Shane Lontis [Fri, 25 Sep 2020 03:50:25 +0000 (13:50 +1000)]
Fix bug in EDDSA speed test
The pkey created in one loop was being fed into the keygen of the next loop - since it was not set to NULL after the
free. This meant that the 2 EVP_MD_CTX objects that still had ref counts to this key were getting confused.
All other tests clear the key after freeing the key if they loop (some do this by declaring/initing the pkey inside the loop).
The offending code is a recent addition to the speed app.
This was found using the -async_jobs option.
Similar code was tried for an RSA key using 111 which resulted in the same issue.
Found while trying to test issue #128867 (It is not known if this will fix that issue yet).
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12975)
jwalch [Thu, 24 Sep 2020 15:43:06 +0000 (11:43 -0400)]
en EVP_PKEY_CTX_set_rsa_keygen_pubexp() BIGNUM management
Fixes #12635
As discussed in the issue, supporting the set0-like semantics long-term is not necessarily desirable, although necessary for short-term compatibility concerns. So I've deprecated the original method and added an equivalent that is explicitly labelled as set1.
I tried to audit existing usages of the (now-deprecated) API and update them to use set1 if that appeared to align with their expectations.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12917)
Shane Lontis [Tue, 22 Sep 2020 01:40:46 +0000 (11:40 +1000)]
Remove openssl provider app
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12943)
Shane Lontis [Tue, 22 Sep 2020 01:02:53 +0000 (11:02 +1000)]
Update openssl list to support new provider objects.
Added Keymanager, signatures, kem, asymciphers and keyexchange.
Added -select option so that specific algorithms are easier to view when using -verbose
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12943)
Shane Lontis [Tue, 22 Sep 2020 00:38:13 +0000 (10:38 +1000)]
Add EVP_ASYM_CIPHER_gettable_ctx_params() and EVP_ASYM_CIPHER_settable_ctx_params()
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12943)
Shane Lontis [Tue, 22 Sep 2020 00:36:50 +0000 (10:36 +1000)]
Add EVP_KEM_gettable_ctx_params() and EVP_KEM_settable_ctx_params()
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12943)
Randall S. Becker [Thu, 24 Sep 2020 13:16:37 +0000 (08:16 -0500)]
Modified rand_cpu_x86.c to support builtin hardware randomizer on HPE NonStop.
CLA: Permission is granted by the author to the OpenSSL team to use these modifications.
Fixes #12903
Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12923)
Matt Caswell [Fri, 18 Sep 2020 11:10:21 +0000 (12:10 +0100)]
Document the provider side SM2 Asymmetric Cipher support
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12913)
Matt Caswell [Fri, 18 Sep 2020 10:57:24 +0000 (11:57 +0100)]
Extend the SM2 asym cipher test
Ensure we test getting and setting ctx params
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12913)
Matt Caswell [Fri, 18 Sep 2020 10:06:34 +0000 (11:06 +0100)]
Remove some dead SM2 code
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12913)
Matt Caswell [Fri, 18 Sep 2020 09:41:58 +0000 (10:41 +0100)]
Clean up some SM2 related TODOs in the tests
Now that we have full SM2 support, we can remove some TODOs from the tests.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12913)
Matt Caswell [Fri, 18 Sep 2020 08:55:16 +0000 (09:55 +0100)]
Move SM2 asymmetric encryption to be available in the default provider
Fixes #12908
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12913)
Richard Levitte [Wed, 23 Sep 2020 14:52:13 +0000 (16:52 +0200)]
Build: Make NonStop shared libraries only export selected symbols
We can now re-enable test/recipes/01-test_symbol_presence.t for NonStop.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12962)
Richard Levitte [Wed, 23 Sep 2020 04:18:06 +0000 (06:18 +0200)]
TEST: Remove use of EVP_PKEY_set_alias_type() in test/evp_extra_test.c
We already test EVP_PKEY_set_alias_type() quite thoroughly in
test/ecdsatest.c, that should be enough.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12920)
Richard Levitte [Fri, 18 Sep 2020 18:46:08 +0000 (20:46 +0200)]
EVP: Enforce that EVP_PKEY_set_alias_type() only works with legacy keys
This also deprecates the function, as it is not necessary any more,
and should fall out of use.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12920)
Richard Levitte [Wed, 23 Sep 2020 15:59:39 +0000 (17:59 +0200)]
Configuration: Don't have shared libraries depend on themselves
The NonStop config attributes mean that there's no separate "simple"
and "full" shared library name, they are the same. Because we assumed
that they would always differ, we ended up with this dependency:
libcrypto.so: libcrypto.so
A simple fix was all that was needed to clear that.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12960)
Richard Levitte [Wed, 23 Sep 2020 10:54:56 +0000 (12:54 +0200)]
Configuration: Make it possible to have an argument file
Some compilers / linkers allow arguments to be given in a file instead
of on the command line. We make it possible to specify this by giving
the compiler / linker flag for it, using the config attribute
'shared_argfileflag'.
