23 11:27:19 +02:00
Chase Killorin	380d7f3c28	Removed duplicates in some man pages ... Fixes openssl/openssl#11748 find-doc-nits: Check for duplicate options Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27088) (cherry picked from commit 2c8103e468)	2025-03-26 15:34:48 +01:00
openssl-machine	e5386cd2d7	make update ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes	2025-03-25 15:01:21 +00:00
openssl-machine	0c679f5566	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-03-12 13:35:59 +00:00
Viktor Dukhovni	bcff020c36	Refactor sigalg handling ... - The default sigalg list now puts ML-DSA-65 first, then ML-DSA-87 and then ML-DSA-44. (87 vs. 44 Subject to bikeshedding). - The mintls and maxtls versions are now taken into account for both built-in and provided algorithms. - Some algorithms have a separate TLSv1.2-specific name for future reporting via openssl-list(1). - ML-DSA aside, any new provided algorithms go at the end of the default list (backwards-compatible inclusion). - The built-in algorithms now also have min/max DTLS versions. Though the provider TLS-SIGALG capability was extended to also report the DTLS version range, the minimum supported DTLS is 1.3, which we don't yet have, so it is not yet possible to add DTLS sigalgs via a provider - The TLS 1.3 brainpool sigalgs got their correct IANA names, with the legacy names as purported TLS 1.2 alternatives, but since these are for TLS 1.3 and up those names are for matching only, the reported value will still be the 1.3 name. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26975)	2025-03-09 23:19:37 +01:00
Ivan Stanković	e599893a9f	x509: allow SAN URIs to contain userinfo ... The way we're currently handling SAN URIs does not allow for userinfo, meaning the name constraint check on such URIs will fail. Fix this by skipping over the userinfo component: authority = [ userinfo "@" ] host [ ":" port ] (per RFC 3986). Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25861)	2025-03-04 17:30:34 +01:00
Viktor Dukhovni	44a64029c3	Use better data type info in decoders ... The decoders in some cases failed to capture or propagate information about what is being decoded, causing more work happen to try unrelated decoders as a fallback. We now try harder to keep track of the expected object (private key or public key, if known), and the algorithm determined from the OID of a PKCS8 object or SPKI. This leads in many cases to fewer decoder invocations. With so many more algorithms now, trying every decoder is increasingly best avoided. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26892)	2025-02-26 15:13:57 +01:00
Dmitry Belyavskiy	17bbc16383	EVP_SKEY_get_raw_key => EVP_SKEY_get0_raw_key ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26832)	2025-02-21 17:58:41 +01:00
Cheng Zhang	db2c54cc92	Added new API to enable 0-RTT for 3rd party QUIC stacks. ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26842)	2025-02-21 12:01:30 +01:00
Viktor Dukhovni	cab4e7cbd1	Configurable import-time PCT for ML-KEM ... And related cleanup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26789)	2025-02-20 18:21:40 +11:00
Pauli	73e01df48d	slh-dsa: change the seed parameter name from entropy to seed ... This brings it inline with the same parameter for ML-KEM and ML-DSA. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/26750)	2025-02-20 11:17:40 +11:00
slontis	5c2b404241	SLH-DSA clean ups ... - Make slh_dsa_sign() return the siglen when sig is NULL. - Remove the ability in fromdata to generate the public key root given the private key and public key seed. This was messy and can be done by key generation instead. - Add common EVP_PKEY gettablesto SLH_DSA keys (OSSL_PKEY_PARAM_BITS, OSSL_PKEY_PARAM_SECURITY_BITS, and OSSL_PKEY_PARAM_MAX_SIZE). - Update tests based on the above changes. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	5901ca87ba	Add SLH_DSA to the FIPS provider. ... The keygen tests required "entropy" to be added via an additional parameter for ACVP testing. This is required because TEST_RAND cant be used to pass entropy to the FIPS provider, due to it not knowing the lib ctx of the FIPS provider. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	e240d39c6c	Add SLH-DSA signing. ... Also updated function comments. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
slontis	8f53b9b59d	Add SLH-DSA key generation ... Also made fromdata able to generate the public root key if the private key seed + prf as well as the public key seed are passed to from data. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25882)	2025-02-18 10:13:53 +01:00
