662 Commits

Author	SHA1	Message	Date
Jakub Jelen	11c4979b86	doc: Add missing commas ... CLA: trivial Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28493) (cherry picked from commit 1199882de6)	2025-09-11 16:03:53 +10:00
openssl-machine	c1a2246377	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 11:59:57 +00:00
Tomas Mraz	6c150eacc6	Document that FIPS provider cannot be used by multiple libcryptos ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27702) (cherry picked from commit 08b2042a20)	2025-05-30 08:09:18 +10:00
Norbert Pocs	0190b9f424	Document EVP_CIPHER failure for missing provider function ... When writing a new CIPHER implementation the OSSL_FUNC_cipher_get_params must be present, otherwise the fetch fails. This behaviour is seen in function evp_cipher_cache_constants@crypto/evp/evp_lib.c. Resolves: #25801 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27696) (cherry picked from commit 3423c30db3) (cherry picked from commit 8ff81f95b8)	2025-05-28 10:36:16 +02:00
Christian Wansart	1d02258fe8	Typo in TLS introduction ... CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27455) (cherry picked from commit 9eb2c13432)	2025-04-23 11:22:08 +02:00
Dr. David von Oheimb	1f238535a5	provider-signature.pod: fix typos (digeset -> digest) ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27372) (cherry picked from commit 7d14d1c46a)	2025-04-18 15:40:41 +01:00
Dr. David von Oheimb	c7ddf3aa1f	provider-signature.pod: fix doc of OSSL_SIGNATURE_PARAM_ALGORITHM_ID, describing its relevance ... This provides a fix for the documentation part of #22932. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27372) (cherry picked from commit 23e3b3c0c5)	2025-04-18 15:40:41 +01:00
Mironenko	7724865a32	Fix OSSL_FUNC_keymgmt_load declaration in man7/provider-keymgmt ... OSSL_FUNC_keymgmt_load prototype declared in man7 does not match the actual OSSL_FUNC_keymgmt_load prototype declared in include/openssl/core_dispatch.h. This commit fixes the prototype in man7. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27189) (cherry picked from commit ada231523f)	2025-04-16 09:50:30 +01:00
Richard Levitte	cb58b675cf	In doc/man7/provider-{en,de}coder.pod, clarify where properties are defined ... Fixes #27126 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27132) (cherry picked from commit a006b0a089)	2025-03-26 14:04:24 +01:00
Jon Ericson	c7f3e55930	Change documentation to point to new wiki location ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27081) (cherry picked from commit da8de0e8dd)	2025-03-25 20:25:40 +01:00
Pauli	475343cfac	doc: document that the FIPS provider doesn't support deterministic ECDSA sigs ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26880) (cherry picked from commit 53c54b13ac)	2025-02-25 10:42:08 +01:00
openssl-machine	06243d4e86	Copyright year updates ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-02-11 14:32:03 +00:00
Richard Levitte	17232fcc34	Fix documentation of OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION ... This drops OSSL_PKEY_PARAM_IMPLICIT_REJECTION - which is a meaningless name - everywhere apart from still existing (for API stability, in case someone uses that macro). Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26421) (cherry picked from commit 1df07c761b)	2025-01-17 18:55:12 +01:00
Michael Baentsch	343236ae52	Improve documentation about duplicate algorithm registrations ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25624) (cherry picked from commit 37aa1143c3)	2024-10-23 15:12:20 +02:00
Dr. David von Oheimb	754b2683cd	improve and move text on OPENSSL_TRACE from doc/man1/openssl.pod to doc/man7/openssl-env.pod ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25540) (cherry picked from commit ee0bf38e87)	2024-10-09 12:11:16 +02:00
Dimitri John Ledkov	d52997f5b6	doc: EVP_KDF document the semantic meaning of output ... Explicitely document what semantic meaning do various EVP_KDF algorithms produce. PBKDF2 produces cryptographic keys that are subject to cryptographic security measures, for example as defined in NIST SP 800-132. All other algorithms produce keying material, not subject to explicit output length checks in any known standards. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25610) (cherry picked from commit 6f08353a4b)	2024-10-08 16:06:23 +02:00
Vladimir Kotal	72580a75af	document the format of DSA signature ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23762) (cherry picked from commit e7abc2118f)	2024-09-23 22:37:26 +02:00