This currently only impacts the build of shared libraries, as those
are potentially made up of a massive amount of object files, which has
been reported to overwhelm the command line on some platforms.
Fixes #12797
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12960)
Richard Levitte [Fri, 25 Sep 2020 02:12:22 +0000 (12:12 +1000)]
Hide ECX_KEY again
ECX_KEY was not meant for public consumption, it was only to be
accessed indirectly via EVP routines. However, we still need internal
access for our decoders.
This partially reverts
7c664b1f1b5f60bf896f5fdea5c08c401c541dfe
Fixes #12880
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12956)
Shane Lontis [Wed, 23 Sep 2020 01:49:38 +0000 (11:49 +1000)]
Add key length check to rsa_kem operation.
This uses similiar code used by other rsa related operations.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12955)
Dr. David von Oheimb [Fri, 18 Sep 2020 08:36:15 +0000 (10:36 +0200)]
Test.pm: Some clarifications added to the documentation
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12893)
Dr. David von Oheimb [Thu, 17 Sep 2020 07:55:28 +0000 (09:55 +0200)]
apps/ca.c: Rename confusing variable 'req' to 'template_cert' in certify_cert()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12893)
Dr. David von Oheimb [Wed, 16 Sep 2020 10:52:09 +0000 (12:52 +0200)]
Prune low-level ASN.1 parse errors from error queue in decoder_process()
Fixes #12840
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12893)
Dr. David von Oheimb [Wed, 16 Sep 2020 23:39:00 +0000 (01:39 +0200)]
load_key_certs_crls(): Restore output of fatal errors
Also improve credentials loading diagnostics for many apps.
Fixes #12840
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12893)
Pauli [Fri, 18 Sep 2020 02:12:33 +0000 (12:12 +1000)]
ACVP: add test case for DRBG
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12905)
Richard Levitte [Mon, 21 Sep 2020 11:14:26 +0000 (13:14 +0200)]
Use OPENSSL_SYS_TANDEM instead of OPENSSL_SYSNAME_TANDEM
This streamlines with all other config targets, and draws from the
'sys_id' config attribute.
Fixes #12858
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12933)
Richard Levitte [Mon, 21 Sep 2020 11:13:25 +0000 (13:13 +0200)]
Configure: Show 'enable' and 'disable' config attributes
This makes a difference for './Configure HASH' and './Configure TABLE'
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12933)
Richard Levitte [Mon, 21 Sep 2020 11:11:28 +0000 (13:11 +0200)]
Configuration: Streamline NonStop entries
Because there are many combinations and much repetition, we add a large
number of templates to cover all aspects, and make the actual config
entries inherit from the templates combined.
Fixes #12858
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12933)
Hu Keping [Wed, 9 Sep 2020 16:01:17 +0000 (16:01 +0000)]
Simplify the tarball generating scripts
As per discussed in issue #12364 [1], since the format of git archive is
inferred from the output file, it's safe to remove the pipe for gzip.
[1] https://github.com/openssl/openssl/issues/12364
Fixes #12364
Signed-off-by: Hu Keping <hukeping@huawei.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12841)
Dr. Matthias St. Pierre [Sun, 13 Sep 2020 22:47:26 +0000 (00:47 +0200)]
drbg: revert renamings of the generate and reseed counter
The original names were more intuitive: the generate_counter counts the
number of generate requests, and the reseed_counter counts the number
of reseedings (of the principal DRBG).
reseed_gen_counter -> generate_counter
reseed_prop_counter -> reseed_counter
This is the anologue to commit
8380f453ec81 on the 1.1.1 stable branch.
The only difference is that the second renaming has already been reverted
on the master branch.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12941)
Richard Levitte [Mon, 21 Sep 2020 18:56:34 +0000 (20:56 +0200)]
Configurations/unix-Makefile.tmpl: make cleanup kinder
The removal of certain types of files we structured like this:
-$(RM) `find . {{options}} -print`
This isn't very kind for shells with limited command line lengths
(even when that limit is generous, in our case), so we rewrite those
like this:
-find . {{options}} -exec $(RM) {} \;
Fixes #12938
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12939)
Shane Lontis [Tue, 22 Sep 2020 05:57:19 +0000 (15:57 +1000)]
Fix propq in x942kdf
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:56:11 +0000 (15:56 +1000)]
Fix missing propq in sm2
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:53:58 +0000 (15:53 +1000)]
Fix missing propq in ffc_params_generate
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:53:27 +0000 (15:53 +1000)]
Fix missing propq in ecdh_cms_set_shared_info()
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:51:49 +0000 (15:51 +1000)]
Fix ecx so that is uses a settable propertyquery
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:48:45 +0000 (15:48 +1000)]
Fix ssl_hmac_new() so that it uses the propq
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:45:17 +0000 (15:45 +1000)]
Fix EVP_KDF_scrypt so that is uses a propq for its fetch.
The parameter can be set via settable parameter OSSL_KDF_PARAM_PROPERTIES
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Tue, 22 Sep 2020 05:43:32 +0000 (15:43 +1000)]
Change rsa gen so it can use the propq from OSSL_PKEY_PARAM_RSA_DIGEST
rsa_pss_params_30_fromdata() now uses the OSSL_PKEY_PARAM_RSA_DIGEST_PROPS parameter also.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12944)
Shane Lontis [Mon, 21 Sep 2020 01:42:41 +0000 (11:42 +1000)]
Fix CID
1466709 : Negative value passed to a function that cant be negative in cms_sd.c
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12930)
Shane Lontis [Mon, 21 Sep 2020 01:39:04 +0000 (11:39 +1000)]
Fix CID
1466710 : Resource leak in ec_kmgmt due to new call to ossl_prov_is_running()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12930)
Shane Lontis [Mon, 21 Sep 2020 01:29:30 +0000 (11:29 +1000)]
Fix CID
1466712 : Resource leak in ec_kmgmt due to new callto ossl_prov_is_running()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12930)
Shane Lontis [Mon, 21 Sep 2020 01:09:10 +0000 (11:09 +1000)]
Fix CID
1466713 : Dead code in encode_key2text.c
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12930)
Shane Lontis [Mon, 21 Sep 2020 00:59:20 +0000 (10:59 +1000)]
Fix CID
1466714 : Null pointer dereference in EVP_PKEY_CTX_ctrl() due to new call to evp_pkey_ctx_store_cached_data()
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12930)
Shane Lontis [Mon, 21 Sep 2020 00:47:03 +0000 (10:47 +1000)]
Fix CID
1467068 : Null pointer dereference in self_test.c
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12930)
Pauli [Tue, 22 Sep 2020 05:09:25 +0000 (15:09 +1000)]
rand: add a test case for configuration based random
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12931)
Pauli [Mon, 21 Sep 2020 23:36:53 +0000 (09:36 +1000)]
list: add capability to print details about the current DRBGs
This allows a user to confirm that the DRBG their configuration specified is
being used.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12931)
Pauli [Mon, 21 Sep 2020 23:26:23 +0000 (09:26 +1000)]
drbg: gettable parameters for cipher/digest/mac type.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12931)
Pauli [Mon, 21 Sep 2020 23:25:35 +0000 (09:25 +1000)]
kdf/mac: add name query calls for KDFs and MACs
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12931)
Pauli [Mon, 21 Sep 2020 22:29:58 +0000 (08:29 +1000)]
evp_rand: fix bug in gettable_ctx/settable_ctx calls
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12931)
Pauli [Mon, 21 Sep 2020 06:07:34 +0000 (16:07 +1000)]
Add a "random" configuration section.
This permits the default trio of DRBGs to have their type and parameters set
using configuration.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12931)
Daniel Bevenius [Mon, 21 Sep 2020 13:48:55 +0000 (15:48 +0200)]
DOC: remove OPENSSL_CTX from OSSL_DECODER_CTX_new
This commit changes the man page for OSSL_DECODER_CTX_new by removing
the OPENSSL_CTX parameter which matches the declaration in decoder.h.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12935)
Pauli [Wed, 16 Sep 2020 01:10:01 +0000 (11:10 +1000)]
rand: reference count the EVP_RAND contexts.
This is required before the RAND/DRBG framework can be made user mutable.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12904)
Paul Yang [Fri, 18 Sep 2020 02:27:42 +0000 (10:27 +0800)]
Add auto-gen SM2 der files into .gitignore
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12536)
Paul Yang [Mon, 14 Sep 2020 10:17:35 +0000 (18:17 +0800)]
refactor get params functions
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12536)
Paul Yang [Sun, 13 Sep 2020 12:47:00 +0000 (20:47 +0800)]
support PARAM_SECURITY_BITS for SM2
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12536)
Paul Yang [Sun, 13 Sep 2020 12:31:13 +0000 (20:31 +0800)]
Address review comments
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12536)
Paul Yang [Wed, 4 Mar 2020 15:49:43 +0000 (23:49 +0800)]
Add SM2 signature algorithm to default provider
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12536)
Paul Yang [Sun, 26 Jul 2020 15:25:49 +0000 (23:25 +0800)]
Add SM2 key management
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12536)
Randall S. Becker [Sun, 20 Sep 2020 22:30:14 +0000 (16:30 -0600)]
Added FIPS DEP initialization for the NonStop platform in fips/self_test.c.
CLA: Permission is granted by the author to the OpenSSL team to use these modifications.
Fixes #12918
Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12928)
olszomal [Fri, 19 Jun 2020 13:00:32 +0000 (15:00 +0200)]
Add const to 'ppin' function parameter
CLA: trivial
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #12205
Richard Levitte [Sat, 19 Sep 2020 07:22:34 +0000 (09:22 +0200)]
DOC: POD syntax fixes in doc/man1/openssl-cmp.pod.in
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12924)
Norman Ashley [Fri, 10 Jul 2020 23:01:32 +0000 (19:01 -0400)]
Support keys with RSA_METHOD_FLAG_NO_CHECK with OCSP sign
OCSP_basic_sign_ctx() in ocsp_srv.c , does not check for RSA_METHOD_FLAG_NO_CHECK.
If a key has RSA_METHOD_FLAG_NO_CHECK set, OCSP sign operations can fail
because the X509_check_private_key() can fail.
The check for the RSA_METHOD_FLAG_NO_CHECK was moved to crypto/rsa/rsa_ameth.c
as a common place to check. Checks in ssl_rsa.c were removed.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12419)
(cherry picked from commit
56e8fe0b4efbf582e40ae91319727c9d176c5e1e)
Eric Curtin [Wed, 2 Sep 2020 09:49:47 +0000 (10:49 +0100)]
Increase PSK_MAX_IDENTITY_LEN from 128 to 256
We are considering using the format "host-nqn controller-nqn" for
psk-id in the NVMe-oF/TCP over TLS spec, it's in the current version,
but openssl's limit was 128 upto now, we need a little longer than that.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12771)
Tomas Mraz [Fri, 18 Sep 2020 14:43:00 +0000 (16:43 +0200)]
apps/ocsp: Return non zero exit code with invalid certID
Fixes #7151
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12916)
Rutger Hendriks [Mon, 31 Aug 2020 11:59:51 +0000 (13:59 +0200)]
Increase PSK_MAX_PSK_LEN to 512
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12777)
Tomas Mraz [Fri, 18 Sep 2020 11:59:55 +0000 (13:59 +0200)]
Correct certificate and key names for explicit ec param test
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/12915)
ozppupbg [Mon, 13 Jul 2020 05:04:28 +0000 (07:04 +0200)]
Fixed EVP_MAC_final argument count in example
EVP_MAC_final had only three arguments / the buffer/tag size was missing.
Fixes #12424
Note, that I didn't try to compile the example to look for other problems.
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/12429)
Shane Lontis [Mon, 21 Sep 2020 01:14:47 +0000 (11:14 +1000)]
Fix merge error with libcrypto.num
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12929)
Richard Levitte [Tue, 15 Sep 2020 08:02:34 +0000 (10:02 +0200)]
util/find-doc-nits: Add a regexp for C symbols and use it
Our matching of C symbols here was inconsistent and could therefore
give false negatives when the SYNOPSIS was parsed. Now we have
$C_symbol, which is a simple regexp that matches the common C symbol.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Richard Levitte [Mon, 14 Sep 2020 09:35:07 +0000 (11:35 +0200)]
DECODER: Some cleanups, and aligning with OSSL_ENCODER
Mostly source nits, but also removing a couple of OSSL_DECODER_PARAM
macros that are never used or even make sense.