Neil Horman	a903be9cae	Fixup error ennumeration ... The merge gives us a conflict on SSL_R_MISSING_QUIC_TLS_FUNCTIONS which conflicted with SSL_R_LISTENER_USE_ONLY. Move the former to ordinal 423 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26762)	2025-02-17 11:27:34 -05:00
Neil Horman	9d6e5a69db	Remove NEW_TOKEN public api ... @sashan and I were discussing the usefulness of the public facing api for NEW_TOKEN support, and he has concerns over its usefulness and our being stuck with it if we need to make changes later. Given that it is a convience api for using multiple CTX-es to share a cache, its fine if we remove it for now, as that seems like a less common use case. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	e521131c60	Rename token_store functions to make them consistent ... we use get0 to get a token store, but set to set it. Since the latter takes a refcount, change that to set1. Also rename the interal quic functions to match. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	b1828dc23a	Add public api to create token cache for QUIC NEW_TOKENS ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26517)	2025-02-17 11:27:33 -05:00
Neil Horman	7502df20bc	rename new_pending_ssl to new_pending_conn ... Make it clear its only announcing connections, not streams Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Neil Horman	1abc48fae8	Run Make update ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26361)	2025-02-17 11:27:33 -05:00
Matt Caswell	6d1646c66e	Add documentation for BIO_dgram_set0_local_addr() ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26066)	2025-02-17 11:27:33 -05:00
Andrew Dinh	dad45ea769	Adds a new demo blocking QUIC server for use with the existing demo QUIC clients ... Remove util/quicserver.c Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25465)	2025-02-17 11:27:33 -05:00
Hugo Landau	269409c75b	Allow use of socketpair, WSASocketA ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00
Hugo Landau	5eecb6b619	make update ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24971)	2025-02-17 11:27:32 -05:00
Hugo Landau	56b59e7837	QUIC: Add manpage for listener API ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23334)	2025-02-17 11:27:32 -05:00
Hugo Landau	745a779fb2	make update ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23334)	2025-02-17 11:27:32 -05:00
Viktor Dukhovni	594cef49b4	Accessors for the IANA signature scheme name ... This is the official name of the signature algorithm(s) used by the peer and/or local end of the connection, and should be available, e.g. for logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26738)	2025-02-17 15:08:25 +11:00
Simo Sorce	fc00d9b7b1	Add additional EVP_SKEY helpers ... EVP_SKEY_is_a() allows to check if a key is of a specific type. EVP_SKEY_to_provider() provides an easy way to move a key to a different provider. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:31 +01:00
Dmitry Belyavskiy	759570bfed	Implement EVP_MAC_init_SKEY ... Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy	b9d919f697	EVP_SKEY documentation ... Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
Dmitry Belyavskiy	d46e010cd2	EVP_SKEY implementation for EVP_CIPHER ... Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26753)	2025-02-15 18:51:30 +01:00
Viktor Dukhovni	5b2d996f91	Implement seed/key preference when decoding ... - Moved the codec code out of `ml_kem.c` into its own file in the provider tree. Will be easier to share some code with ML-DSA, and possible to use PROV_CTX, to do config lookups directly in the functions doing the work. - Update and fixes of the EVP_PKEY-ML-KEM(8) documentation, which had accumulated some stale/inaccurate material, and needed new text for the "prefer_seed" parameter. - Test the "prefer_seed=no" behaviour. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/26569)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	318994a121	ASN.1 ML-KEM private key format ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26512)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	869903c07c	Improved import and export ... - On import, if a seed is provided, the keys are regenerated. - The seed is exported as a separate "seed" parameter, when available. The "ml-kem.retain_seed" parameter is also exported, when false. - The seed is optionally dropped after key generation. * When the "ml-kem.retain_seed" keygen parameter is set to zero. * When the "ml-kem.retain_seed" keygen parameter is not set to 1, and the "ml-kem.retain_seed" provider config property is set explictly false. - The exported private key parameter "priv" is always the FIPS 203 |dk|. - Private key decoding from PKCS#8 produces a transient "seed-only" form of the key, in which "retain_seed" is set to false when the "ml-kem.retain_seed" provider config property is set explictly false. The full key is generated during "load" and the seed is retained or not as specified. - Import honours the "ml-kem.retain_seed" parameter when specified, or otherwise honours the provider's "ml-kem.retain_seed" property. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26512)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	b818a99839	Encoders and Decoders for ML-KEM ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26341)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	4b1c73d2dd	ML-KEM hybrids for TLS ... - When used as KEMs in TLS the ECDHE algorithms are NOT subjected to HPKE Extract/Expand key derivation. Instead the TLS HKDF is used as usual. - Consequently these KEMs are just the usual ECDHE key exchange operations, be it with the encap ECDH private key unavoidably ephemeral. - A new "MLX" KEM provider is added that supports four hybrids of EC/ECX DH with ML-KEM: * ML-KEM-768 + X25519 * ML-KEM-1024 + X448 * P-256 + ML-KEM-768 * P-384 + ML-KEM-1024 - Support listing of implemented TLS groups. The SSL_CTX_get0_implemented_groups() function and new `openssl list -tls-groups` and `openssl list -all-tls-groups` commands make it possible to determine which groups are implemented by the SSL library for a particular TLS version or range of versions matching an SSL_CTX. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26220)	2025-02-14 10:50:58 +01:00
Viktor Dukhovni	d2136d9e73	Multi-variant ML-KEM ... This introduces support for ML-KEM-512 and ML-KEM-1024 using the same underlying implementation parameterised by a few macros for the associated types and constants. KAT tests are added for ML-KEM 512 and 1024, to complement the previous tests for ML-KEM-768. MLKEM{512,768,1024} TLS "group" codepoints are updated to match the final IANA assigments and to make the additional KEMs known to the TLS layer. The pure-QC MLKEMs are not in the default list of supported groups, and need to be explicitly enabled by the application. Future work will introduce support for hybrids, and for more fine-grained policy of which keyshares a client should send by default, and when a server should request (HRR) a new mutually-supported group that was not sent. Tests for ML-KEM key exchange added to sslapitest to make sure that our TLS client MLKEM{512,768,1024} implementations interoperate with our TLS server, and that MLKEM* are not negotiated in TLS 1.2. Tests also added to excercise non-derandomised ML-KEM APIs, both directly (bypassing the provider layer), and through the generic EVP KEM API (exercising the provider). These make sure that RNG input is used correctly (KAT tests bypass the RNG by specifying seeds). The API interface to the provider takes an "const ML_KEM_VINFO" pointer, (obtained from ossl_ml_kem_get_vinfo()). This checks input and output buffer sizes before passing control to internal code that assumes correctly sized (for each variant) buffers. The original BoringSSL API was refactored to eliminate the opaque public/private key structure wrappers, since these structures are an internal detail between libcrypto and the provider, they are not part of the public (EVP) API. New "clangover" counter-measures added, refined with much appreciated input from David Benjamin (Chromium). The internal steps of "encrypt_cpa" were reordered to reduce the working-set size of the algorithm, now needs space for just two temporary "vectors" rather than three. The "decap" function now process the decrypted message in one call, rather than three separate calls to scalar_decode_1, scalar_decompress and scalar_add. Some loops were unrolled, improving performance of en/decapsulate (pre-expanded vectors and matrix) by around 5%. To handle, however unlikely, the SHA3 primitives not behaving like "pure" functions and failing, the implementation of `decap` was modifed: - To use the KDF to compute the Fujisaki-Okamoto (FO) failure secret first thing, and if that fails, bail out returning an error, a shared secret is still returned at random from the RNG, but it is OK for the caller to not use it. - If any of the subsequently used hash primitives fail, use the computed FO failure secret (OK, despite no longer constant-time) and return success (otherwise the RNG would replace the result). - We quite reasonably assume that chosen-ciphertext attacks (of the correct length) cannot cause hash functions to fail in a manner the depends on the private key content. Support for ML-KEM-512 required adding a centered binomial distribution helper function to deal with η_1 == 3 in just that variant. Some additional comments were added to highlight how the code relates to the ML-KEM specification in FIPS 203. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26172)	2025-02-14 10:50:57 +01:00