Deprecate the low level MD5 functions.

Use of the low level MD5 functions has been informally discouraged for a long
time.  We now formally deprecate them.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10791)

diff --git a/apps/speed.c b/apps/speed.c
index 773bd222f236675c214f53a77edadc78249d3ddc..dd07527cdeff041f658c180eb3095ee62192bff9 100644 (file)
--- a/apps/speed.c
+++ b/apps/speed.c
@@ -338,7 +338,7 @@ static const OPT_PAIR doit_choices[] = {
 #if !defined(OPENSSL_NO_MD4) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     {"md4", D_MD4},
 #endif
-#ifndef OPENSSL_NO_MD5
+#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     {"md5", D_MD5},
     {"hmac", D_HMAC},
 #endif
@@ -623,7 +623,7 @@ static int EVP_Digest_MD4_loop(void *args)
 }
 #endif
 
-#ifndef OPENSSL_NO_MD5
+#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
 static int MD5_loop(void *args)
 {
     loopargs_t *tempargs = *(loopargs_t **) args;
@@ -2289,7 +2289,7 @@ int speed_main(int argc, char **argv)
     }
 #endif
 
-#ifndef OPENSSL_NO_MD5
+#if !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     if (doit[D_MD5]) {
         for (testnum = 0; testnum < size_num; testnum++) {
             print_message(names[D_MD5], c[D_MD5][testnum], lengths[testnum],

diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c
index fa838bf4b2468c16d0769d6ab9e25e255c0debc5..d3b1dfe2588163a92568fc987405a9ae7cfb64c8 100644 (file)
--- a/crypto/evp/e_rc4_hmac_md5.c
+++ b/crypto/evp/e_rc4_hmac_md5.c
@@ -8,8 +8,8 @@
  */
 
 /*
- * RC4 low level APIs are deprecated for public use, but still ok for internal
- * use.
+ * MD5 and RC4 low level APIs are deprecated for public use, but still ok for
+ * internal use.
  */
 #include "internal/deprecated.h"
 

diff --git a/crypto/evp/legacy_md5.c b/crypto/evp/legacy_md5.c
index 9bb1258e47e000103880022589e7f3b476dd9d5d..3ca5305622a407fb9a7ea1023afbc36f817f6d64 100644 (file)
--- a/crypto/evp/legacy_md5.c
+++ b/crypto/evp/legacy_md5.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * MD5 low level APIs are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include <openssl/md5.h>
 #include "crypto/evp.h"
 #include "legacy_meth.h"

diff --git a/crypto/evp/legacy_md5_sha1.c b/crypto/evp/legacy_md5_sha1.c
index 380cdf4a79a3569da5bbb4ea61735f807f8eaea4..9910892af805a443d2f70e56623e8da49ca85937 100644 (file)
--- a/crypto/evp/legacy_md5_sha1.c
+++ b/crypto/evp/legacy_md5_sha1.c
@@ -8,7 +8,7 @@
  */
 
 /*
- * SHA-1 low level APIs are deprecated for public use, but still ok for
+ * MD5 and SHA-1 low level APIs are deprecated for public use, but still ok for
  * internal use.  The prov/md5_sha1.h include requires this, but this must
  * be the first include loaded.
  */

diff --git a/crypto/md5/md5_dgst.c b/crypto/md5/md5_dgst.c
index b594652f0dddf7a7036c4e59d147ca6cbb3fa47d..72b641f4f85d3d26e9838d4363974151a0f7d397 100644 (file)
--- a/crypto/md5/md5_dgst.c
+++ b/crypto/md5/md5_dgst.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * MD5 low level APIs are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include <stdio.h>
 #include "md5_local.h"
 #include <openssl/opensslv.h>

diff --git a/crypto/md5/md5_one.c b/crypto/md5/md5_one.c
index c31760bb39784a89ba0c9ac93e769fc712cd8eea..96f4f96f4276d221c2f468d6542ae6bd7e22fdef 100644 (file)
--- a/crypto/md5/md5_one.c
+++ b/crypto/md5/md5_one.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * MD5 low level APIs are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include <stdio.h>
 #include <string.h>
 #include <openssl/md5.h>

diff --git a/crypto/md5/md5_sha1.c b/crypto/md5/md5_sha1.c
index fa2ccde30f44e12c93c1e6e23998edd93acd6be6..054f634ac82d4ae37d652865c198f9a0cc0bbe6e 100644 (file)
--- a/crypto/md5/md5_sha1.c
+++ b/crypto/md5/md5_sha1.c
@@ -8,7 +8,7 @@
  */
 