Also, some function names weren't quite consistent. They were made a
bit more consistent in the OSSL_ENCODER API, now we bring that back to
OSSL_DECODER.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Richard Levitte [Mon, 14 Sep 2020 09:21:37 +0000 (11:21 +0200)]
TEST: Adapt applicable tests to the changed OSSL_ENCODER_CTX_new_by_EVP_PKEY()
This adds the convenience function EVP_PKEY_typenames_do_all(), which
does the same as EVP_KEYMGMT_names_do_all(), but without having to
expose all the internal ways to find out if the internal EVP_PKEY key
is legacy or provider-native.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Richard Levitte [Mon, 14 Sep 2020 08:42:05 +0000 (10:42 +0200)]
ENCODER: Adapt calls to the changed OSSL_ENCODER_CTX_new_by_EVP_PKEY()
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Richard Levitte [Mon, 14 Sep 2020 07:31:36 +0000 (09:31 +0200)]
ENCODER: Refactor our provider encoder implementations
This only refactors them for the changed API, there's not yet a
separate DER to PEM encoder and therefore no chaining possibility
yet.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Richard Levitte [Mon, 14 Sep 2020 07:20:41 +0000 (09:20 +0200)]
ENCODER: Refactor the OSSL_ENCODER API to be more like OSSL_DECODER
OSSL_ENCODER was developed before OSSL_DECODER, so the idea of
chaining and the resulting API came later. This series of changes
brings the same sort of API and functionality back to OSSL_ENCODER,
making the two APIs more consistent with each other.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Richard Levitte [Mon, 14 Sep 2020 06:29:45 +0000 (08:29 +0200)]
ENCODER: Redefine the libcrypto <-> provider interface
This is part of an effort to make OSSL_ENCODER work more like OSSL_DECODER.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12873)
Dr. David von Oheimb [Tue, 18 Aug 2020 12:44:33 +0000 (14:44 +0200)]
ocsp_vfy.c: Clean up code w.r.t. coding guidelines and reduce redundancies
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12669)
Henry N [Thu, 10 Sep 2020 21:55:28 +0000 (23:55 +0200)]
Fix: ecp_nistz256-armv4.S bad arguments
Fix this error:
crypto/ec/ecp_nistz256-armv4.S:3853: Error: bad arguments to instruction -- `orr r11,r10'
crypto/ec/ecp_nistz256-armv4.S:3854: Error: bad arguments to instruction -- `orr r11,r12'
crypto/ec/ecp_nistz256-armv4.S:3855: Error: bad arguments to instruction -- `orrs r11,r14'
CLA: trivial
Fixes #12848
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
GH: #12854
David Benjamin [Fri, 18 Sep 2020 19:21:43 +0000 (15:21 -0400)]
Deprecate ASN1_STRING_length_set in OpenSSL 3.0.
Fixes #12885
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
GH: #12922
Richard Levitte [Fri, 18 Sep 2020 09:00:31 +0000 (11:00 +0200)]
util/mkerr.h: Restore header file rename
With '-internal', we commonly write the reason code macros to header
file renamed 'name.h' to 'nameerr.h'. That renaming was removed by
mistake, this restores it.
Fixes #12891
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12910)
Shane Lontis [Tue, 15 Sep 2020 04:45:49 +0000 (14:45 +1000)]
Fix ec keygen so that it passes the library context to SSL_SELF_TEST_get_callback().
This was written before the ec key contained a library context,
now that it contains a libctx it can be passed correctly to the callback.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12877)
Shane Lontis [Tue, 15 Sep 2020 04:32:40 +0000 (14:32 +1000)]
Add a copy of OSSL_SELF_TEST_get_callback() to the fips module.
The user can set up a self test callback that should be activated when a keygen operation (e.g ec) occurs for the fips module.
The callback information is stored inside the applications library context, but this was not being triggered since the
library context used for the key generation operation was the internal library context used by the fips module (which is not
the same as the application's library context). During the keygen operation the OSSL_SELF_TEST_get_callback() function is used
to retrieve the callback info.
By having a seperate copy of OSSL_SELF_TEST_get_callback() for the fips module we can ensure that the parent library context
is used instead.
The core OSSL_SELF_TEST_get_callback() function pointer is passed across the boundary during the fips modules entry point
such that the fips version of the function can call it after changing the libctx.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12877)
Shane Lontis [Sat, 19 Sep 2020 08:08:46 +0000 (18:08 +1000)]
Add KEM (Key encapsulation mechanism) support to providers
SP800-56Br2 requires support for the RSA primitives for RSASVE generate and recover.
As these are simple KEM operations another operation type has been added that can support future extensions.
Added public functions EVP_PKEY_encapsulate_init(), EVP_PKEY_encapsulate(), EVP_PKEY_decapsulate_init() and EVP_PKEY_decapsulate()
Added EVP_KEM_* functions.
Added OSSL_FUNC_kem_* dispatch functions
Added EVP_PKEY_CTX_set_kem_op() so that different types of KEM can be added in the future. This value must currently be set to
"RSASVE" after EVP_PKEY_encapsulate_init() & EVP_PKEY_decapsulate_init() as there is no default value.
This allows the existing RSA key types, keymanagers, and encoders to be used with the encapsulation operations.
The design of the public API's resulted from contributions from @romen & @levitte.
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12750)
Matt Caswell [Thu, 17 Sep 2020 13:11:21 +0000 (14:11 +0100)]
Update the EdDSA docs with information about Algorithm Identifiers
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12884)
Matt Caswell [Tue, 15 Sep 2020 15:48:55 +0000 (16:48 +0100)]
Make sure we properly test for EdDSA with alg ids
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12884)
Matt Caswell [Tue, 15 Sep 2020 15:20:51 +0000 (16:20 +0100)]
Teach EdDSA signature algorithms about AlgorithmIdentifiers
The other signature algorithms know how to create their own
AlgorithmIdentifiers, but the EdDSA algorithms missed this.
Fixes #11875
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12884)
Shane Lontis [Sat, 5 Sep 2020 03:08:27 +0000 (13:08 +1000)]
Add option to fipsinstall to disable fips security checks at run time.
Changes merged from a patch by @richsalz.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Fri, 4 Sep 2020 07:55:28 +0000 (17:55 +1000)]
Add 'fips-securitychecks' option and plumb this into the actual fips checks
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 08:04:13 +0000 (18:04 +1000)]
fix provider exchange operations
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 08:03:17 +0000 (18:03 +1000)]
fix provider signatures
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 07:59:07 +0000 (17:59 +1000)]
Separate fips and non fips code for key operations
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:33:34 +0000 (12:33 +1000)]
Add missing 'ossl_unused' tags to some gettable and settable methods.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:06:05 +0000 (12:06 +1000)]
Add error message to genpkey app for the '-genparam' option
The ordering of this option is important so inform the user if they do it incorrectly.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:59:04 +0000 (12:59 +1000)]
Add fips checks for ecdh key agreement
For key agreement only NIST curves that have a security strength of 112 bits or more are allowed.
Fixed tests so they obey these restrictions when testing in fips mode.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:55:43 +0000 (12:55 +1000)]
Add fips checks for rsa encryption
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:54:00 +0000 (12:54 +1000)]
Add fips checks for dh key agreement
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:51:14 +0000 (12:51 +1000)]
Add fips checks for ecdsa signatures
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:37:46 +0000 (12:37 +1000)]
Add fips checks for dsa signatures
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Shane Lontis [Sat, 29 Aug 2020 02:25:54 +0000 (12:25 +1000)]
Add fips checks for rsa signatures.
In fips mode SHA1 should not be allowed for signing, but may be present for verifying.
Add keysize check.
Add missing 'ossl_unused' to gettable and settable methods.
Update fips related tests that have these restrictions.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12745)
Matt Caswell [Tue, 15 Sep 2020 13:00:37 +0000 (14:00 +0100)]
Fix some doc-nits and make update errors
The new lhash changes have confused some of the perl scripts so we add
some fixes.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12860)
Matt Caswell [Fri, 11 Sep 2020 13:04:51 +0000 (14:04 +0100)]
Remove some unneeded code from lhash.h
lhash.h had some workaround code for the issue where static inline
functions contained references to libcrypto symbols in public header
files. Since this issue no longer exists this workaround code can be
removed.
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12860)