Michael Baentsch	99c05aae88	document provider dependency handling ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24884) (cherry picked from commit e8498dc645)	2024-09-11 09:33:52 +02:00
Tomas Mraz	96782e34dd	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-09-03 14:44:27 +02:00
Clemens Lang	589286efca	doc: Document properties param for Argon2 KDF ... The Argon2 KDF uses OSSL_KDF_PARAM_PROPERTIES to fetch implementations of blake2bmac and blake2b512 if ctx->mac and ctx->md are NULL. This isn't documented in the manpage, so users that might, for example, want to fetch an instance of Argon2 with the -fips property query to obtain a working Argon2 KDF even though the default property query requires fips=yes are left wondering why this fails. Fortunately, EVP_KDF(3)/PARAMETERS already explains what the properties are used for, so we really just need to add a single line. Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25306) (cherry picked from commit 6772c2ab1b)	2024-08-29 19:20:27 +02:00
Tomas Mraz	bfb7d25632	EVP_PKEY-DH.pod: Clarify the manpage in regards to DH and DHX types ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/24819) (cherry picked from commit cf3d65b866)	2024-07-17 16:39:14 +02:00
Tomas Mraz	45b51c4cb6	Document that DH and DHX key types cannot be used together in KEX ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/24819) (cherry picked from commit 45611a8a89)	2024-07-17 16:39:13 +02:00
Et7f3	c9abe84dd7	ossl_store.pod: Correct the example of OSSL_STORE API usage ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24056) (cherry picked from commit d5412c94a3)	2024-06-19 18:57:38 +02:00
Tomas Mraz	ecb03cdeaa	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-06-04 14:50:58 +02:00
Hubert Kario	50a8198f4e	Be more explicit about RSAES-PKCS#1v1.5 error handling ... And add a note how to perform side-channel free error stack handling. Signed-off-by: Hubert Kario <hkario@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24159) (cherry picked from commit 9816127463)	2024-04-22 15:57:37 +02:00
slontis	e5b1c72c10	Fix migration guide mappings for i2o/o2i_ECPublicKey ... Fixes #23854 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24041) (cherry picked from commit 6594baf645)	2024-04-19 14:31:04 -04:00
Richard Levitte	4523cbe81c	OSSL_STORE: Add reference docs for the built-in Windows store implementation ... Fixes openssl/project#422 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24170) (cherry picked from commit faa4a10ebe)	2024-04-19 14:21:26 +02:00
Neil Horman	2d1508f018	Add docs noting requirements for SM2 signing ... Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23887) (cherry picked from commit 4feb4a2b2c)	2024-04-09 20:41:53 +02:00
slontis	92d05708d1	Add demo for ECDH key exchange ... Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22916) (cherry picked from commit 56e4d112ae)	2024-04-09 20:15:56 +02:00
Richard Levitte	0ce7d1f355	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-03-20 13:07:54 +01:00
Hugo Landau	e98940d6f6	Enable qlog support by default ... Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23744)	2024-03-06 20:44:48 +00:00
pohsingwu	fbce6ebf70	Implement PCT for EDDSA ... According to FIPS 140-3 IG 10.3.A Additonal Comment 1, a PCT shall be performed consistent with the intended use of the keys. This commit implements PCT for EDDSA via performing sign and verify operations after key generated. Also use the same pairwise test logic in EVP_PKEY_keygen and EVP_PKEY_pairwise_check for EDDSA in FIPS_MODULE. Add OSSL_SELF_TEST_DESC_PCT_EDDSA to OSSL_PROVIDER-FIPS page. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23408)	2024-03-01 11:06:03 +01:00
Hugo Landau	5f603a12cd	QUIC QLOG: Minor manpage updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)	2024-02-02 11:50:30 +00:00
Hugo Landau	1aeab15f46	QUIC QLOG: Minor doc updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)	2024-02-02 11:50:30 +00:00
Hugo Landau	ae300c0d5e	Minor updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)	2024-02-02 11:50:29 +00:00
Hugo Landau	de60b122b2	QLOG: Editorial fixes (QLOG is spelled 'qlog') ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)	2024-02-02 11:50:29 +00:00
Hugo Landau	82973bcf87	QLOG: Add manpage openssl-qlog(7) ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22037)	2024-02-02 11:50:03 +00:00
Tomas Mraz	dbb478a51d	Document the implications of setting engine-based low-level methods ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23063)	2024-01-31 18:40:30 +01:00
James Muir	ff7b32e1d7	doc: "digest" must be explicitly set with deterministic ECDSA/DSA ... Fixes #23205 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23250)	2024-01-11 10:15:03 +01:00
Neil Horman	f3be536686	Augment RSA provider to generate CRT coefficients on EVP_PKEY_fromdata() ... It would be helpful to be able to generate RSA's dmp1/dmq1/iqmp values when not provided in the param list to EVP_PKEY_fromdata. Augment the provider in ossl_rsa_fromdata to preform this generation iff: a) At least p q n e and e are provided b) the new parameter OSSL_PARAM_RSA_DERIVE_PQ is set to 1 Fixes #21826 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21875)	2024-01-09 12:03:32 +01:00
rilysh	cf8fea86f7	provider-keymgmt.pod: fix typo ... Fix a typo from asymmmetric to asymmetric CLA: trivial Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23164)	2024-01-03 13:14:00 +01:00
Neil Horman	94be985cbc	gate calling of evp_method_id on having a non-zero name id ... If a name is passed to EVP_<OBJ>_fetch of the form: name1:name2:name3 The names are parsed on the separator ':' and added to the store, but during the lookup in inner_evp_generic_fetch, the subsequent search of the store uses the full name1:name2:name3 string, which fails lookup, and causes subsequent assertion failures in evp_method_id. instead catch the failure in inner_evp_generic_fetch and return an error code if the name_id against a colon separated list of names fails. This provides a graceful error return path without asserts, and leaves room for a future feature in which such formatted names can be parsed and searched for iteratively Add a simple test to verify that providing a colon separated name results in an error indicating an invalid lookup. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/23110)	2024-01-01 12:57:59 -05:00
Dimitri Papadopoulos	7deb2b433a	Fix typos found by codespell in man pages ... Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23131)	2023-12-29 10:13:01 +01:00
Neil Horman	62457fd941	Ignore OSSL_MAC_PARAM_DIGEST_NOINIT/OSSL_MAC_PARAM_DIGEST_ONESHOT ... The hmac flags OSSL_MAC_PARAM_DIGEST_NOINIT and OSSL_MAC_PARAM_DIGEST_ONESHOT dont add any real value to the provider, and the former causes a segfault when the provider attempts to call EVP_MAC_init on an EVP_MAC object that has been instructed not to be initalized (as the update function will not have been set in the MAC object, which is unilaterally called from EVP_MAC_init Remove the tests for the above flags, and document them as being deprecated and ignored. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23054)	2023-12-26 10:36:00 -05:00
Tomas Mraz	8f0f814d79	AES: Document that the XTS, SIV, WRAP modes do not support streaming ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23028)	2023-12-22 13:42:28 +01:00
Tomas Mraz	e2f9c2dd37	SM4: Document that the XTS mode does not support streaming ... Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23028)	2023-12-22 13:42:28 +01:00
slontis	f02d33118b	Removed extra spaces in documentation ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22968)	2023-12-12 20:00:05 +01:00
Dr. David von Oheimb	a149e8e108	provider-storemgmt.pod: fix nits (unclosed '<' around name) ... Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22942)	2023-12-12 19:52:02 +01:00
Matthias St. Pierre	6ebdbba76a	doc: improve documentation of EVP in-place encryption ... The EVP interface explicitly allows in-place encryption/decryption, but this fact is just 'partially' documented in `EVP_EncryptUpdate(3)` (pun intended): the manual page mentions only operation failure in case of 'partial' overlaps. This is not even correct, because the check for partially overlapping buffers is only implemented in legacy code paths. Currently, in-place encryption/decryption is only documented for RSA (`RSA_public_encrypt(3)`) and DES (`DES_ecb_encrypt(3)`), as well as in the provider interface (`provider-cipher(7)`). This commit amends `EVP_EncryptUpdate(3)` and `provider-cipher(7)` to make the front-end and back-end documentation consistent. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22875)	2023-12-12 10:40:56 +01:00
James Muir	8da20b30da	doc: improve display of KECCAK-KMAC128, KECCAK-KMAC256 defs ... Do not allow mid-expression line breaks. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22814)	2023-12-04 09:33:25 +01:00