 /*
- * SHA-1 low level APIs are deprecated for public use, but still ok for
+ * MD5 and SHA-1 low level APIs are deprecated for public use, but still ok for
  * internal use.
  */
 #include "internal/deprecated.h"

diff --git a/doc/man3/MD5.pod b/doc/man3/MD5.pod
index 8efc8240aee3708fd7773e3f5f7bec4fe42d5349..8d24e5ad0481b6099a7bc322464ed2b4a9f5cb5f 100644 (file)
--- a/doc/man3/MD5.pod
+++ b/doc/man3/MD5.pod
@@ -35,6 +35,10 @@ L<openssl_user_macros(7)>:
 
  #include <openssl/md5.h>
 
+Deprecated since OpenSSL 3.0, can be hidden entirely by defining
+B<OPENSSL_API_COMPAT> with a suitable version value, see
+L<openssl_user_macros(7)>:
+
  unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md);
 
  int MD5_Init(MD5_CTX *c);

diff --git a/include/openssl/md5.h b/include/openssl/md5.h
index 0a75b084a291f28319b931187c63e04e6feaf507..c61b3d94c8f2ffd17b4418d4b8a584eb28b91deb 100644 (file)
--- a/include/openssl/md5.h
+++ b/include/openssl/md5.h
@@ -19,22 +19,24 @@
 # include <openssl/opensslconf.h>
 
 # ifndef OPENSSL_NO_MD5
-# include <openssl/e_os2.h>
-# include <stddef.h>
-# ifdef  __cplusplus
+#  include <openssl/e_os2.h>
+#  include <stddef.h>
+#  ifdef  __cplusplus
 extern "C" {
-# endif
+#  endif
+
+#  define MD5_DIGEST_LENGTH 16
 
+#  if !defined(OPENSSL_NO_DEPRECATED_3_0)
 /*
  * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
  * ! MD5_LONG has to be at least 32 bits wide.                     !
  * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
  */
-# define MD5_LONG unsigned int
+#   define MD5_LONG unsigned int
 
-# define MD5_CBLOCK      64
-# define MD5_LBLOCK      (MD5_CBLOCK/4)
-# define MD5_DIGEST_LENGTH 16
+#   define MD5_CBLOCK      64
+#   define MD5_LBLOCK      (MD5_CBLOCK/4)
 
 typedef struct MD5state_st {
     MD5_LONG A, B, C, D;
@@ -42,15 +44,18 @@ typedef struct MD5state_st {
     MD5_LONG data[MD5_LBLOCK];
     unsigned int num;
 } MD5_CTX;
+#  endif
 
-int MD5_Init(MD5_CTX *c);
-int MD5_Update(MD5_CTX *c, const void *data, size_t len);
-int MD5_Final(unsigned char *md, MD5_CTX *c);
-unsigned char *MD5(const unsigned char *d, size_t n, unsigned char *md);
-void MD5_Transform(MD5_CTX *c, const unsigned char *b);
-# ifdef  __cplusplus
+DEPRECATEDIN_3_0(int MD5_Init(MD5_CTX *c))
+DEPRECATEDIN_3_0(int MD5_Update(MD5_CTX *c, const void *data, size_t len))
+DEPRECATEDIN_3_0(int MD5_Final(unsigned char *md, MD5_CTX *c))
+DEPRECATEDIN_3_0(unsigned char *MD5(const unsigned char *d, size_t n,
+                                    unsigned char *md))
+DEPRECATEDIN_3_0(void MD5_Transform(MD5_CTX *c, const unsigned char *b))
+
+#  ifdef  __cplusplus
 }
-# endif
+#  endif
 # endif
 
 #endif

diff --git a/providers/implementations/ciphers/cipher_rc4_hmac_md5.c b/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
index 876c81d34dc5186b16fc608daee4fb78843bd6b6..55bdfe7384384db7added2c2fa075c06e6a491ec 100644 (file)
--- a/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
+++ b/providers/implementations/ciphers/cipher_rc4_hmac_md5.c
@@ -10,8 +10,8 @@
 /* Dispatch functions for RC4_HMAC_MD5 cipher */
 
 /*
- * RC4 low level APIs are deprecated for public use, but still ok for internal
- * use.
+ * MD5 and RC4 low level APIs are deprecated for public use, but still ok for
+ * internal use.
  */
 #include "internal/deprecated.h"
 

diff --git a/providers/implementations/ciphers/cipher_rc4_hmac_md5_hw.c b/providers/implementations/ciphers/cipher_rc4_hmac_md5_hw.c
index 767a1e3e6bdc8f334b940994c873f9e2eba025d2..253bb54faf9117a749da78e4a006f9d7ada11735 100644 (file)
--- a/providers/implementations/ciphers/cipher_rc4_hmac_md5_hw.c
+++ b/providers/implementations/ciphers/cipher_rc4_hmac_md5_hw.c
@@ -10,8 +10,8 @@
 /* RC4_HMAC_MD5 cipher implementation */
 
 /*
- * RC4 low level APIs are deprecated for public use, but still ok for internal
- * use.
+ * MD5 and RC4 low level APIs are deprecated for public use, but still ok for
+ * internal use.
  */
 #include "internal/deprecated.h"
 

diff --git a/providers/implementations/digests/md5_prov.c b/providers/implementations/digests/md5_prov.c
index 7b92b6139c068ea236081c3f95d8fd9c08832064..73071cdd958564cca9b7e370816c239ed62f6170 100644 (file)
--- a/providers/implementations/digests/md5_prov.c
+++ b/providers/implementations/digests/md5_prov.c
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/*
+ * MD5 low level APIs are deprecated for public use, but still ok for
+ * internal use.
+ */
+#include "internal/deprecated.h"
+
 #include <openssl/crypto.h>
 #include <openssl/md5.h>
 #include "prov/digestcommon.h"

diff --git a/providers/implementations/digests/md5_sha1_prov.c b/providers/implementations/digests/md5_sha1_prov.c
index cd6eab6b092fd59d64761728f0bc433e68878182..4d87e2fec60661562c6e42b5230b96034846beb5 100644 (file)
--- a/providers/implementations/digests/md5_sha1_prov.c
+++ b/providers/implementations/digests/md5_sha1_prov.c
@@ -8,7 +8,7 @@
  */
 
 /*
- * SHA-1 low level APIs are deprecated for public use, but still ok for
+ * MD5 and SHA-1 low level APIs are deprecated for public use, but still ok for
  * internal use.
  */
 #include "internal/deprecated.h"

diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index 20a2aa3599081a6998230a44bb5e3e4461ef38c5..888ff3c2f691771911cc3e8ab51524c66951864d 100644 (file)
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -8,7 +8,7 @@
  */
 
 /*
- * SHA-1 low level APIs are deprecated for public use, but still ok for
+ * MD5 and SHA-1 low level APIs are deprecated for public use, but still ok for
  * internal use.
  */
 #include "internal/deprecated.h"

diff --git a/util/libcrypto.num b/util/libcrypto.num
index ede0a40e8bae269101912e70abad5ca7b7f3e2c4..7ae99d1f6c61b95382ecc28b23ae2104f56cfc2d 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -1001,7 +1001,7 @@ i2d_PKCS8PrivateKey_nid_bio             1026      3_0_0   EXIST::FUNCTION:
 ERR_put_error                           1027   3_0_0   NOEXIST::FUNCTION:
 ERR_add_error_data                      1028   3_0_0   EXIST::FUNCTION:
 X509_ALGORS_it                          1029   3_0_0   EXIST::FUNCTION:
-MD5_Update                              1030   3_0_0   EXIST::FUNCTION:MD5
+MD5_Update                              1030   3_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0,MD5
 X509_policy_check                       1031   3_0_0   EXIST::FUNCTION:
 X509_CRL_METHOD_new                     1032   3_0_0   EXIST::FUNCTION:
 ASN1_ANY_it                             1033   3_0_0   EXIST::FUNCTION:
@@ -1252,7 +1252,7 @@ ASN1_INTEGER_set_int64                  1280      3_0_0   EXIST::FUNCTION:
 ASN1_TIME_free                          1281   3_0_0   EXIST::FUNCTION:
 i2o_SCT_LIST                            1282   3_0_0   EXIST::FUNCTION:CT
 AES_encrypt                             1283   3_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0
-MD5_Init                                1284   3_0_0   EXIST::FUNCTION:MD5
+MD5_Init                                1284   3_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0,MD5
 UI_add_error_string                     1285   3_0_0   EXIST::FUNCTION:
 X509_TRUST_cleanup                      1286   3_0_0   EXIST::FUNCTION:
 PEM_read_X509                           1287   3_0_0   EXIST::FUNCTION:STDIO
@@ -1835,7 +1835,7 @@ RSA_verify_ASN1_OCTET_STRING            1877      3_0_0   EXIST::FUNCTION:RSA
 SCT_set_log_entry_type                  1878   3_0_0   EXIST::FUNCTION:CT
 BN_new                                  1879   3_0_0   EXIST::FUNCTION:
 X509_OBJECT_retrieve_by_subject         1880   3_0_0   EXIST::FUNCTION:
-MD5_Final                               1881   3_0_0   EXIST::FUNCTION:MD5
+MD5_Final                               1881   3_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0,MD5
 X509_STORE_set_verify_cb                1882   3_0_0   EXIST::FUNCTION:
 OCSP_REQUEST_print                      1883   3_0_0   EXIST::FUNCTION:OCSP
 CMS_add1_crl                            1884   3_0_0   EXIST::FUNCTION:CMS
@@ -1876,7 +1876,7 @@ CMS_SignedData_init                     1920      3_0_0   EXIST::FUNCTION:CMS
 X509_REQ_free                           1921   3_0_0   EXIST::FUNCTION:
 ASN1_INTEGER_set                        1922   3_0_0   EXIST::FUNCTION:
 EVP_DecodeFinal                         1923   3_0_0   EXIST::FUNCTION:
-MD5_Transform                           1925   3_0_0   EXIST::FUNCTION:MD5
+MD5_Transform                           1925   3_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0,MD5
 SRP_create_verifier_BN                  1926   3_0_0   EXIST::FUNCTION:SRP
 ENGINE_register_all_EC                  1927   3_0_0   EXIST::FUNCTION:ENGINE
 EVP_camellia_128_ofb                    1928   3_0_0   EXIST::FUNCTION:CAMELLIA
@@ -3003,7 +3003,7 @@ EVP_des_ede_cfb64                       3067      3_0_0   EXIST::FUNCTION:DES
 d2i_RSAPrivateKey                       3068   3_0_0   EXIST::FUNCTION:RSA
 ERR_load_BN_strings                     3069   3_0_0   EXIST::FUNCTION:
 BF_encrypt                              3070   3_0_0   EXIST::FUNCTION:BF,DEPRECATEDIN_3_0
-MD5                                     3071   3_0_0   EXIST::FUNCTION:MD5
+MD5                                     3071   3_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0,MD5
 BN_GF2m_arr2poly                        3072   3_0_0   EXIST::FUNCTION:EC2M
 EVP_PKEY_meth_get_ctrl                  3073   3_0_0   EXIST::FUNCTION:
 i2d_X509_REQ_bio                        3074   3_0_0   EXIST::FUNCTION: