[openssl] openssl-3.0.0-alpha1 create
Matt Caswell
matt at openssl.org
Wed Apr 29 15:53:09 UTC 2020
The annotated tag openssl-3.0.0-alpha1 has been created
at 25ea8db20a992e015676c0573d91b601a67feff0 (tag)
tagging 05feb0a0f1fecb6839888bb7590fb92be70d8d3c (commit)
replaces OpenSSL_1_1_1
tagged by Matt Caswell
on Thu Apr 23 14:27:49 2020 +0100
- Log -----------------------------------------------------------------
OpenSSL 3.0.0-alpha1 release tag
-----BEGIN PGP SIGNATURE-----
iQFFBAABCAAvFiEEhlersmDwVrHlGQg52cTSbQ5gRJEFAl6hl9URHG1hdHRAb3Bl
bnNzbC5vcmcACgkQ2cTSbQ5gRJFQ2QgAo8izQ8TwWcLSiQufm8YcZSJxBjF6XTUF
eTWb9VDWZVnPODZCjFAjzCsWawwarU9Ay/dqXPc8BUpntr/gG8NUsKtqqzb62z/R
Gz/j9zMbMhG568SGLm3vTa4F3Yk2iOvId4s9fk4qCj+ZjnHbUKpKVKkOwZEzxakM
2SZvadt9mwEIZL1ZFbXWV4pdbjmSLxjGBRZwBJNFR8bHL6d/jR0Pw2QeMxQC4Xw8
lTjDFvI7mxpP55XzgsdbzXSu+x5qZFqDSg4FS3VQ2WNQmYdZrZZmZQ4jipZmVd6s
jXYVgrVIJbvhZfSf0fQmqgmuo2EesEvPsai+pLvOXeYclr7rbDMAMQ==
=zDMO
-----END PGP SIGNATURE-----
A. Schulze (1):
Fix two spelling errors
Aaron Thompson (3):
Fix bugs in EC code introduced with FIPS changes.
Remove an unnecessary call to BN_CTX_free.
Add ex_data to EVP_PKEY.
Acheev Bhagat (2):
Replace BIO_printf with ASN1_STRING_print in GENERAL_NAME_print
Remove redundant include
Alex Boboc (5):
DOC:Fix typos in ossl_param_bld_init
DOC:Fix typos in ossl_cmp_print_log.pod
DOC:Fix typos in openssl-enc.pod.in + openssl.pod
DOC:Fix typos in man5/config.pod
DOC:Fix typos in x509v3_config.pod
Alistair Francis (1):
Add support for io_pgetevents_time64 syscall
Andreas Kretschmer (2):
Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)
fix CRMF symmetric key handling
Andreas Schnebinger (1):
Fix typo and create compatibility macro
Andrew Gallatin (2):
Add support for in-kernel TLS (KTLS) on FreeBSD.
Bypass multiblock and send individual records when using KTLS.
Andrew Hoang (1):
Fix incorrect return code on ECDSA key verification
André Klitzing (1):
Fix drop of const qualifier
Andy Polyakov (36):
sha/asm/keccak1600-s390x.pl: resolve -march=z900 portability issue.
ssl/s3_enc.c: fix logical errors in ssl3_final_finish_mac.
rsa/rsa_ossl.c: fix and extend commentary [skip ci].
arch/async_posix.h: improve portability.
Configurations/15-android.conf: add support for "standalone toolchain".
sha/asm/keccak1600-armv8.pl: halve the size of hw-assisted subroutine.
Configurations/15-android.conf: fix implicit __ANDROID_API__ handling.
Configurations/15-android.conf: detect NDK llvm-ar.
sha/asm/sha512p8-ppc.pl: fix typo in prologue.
sha/asm/sha512p8-ppc.pl: optimize epilogue.
rsa/rsa_ossl.c: cache MONT_CTX for public modulus earlier.
err/err.c: add err_clear_last_constant_time.
rsa/rsa_ossl.c: make RSAerr call in rsa_ossl_private_decrypt unconditional.
rsa/rsa_pk1.c: remove memcpy calls from RSA_padding_check_PKCS1_type_2.
rsa/rsa_oaep.c: remove memcpy calls from RSA_padding_check_PKCS1_OAEP.
rsa/rsa_ssl.c: make RSA_padding_check_SSLv23 constant-time.
Configurations/10-main.conf: remove MIPS bn_div_3_words.
Configure: recognize div3w modules and add -DBN_DIV3W.
bn/bn_div.c: make conditional addition unconditional
bn/bn_{div|shift}.c: introduce fixed-top interfaces.
err/err.c: improve err_clear_last_constant_time's portability.
perlasm/ppc-xlate.pl: add VSX word load/store instructions.
poly1305/asm/poly1305-ppc.pl: add vector base 2^26 implementation.
AArch64 assembly pack: authenticate return addresses.
ARM assembly pack: make it Windows-friendly.
ARM64 assembly pack: make it Windows-friendly.
sha/keccak1600.c: subscribe more platforms for "complementing" optimization.
sha/asm/keccak1600-ppc64.pl: up 10% performance improvement.
IA64 assembly pack: add {chacha|poly1305}-ia64 modules.
Configurations/00-base-templates.conf: engage {chacha|poly1305}-ia64.
ARM64 assembly pack: add ThunderX2 results.
aes/asm/aesv8-armx.pl: ~20% improvement on ThunderX2.
chacha/asm/chacha-armv8.pl: replace 3+1 code paths with 4+1.
Fix an overflow bug in rsaz_512_sqr
crypto/perlasm/ppc-xlate.pl: add linux64v2 flavour
Configure: use ELFv2 ABI on some ppc64 big endian systems
Anna Henningsen (1):
Fix compilation with `-DREF_PRINT`
Anthony Hu (1):
Add missing EVP_PKEY_METHOD accessors for digestsign and digestverify
Antoine Cœur (2):
Fix Typos
Fix Typos
Antoine Salon (21):
Update enc(1) examples to more recent ciphers and key derivation algorithms
Add missing cipher aliases to openssl(1)
EVP module documentation pass
Deprecate ECDH_KDF_X9_62()
SSL extra chain certificates doc
Add SSL_CTX_set_tmp_ecdh.pod
SRP module documentation
Added SRP_VBASE_add0_user()
Making SRP_user_pwd functions public
Deprecate SSL_set_tmp_ecdh
Fix usage of deprecated SSL_set_tmp_ecdh()
Add missing EVP_MD documentation
blake2: add implementation support for variable digest length
blake2b: add support for parameter setting and keyed hash
blake2b: add EVP_MAC API
blake2: register MAC objects
blake2: add EVP_MAC man page
blake2: backport changes to blake2s
blake2: add evpmac test vectors
blake2: avoid writing to output buffer when using default digest length
Add CHANGES entry for blake2mac
Antonio Iacono (1):
crypto/cms: Add support for CAdES Basic Electronic Signatures (CAdES-BES)
Ard Biesheuvel (1):
chacha/asm/chacha-armv8.pl: preserve FP registers d8 and d9 correctly
Arne Schwabe (1):
Change SSL parameter SSL_session_reused const
Artiom Vaskov (1):
ssl/statem/statem_lib.c: make servercontext/clientcontext arrays of chars instead of char pointers to fix EBCDIC builds.
Asfak Rahman (1):
bugfix in cmac calculation example
Bastian Germann (2):
apps x509: passing PKCS#11 URL as -signkey
apps x509: restrict CAkeyform option to OPT_FMT_PDE
Behrang (1):
Fixed minor typo in the req.pod docs
Ben Kaduk (1):
sslapitest: don't leak the SSL_CTX pair
Benjamin Kaduk (22):
Reset TLS 1.3 ciphers in SSL_CTX_set_ssl_version()
apps: allow empty attribute values with -subj
mkdef: bsd-gcc uses solaris symbol version scripts
Add tsan_decr() API, counterpart of tsan_counter()
Restore sensible "sess_accept" counter tracking
Fix strict-warnings build on FreeBSD
Add regression test for #9099
Revert "Delay setting the sig algs until after the cert_cb has been called"
Move 'shared_sigalgs' from cert_st to ssl_st
Fix a race condition in SNI handling
Update the krb5 submodule
Update SSL_CTX_sess_set_new_cb(3) docs for refcounts
openssl-config: add example libssl system-defaults
Additional updates to SSL_CTX_sess_set_get_cb.pod
doc: fix spelling of TYPE_get_ex_new_index
Fix whitespace nit in ssl_generate_master_secret()
Don't write to the session when computing TLS 1.3 keys
Code to thread-safety in ChangeCipherState
Add test that changes ciphers on CCS
Fix krb5 external test
Add test for CVE-2020-1967
Fix NULL dereference in SSL_check_chain() for TLS 1.3
Bernd Edlinger (108):
Fix a possible recursion in SSLfatal handling
Create the .rnd file it it does not exist
Reduce stack usage in tls13_hkdf_expand
Fix a possible crash in rand_drbg_get_entropy
Fix data race in RAND_DRBG_generate
Rework and simplify resource flow in drbg_add
Fix a race condition in drbg_add
Avoid two memory allocations in each RAND_DRBG_bytes
Fix error handling in RAND_DRBG_set
Fix error handling in rand_drbg_new
Fix error handling in drbgtest.c
Fix error handling in RAND_DRBG_uninstantiate
Fix a race condition in drbgtest.c
Rename the rand_drbg_st data member "pool" to "seed_pool"
Fix issues with do_rand_init/rand_cleanup_int
Fix a minor nit in the hkdflabel size
Fix cert with rsa instead of rsaEncryption as public key algorithm
PPC: Try out if mftb works before using it
Make ca command silently use default if .attr file does not exist
Fix a memory leak with di2_X509_CRL reuse
Fixed d2i_X509 in-place not re-hashing the ex_flags
Fix a crash in reuse of i2d_X509_PUBKEY
Add an entry to the CHANGES for the d2i_X509_PUBKEY fix
Fix seeding from random device w/o getrandom syscall
Limit DEVRANDOM_WAIT to linux
Fix memory overrun in rsa padding check functions
Update documentation regarding required output buffer memory size of RSA_private_decrypt/RSA_public_encrypt.
Add a simple test for RSA_SSLV23_PADDING
Do the error handling in pkey_rsa_decrypt in constant time
Update documentation of RSA_padding_check_PKCS1_OAEP_mgf1
Update to xenial
Clear the secret point in ecdh_simple_compute_key
Clear the point S before freeing in ec_scalar_mul_ladder
Make err_clear_constant_time really constant time
Modify the RSA_private_decrypt functions to check the padding in constant time with a memory access pattern that does not depend on secret information.
Fix the allocation size in EVP_OpenInit and PEM_SignFinal
Avoid creating invalid rsa pss params
Add CMAC speed measurements
Don't use coordinate blinding when scalar is group order
Add test for the BIO_get_mem_ptr() regression
Fix a crash in the speed command with wrap ciphers
Fix a URL to the NMBRTHRY list archive
Fix error handling at openssl_strerror_r
Handle CTRL-C as non-redoable abort signal
Keep the externally visible macro BIO_FLAGS_UPLINK in bio.h and rename the internally used macro to BIO_FLAGS_UPLINK_INTERNAL.
Fix ASN1_TYPE_get/set with type=V_ASN1_BOOLEAN
Check for V_ASN1_BOOLEAN/V_ASN1_NULL in X509_ATTRIBUTE_get0_data
Fix a typo and a syntax error in opensslconf.h
Fix an endless loop in BN_generate_prime_ex
Replace long dash characters with normal ascii minus
Add value_barriers in constant time select functions
Allocate DRBG additional data pool from non-secure memory
Change DH parameters to generate the order q subgroup instead of 2q
Enforce a minimum DH modulus size of 512 bits
Use OPENSSL_strlcpy instead of strncpy in e_afalg.c
Fix BIO_printf format warnings
Add a parameter to probable_prime if we look for a safe prime
Merge probable_prime_dh_safe with bn_probable_prime_dh
Update documentation of BN_generate_prime_ex
Add a CHANGES entry for BN_generate_prime_ex
Add a clang-7 build target with --strict-warnings
Fix error handling in X509_chain_up_ref
Add a fallback definition for __NR_getrandom for ARM linux
Add a fallback definition for __NR_getrandom for x86 linux
Remove extern declarations of OPENSSL_ia32cap_P
Add CPU info to the speed command summary
Cleanup includes in rand_unix.c
Fix error handling in x509_lu.c
Fix a SCA leak in BN_generate_dsa_nonce
Check the DH modulus bit length
Use BN_clear_free in DH_set0_key
DH_check_pub_key_ex was accidentally calling DH_check, so results were undefined.
Fix build with VS2008
Fix a strict warnings error in rand_pool_acquire_entropy
Fix a potential crash in rand_unix.c
Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
Fix potential memory leaks with BN_to_ASN1_INTEGER
Fix building statically without any dso support
Fix a -Warray-bounds gcc warning in OPENSSL_DIR_read
Fix sha512_block_data_order_avx2 backtrace info
Improve the overflow handling in rsaz_512_sqr
Add a test case for rsaz_512_sqr overflow handling
Add a CHANGES entry for CVE-2019-1551
Fix unwind info for some trivial functions
Fix no-des build
Add some missing cfi frame info in camellia-x86_64.pl
Add some missing cfi frame info in aes-x86_64.pl
Add some missing cfi frame info in x86_64-mont5.pl
Add some missing cfi frame info in rsaz-x86_64
Add some missing cfi frame info in aesni-x86_64.pl
Add some missing cfi frame info in keccak1600-x86_64.pl
Add some missing cfi frame info in aesni-sha and sha-x86_64.pl
Add some missing cfi frame info in ecp_nistz256-x86_64.pl
Fix aesni_cbc_sha256_enc_avx2 backtrace info
Add some missing cfi frame info in x25519-x86_64.pl
Add some missing cfi frame info in aesni-gcm-x86_64.pl
Add some missing cfi frame info in poly1305-x86_64.pl
Add some missing cfi frame info in rc4-md5-x86_64.pl
Fix a race condition in the speed command
Fix side channel in ecp_nistz256-x86.pl
Fix side channel in ecp_nistz256-armv4.pl
Improve side channel fix in ecp_nistz256-x86_64.pl
Fix side channel in the ecp_nistz256.c reference implementation
Add a minimal build target for Travis and Appveyor
Fix error handling in x509v3_cache_extensions and related functions
Fix a printf format error in cmp_client.c
Fix a gcc warning about possible null pointer
Fix the error handling in EC_POINTs_mul
Billy Brawner (1):
Suppress 'No server certificate CA names sent' message
Billy Brumley (15):
[crypto/bn] swap BN_FLG_FIXED_TOP too
Clean up BN_consttime_swap.
SCA hardening for mod. field inversion in EC_GROUP
[test] unit test for field_inv function pointer in EC_METHOD
[test] modernize ecdsatest and extend ECDSA sign KATs
[crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
[test] computing ECC cofactors: regression test
[test] computing ECC cofactors: regression test
CHANGES entry: for ECC parameters with NULL or zero cofactor, compute it
[test] ECC: check the bounds for auto computing cofactor
[crypto/bn] fix a few small timing leaks in BN_lshift1 and BN_rshift1
[test] Make sm2_internal_test less fragile to changes in the ec module
[crypto/ec] Ladder tweaks
[crypto/ec] blind coordinates in ec_wNAF_mul for robustness
[crypto/ec] deprecate Jprojective_coordinates_GFp functions
Boris Pismenny (16):
Linux ktls infrastructure
Configure Kernel TLS datapath
bio: Linux TLS Offload
evp/e_aes: Expose IV
ssl: Linux TLS Tx Offload
sslapitest: add test ktls
CHANGES: Add Linux Kernel TLS data-path
apps: print Kernel TLS in s_client and s_server
Linux ktls Rx infrastructure
bio: Linux TLS Rx Offload
ssl: Linux TLS Rx Offload
sslapitest: add test ktls Rx
apps: print Kernel receive side TLS in s_client and s_server
add documentation
Linux ktls sendfile
ssl: Add SSL_sendfile
Brian 'geeknik' Carpenter (1):
Update README.md
Brian Chen (1):
Update fuzzing README for recent clang versions
Cesar Pereida Garcia (8):
Fix SCA vulnerability when using PVK and MSBLOB key formats
[crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
[crypto/rsa] Set the constant-time flag in multi-prime RSA too
Unify BN_rshift design
Constant-time GCD function.
Add GCD testing infrastructure.
Update control logic for BN_gcd
Enable runtime testing of no-deprecated builds in Travis
Chocobo1 (1):
Fix MSVC warning C4819
Christian Heimes (3):
Fix function names in ct(7) documentation
doc: EVP_DigestInit clears all flags
Add test cases for min/max protocol API
Christopher J Zurcher (1):
Add assembly config targets for UEFI build
Christos Zoulas (11):
use the proper types to eliminate casts
add missing const
add missing const in cast
add missing "void" in prototype.
don't pass const string where a modifyable string is expected
Use the proper fonst cast
Use a const variable
Avoid const castaway warning
Fix const issues
Add a format attribute to the format functions and fix the broken format strings.
change into hex string constants to avoid overflow warnings
Corey Minyard (1):
Fix a memory leak in the mem bio
Corinna Vinschen (1):
cygwin: drop explicit O_TEXT
Dan Campbell (1):
s_client starttls: fix handling of multiline reply
Dane (4cad at silvertoque) (1):
Remove unneeded switch statement to fix warning
Daniel Axtens (2):
PPC assembly pack: fix copy-paste error in CTR mode
ppc assembly pack: always increment CTR IV as quadword
Daniel Bevenius (1):
Document OPENSSL_VERSION_TEXT macro
Daniel DeFreez (2):
Fix null pointer dereference in ssl_module_init
Fix null pointer dereference in cms_RecipientInfo_kari_init
Daniil Zotkin (2):
Do not print extensions in Certificate message for TLS1.2 and lower
Process GOST ClientKeyExchange message in SSL_trace
Daniël van Eeden (2):
Update format string for ciphers to account for newer ciphers
Use fixed length for formatting standard cipher names
Darren Tucker (1):
Fix typo in ifndef OPENSSL_NO_ENGINES.
David Asraf (2):
crypto/bn: fix return value in BN_generate_prime
Add EC_GROUP_get0_field
David Benjamin (11):
Reduce inputs before the RSAZ code.
Document and add macros for additional DSA options
Fix some CFI issues in x86_64 assembly
Check for unpaired .cfi_remember_state
Fix calling convention bug in ecp_nistz256_ord_sqr_mont
Copy RSA-PSS saltlen in EVP_PKEY_CTX_dup.
Fix various mistakes in ec_GFp_nistp_recode_scalar_bits comment.
Don't generate an unnecessary Diffie-Hellman key in TLS 1.3 clients.
Avoid leaking intermediate states in point doubling special case.
Do not silently truncate files on perlasm errors
Also check for errors in x86_64-xlate.pl.
David Makepeace (10):
Fixed typos in hkdf documentation.
Minor doc fixes for EVP_MAC.
Added new EVP/KDF API. Changed PKEY/KDF API to call the new API. Added wrappers for PKCS5_PBKDF2_HMAC() and EVP_PBE_scrypt() to call the new EVP KDF APIs. Documentation updated.
Added algorithm description comments to HKDF.
Cleaned up tls1_prf and added comments.
Added Conforming To section to EVP_KDF_TLS1_PRF documentation.
Changed ssl layer to use EVP_KDF API for TLS1_PRF and HKDF.
Fixed typo in code comment. [skip ci]
Add simple ASN.1 utils for DSA signature DER.
Fix type name typo in d2i/i2d documentation.
David Woodhouse (4):
Stop marking default digest for EC keys as mandatory
Honour mandatory digest on private key in has_usable_cert()
Add EVP_PKEY_supports_digest_nid()
Fix bogus check for EVP_PKEY_supports_digest_nid() in check_cert_usable()
David von Oheimb (17):
add 'L' after _OPENSSL_VERSION_PRE_RELEASE literals, fixes #8021
update Copyright date
fix x509 -force_pubkey option to take effect with cert input or self-signing; improve its doc
constify *_dup() and *i2d_*() and related functions as far as possible, introducing DECLARE_ASN1_DUP_FUNCTION
Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)
2nd chunk: CRMF code (crypto/crmf/, ) and its integration in INSTALL, Configure, crypto/build.info, include/openssl/crmferr.h, crypto/err/, include/openssl/err.h, and (to be updated:) util/libcrypto.num
prevent app_get_pass() from revealing cleartext password on syntax error
remove needless empty lines when printing certificates
remove 'keyid:' when printing simple X509 authority keyID (without issuer and serial)
update reference output of test_x509 in test/certs/cyrillic.*
add 'Signature Value:' line and correct indentation when printing X.509 signature value
Add -new and -subj options to x509 app for direct cert generation
replace 'OpenSSL license' by 'Apache License 2.0'
make RSA and DSA operations throw MISSING_PRIVATE_KEY if needed, adapt ECDSA
Fix deprecation inconsisteny w.r.t. CRYPTO_mem_debug_{push,pop}()
add line and file info to 'Malformed line' error msg on *.num files in make-doc-nits
make err() message strings of find-doc-nits consistently start with uppercase letters
Davide Galassi (6):
Missing "obj_mac" header file in "dh_lib"
Removed unused ssl_dane struct declaration.
Prevent compiler warning for unused static function.
Memory allocator code cleanup
Mem-sec small code adjustment
Remove double fetch of "OSSL_EX_DATA_GLOBAL" for global lock
Denis Ovsienko (1):
Remove some duplicate words from the documentation
Dirk-Willem van Gulik (1):
Add setter equivalents to X509_REQ_get0_signature
Dmitry Belyavskiy (27):
Some deabbreviations
Remove unused variables from tls1_change_cipher_state
Eliminate unused buffers from ssl3_change_cipher_state
Restore compatibility with GOST2001 implementations.
Providing missing accessor to EVP_PKEY.engine
EVP_PKEY_get0_engine documentation
Add some checks of OCSP functions
A very brief explanation of how to add custom functions to OpenSSL.
Avoid NULL pointer dereference. Fixes #9043.
Get rid of using deprecated function isascii
Disallow change EVP_MD properties once set
Disallow change EVP_CIPHER properties once set
Reverting check to correct
Support printing out some otherName variants
Strip BOM on loading PEM files
Workaround for Windows-based GOST implementations
Fix cut'n'paste typos in the provider-digest pod
Difference between EVP_CipherInit and EVP_CipherInit_ex
Parse large GOST ClientKeyExchange messages
Restoring correct check for legacy PKEY
Russian Elbrus processors support
Legacy digests can have custom control values
New functions for PKCS8 attributes management
New functions for PKCS8 attributes management - documentation
Implementation of Russian GOST CMS
Documenting newly added CMS modification
GOST cipher names adjustment
Dr. David von Oheimb (54):
prevent endless recursion when trace API is used within OPENSSL_init_crypto()
fix ERR_add_error_vdata() for use with multiple args/calls
Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712)
Make default values by ERR_get_error_all() and friends more consistent
chunk 5 of CMP contribution to OpenSSL
re-add definition of OPENSSL_MSTR deleted from opensslv.h in macros.h
add OPENSSL_FUNC.pod documenting OPENSSL_MSTR, OPENSSL_FUNC, and friends
add X509_cmp_timeframe() including its documentation
chunk 6 of CMP contribution to OpenSSL
fix dependencies of cmp_{msg,protect}_test.c in test/build.info
fix obsolete error codes in test/cmp_msg_test.c
add missing load_pkimsg() in test/cmp_testlib.c
improve 'typedef' patterns of find-doc-nits
handle new findings of find-doc-nits for certain typedefs
make find-doc-nits report function typedef w/ space before arg list
handle new findings of find-doc-nits on fn typedefs w/ extra space
add BIO_socket_wait(), BIO_wait(), and BIO_connect_retry() improving timeout support
Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.c The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c
fix build for new HTTP client in case OPENSSL_NO_CMP or OPENSSL_NO_OCSP
add internal doc files actually belonging to CMP contribution chunk 6
improve CMP logging according to comments on CMP chunk 7 preview
fix various formatting nits in CMP contribution chunks 1-6 found by the new util/check-format.pl
chunk 7 of CMP contribution to OpenSSL
Don't exclude quite so much in a no-sock build
Renew and extend the tool for checking adherence to C coding style rules
fix two mistakes w.r.t. ERR_LIB_* parameters in ERR_add_error_txt()
fix coding style nits w.r.t. 'defined' in http_local.h, http.h, and ocsp.h
Extract sk_ASN1_UTF8STRING2text() from ts_get_status_text() in ts_rsp_verify.c to asn1_lib.c
Chunk 8 of CMP contribution to OpenSSL: CMP server and cmp_mock_srv.c for testing
Fix error in case CMP msg POPO is not provided in OSSL_CRMF_MSGS_verify_popo()
Fix handling of CMP msg senderKID and improve doc of related CTX functions
Move OSSL_CMP_X509_digest() to x_all.c, renaming it to X509_digest_sig()
fix false positive of check-format.pl reporting '{1 stmt}' after multi-line 'if(expr)'
make util/check-format.pl script executable
fix false positive of check-format.pl regarding '#if' on preceding line; extend negative tests
Rename OSSL_{d2i,i2d}_CMP_MSG_bio to {d2i,id2}_OSSL_CMP_MSG_bio
Constify various mostly X509-related parameter types in crypto/ and apps/
Fix whitespace nit in OSSL_SELF_TEST_new.pod which caused doc-nits warning
Fix bug in strncpy() use of sk_ASN1_UTF8STRING2text() in asn1_lib.c
Chunk 9 of CMP contribution to OpenSSL: CMP client and related tests
Chunk 10 of CMP contribution to OpenSSL: CMP http client and related tests
HTTP client: make server/proxy and port params more consistent; minor other improvements
Fix bugs in 3GPP exception checking and improve diagnostics in crypt/cmp/cmp_vfy.c
Fix error reporting glitch in X509_STORE_CTX_print_verify_cb() in t_x509.c
Fix misleading error msg for PBM check w/o secret in OSSL_CMP_validate_msg()
Rename CMP_PROTECTEDPART to OSSL_CMP_PROTECTEDPART for consistency
Add a couple of hints to fuzz/README.md
Add CMP fuzzing to fuzz/cmp.c, including a couple of helpers in crypto/cmp/
Add CMP error reason 'missing reference cert'
Prevent crash in X509_NAME_cmp() etc. when cert has no issuer or no serialNumber
Fix descriptions of credentials and verification options for various apps
Update comment on crls_http_cb() as it does support non-blocking I/O since #10667
Fix test_cmp_vfy failures with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
Add info on the CMP implementation and HTTP client to NEWS.md and CHANGES.md
Dr. Matthias St. Pierre (118):
Replace the public RAND_DRBG_USED_FLAGS #define by an internal constant
ssl/ssl_ciph.c: make set_ciphersuites static
test/secmemtest: test secure memory only if it is implemented
rand_unix.c: fix --with-rand-seed=none build
DRBG: fix reseeding via RAND_add()/RAND_seed() with large input
Fix: 'openssl ca' command crashes when used with 'rand_serial' option
RAND_add(): fix heap corruption in error path
RAND_load_file(): return error if reseeding failed
RAND_load_file(): avoid adding small chunks to RAND_add()
RAND_add()/RAND_seed(): fix failure on short input or low entropy
Configure: Reword the summary output
Configure: Improve warning if no random seed source was configured
drbg_lib: avoid NULL pointer dereference in drbg_add
randfile.c: fix a Coverity warning
rand_drbg.h: include <openssl/obj_mac.h>
Test: link drbgtest statically against libcrypto
Test: enable internal tests for shared Windows builds
rand_unix.c: open random devices on first use only
curve25519.c: reformat code to follow coding guidelines
curve25519.c: improve formula alignment
Configure: fix the version string in the configure output
doc/man3: remove copy&paste leftover
man: harmonize the various formulations in the HISTORY sections
doc/man1/x509.pod: fix typo
X509_STORE: fix two misspelled compatibility macros
engines/dasync: add explaining comments about AES-128-CBC-HMAC-SHA1
Configure: disable new trace api by default
VMS: only use the high precision on VMS v8.4 and up
trace: remove some magic numbers
trace: rename the trace channel types
trace: don't leak the line prefix
trace: ensure correct grouping
trace: update the documentation
Configure: untabify indentation
Fix three identical grammatical errors
trace: don't pretend success if it's not enabled
trace: fix out-of-bound memory access
trace: apps/openssl: print the correct category name
trace: rename the default trace category from 'ANY' to 'ALL'
rand_win.c: loosen version requirements for BCryptGenRandom
trace: add PROVIDER_CONF trace category
FIPS: Fix compiler errors in rsa_chk.c when building with `-DFIPS_MODE`
Test: use keywords instead of magic numbers for 'rsa_pss_saltlen'
openssl cms: add error message if operation option is missing
man: fix a typo and a grammar nit in EVP_PKEY_meth_new(3)
Ignore entropy from RAND_add()/RAND_seed() in FIPS mode
Ignore entropy from RAND_add()/RAND_seed() in FIPS mode [fixup]
crypto/conf: openssl_config_int() returns unitialized value
Remove last references to DEBUG_SAFESTACK
Document deprecation of version-specific SSL/TLS methods
man: fix doc-nit in property.pod
Fix typo in macro argument of SSL_set1_client_sigalgs_list()
Revert the DEVRANDOM_WAIT feature
OSSL_TRACE: enhance documentation and fix doc-nit errors
man: fix documentation for RSA_generate_key()
man: clarify the 'random number generator must be seeded' requirement
man: fix typo in OPENSSL_fork_prepare.pod
Fix init_get_thread_local()
x509: sort X509 dup functions alphabetically
x509: add missing X509 dup functions
x509: publish X509_PUBKEY_dup
Remove HEADER_BSS_FILE_C module include guard
Remove OPENSSL_X509V3_H include detector from openssl/cms.h
Remove HEADER_X509_H and HEADER_SSL_H include detectors from apps
Add missing accessors for X509 AuthorityKeyIdentifier
INSTALL: clarify documentation of the --api=x.y.z deprecation option
Deprecate unprefixed manual entries for openssl commands
Configure: clang: move -Wno-unknown-warning-option to the front
drbg: ensure fork-safety without using a pthread_atfork handler
drbg: add fork id to additional data on UNIX systems
drbg: fix issue where DRBG_CTR fails if NO_DF is used (2nd attempt)
crypto/threads_win.c: fix preprocessor indentation
Configure: add missing dependency to fix parallel builds on Windows
Add legacy include guard manually to opensslconf.h.in
Reorganize private crypto header files
Reorganize local header files
Reorganize public header files (part 1)
Reorganize public header files (part 2)
Fix header file include guard names
Add legacy include guards to public header files
Add util/fix-includes script
rsa: replace magic number '11' by RSA_PKCS1_PADDING_SIZE
Configure: accept Windows style compiler options
rand_unix.c: correct include guard comments
Move random-related defines from e_os.h to rand_unix.c
ciphers/chacha20,poly1303: Fix two coverity errors
github: switch issue templates to new labels
Add a GitHub issue template for questions
Add a GitHub issue template for documentation issues
libcrypto.num: remove some unused EVP_MAC symbols
Remove RANDFILE settings from configuration files
Fix typos in fipsinstall test
rand_lib.c: fix null pointer dereferences after RAND_get_rand_method() failure
Move random-related defines to "crypto/rand.h"
Modify the add_seeds_stringlist() macro to fix a preprocessor error
nmake: fix install_html_docs target
testutil_init.c: fix compilation error with enable-trace
Fix misspelling errors and typos reported by codespell
RAND_DRBG: add a callback data for entropy and nonce callbacks
tests/drbgtest: use new RAND_DRBG callback_data API instead of ex_data
DRBG: delay initialization of DRBG method until instantiation
Check that the DRBG's internal state has been zeroized after uninstantiation
doc: convert standard project docs to markdown
doc: introduce some minimalistic markdown without essential changes
doc: add OpenSSL logo
doc: revamp the README file
doc: add missing NEWS entries for all versions >= 1.0.0
doc: add missing CHANGES entries for all versions >= 1.0.0
doc: revamp the INSTALL file
doc: revamp the SUPPORT file
doc: add a fancy CHANGES entry to celebrate the new Markdown format
man: openssl-ocsp: separate client and server options
doc: document that 'openssl rand' is cryptographically secure
doc: slightly reformulate 'openssl(1)/Random State Options' section
Update CHANGES and NEWS for 1.1.1e release
mkerr: remove legacy guards from generated error headers
Fix an assertion (and a comment) of evp_method_id()
Swap parameters of evp_method_id()
EasySec (1):
s_server: warn about NO PSK identity hint in TLSv1.3
Eneas U de Queiroz (18):
INSTALL: add note about devcrypto engine
eng_devcrypto: don't leak methods tables
eng_devcrypto: expand digest failure cases
eng_devcrypto: fix copy of unitilialized digest
eng_devcrypto: close session on cleanup, not final
eng_devcrypto: add cipher CTX copy function
eng_devcrypto: fix ctr mode
eng_devcrypto: make sure digest can do copy
eng_devcrypto: save ioctl if EVP_MD_..FLAG_ONESHOT
eng_devcrypto: add configuration options
eng_devcrypto: add command to dump driver info
e_devcrypto: make the /dev/crypto engine dynamic
CHANGES: add note about building devcrypto dynamic
eng_devcrypto.c: close open session on init
engines/build.info: fix devcrypto MODULES entry
engines/e_devcrypto.c: fix cipher_ctrl function
engines/e_devcrypto: fixes logic in close_devcrypto
engines/e_devcrypto: set digest input_blocksize
Fangming.Fang (6):
Missing else in cipher_hw_aes_ocb_generic_initkey
Add arm64 in test matrix on TravisCI.
Fix exit issue in travisci
Enrich arm64 tests in Travis matrix
Optimize AES-GCM implementation on aarch64
Fix side channel in ecp_nistz256-armv8.pl
FdaSilvaYY (19):
crypto/rand: fix some style nit's
Doc: fix reference to deprecated methods.
Coverity fix in apps/oscp
Coverity fix in some crypto/asn1 code
Fix CID 1434549: Unchecked return value in test/evp_test.c
Coverity: fix two minor NPD issues. Found by Coverity.
OCSP: fix memory leak in OCSP_url_svcloc_new method. Add a few coverage test case.
CAdES: Fix SignerInfo attribute construction order.
Fuzz: add a few more types into Fuzzing for ESS
CAdES : lowercase name for now internal methods. CAdES : rework CAdES signing API. Make it private, as it is unused outside library bounds. Fix varous doc-nits.
apps/speed: allow to continue tests after any init failure handling. previouly the exit(1) call was aborting the whole execution. Improve error message.
apps/speed: discard useless protoypes as these methods are defines before being used.
apps/speed: remove a shared global variable replace |save_count| by the right c[D_EVP(_xxx)] variable. this may shared a value between various algorithm.
apps/speed: initialize key material only when its algo is selected. Remove some duplicate key data declarations.
apps/speed: simplify 'doit' action flag management code. Optimize algorithm selection code.
apps/speed: improve sm2 failure code. attach the new objects sooner, so error handling is simplified.
apps/speed: factorize ec test curves declarations remove 'test' prefix from variable names.
apps/speed: replace list of #define by enums declarations. it simplifies some pieces of code. Improve internal assertions Tag a few #endif with OPENSSL_NO_EC to mark its ending.
Appveyor: update to Visual Studio 2017.
Fraser Tweedale (1):
Support GeneralSubtrees with minimum = 0
Frederik Wedel-Heinen (1):
Update test/README
Guido Vranken (2):
Enforce a strict output length check in CRYPTO_ccm128_tag
EVP_EncryptUpdate, EVP_EncryptFinal_ex: don't branch on uninitialized memory
H.J. Lu (8):
Fix unwind info in crypto/rc4/asm/rc4-x86_64.pl
x86: Add endbranch to indirect branch targets for Intel CET
Use swapcontext for Intel CET
x86: Always generate .note.gnu.property section for ELF outputs
x86_64: Always generate .note.gnu.property section for ELF outputs
x86_64: Add endbranch at function entries for Intel CET
x86_64: Don't assume 8-byte pointer size
x86_64: Replace .asciz "GNU" with .byte
Haohui Mai (1):
Make Windows build more robust
Hua Zhang (1):
Fix compiling error for mips32r6 and mips64r6
Hubert Kario (2):
SSL_CONF_cmd: fix doc for NoRenegotiation
ts(1): digest option is mandatory
Ibrahim M. Ghazal (1):
Add -iter option to pkcs12 command
Ido Ben-Natan (1):
Fix misspelled resumption_label for CHARSET_EBCDIC
Ionut Mihalcea (1):
Don't set SNI by default if hostname is not dNS name
Iuri Rezende Souza (1):
Typo BIO_SOCK_REUSADDR => BIO_SOCK_REUSEADDR
Jake Massimo (1):
Increase rounds of Miller-Rabin testing DH_check
Jake Maynard (1):
Add manpage entry for X509_check_purpose()
Jakub Jelen (4):
Use the correct function name
doc: Get rid of unrelated reference to DSA_new()
doc: Fix typo in EVP_DigestSignInit manpage
doc: Update the reference from draft to RFC
Jakub Wilk (1):
Fix typos
Jakub Zelenka (2):
Fix typos in the OSSL_METHOD_STORE doc
Fix SYNOPSIS for ASN1_ENUMERATED_get_int64 and ASN1_ENUMERATED_set_int64
James Callahan (1):
doc/man3/SSL_set_bio.pod: Fix wrong function name in return values section
James Peach (1):
docs: fix typo in SSL functions
Jan Macku (1):
Fixed typo
Jan-Frederik Rieckers (2):
Fix small typo in doc for X509_STORE_CTX_new
Add support for otherName:NAIRealm in output
Jim Newsome (1):
Update RAND_METHOD definition in man page
Joerg Schmidbauer (1):
chacha_enc.c: fix for EBCDIC platforms
Johannes (1):
Correct documented return value for BIO_get_mem_data()
Johannes Bauer (3):
Add option to read pkeyopts interactively
Add documentation for -pkeyopt_passin
Cleanup hardcoded cipher suite codepoints in s_server
John Baldwin (6):
Simplify NO_KTLS path in SSL_sendfile.
Fix BIO_get_ktls_send() and BIO_get_ktls_recv() to work again.
Don't generate a MAC when using KTLS.
Support ciphersuites using a SHA2 384 digest in FreeBSD KTLS.
Support KTLS on connections using BIO_TYPE_CONNECT.
Use a flag in SSL3_BUFFER to track when an application buffer is reused.
John Schember (1):
iOS build: Replace %20 with space in config script
Jon Spillett (3):
apps/pkcs12: print multiple PKCS#12 safeBag attribute values if present
Add option grouping capability to apps
Add missing docs for some PKCS12 functions
Joshua Lock (4):
Make check_example_location() in find-doc-nits generic
Add a check for history section location to find-doc-nits
Update various man pages to place HISTORY section after SEE ALSO
Further harmonisation of manual page HISTORY sections
Jung-uk Kim (1):
Do not complain when /dev/crypto does not exist.
Jussi Keranen (1):
Fix regression on x509 keyform argument
Kelvin Lee (2):
Fix undefined array OPENSSL_ia32cap_P.
Fix typo in cipher_chacha20_poly1305_hw.c.
Ken Goldman (1):
Admit unknown pkey types at security level 0
Klotz, Tobias (2):
Cleanup vxworks support to be able to compile for VxWorks 7
Use vxRandLib for VxWorks7
Kochise (1):
Windows: Add type casting in CRYPTO_atomic_add to remove warning
Krists Krilovs (1):
Fix wrong lock claimed in x509 dir lookup.
Kurt Roeckx (23):
Improve SSL_shutdown() documentation
Use (D)TLS_MAX_VERSION_INTERNAL internally
Deprecate TLS_MAX_VERSION, DTLS_MAX_VERSION and DTLS_MIN_VERSION
Convert tls1_prf_P_hash to use the EVP_MAC interface
Indent with 4
Make sure that generated POD files are actually created before we run doc-nits
Call RSA generation callback at the correct time.
Change default RSA, DSA and DH size to 2048 bit
Replace EVP_MAC_CTX_copy() by EVP_MAC_CTX_dup()
Change EVP_MAC method from copy to dup
Auto add a label depending on the type of issue they report.
Use the correct maximum indent
Add defines for __NR_getrandom for all Linux architectures
Use fewer primes for the trial division
Add BN_check_prime()
RSA generation: Use more bits of 1/sqrt(2)
Replace apps/server.pem with certificate with a sha256 signature.
Check that the default signature type is allowed
Create a new embeddedSCTs1 that's signed using SHA256
Stop accepting certificates signed using SHA1 at security level 1
Generate new Ed488 certificates
Check that ed25519 and ed448 are allowed by the security level
Improve small block cipher performance
Laszlo Ersek (1):
crypto/evp/evp_key.c: #define BUFSIZ if <stdio.h> doesn't #define it
Lei Maohui (1):
Fix build error for aarch64 big endian.
Leo Neat (1):
Add CIFuzz action
Lorinczy Zsigmond (2):
Reorganized signature-scheme detection in 'apps/s_cb.c:security_callback_debug' callback-function.
Squashed commit of the following:
ManishPatidar1 (1):
clearing the ecx private key memory
Mansour Ahmadi (5):
Add a missing check on s->s3->tmp.pkey
Check return value of EVP_PKEY_new
fix inconsistent flen check in rsa_pk1 and rsa_oaep
add missing check for BN_mod_inverse
Add missing OPENSSL_clear_free before using ec->key
Marc (1):
s_client: Add basic proxy authentication support
Markus Stockhausen (1):
MIPS32R3 provides the EXT instruction to extract bits from registers. As the AES table is already 1K aligned we can use it everywhere and speedup table address calculation by 10%. Performance numbers:
Martin Peylo (1):
Adding Test.pm with workaround for Perl abs2rel bug
Martin Ukrop (1):
Fix reversed meaning of error codes
Mathias Berchtold (1):
Add missing parentheses in macro
Matt Caswell (494):
Prepare for 1.1.1a-dev
Add an explicit cast to time_t
Don't allow -early_data with other options where it doesn't work
Delay setting the sig algs until after the cert_cb has been called
Add a test for the certificate callback
Fix the max psk len for TLSv1.3
Fix no-psk
Fix no-tls1_2
Fix a mem leak in the ocsp app
Fix some Coverity warnings
Ignore libcrypto.ld and libssl.ld
Fix the drbgtest with randomized ordering
Fix the BIO callback return code handling
Extend the BIO callback tests to check the return value semantics
Fix no-engine
Fix a typo in a macro
Fix a DTLS memory leak
Test DTLS cookie generation and verification
Use the read and write buffers in DTLSv1_listen()
Buffer a ClientHello with a cookie received via DTLSv1_listen
Don't complain and fail about unknown TLSv1.3 PSK identities in s_server
Properly handle duplicated messages from the next epoch
Add a test for duplicated DTLS records
Reset the HKDF state between operations
Add a test where we reuse the EVP_PKEY_CTX for two HKDF test runs
Don't call the client_cert_cb immediately in TLSv1.3
Add a client_cert_cb test
Ignore disabled ciphers when deciding if we are using ECC
Give a better error if an attempt is made to set a zero length groups list
Don't negotiate TLSv1.3 if our EC cert isn't TLSv1.3 capable
Add some test brainpool certificates
Test use of a brainpool ECDSA certificate
Separate ca_names handling for client and server
Add a test for SSL_CTX_set0_CA_list()/SSL_CTX_set_client_CA_list()
Merge the CA list documentation for clarity
Fix no-ec and no-tls1_2
Add a missing SSLfatal call
Update CHANGES and NEWS for new release
Update copyright year
Disallow Ed25519 signature maleability
Add an Ed25519 signature maleability test
Ignore an auto-generated documentation file
Revert "Reduce stack usage in tls13_hkdf_expand"
Fix some SSL_export_keying_material() issues
Remove the cast from the definition of OPENSSL_VERSION_NUMBER
Only include opensslconf.h once
Make sure build_SYS_str_reasons() preserves errno
Preserve errno on dlopen
Document the num_tickets s_server option
Disallow Ed448 signature malleability
Add an Ed448 malleability test
make update
Fix shlibloadtest to properly execute the dso_ref test
Fix a RUN_ONCE bug
Implement OPENSSL_INIT_NO_ATEXIT
Don't link shlibloadtest against libcrypto
Test atexit handlers
Introduce a no-pinshared option
Support _onexit() in preference to atexit() on Windows
Fix no-cmac
Fix no-sock
Don't complain if we receive the cryptopro extension in the ClientHello
Add a test for correct handling of the cryptopro bug extension
Fix compilation on sparc
Don't artificially limit the size of the ClientHello
Check a return value in the SRP code
Check more return values in the SRP code
Add missing entries in ssl_mac_pkey_id
Don't get the mac type in TLSv1.3
Make sure we trigger retransmits in DTLS testing
Revert "Keep the DTLS timer running after the end of the handshake if appropriate"
Fix s_client so that it builds on Windows
Don't leak memory from ERR_add_error_vdata()
Fix no-dso builds
Complain if -twopass is used incorrectly
Make OPENSSL_malloc_init() a no-op
Don't signal SSL_CB_HANDSHAKE_START for TLSv1.3 post-handshake messages
Fix -verify_return_error in s_client
Fix no-stdio
Use order not degree to calculate a buffer size in ecdsatest
Don't leak EVP_KDF_CTX on error
Don't interleave handshake and other record types in TLSv1.3
Add a test for interleaving app data with handshake data in TLSv1.3
Fix dasync engine
Don't restrict the number of KeyUpdate messages we can process
Ensure bn_cmp_words can handle the case where n == 0
Clarify that SSL_shutdown() must not be called after a fatal error
Fix no-ec, no-sm2 and no-sm3
Don't write the tick_identity to the session
Prevent over long nonces in ChaCha20-Poly1305
Test an overlong ChaCha20-Poly1305 nonce
Update ChaCha20-Poly1305 documentation
Avoid an underflow in ecp_nistp521.c
Add a test for underflow in ecp_nistp521.c
Change arg to cms_CompressedData_init_bio to be const
Fix memory leaks in pkread.c demo file
Fix various no-* options
Fix no-dso
Enable pkeyutl to use Ed448 and Ed25519
Guard some SM2 functions with OPENSSL_NO_SM2
Update pkeyutl documentation about the digest option
Add a skeleton default provider
Implement EVP_MD_fetch()
Make EVP_Digest* functions provider aware
Implement SHA256 in the default provider
Add a test for EVP_MD_fetch
Document the functions EVP_MD_fetch() and EVP_MD_upref()
Fix no-ec
Tolerate 0 byte input length for Update functions
Fix a memory leak in ARIA GCM
Correctly check the return code of EVP_MAC_ctrl everwhere it is used
Don't allow SHAKE128/SHAKE256 with HMAC
Make OCSP_id_cmp and OCSP_id_issuer_cmp accept const params
Ensure EVP_MD_CTX_md returns the EVP_MD originally used
Add an EVP_MD_CTX_md() test
Support EVP_MD_block_size() with providers
Add a test for EVP_MD_block_size()
Skip the correct number of tests if SM2 is disabled
Correct the documentation about SSL_CIPHER_description()
Create a FIPS provider and put SHA256 in it
Add a no-fips Configure option
Test that we can use the FIPS provider
Complain if there are missing symbols when creating a provider .so file
Use the right NID when putting a method in the store
Add a legacy provider and put MD2 in it
Fix crash in X509_STORE_CTX_get_by_subject
Deprecate AES_ige_encrypt() and AES_bi_ige_encrypt()
Make EVP_Encrypt*/EVP_Decrypt* and EVP_Cipher* provider aware
Implement support for AES-256-ECB in the default provider
Add the provider_algs.h internal header file
Add support in the default provider for 192/128 bit AES ECB
Implement AES CBC ciphers in the default provider
Implement AES OFB ciphers in the default provider
Implement AES CFB ciphers in the default provider
Implement AES CTR ciphers in the default provider
Add iv length and key length params to the cipher init calls
Add a maximum output length to update and final calls
Make implementation of blocksize, iv_length and key_length mandatory
Add forward declarations of the AES dispatch table functions
Fix the S390X support for the basic AES ciphers
Create provider errors and use them
Clarify the documentation on the use of ChaCha20
Add some more test vectors for ChaCha20
Fix no-ec2m
Fix EVP_CIPHER_CTX_rand_key()
If key or iv is NULL set the respective length to 0
Fix KTLS compilation error
Fix error in BIO_get_ktls_send() and BIO_get_ktls_recv()
Fix no-srp
Add support for openssl_ctx_run_once and openssl_ctx_onfree
Instead of global data store it in an OPENSSL_CTX
Add some TODO notes into init.c
Update internal documentation after global data move to OPENSSL_CTX
Reject obviously invalid DSA parameters during signing
Revert "EVP_*Update: ensure that input NULL with length 0 isn't passed"
Add the NIST CAVS test vectors for CCM
Make core code available within the FIPS module
Make some EVP code available from within the FIPS module
Move where include path for providers/common/include gets specified
Add more commentary about recursive Provider intialisation in the FIPS module
Defer sending a KeyUpdate until after pending writes are complete
Write a test for receiving a KeyUpdate (update requested) while writing
Make basic AES ciphers available from within the FIPS providers
Ensure we get all the right defines for AES assembler in FIPS module
Really fail if we have a test failure
Convert drbg_lib to use OPENSSL_CTX for its global data
Make the rand_crng code OPENSSL_CTX aware
Move the rand_nonce_lock code into drbg_lib.c
Add documentation for new functions taking an OPENSSL_CTX parameter
Move a fall through comment
Create BN_CTX_new_ex() and BN_CTX_secure_new_ex()
Convert bn_rand.c to use EVP
Temporarily disable RAND call in FIPS_MODE until RAND is available
Make BIGNUM code available from within the FIPS module
Add some dummy BIGNUM calls from inside the FIPS provider
Ensure code is compiled with correct BIGNUM assembler defines
Make find-doc-nits check for newly added undocumented symbols
i2d_PublicKey was listed in 2 different man pages
Fix an incorrect macro
Enable find-doc-nits to find undocumented symbols since 1.1.1
Update the d2i docs to reflect reality
Fix no-dh
Fix building with enable-trace
Allow TLSv1.3 in a no-ec build
Fix no-ec with no-dh
Add the function openssl_ctx_get_concrete()
Convert thread stop handling into a publish/subscribe model
Split thread intialisation and handling out of init.c
Provide a version of ossl_init_thread_start that works in FIPS mode
Tell the FIPS provider about thread stop events
Add the function OPENSSL_thread_stop_ex()
Document OPENSSL_thread_stop_ex()
Standardise the function naming conventions in initthread.c
Fix a race condition in supported groups handling
Fix a race condition in ciphers handling
Following the previous 2 commits also move ecpointformats out of session
Don't create an OPENSSL_CTX twice
Provide an ability to deregister thread stop handlers
Add some internal documentation for some thread related functions
Fix a doc-nits failure
Move the public SIV mode functions from public headers to internal ones
Add documentation for EVP_CIPHER_fetch
Rename EVP_MD_upref/EVP_CIPHER_upref to EVP_MD_up_ref/EVP_CIPHER_up_ref
Document EVP_CIPHER_up_ref()
Make the RAND code available from inside the FIPS module
Fix NULL pointer dereference in the ex_data code
Call RAND_DRBG_bytes from inside the FIPS provider
Add a nid 2 algorithm name mapping capability
Change the DRBG HASH implementation to lookup all allowed algorithm names
Change the DRBG HMAC implementation to lookup allowed digest names
Only cache a method if we actually created one
Ensure that rc5 doesn't try to use a key longer than 2040 bits
Change RC5_32_set_key to return an int type
Fix a leak in evp_test
Provide rand_bytes_ex and rand_priv_bytes_ex
Make BIGNUM rand functions available within the FIPS module
Add a dummy call to BN_rand_ex() in the FIPS provider
Prevent the use of RUN_ONCE inside the FIPS module
Make sure all BIGNUM operations work within the FIPS provider
Make the PACKET/WPACKET code available to both libcrypto and libssl
Convert asn1_dsa.c to use the PACKET API instead
Give WPACKET the ability to have a NULL buffer underneath it
Convert asn1_dsa.c to use the WPACKET API instead
Make the EVP Key Exchange code provider aware
Implement PKCS#3 DH Key Exchange in the default provider
Enable PKCS#3 DH in the providers
Add the ability to set PKCS#3 DH padding in providers
Document the new EVP_KEYEXCH type and related functions
Fix the return value for SSL_get0_chain_certs()
Fix no-dh
Remove some utilities from the core to provider interface
Document the provider DIGEST operation
Document the provider CIPHER operation
Properly process the "Availablein" keyword for evp_test
Suppress loading the FIPS module in evp_test
Load the config file by default
Fix the krb5 external test
Add a CHANGES entry about loading the config file by default
Documentation for the provider Key Exchange operation
Fix SSL_MODE_RELEASE_BUFFERS functionality
Correct the Extended Master Secret string for EBCDIC
Make the EC code available from inside the FIPS provider
Insert a dummy call to EC code in the FIPS provider
Add documentation for new EC functions
Fix ECDSA_SIG docs
Don't set ctx->cipher until after a successful fetch
Run evp_test in FIPS mode
Fix BN error reporting
Fix enable-ec_nistp_64_gcc_128
Fix no-ec
Fix no-filenames
Avoid holding a lock when calling OPENSSL_init_crypto
Clarify the INSTALL instructions
Ensure RSA PSS correctly returns the right default digest
Add Restricted PSS certificate and key
Add TLS tests for RSA-PSS Restricted certificates
Fix test_sslextension if TLSv1.2 has been disabled
Fix test_key_exchange with no_tlsv1_2
Fix SSL_check_chain()
Extend tests of SSL_check_chain()
If we are multiblock capable make sure we use it
Fix context locking
Make sure we pre-initialise properties
Fix data races in EVP_CIPHER_fetch and EVP_MD_fetch
Update fuzz README.md
Fix no-des
Fix no-ec
Fix a documentation bug in ec.h
Fix no-poly1305, no-siphash and no-blake2
Fix no-cmac
Fix no-engine
Use ENGINE_get_id() instead of ENGINE_get_name()
Fix pkeyutl -verifyrecover
Don't send a status_request extension in a CertificateRequest message
Teach TLSProxy how to parse CertificateRequest messages
Add the ability to perform signatures in a provider
Implement DSA in the default provider
Add support for verify/verify_recover functions to EVP_SIGNATURE
Add public API docs for newly added EVP_SIGNATURE related functions
Add docs for the provider interface for signature operations
Enable DH "keys" which only contain domain parameters
Revise EVP_PKEY param handling
Move EVP_PKEY algorithm implementations into a union
Use simple names in core_names.h
Fix no-dsa
Fix no-engine
Pass the correct ctx to provider KDF functions
Avoid passing NULL to memcpy
Make EVP_MD_CTX_[gettable|settable]_params() take an EVP_MD_CTX
Correct the function names in SSL_CTX_set_stateless_cookie_generate_cb.pod
Add the provider function signatures for DigestSign*
Add EVP_DigestSign/EVP_DigestVerify support for DSA
Ensure we look at EVP_MD_CTX_FLAG_KEEP_PKEY_CTX in non-legacy code
Update documentation
Update EVP_MD_CTX_get_params() et al to be EVP_DigestSign*() aware
Add a test for the newly added md params code
Don't call EVP_MD_CTX_reset during EVP_DigestFinal
Free a fetched digest during EVP_MD_CTX_reset() not EVP_MD_free()
Fix no-err
Don't follow legacy path if ctx->pctx is set
RC4 is not a block cipher
Send bad_record_mac instead of decryption_failed
Fix no-autoerrinit
Don't use internal knowledge about EVP_MD_CTX in and MD BIO
Support calling EVP_DigestUpdate instead of EVP_Digest[Sign|Verify]Update
Add a test for EVP_Digest[Sign|Verify]* with a BIO MD
Correctly handle SSL3 Master Secret when calling providers
Fix a copy&paste error in the TLSv1.3 server side PSK documentation
Fix an s_server arbitrary file read issue on Windows
Don't leak memory in the event of a failure in i2v_GENERAL_NAMES
Don't assume the type we read was the type we expected
Ensure EVP_get_digestbyname() and EVP_get_cipherbyname() know all aliases
Test EVP_get_[digest|cipher]byname() use the namemap
Fix no-dsa
Allow setting a NULL pointer in a params structure
Allow strings in params to be of zero length
Implement provider support for Asym Ciphers
Increase OSSL_PARAM_BLD_MAX for multi-prime RSA
Move RSA Asym cipher code to the default provider
Add documentation for the Asymmetric Cipher Operation
Document the public EVP_ASYM_CIPHER releated functions
Document various new/changes EVP_PKEY_CTX_* functions
Add confdump to .gitignore
Fix no-cmac and no-camellia
Fix no-engine
Fix no-blake2
Fix an uninitialised read in conf_def.c
Make sure we free the CONF structure allocated by confdump
EVP_CIPHER_CTX_set_keylen should not succeed if a bad keylen is passed
Add test for non-default sized keys in variable key size ciphers
Tweak some algorithm naming inconsistencies
Documentation updates due to naming tweaks
Make sure we handle input NULL with length 0
Add a test for NULL chunks in encrypt/decrypt
Check that OPENSSL_zalloc was successful when creating EVP types
Check the return from OPENSSL_buf2hexstr()
Make sure we only run the self tests once
Disable mem leak checking for the self test lock
Add the ability to supress deprecation warnings
Deprecate the AES_ige_*() functions
Teach the RSA implementation about TLS RSA Key Transport
Move constant time RSA code out of libssl
Add documentation for the newly added RSA_PKCS1_WITH_TLS_PADDING
Ensure EVP_PKEY_set1_DH detects X9.42 keys
Test that EVP_PKEY_set1_DH() correctly identifies the DH type
Update the HISTORY entry for RSA_get0_pss_params()
Fix evp_extra_test with no-dh
Fix no-dh
Fix no-dsa builds
Don't run test_conf in cross compiled builds
Temporarily disable some Travis external tests
Temporarily disable the explicit enable-asan build
Run make update
Don't store an HMAC key for longer than we need
Don't use the low level AES key wrap APIs in CMS
Deprecate the low level AES functions
Deprecate Low Level Blowfish APIs
Deprecate Low Level Camellia APIs
Deprecate the Low Level CAST APIs
Always go the legacy route if EVP_MD_CTX_FLAG_NO_INIT is set
Add a test for HMAC via EVP_DigestSign*
libssl: Eliminate as much use of EVP_PKEY_size() as possible
Fix init_thread_stop
Don't register drbg_delete_thread_state twice
Convert rand_bytes_ex and rand_priv_bytes_ex to public functions
Implement the NULL cipher in the default provider
Introduce SSL_CTX_new_with_libex()
Document the SSL_CTX_with_libctx() function
Make sure we use RAND_bytes_ex and RAND_priv_bytes_ex in libssl
Modify EVP_PKEY_CTX_new_from_pkey() to add a propquery parameter
Fix SSL_get_servername() and SNI behaviour
Test that SSL_get_servername returns what we expect
Provide better documentation for SSL_get_servername()
Don't acknowledge a servername following warning alert in servername cb
Revert "Legacy digests can have custom control values"
Fix no-ec
Fix common test framework options
Don't complain about documented symbols with find-doc-nits -d -o
Detect EOF while reading in libssl
Teach more BIOs how to handle BIO_CTRL_EOF
Fix no-multiblock
Explicitly fetch ciphers and digests in libssl
Use the OPENSSL_CTX and property query string in EVP_PKEY_CTX
Add a test for SSL_CTX_new_with_libctx()
Fix builds with no-dh
Fix no-tls1_3
Fix no-sm2
Don't ignore ASN1 when checking for undocumented symbols
Temporariy add ASN1_item_verify_ctx() missingcrypto.txt
Fix no-ec
Fix no-dh
Fix no-engine
Fix no-des
Don't compile AESNI code if we're not AESNI capable
Implement a stricter ECX_KEY type
Implement Provider side Key Management for X25519 and X448
Add X25519/X448 Key Exchange to the default provider
Add S390 support for provider based X25519/X448
Fix no-ec build
Make the RSA ASYM_CIPHER implementation available inside the FIPS module
Add Asymmetric RSA cipher tests in FIPS provider
Fix a mem leak in libssl
Add *.d.tmp files to .gitignore
Introduce the provider property
Implement the ECX Serializers
Clarify the usage of EVP_PKEY_get_raw_[private|public]_key()
Add Key Management support for EdDSA keys
Add provider awareness of EVP_DigestSign() and EVP_DigestVerify()
Implement provider support for Ed25519 annd Ed448
Document the new DigestSign provider functions
Don't crash if we fail to find a serializer for the current provider
If the first serializer we find is the desired one that's ok
Implement serializers for ED25519 and ED448
Handle the case where there is no digest in an EVP_MD_CTX
Make sure we use the libctx when fetching a MAC
Use RAND_bytes_ex in crypto/rsa
Make it possible to easily specify a libctx for EVP_DigestSign*
Handle mdname in legacy EVP_DigestSignInit_ex codepaths
Use the libctx and properties when constructing an EVP_PKEY_CTX
Use correct libctx when fetching the TLS1 PRF in libssl
Use a fetched version of SHA256 in tls_process_new_session_ticket()
Make sure we use a fetched cipher when encrypting stateless tickets
Fix EVP_PKEY_new_mac_key()
Use a fetched cipher when decrypting a ticket in libssl
Use a fetched cipher for the TLSv1.3 early secret
Put an error on the stack in the event of a fetch failure
Ignore some fetch failures
Add OCSP_RESPID_set_by_key_ex() and OCSP_RESPID_match_ex()
Use the new OCSP functions in sslapitest.c
Make SRP library context aware
Update libssl to use the new library context aware SRP functions
Use the new library context aware SRP functions in sslapitest
Document various SRP related APIs
Display errors if a test TLS connection fails
Describe the "want" parameter in int create_bare_ssl_connection()
Don't attempt to up-ref an EVP_CIPHER if it is NULL
Add the X509v3_cache_extensions() function
Explicitly cache X509v3 extensions in libssl
Document the new X509v3_cache_extensions() function
Give a better error if we can't find a sig alg
Don't double free a DH object
Use EVP_DigestSignInit_ex and EVP_DigestVerifyInit_ex in libssl
Make sure we use the libctx when creating an EVP_PKEY_CTX in libssl
Make sure we always use the correct libctx in sslprovidertest.c
Extend the sslprovider_test to be able to additionally test FIPS
Expand the XTS documentation
Add "endfirst" writing to WPACKET
Add a WPACKET test for the new DER capability
Add X509_STORE_CTX_new_with_libctx()
Use X509_STORE_CTX_new_with_libctx() in libssl
Use the libctx and propq from the X509_STORE_CTX
Explicitly cache the X509v3_extensions in one more place in libssl
Document the new X509_STORE_CTX_new_with_libctx() function
Enable export_to functions to have access to the libctx
Make the CT code library context aware
Ensure libssl uses the new library context aware CT code
Document the new library context aware CT functions
Add the auto generated der files to .gitignore
Enable Ed25519 signing/verifying to use the libctx
Teach d2i_PrivateKey et al about libctx
Use the libctx in Ed448 private key decoding
Teach the OSSL_STORE code about libctx
Teach PEM_read_bio_PrivateKey about libctx
Make sure we use the libctx in libssl when loading PrivateKeys
Document the new libctx aware private key functions
When calling EC_POINT_point2buf we must use a libctx
Make sure we always send an alert in libssl if we hit a fatal error
Create a libctx aware X509_verify_ex()
Introduce an internal version of X509_check_issued()
Document X509_verify_ex() and X509_REQ_verify_ex()
When calling the import_to function pass the libctx too
Use a non-default libctx in sslapitest
Re-enable FIPS testing in sslapitest.c
Use the libctx for all EVP_PKEY_CTX operations
Run ssl_test_new with a non-default library context
Teach ssl_test_new to have different tests for different loaded providers
Teach ssl_test_new how to test the FIPS module
Use a fetched MD if appropriate in ssl3_cbc_digest_record
Teach ssl_test_old how to run tests in a non-default library context
Teach ssl_test_old to use the FIPS provider for its tests
Fix test_ssl_new test failure
Fix an ssl_test_old test failure
Fix no-des
Fix no-deprecated tests where the GOST engine is present
Add a link to wiki 3.0 upgrade notes
Fix no-ec
Fix some build failures with no-dh
Skip a test in a no-dh build
Skip a no-dsa test in the fipsinstall test
Fix no-err
Mention the 3.0 wiki page in the release announcement emails
Fix a typo in the makefile templates
Update copyright year
Prepare for release of 3.0 alpha 1
Matt Eaton (2):
Update RAND_DRBG.pod
Update NOTES.ANDROID
Matt Turner (1):
config: Drop linux-alpha-gcc+bwx
Matthew Hodgson (1):
openssl s_server: don't use sendto() with connected UDP socket
Matthias Kraft (3):
Add "weak" declarations of symbols used in safestack.h and lhash.h
Fix Invalid Argument return code from IP_Factory in connect_to_server().
Fix reference to symbol 'main'.
Matus Kysel (1):
Remove deadlock that was caused by calling pthread_rwlock_wrlock() on same thread twice. This can be reproduce only with musl.
Michael Haubenwallner (1):
Windows/Cygwin dlls need the executable bit set
Michael Osipov (1):
Fix long name of some Microsoft objects
Michael Richardson (2):
fixed grammar typo
clarify which functions are the CMS functions which must have CMS_PARTIAL set
Michael Tuexen (1):
Fix end-point shared secret for DTLS/SCTP
Miquel Ruiz (1):
Add SSL_shutdown to SSL_get_error's documentation
MouriNaruto (1):
Improve the Windows OneCore target support. (Add targets for building libraries for Windows Store apps.)
Mykola Baibuz (3):
Remove useless check. Hash can be longer than EC group degree and it will be truncated.
Safer memory cleanup in (crypto/rsa/rsa_lib.c)
doc: fix link in BN_new.pod
NaveenShivanna86 (1):
'init_buf' memory can be freed when DTLS is used over SCTP (not over UDP).
Nicola Tuveri (38):
Test for constant-time flag leakage in BN_CTX
Clear BN_FLG_CONSTTIME on BN_CTX_get()
Fix trivial typo in EVP_DigestVerifyInit doc
Fix memory leak in ectest
EC_GROUP_set_curve() might fail for arbitrary params
Separate the lookup test
Temporary workaround for ectest.c for [extended tests]
Fix a SCA leak using BN_bn2bin()
Make BN_num_bits() consttime upon BN_FLG_CONSTTIME
Uniform BN_bn2binpad() and BN_bn2lebinpad() implementations
[ec/ecp_nistp*.c] remove flip_endian()
[ec/ecp_nistp*.c] restyle: use {} around `else` too
[ec] Match built-in curves on EC_GROUP_new_from_ecparameters
Fix spacing nit in test/ectest.c
Uniform TEST_*() check usage in test/ectest.c
[ec_asn1.c] Avoid injecting seed when built-in matches
Avoid using EC_GROUP_clear_free() internally
Deprecate EC_GROUP_clear_free()
Improve formatting for man3/EC_GROUP_new.pod
Fix doc for EC_GROUP_set_curve()
Add more tests for apps/req
Fix EC_POINT_bn2point() for BN_zero()
Add self-test for EC_POINT_hex2point
Extend docs for EC_POINT conversion functions
More testing for CLI usage of Ed25519 and Ed448 keys
More testing for sign/verify through `dgst` and `pkeyutl`
Fix potential SCA vulnerability in some EC_METHODs
Add test/bio_prefix_text to .gitignore
[PROV][KEYMGMT][DH][DSA] use BN_clear_free for secrets
[EC] Constify internal EC_KEY pointer usage
[CMS] Test decryption of a ciphertext encrypted from 1.1.1
[PROV][KMGMT][KEXCH][EC] Implement EC keymgtm and ECDH
[PROV][KEYMGMT][EC] Import/export of priv_key as padded const time BN
[EC] harden EC_KEY against leaks from memory accesses
[BN] harden `BN_copy()` against leaks from memory accesses
[PROV][EC] Update documentation
Add test for providers exposing OSSL_FUNC_PROVIDER_GET_REASON_STRINGS
Fix off-by-1 bug on provider_activate with custom error strings
Nikolay Morozov (7):
Forgotten GOST2012 support in non-vital places
x509v3 subjectSignTool extention support
Issuer Sign Tool extention support
TLS Cipher Suite 0xC102 Support
TLSEXT_SIGALG_gostr34102012 0x0840 and 0x0841 support
GOST2012 TLS ClientCertificateType Identifiers support
GOST2012 TLS Supported Groups Identifiers Support
Omid Najafi (1):
Fix syntax error for the armv4 assembler
Patrick Steuer (61):
s390x assembly pack: add OPENSSL_s390xcap environment variable.
s390x assembly pack: add OPENSSL_s390xcap man page.
s390x assembly pack: perlasm support.
crypto/chacha/asm/chacha-s390x.pl: add vx code path.
crypto/poly1305/asm/poly1305-s390x.pl: add vx code path.
s390x assembly pack: fix formal interface bug in chacha module
s390x assembly pack: import chacha from cryptogams repo
s390x assembly pack: import poly from cryptogams repo
fix --strict-warnings build
fix --strict-warnings build
s390x assembly pack: allow alignment hints for vector load/store
s390x assembly pack: update perlasm module
s390x assembly pack: remove chacha20 dependency on non-base memnonics
s390x assembly pack: remove poly1305 dependency on non-base memnonics
s390x assembly pack: allow specifying the tag after aad in aes-ccm
EVP_Digest*: enable SHA3 pre-hashing for ECDSA
EVP_Digest*: enable SHA3 pre-hashing for DSA
Fix s390x build errors and warnings
s390x assembly pack: add support for pcc and kma instructions
s390x assembly pack: update OPENSSL_s390xcap(3)
test/p_test.c: silence -Wstringop-overflow
s390x assembly pack: fix various aes modes performance regression
s390x assembly pack: fix restoring of SIGILL action
Remove superfluous call to OPENSSL_cpuid_setup
s390x assembly pack: use getauxval to detect hw capabilities
Fix commit a672a02a s390x build breakage
s390xcpuid.pl: fix comment
s390x assembly pack: accelerate scalar multiplication
Enable curve-spefific ECDSA implementations via EC_METHOD
s390x assembly pack: accelerate ECDSA
OPENSSL_s390xcap.pod: list msa9 facility bit (155)
Fix 9bf682f which broke nistp224_method
Directly return from final sha3/keccak_final if no bytes are requested
Test for out-of-bounds write when requesting zero bytes from shake
Fix --strict-warnings build
Fix aes ofb, cfb and cfb8 for s390x
Fix strict-warnings build
s390x assembly pack: fix msa3 stfle bit detection
s390x assembly pack: fix OPENSSL_s390xcap z15 cpu mask
s390x assembly pack: cleanse only sensitive fields
s390x assembly pack: accelerate X25519, X448, Ed25519 and Ed448
md4/md5: macros should not include the line following them
s390x: fix build errors
s390x assembly pack: enable clang build
Fix --strict-warnings build
s390x assembly pack: perlasm module update
s390x assembly pack: fix x448 handling of non-canonical values
Add self-generated test vector for x448 non-canonical values
s390x assembly pack: process x25519 and x448 non-canonical values
bss_dgram.c: fix unaligned access
testutil/init.c rename to testutil/testutil_init.c
travis.yml: add arch s390x target
s390x assembly pack: fix bn_mul_comba4
Dont pass zero length input to asm modules for ciphers
Allow specifying the tag after AAD in CCM mode (2)
aes-s390x.pl: fix stg offset caused by typo in perlasm
crypto/ec/curve448/eddsa.c: fix EBCDIC platforms
AES CTR-DRGB: performance improvement
AES CTR-DRGB: add test for 32-bit counter overflow
AES CTR-DRGB: do not leak timing information
Fix EVP_DigestSign interface when used with DES CMAC
Paul Monson (1):
conn_is_closed should return 1 if get_last_sys_error is WSAECONNRESET CLA: trivial
Paul Yang (31):
Make some return checks consistent with others
Add some missing ciphers in 'enc' document
Fix a nit of copyright date range
Fix compiling warnings in example code
Fix a doc-nit in EVP_PKEY_CTX_ctrl.pod
Add poly1305 MAC support
Fix a collision in function err numbers
Fix access zero memory if SSL_DEBUG is enabled
Fix a grammar nit in CRYPTO_get_ex_new_index.pod
Support raw input data in apps/pkeyutl
Fix the default digest algorthm of SM2
Place return values after examples in doc
Add section order check in util/find-doc-nits
Add test cases for SM2 cert verification
Add documents for SM2 cert verification
Fix a memleak in apps/verify
Make X509_set_sm2_id consistent with other setters
Add documentation for X509_cmp and related APIs
Fix incorrect usage of a test case
Support SM2 certificate signing
Add description in X509_STORE manipulation
Support parsing of SM2 ID in hexdecimal
Fix test error if scrypt is disabled
Fix a double free issue when signing SM2 cert
Fix a document description in apps/req
Fix a return value bug in apps/speed.c
Fix a bundle of mischecks of return values
Support SM2 in apps/speed
Fix no-sm2 issue
Add doc for TS_VERIFY_CTX_set_certs()
Add duplication APIs to ASN1_TIME and related types
Pauli (357):
FIPS 140-2 IG A.9 XTS key check.
Add a note to CHANGES indicating that AES-XTS now enforces two different keys.
Speed for HMACs.
Limit the number of AES-GCM keys allowed in TLS. A new error is raised if this limit is ever reached.
Use 'i' as parameter name not 'I'.
Add a compile time test to verify that openssl/rsa.h and complex.h can coexist.
Add missing include file. Specifically, include e_os.h to pick up alloca definition for WIN32.
Add a GMAC demonstration program.
Use secure_getenv(3) when available.
Indentation fixes.
RSA security bits calculation
DSA mod inverse fix
Timing vulnerability in DSA signature generation (CVE-2018-0734).
Timing vulnerability in ECDSA signature generation (CVE-2018-0735)
openssl list -mac-algorithms support.
Add a constant time flag to one of the bignums to avoid a timing leak.
GMAC implementation Remove GMAC demo program because it has been superceded by the EVP MAC one
Clarify the POD source for the list command.
EVP_MAC ctrl numbering duplicate removal.
Cleanse the key log buffer.
Fix return formatting.
Add missing RAND initialisation call.
Address a bug in the DRBG tests where the reseeding wasn't properly reinstantiating the DRBG.
Fix comment typo
Add sparse array data type.
Fix typo in comment
Macro typo fix not propagated
Fix master build. The recent change from ENGINES to MODULES broke the configure it seems.
Sparse array limit testing: reduce the range limit for the number of bits in a sparse array pointer block.
Sparse array iterators include index position.
Properties for implementation selection.
generated files
Fix a test ordering issue.
CID 1442836: Resource leaks
CID 1442835: Integer Overflow
CID 1442838: API usage errors
Check for negative return for signature size.Addresses Coverity 1442933
Make the sparse array code use ossl_uintmax_t as its index rather than size_t.
OSSL_PARAM helper functions.
generated files
Fix resource leak coverity 1443711. Free the allocated pointer on error.
Add documentation for the -sigopt option.
Cosmetic rand/drbg changes.
Detect endian without relying on defined symbols.
Fix test builds.
Fix broken change from b3d113e.
Add the FIPS related continuous random number generator (CRNG) testing. Refer to FIPS 140-2 section 4.9.2 Conditional Tests for details.
Clear seed source structures.
Ensure that the struct msghdr is properly zeroed.
It isn't necessary to initialise a struct stat before a stat(2) system call. The initialisation was also flawed, failing to account for padding and alignment bytes.
Make the array zeroing explicit using memset.
Correctly zero the DISPLAY_COLUMNS structure.
Propery initialise struct sslapitest_log_counts to zero using memset.
Correctly initialise PACKET to zero in the tests to avoid possible problems with padding bytes.
issue-8493: Fix for filenames with newlines using openssl dgst
Implement the param types that aren't explicitly lengthened (e.g. int) in terms of those that are (e.g. int32_t).
AES-XTS block limit.
Move the AES-XTS mode duplicated key check into the init_key function rather than the update call. The means an earlier error return at the cost of some duplicated code.
Fix big endian param API tests.
Avoid alignment problems in params API.
Reseeding without derivation function is not supported in FIPS mode.
Add prediction resistance capability to the DRBG reseeding process.
SP 800-56B steps enumerated.
Fix bug in entropy gathering.
Statistically test BN_rand_range().
Squashed commit of the following:
Structure alignment macro.
Coverity CID 1444963: Null pointer dereferences
Coverity CID 1444961: Integer handling issues
Coverity CID 1444960: Error handling issues
Coverity CID 1444959: Integer handling issues
Coverity CID 1444958: Null pointer dereferences
Coverity CID 1444957: Error handling issues
Coverity CID 1444956: Integer handling issues
Coverity CID 1444955: Null pointer dereferences
Coverity CID 1444954: Integer handling issues
Coverity CID 1444953: Null pointer dereferences
Coverity CID 1444952: Null pointer dereferences
Coverity CID 1444951: Null pointer dereferences
Coverity CID 1444950: Control flow issues
Skip the no derivation functions when in FIPS mode because they are not applicable.
Test skip option.
Revert "ppc assembly pack: always increment CTR IV as quadword"
Params conversion tests.
Optional property query support.
Always show application and library versions in "openssl version".
Avoid trailing space in "openssl version -o".
Test of uniformity of BN_rand_range output.
Add man 7 page about properties.
Add sparse array of const pointer type
Fix a typo in the property grammar that creates an ambiguous parse.
Remove file reference from property documentation.
Document property hierarchy.
Address property documentation concerns.
OSSL_PARAM example code bug fix.
Better document specific OSSL_PARAM symbols.
ARIA documentation titled itself AES
Print thread IDs nicely.
Remove OPENSSL_memcmp.
Add documentation for CRYPTO_memcmp.
Change OSSL_PARAM return size to not be a pointer.
Allow AES XTS decryption using duplicate keys.
The params_test uses wrong size for BN check.
Add a note in the contributing file about trivial commits.
Add OIDs for kmac128, kmac256 and blake2.
Coverity #1451595: use correct free function.
Coverity #1451596: check dirlen for being negative
remove end of line whitespace
Remove DRBG from SSL structure.
Remove tab characters from C source files.
remove end of line spaces
Parameter building utilities.
Add param builder free function.
Avoid double clearing some BIGNUMs
Make rand_pool buffers more dynamic in their sizing.
Add weak platform independent PRNG to test framework.
Fix coverity 1452084 Fix coverity 1452083
Check for NULL return from zalloc in dh_dupctx.
The query cache has been updated to not depend on RAND_bytes being available.
Prevent an infinite recursion when the query cache is flushed.
Use NULL as parameter when pointer can only be NULL.
Access data after obtaining the lock not before.
Start up DEVRANDOM entropy improvement for older Linux devices.
Constify param builder string functions.
Avoid overflowing FDSET when using select(2).
Include mac_meth and mac_lib in the FIPS provider
Allow an output indentation of zero in apps.
Fix NITs in comments and CHANGES for DEVRANDOM seeded check.
Don't include the DEVRANDOM being seeded logic on Android.
Fix function name typo in MAC documentation.
Fix Coverity 1453452: Control flow issues (DEADCODE)
OSSL_PARAM_construct_utf8_string computes the string length.
Move KDFs to the provider.
Fix TLS/SSL PRF usages.
Remove old KDF initialisation
Fix users of KDFs to use params not ctls
Add KDFs to providers
Documentation updates in light of the KDF conversion
Test updates in light of the KDF switchover
KDF additons to names and numbers
KDF provider conversion error updates - generated
App updates for KDF provider conversion.
KDF/PRF updates to libcrypto
Cleanse crypto/kdf directory
Cleanse KDF error files
Cleanse KDF missing crypto files
KDF error codes reworked
Update EVP test data for KDFs and PRFs.
Params from text to allow zero length value fields
ossl_provider_library_context(NULL) returns NULL.
Update private.num for KDFs/PRFs
Update KDF documentation (section 7)
Update KDF documentation (section 1)
Update KDF documentation (section 3)
Lowercase command line 'N' argument since params have lower case names
Clear collected_seed after freeing it
Remove reference to legacy aliases for MAC and KDF
Move OSSL_OP_KDF into its rightful place amongst the other OSSL_OP_ definitions
libcrypto.num entries for KDFs
Unify the digest getting code inside providers.
CMAC using common cipher get code
GMAC using common cipher get code
HMAC using common digest get code
KMAC using common digest get code
Add 'engine' param to KDFs
Use common define for properties, engine, cipher and digest params
Use common digest getter for HKDF
Use common digest getter for PBKDF2
Use common digest getter for single step KDF
Use common digest getter for TLS1 PRF
Use common digest getter for SSH KDF
Use common digest getter for X942 KDF
Coverity 1414465: Resource leaks (RESOURCE_LEAK)
Coverity 1453627: Null pointer dereferences (REVERSE_INULL)
Coverity 1453628: Null pointer dereferences (REVERSE_INULL)
Coverity 1453630: Null pointer dereferences (FORWARD_NULL)
Coverity 1453632 & 1453635: Null pointer dereferences (FORWARD_NULL)
Coverity 1453633: Error handling issues (CHECKED_RETURN)
Coverity 1453634: Resource leaks (RESOURCE_LEAK)
Coverity 1453629 and 1453638: Error handling issues (NEGATIVE_RETURNS)
Add macros for the KDF algorithm names.
Convert SSL functions to use KDF names not SN_ strings
Update tests to (mostly) use KDF names
Make FIPS provider use KDF name for PBKDF2
Register KDF's using their name macros rather than strings
Usages of KDFs converted to use the name macros
Define the MAC parameter types without using C type names to avoid confusion.
Add wording to limit the 'size' parameter to no more than can be specified using a size_t variable
Use param types for parameter descriptions. Mention a size_t limit to those where it makes sense.
Use param types instead of native types in the param descriptions
Fix examples in the section 7 KDF man pages.
Use "PARAMETERS" in the documentation headings.
Avoid mentioning ctrl_str in the MAC documentation.
Clean up KDF documentation in section 7.
Cleanup KDF section 1 documentation.
Fix links to functions.
Use PARAMETERS instead of PARAMETER NAMES for the heading for consistency.
Change PARAMETER NAMES links to PARAMETERS
Note that the mac command is preferrable to the MAC command line options.
Make the "engine" parameter to some provider algorithms (KDF/PRF) hidden.
Remove engine param macros from wrapper APIs
Remove engine param from the settable list
Remove engine param from EVP_KDF and EVP_MAC documentation
Remove the engine parameter from the individual MAC documentation
Remove the engine parameter from the provider MAC documentations
Use OSSL_PARAM types for KDF documentation
Use OSSL_PARAM types for MAC documentation
KDF section 3 clean up
Use OSSL_PARAM types. Limits are explained in the description where appropriate.
Use OSSL_PARAM types. Limits are explained in the description where appropriate.
Make OSSL_PARAM descriptions uniformly formatted.
Reformat param description lines
Consistent naming for context gettable param queries .
Remove unused fields in method store structure.
Fix typo in comment
Remove providers/default which seems to have been missed.
Clarify the description of the NULL argument in SSL_set1_host().
KDF: use string names not macros to align with other algorithms.
DRBG: weaken the restriction on allowed digests.
DRBG: add check for XOF so these can be disallowed by the DRBGs
Properties: make query cache reference count aware.
ECDSA: don't clear free memory after verify.
Engine: Add NULL check.
EVP p_lib: Add NULL check to EVP_PKEY_missing_parameters.
Core: allow NULL argument to stored_namemap_free().
kdfs: make free calls check for NULL.
PROV: check for memory allocation failure in digest _dupctx.
PROV: Avoid NULL dereference in SHA3 dup call.
main: avoid a NULL dereference on initialisation.
Thread: Avoid a NULL dereference after failed initialisation.
Property: fix intermittent test failure.
Property: fix memory leak.
Remove spurious space from file.
mac siphash: add missing NULL check on context creation
mac poly1305: add missing NULL check in new function.
coverity 1456642: fix null check
coverity 1456640: fix null check
coverity 1456639: fix NULL dereference
coverity 1456638: fix null check
coverity 1201478: check BIO_indent returns
coverity 1201462: check error returns
ripemd: fix preprocessor indentation
Deprecate the low level RIPEMD160 functions.
md2: fix preprocessor indentation
Deprecate the low level MD2 functions.
md4: fix preprocessor indentation
Deprecate the low level MD4 functions.
mdc2: fix preprocessor indentation
Deprecate the low level MDC2 functions.
whirlpool: fix preprocessor indentation
Deprecate the low level Whirlpool functions.
The MD2 test uses the EVP APIs not the low level ones. The test can be moved into the EVP tests and the separate executable removed.
seed: fix preprocessor indentation
Deprecate the low level SEED functions
rc2: fix preprocessor indentation
Deprecate the low level RC2 functions
rc4: fix preprocessor indentation
Deprecate the low level RC4 functions
rc5: fix preprocessor indentation
Deprecate the low level RC5 functions
Digest function deprecation CHANGES.
changes: combined CHANGES entry for deprecated low level cipher functions.
news: combined NEWS entry for deprecated low level cipher functions
sha: fix preprocessor indentation
Deprecate the low level SHA functions.
Deprecate the low level MD5 functions.
TODO: undo md5.h and sha.h changes temporarily
param_bld: add a padded BN call.
idea: fix preprocessor indention
Deprecate the low level IDEA functions.
apps: Fix deprecation conditional in speed.c
mdc2: use evp_test instead of a separate test application.
des: fix header file preprocessor indentation
Deprecate the low level DES functions.
cmac: preprocessor indentation fixes
Deprecate the low level CMAC functions
hmac: preprocessor indentation fixes
Deprecate the low level HMAC functions
TLS: use EVP for HMAC throughout libssl.
scrypt: free the MD reference correctly.
evp_pmeth: free the MD reference correctly.
ec.h: fix preprocessor indentation
Deprecate the ECDH functions.
Deprecate the ECDSA and EV_KEY_METHOD functions.
Make minimum size for secure memory a size_t.
Params: change UTF8 construct calls to avoid explicit strlen(3) calls.
DSA: fix the DSA parameter logic in test.
dsa.h: fix preprocessor indentation
Deprecate the low level DSA functions.
test_dsa: fix deprecation logic
app: add a deprecation warning to all deprecated commands.
dsa: deprecate applications that depend on the low level DSA functions.
Add NEWS entry about deprecation of command line public tools
Remove unused OSSL_PARAM_construct_from_text() function.
Remove unused ossl_param_bld_to_param_ex() function.
Apps: don't build deprecated DH and DSA apps.
dsatest: fix the non-deprecated version of the test run.
Coverity 1458439: fix resource leak
Coverity 1458438: fix uninitialised memory access.
ffc: use sizeof(*pointer) instead of sizeof(struct) in memset(3) call.
Deprecate EC command line apps.
rsa.h: fix preprocessor indentation
NEWS: DH, DSA, ECDH, ECDSA and RSA public key function deprecation note
rsa: document deprecated low level functions
rsa: document deprecated RSA command line apps
Deprecate the low level RSA functions.
DH: fix header file indentation
DH: add CHANGES entry listing the deprecated DH functions.
Deprecate the low level Diffie-Hellman functions.
Params: add argument to the _from_text calls to indicate if the param exists.
pmeth_lib: detect unsupported OSSL_PARAM.
apps: distinguish between a parameter error and an unknown parameter.
pkey: update command line tool examples in light of deprecations.
pkey: additional EC related options
sec_mem: add note about the minimum size parameter.
secmem: ignore small minsize arguments to CRYPTO_secure_malloc_init().
man1: make all openssl command line tool documentation generated.
cmdline app: add provider commandline options.
dh: document what the PEM files in apps actually contain.
Remove old incorrect DH parameter files
Remove reference to old DH files.
DH: remove DH parameter files that aren't used or installed.
Param builder: make the OSSL_PARAM_BLD APIs public.
NEWS: note OSSL_PARAM_BLD API as public.
Param build: make structures opaque.
Param builder: Remove the static size limit.
params: avoid a core dump with a null pointer and a get string call
Integer overflow in ASN1_STRING_set.
params: add a warning about the PTR types.
Add a null provider which implements no algorithms.
Add ECX to FIPS provider as non-FIPS algorithms
ecx: add key generation support.
s390: ECX key generation fixes.
ecx: check for errors creating public keys from private ones.
pkey: free key manager on error path
news: note the addition of ECX and SHAKE256 to the FIPS provider as non-approved algorithms
doc: note that the FIPS provider contains some non-approved algorithms.
dsa: update command line app to use EVP calls
rsa: update command line app to use EVP calls
dsaparam: update command line app to use EVP calls
tests: reinstate tests for deprecated but non-removed functionality
dhparam: update command line app to use EVP calls
apps: reinstate deprecated commands but using PKEY APIs
openssl: include the version a command was deprecated in the output text.
genrsa: update command line app to use EVP calls
gendsa: update command line app to use EVP calls
Undeprecate DH_get_length() and DH_set_length() functions
CHANGES: note which command line utilities are marked for deprecation but still available.
dsaparam: update command line app to use EVP calls
apps: reinstate deprecated commands but using PKEY APIs
openssl: include the version a command was deprecated in the output text.
apps: undeprecate the conditioned out apps
dhparam: white space cleaning
gendsa: remove unnecessary OPENSSL_SUPPRESS_DEPRECATED definition
params: add functionality to test if an OSSL_PARAM has been set.
evptest: set the DESX provider to be the legacy provider.
FIPS: remove algorithms that are not being validated.
Pavel Karagodin (1):
apps/dgst.c: allocate a new signature buffer
Petr Vorel (1):
Reuse already defined macros
Philip Prindeville (2):
genrsa: introduce -verbose option to enable output
gendsa: dsaparam: introduce -verbose option to enable output
Philippe Antoine (1):
Fix build with clang assembler
Ping Yu (1):
add an additional async notification communication method based on callback
Quantomicus (1):
Fix s_client hang on non-compliant NNTP server test
Rashmica Gupta (1):
crypto/ppccap.c: Fix which hwcap value used to check for HWCAP_ARCH_3_00
Rebecca Cran (2):
Swap #if blocks in uid.c so target platform gets checked before host
Fix UEFI build on FreeBSD by not including system headers
Retropotenza (1):
Fix CHECK_BSD_STYLE_MACROS for OpenBSD and cryptodev-linux
Rich Salz (114):
Remove outdated e_chil.txt file
Ignore duplicated undocumented things
Some code-cleanup/simplification in apps
util/mkerr.pl: Add an inclusion of symhacks.h in all error files
Add regenerated header files
Move ASN1_BROKEN macros
Change ERR_add_error_[v]data to append
Remove NextStep support
Remove DES_check_key global
Remove global-var/function macros
Remove EXPORT_VAR_AS_FUNC
Fix comment; unchecked->checked
Make allocation/free/clean available to providers
Remove function name from errors
Regenerate mkerr files
Deprecated {OPENSSL,CRYPTO}_debug_mem_{push,pop}
Add ERR_put_func_error, and use it.
Deprecate SYSerr, add new FUNCerr macro
Include deprecated SYS_F_xxx codes
Don't complain if function name doesn't match
Replace FUNCerr with ERR_raise_data
Fix doc example code to follow coding style
Ignore function code collisions
.travis.yml: Use travis_terminate on failure
Fix some pod-page ordering nits
Use EXAMPLES not EXAMPLE for section title
Use WARNINGS heading not WARNING
Do not have duplicate section heads
Handle the renamed command POD files in find-doc-nits
Make failed messages easier to find
ERR: Change get_error_values() to use an enum
Add script convert XXerr to ERR_raise
Deprecate XXXerr() macros
Add merge-err-lines script
Avoid ?: construct in XXXerr calls
Exit non-zero if find-doc-nits finds nits
Fix bugs in "info" commands flags
Ensure man1 POD files start with openssl-
Consistent formatting of flags with args
Add '=for comment ifdef' to pod pages
Update "missing documentation" function lists
Add wordlist from man7.org
Fix errors found by new find-doc-nits
Rename "private" file, doc doc changes in CHANGES
Fix L<EVP_KDF-derive> to L<EVP_DEF_derive>
Add missing help text for some options
Also mention -- flag and ignore if undocumented
Deprecate NCONF_WIN32() function
Fix typo in flag name
Fix reference to PEM docs
Refactor -passin/-passout documentation
Explicitly test against NULL; do not use !p or similar
Replace '=for comment ifdef' with '=for openssl'
Remove duplicated line in 'openssl list' output
Refactor many common flags into openssl.pod
Replace BUF_ string function calls with OPENSSL_ ones
Add/remove things from .gitignore
Fix some wording and markup
Document the -inform, etc., in openssl.pod
Document "get/set-app-data" macros.
Fix broken links, mainly typo's
Infrastructure for templated doc in POD files
Fix L<> entries without sections
Remove outdated info from man7/ssl
Add L<ssl(7)> to all SSL pages
Strip much out of ssl.pod
Add "sections" to -help output
Add ssl_ctx_test to test suite.
Fix L<xxx(1)> links to be L<openssl-xxx(1)>
Fix some broken doc links
Document command parameters.
Document more env var stuff, fix some typo's
Use option/parameter consistently.
Remove handling of outdated macro's
Fix docs for CRYPTO_secure_allocated
Various missing-link fixes
Deprecate most of debug-memory
Deprecated crypto-mdebug-backtrace
Fix build when enabling mdebug options.
Use a function to generate do-not-edit comment
Move -nameopt to openssl.pod
Refactor -engine documentation
Make generated copyright year be "now"
Tweak option error messages
Refactor the tls/dlts version options
Better documentation of -www,-WWW,-HTTP flags
Remove duplicates
Fix some missing doc links.
Add missing files to generated
Update man3/verify documentation, error text
Add more generated man1 doc files
Document most missing options
Add -issuer_checks to verify options
Update the SSL/TLS connection options
Fix "ts" no-XXX options, document two TLS options
Add missing s_client options
The -hmac option to speed is now #ifdef'd
Add cmd-nits to travis build
Update command list
More accurate doc of -ssl_config option
Remove unused HAS_LFN_SUPPORT
Make secure-memory be a config option
Add $debug variable and use it
Use a wrapper for pod2html
Add some missing env var documentation
Remove unused files
Use .cnf for config files, not .conf
Add -section option to 'req' command
DOCS: Use "command" not "tool" or "utility"
Extend Travis build time-out
Update CA.pl podpage, and script
Don't compile commands if disabled
Use build.info, not ifdef for crypto modules
Put sys-specific files in build.info
Richard Könning (1):
Use ctx2 instead ctx.
Richard Levitte (1012):
The next version in master is at least 1.1.2, not 1.1.1x
Configure: DON'T trickle down includes from products to sources
Configure: Name object files according to the product they are part of
Build files: Separate 'lib' intent from 'shlib' intent
crypto/sm2/sm2_sign.c: ensure UINT16_MAX is properly defined
VMS: stop trying to build shared libraries from static ones
Update the documentation on libobj2shlib / obj2shlib
VMS build: fix a misspelled 'bin_cflags' and a wrongly coded 'NO_INST_'
VMS: turn on name mangling for all our programs
VMS libtestutil: look for lower case "main"
VMS: only use the high precision on VMS v8.4 and up
crypto/ui/ui_openssl.c: make sure to recognise ENXIO and EIO too
util/mkdef.pl, util/add-depends.pl: don't lowercase file names
/dev/crypto engine: add missing RC4 parameter
crypto/bn/asm/x86_64-gcc.c: remove unnecessary redefinition of BN_ULONG
Small cleanup (util/mkdef.pl, crypto/bio/bss_log.c, include/openssl/ocsp.h)
Clean out aliases in include/openssl/symhacks.h
Refactor linker script generation
'openssl list': add option -objects to list built in objects
Remove SSL_version_str
Add a perl module that deals with ordinals files
Refactor util/mkdef.pl for clearer separation of functionality
Move ZLIB from 'platforms' to 'features'
A perl module to parse through C headers
Add code to manipulate the items in OpenSSL::Ordinals
Refactor util/mknum.pl for clearer separation of functionality
util/mkdef.pl: Produce version scripts from unversioned symbols
Change the build of engines to use ordinal files for symbol export
Add build file support for generic symbol exports with DSOs
Configure: use correct variable to infer the .ld file location
util/mkdef.pl: for VMS, allow generation of case insensitive symbol vector
/dev/crypto engine: give CIOCFSESSION the actual sess-id
Build file templates: look at *all* defines
build file templates: have targets for all shared library names
RAND: ensure INT32_MAX is defined
Windows: Produce a static version of the public libraries, always
iOS config targets: disable "async" by default
Add EVP_MAC API
Add automatic initializations support for EVP_MAC objects
Add generic EVP_PKEY_METHOD for EVP_MACs
Adapt test/evp_test.c to deal with available EVP_MACs
Add convenience functions EVP_str2ctrl() and EVP_hex2ctrl()
apps/rehash.c: Convert ISO-8859-1 to UTF-8
VMS & cryptoerr.h: include symhacks.h
ssl/statem: Don't compare size_t with less than zero
Windows build: build foo.d after foo.obj
test/evp_test.c: don't misuse pkey_test_ctrl() in mac_test_run()
test/evp_test.c: Fixed strcmp() fault in mac_test_init()
EVP_MAC: Add CMAC implementation
EVP_MAC: Integrate CMAC EVP_PKEY_METHOD into generic MAC EVP_PKEY_METHOD
Adapt other EVP code to use EVP_MAC instead of direct implementation calls
Make sure at least one CMAC test still uses the EVP_PKEY method
EVP_MAC: Add HMAC implementation
EVP_MAC: Integrate HMAC EVP_PKEY_METHOD into generic MAC EVP_PKEY_METHOD
Make sure at least one HMAC test still uses the EVP_PKEY method
EVP_MAC: Add SipHash implementation
EVP_MAC: Integrate SipHash EVP_PKEY_METHOD into generic MAC EVP_PKEY_METHOD
Have a couple of SipHash test uses the EVP_PKEY method
Add blurbs about EVP_MAC in NEWS and CHANGES
Configuration: when building the dirinfo structure, include shared_sources
Configure: ensure empty arrays aren't created inadvertently
apps: Stop pretending to care about Netscape keys
doc/man7/EVP_MAC_*.pod: incorrect english corrected
crypto/engine/eng_devcrypto.c: add digest copy
crypto/engine/eng_devcrypto.c: new compilers are strict on prototypes
crypto/engine/eng_devcrypto.c: open /dev/crypto only once
crypto/engine/eng_devcrypto.c: ensure we don't leak resources
Build: make it possible to assign macro definitions for specific outputs
Build: adapt Unix Makefile template to use the extra macros
Build: adapt Windows makefile template to use the extra macros
Build: adapt VMS build file template to use the extra macros
Build: Make it possible to have defines assigned to end products as well
Build: make it possibly to specify subdirs in build.info
Add SUBDIRS settings in relevant build.info files
Collapse different classes of macro databases
Simplify the processing of skipped source directories
GMAC: Add subdir info in crypto/build.info for this to build
util/add-depends.pl: go through shared_sources too
VMS build: don't add a comma before 'extradefines'
Allow parallel install
Have install targets depend on more precise build targets
VMS build: colon after target must be separated with a space
Recreate the OS390-Unix config target
Fix SipHash init order.
Add issue templates and a user support page
Remove markdown links from HTML comments in issue templates
Fix rpath-related Linux "test_shlibload" failure.
test/recipes/90-test_shlibload.t needs $target{shared_extension}
Fix typo in util/perl/OpenSSL/Test.pm
test/siphash_internal_test.c: ensure the SIPHASH structure is zeroed
Configuration: only include shared_sources in dirinfo in shared config
Unix build: for mingw and cygwin, create the right location for DLLs
Smarter build of system error text database
Add an error message test recipes for system error messages
Change tarball making procedure
Remove all 'make dist' artifacts
VMS: fix collected error strings
VMS config: Typo fix, as -> AS
VMS build: typo in build file template, generatesrc
Document the removed 'dist' target
Don't export util/mktar.sh
Don't export the submodules 'boringssl', 'krb5' and 'pyca-cryptography'
Make sure to run util/mktar.sh from the source directory
Have util/mktar.sh display the absolute path to the tarball
Avoid test_errstr in a cross compiled configuration
VMS build: in descrip.mms.tmpl's src2obj, do .S -> .asm too
VMS build: don't forget the generation marker when removing files
Don't test the collected system errors when configured to not have them
Doc: add doc/man7/openssl_user_macros.pod.in
util/process_docs.pl: handle multiple source directories for .pod files
Docs fixup: some man3 pages had unindented code in SYNOPSIS
Docs: better deprecation text
util/mkdef.pl: prepare for DEPRECATEDIN_X
Switch future deprecation version from 1.2.0 to 3.0
Switch to MAJOR.MINOR.PATCH versioning and version 3.0.0-dev
Configure: allow building without things deprecated up to and including v3.0
include/openssl/opensslconf.h.in: allow future deprecation for v4.0
util/find-doc-nits: allow #undef
Refactor the computation of API version limits
License: change any non-boilerplate comment referring to "OpenSSL license"
Change license to the Apache License v2.0
Following the license change, modify the boilerplates in apps/
Following the license change, modify the boilerplates in util/, tools/
Following the license change, modify the boilerplates in test/
Following the license change, modify the boilerplates in ssl/
Following the license change, modify the boilerplates in ms/
Following the license change, modify the boilerplates in crypto/aes/
Following the license change, modify the boilerplates in crypto/asn1/
Following the license change, modify the boilerplates in crypto/async/
Following the license change, modify the boilerplates in crypto/bf/
Following the license change, modify the boilerplates in crypto/bio/
Following the license change, modify the boilerplates in crypto/blake2/
Following the license change, modify the boilerplates in crypto/bn/
Following the license change, modify the boilerplates in crypto/buffer/
Following the license change, modify the boilerplates in crypto/camellia/
Following the license change, modify the boilerplates in crypto/cast/
Following the license change, modify the boilerplates in crypto/chacha/
Following the license change, modify the boilerplates in crypto/cmac/
Following the license change, modify the boilerplates in crypto/cms/
Following the license change, modify the boilerplates in crypto/comp/
Following the license change, modify the boilerplates in crypto/conf/
Following the license change, modify the boilerplates in crypto/ct/
Following the license change, modify the boilerplates in crypto/des/
Following the license change, modify the boilerplates in crypto/dh/
Following the license change, modify the boilerplates in crypto/dsa/
Following the license change, modify the boilerplates in crypto/dso/
Following the license change, modify the boilerplates in crypto/ec/
Following the license change, modify the boilerplates in crypto/engine/
Following the license change, modify the boilerplates in crypto/err/
Following the license change, modify the boilerplates in crypto/evp/
Following the license change, modify the boilerplates in crypto/idea/
Following the license change, modify the boilerplates in crypto/kdf/
Following the license change, modify the boilerplates in crypto/kmac/
Following the license change, modify the boilerplates in crypto/gmac/
Following the license change, modify the boilerplates in crypto/hmac/
Following the license change, modify the boilerplates in crypto/lhash/
Following the license change, modify the boilerplates in crypto/mdN/
Following the license change, modify the boilerplates in crypto/mdc2/
Following the license change, modify the boilerplates in crypto/modes/
Following the license change, modify the boilerplates in crypto/objects/
Following the license change, modify the boilerplates in crypto/ocsp/
Following the license change, modify the boilerplates in crypto/pem/
Following the license change, modify the boilerplates in crypto/perlasm/
Following the license change, modify the boilerplates in crypto/pkcs12/
Following the license change, modify the boilerplates in crypto/pkcs7/
Following the license change, modify the boilerplates in crypto/poly1305/
Following the license change, modify the boilerplates in crypto/rand/
Following the license change, modify the boilerplates in crypto/rcN/
Following the license change, modify the boilerplates in crypto/ripemd/
Following the license change, modify the boilerplates in crypto/rsa/
Following the license change, modify the boilerplates in crypto/seed/
Following the license change, modify the boilerplates in crypto/sha/
Following the license change, modify the boilerplates in crypto/siphash/
Following the license change, modify the boilerplates in crypto/smN/
Following the license change, modify the boilerplates in crypto/srp/
Following the license change, modify the boilerplates in crypto/stack/
Following the license change, modify the boilerplates in crypto/store/
Following the license change, modify the boilerplates in crypto/ts/
Following the license change, modify the boilerplates in crypto/whrlpool/
Following the license change, modify the boilerplates in crypto/x509/
Following the license change, modify the boilerplates in crypto/x509v3/
Following the license change, modify the boilerplates in crypto/ui/
Following the license change, modify the boilerplates in crypto/
Following the license change, modify the boilerplates in doc/man1/
Following the license change, modify the boilerplates in doc/man3/
Following the license change, modify the boilerplates in doc/man5/
Following the license change, modify the boilerplates in doc/man7/
Following the license change, modify the boilerplates in engines/
Following the license change, modify the boilerplates in fuzz/
Following the license change, modify the boilerplates in demos/
Following the license change, modify the boilerplates in external/
Following the license change, modify the boilerplates in last few
Following the license change, modify the boilerplates in include/ and crypto/include/
Remaining boilerplate change in doc/man3/OpenSSL_version.pod
Make EVP_PKEY_asn1_add0() stricter about its input
util/perl/OpenSSL/Ordinals.pm: shift to dotted versions internally
util/perl/OpenSSL/Ordinals.pm: use OpenSSL::Util::cmp_versions
util/perl/OpenSSL/Ordinals.pm: introduce a base version
make update
Remove all NOEXIST symbols from ordinals files
Prevent calling decryption in an encryption context and vice versa
make update
VMS: fix library compatibility settings in util/mkdef.pl
apps/tsget.in: use the full version in the user agent string
Configuration: $config{shlib_version_number} -> $config{shlib_version}
util/mkdef.pl: Remove a ';' that snuck in
Fix error in processing $target{enable}
VMS build: better treatment of .S -> .obj compilation
ERR: preserve system error number in a few more places
X509_check_issued: check that signature algo matches signing key algo
util/process_docs.pl: handle multiple source directories correctly
crypto/evp/e_aes.c: build again on s390x
crypto/uid.c: use own macro as guard rather than AT_SECURE
crypto/armcap.c, crypto/ppccap.c: stricter use of getauxval()
crypto/bio/b_dump.c: change all char* to void*, and constify
apps/verify.c: Change an old comment to clarify what the callback does
Rework building: initial changes
Rework building: Windows changes to handle extensions and product names
Rework building: VMS changes to handle extensions and product names
Rework building: Unix changes to handle extensions and product names
Rework building: adapt some scripts
Rework building: Get rid of old %unified_info structures
Configure: teach the tokenizer to handle other separators than spaces
Configure: add attributes to end product build.info variables
Build: Change all _NO_INST to use attributes instead.
Build: use attributes to indicate installed script classes
Build: pass attributes down to make rule generators
Rework build: Windows dependency building fix
Build: change remaining $unified_info{install} checks to use attributes
Android build: use ANDROID_NDK_HOME rather than ANDROID_NDK
VMS: force 'pinshared'
Build cleanup: Remove the VMS hack from test/build.info
Build: Remove BEGINRAW / ENDRAW / OVERRIDE
Build: remove EXTRA
Build: clean away RENAME and SHARED_NAME
Configure: clean away unused variables and double assignments
Better phrasing around 1.1.0
VMS: Clean away stray debugging prints from descrip.mms.tmpl
Build: correct assembler generation in crypto/rc4/build.info
test/drbgtest.c: call OPENSSL_thread_stop() explicitly
ENGINE modules aren't special, so call them MODULES
Build: correct BASE shlib_version_as_filename
test/recipes/02-err_errstr: skip errors that may not be loaded on Windows
apps/ocsp.c Use the same HAVE_FORK / NO_FORK as in speed.c
Rework build: add special cases for AIX
Rework build: small correction in unix-Makefile.tmpl
To use BN_BITS2, we'd better include openssl/bn.h
Move libapps headers into their own directory
test/build.info: add missing ../apps/include
Configure: stop forcing use of DEFINE macros in headers
Configure: make --strict-warnings a regular user provided compiler option
Mark generated functions unused (applies to safestack, lhash, sparse_array)
Add CRYPTO_alloc_ex_data()
Add an OpenSSL library context
Property: naming and manual clarifiations
Conform to proper NAME section format
util/find-docs-nits: Extend to handle internal documentation
util/find-docs-nits: Recognise SPARSE_ARRAY_OF
Fixup internal documentation
test/context_internal_test.c: don't initialize as a separate test
Windows: Call TerminateProcess, not ExitProcess
Rearrange the inclusion of curve448/curve448_lcl.h
Disable 02-test_errstr.t on msys/mingw as well as MSWin32
Add BN_native2bn and BN_bn2nativepad, for native BIGNUM import/export
Revert "Configure: stop forcing use of DEFINE macros in headers"
The use of the likes of UINT32_MAX requires internal/numbers.h
Add PADLOCK_ASM to dso_defines rather than lib_defines
Ensure configured module specific and application specific defines are used
Make the padlock engine build correctly
Replumbing: Add include/openssl/core.h, initially with core types
OpenSSL::Util::Pod: allow slashes in names
Do buildtests on our public header files with C++ as well
Configuration: divide devteam flags into language specific sets
.travis.yml: change -std=c89 to -ansi
Configure: support a few more "make variables" defaulting from env
The use of the likes of UINT32_MAX requires internal/numbers.h
apps/ca.c: only output DER with SPKAC input and when -out is chosen
Deprecate the "hw" configuration options, make "padlockeng" disablable
VMS: move copy_argc to its own module and make it an aux source
testutil: ensure good treatment of argv on non-Unix platforms
VMS: fix util/[un]local.com.in to handle attributes
Configure: make C++ build tests optional and configurable
Travis: use enable-buildtest-c++
Add advice on setting CXX at the same time as CC
padlock: generate assembler source for static libraries too
Add generic trace API
apps/openssl.c: Adapt to enable tracing output
Make it possible to disable the TRACE API
Adapt SSL_DEBUG to the new generic trace API
Adapt CIPHER_DEBUG to the new generic trace API
Adapt OPENSSL_INIT_DEBUG to the new generic trace API
Adapt ENGINE_CONF_DEBUG to the new generic trace API
Adapt ENGINE_TABLE_DEBUG to the new generic trace API
Adapt ENGINE_REF_COUNT_DEBUG to the new generic trace API
Adapt OPENSSL_DEBUG_PKCS5V2 to the new generic trace API
Adapt OPENSSL_DEBUG_KEYGEN to the new generic trace API
Adapt OPENSSL_POLICY_DEBUG to the new generic trace API
Adapt OPENSSL_DEBUG_DECRYPT to the new generic trace API
Adapt BN_CTX_DEBUG to the new generic trace API
Make it possible to trace the trace functionality itself
Document the tracing functionality
Add a log about the tracing functionality
apps/openssl.c: avoid memory leaks
Replumbing: Add MODULESDIR macro and OPENSSL_MODULES environment variable
Replumbing: Add the Provider Object, type OSSL_PROVIDER
Replumbing: New public API to load or add providers
Add provider module infrastructure
Add provider tests
Add documentation
Rename 'buffer' to 'data' in OSSL_PARAM
Change OSSL_PARAM_UTF8_STRING_PTR to OSSL_PARAM_UTF8_PTR
Replumbing: Add an OSSL_PROVIDER iterator with callback
Replumbing: Add support for the provider query_operation function
Replumbing: Add constructor of libcrypto internal method structures
test/params_test.c: Add "real world" parameter testing
test/params_test.c: Add API test case, and mixed methods
test/params_test.c: Add run-time constructed OSSL_PARAM variant
test/params_test.c: make construct_api_params() static
test/params_test.c: make more global variables static
test/params_test.c: use TEST_double_eq to check doubles
Don't fail when tracing is disabled
crypto/provider_core.c: correct definition and use of lock
internal/refcount.h: allow non-atomic build
Configurations/windows-makefile.tmpl: small fixes
test/params_api_test.c: fix size_t assumptions
Replumbing: pass callback data to the algo destructor too
Replumbing: better reference counter control in ossl_method_construct()
Add generic EVP method fetcher
doc/man3/OSSL_PARAM_TYPE.pod: modify Example 2 to allow unspecified params
Fix no-posix-io
Add missing '.text' in crypto/bn/asm/ppc.pl
Replumbing: add fallback provider capability
Replumbing: Add a mechanism to pre-populate the provider store
OPENSSL_config(): restore error agnosticism
openssl dgst: show MD name at all times
openssl dgst: show MD name at all times - CHANGES entry
Windows, VMS: build fixes
Remove heartbeats completely
Rework DSO API conditions and configuration option
Restore the "heartbeats" configuration option among the deprecated
Build cleanup: don't use SHARED_SOURCE with modules
Configuration / build: make it possible to disable building of modules
Correct the checks of module availability in provider test programs
crypto/rand/rand_win.c: include "e_os.h" to get the default _WIN32_WINNT
Revert "crypto/rand/rand_win.c: include "e_os.h" to get the default _WIN32_WINNT"
Replumbing: add functionality to set provider parameters
Replumbing: add a configuration module for providers
Add test for the provider configuration module
Replumbing: add documentation for the provider configuration module
replaced snprintf with BIO version (for windows builds)
Correct EVP_F_EVP_MD_BLOCK_SIZE number
Document the 'no-module' configuration option
For provider tests, don't define a OPENSSL_NO_ macro
Fix number clash: EVP_F_AESNI_XTS_INIT_KEY vs EVP_F_EVP_MD_BLOCK_SIZE
OPENSSL_init_crypto(): check config return code correctly
Rename the PROVIDER_CONF trace to CONF
Add a bit of tracing in the core conf module runner
Convert the ENGINE_CONF trace calls to use CONF instead
EVP_set_default_properties(): New function to set global properties
EVP configuration section: add 'default_properties' command
Params: add OSSL_PARAM_construct_end()
Configurations/10-main.conf: Don't inherit assembler in Cygwin-common
Params API: {utf8,octet}_ptr need to know the data size
test/params_test.c : Adjust tests to check utf8_ptr sizes
EVP_*Update: ensure that input NULL with length 0 isn't passed
Providers: for the digest_final operation, pass a output buffer size
providers/common/digests/sha2.c: forward declare all dispatched functions
Don't use '-z defs' with Clang's sanitizers
asn1parse: avoid double free
Fix the generic EVP algorithm fetch to actually cache them
OPENSSL_LH_flush(): assign NULL after freeing
ossl_method_store_cache_get(): ensure non-NULL property query
Configure: merge all of %user and %useradd into %config earlier
Configure: recognise -static even if given through variables
Configure: make disabling stuff easier and safer
Add the possibility to display and use MODULESDIR
Add a way for the application to get OpenSSL configuration data
Recognise clang -fsanitize options and translate them
Configure: process shared-info.pl later
Replumbing: make the oneshot proider cipher function like the others
Replumbing: give the possibility for the provider to create a context
p_get_params() [test/p_test.c]: clear the OSSL_PARAM buffers for every test
ossl_bsearch(): New generic internal binary search utility function
Don't use '-z defs' if sanitizers are used
Create internal number<->name mapping API
Make the generic EVP fetching mechanism use the namenum map
EVP_FETCH: deal with names without pre-defined NIDs
util/find-doc-nits: Fine tune detection of POD markup in NAME section
EVP_FETCH: remove the need to transport the legacy NID through construction
Configure: let platform->dsoext() default with platform->shlibextsimple()
Clear CRMF vs CMP confusion
Configure: for '-z defs', also check $config{cflags}
doc/man3/X509_LOOKUP_meth_new.pod: clarify the requirements
Configure: Remove extra warning and sanitizer options from CXXFLAGS
Configure: link AIX modules correctly
Configurations/unix-Makefile.tmpl: not -v for rm
Join the x509 and x509v3 directories
Constify OSSL_PROVIDER getter input parameters
Windows: Add missing quotes in build file
EVP_DigestInit_ex(): drop previous context engine earlier
EVP fetching: make operation_id part of the method identity
doc/internal/man3/ossl_method_construct.pod: follow common conventions
Configure: count basenames for all library sources
Configure: Add support for variables in build.info files
Use variables in build.info files where it's worth the while
crypto/ppccap.c: Fix FIPS build on PPC
Replumbing: offer a core upcall to get the provider object's library context
Replumbing: Adapt the FIPS module to use the library context upcall
Replumbing: Adapt the default and legacy providers to use library context upcall
Configure: AIX needs a specific DSO extension function
Configure: allow conditions and variable values to have variable references
Configure: add mechanism to specify uplink target architecture
Move uplink file information to build.info files
Configure: add mechanism to specify asm target architecture
Move bn_asm_src file information to build.info files
Move cpuid_asm_src file information to build.info files
Move ec_asm_src file information to build.info files
Move des_asm_src file information to build.info files
Move aes_asm_src file information to build.info files
Move bf_asm_src file information to build.info files
Move md5_asm_src file information to build.info files
Move sha1_asm_src file information to build.info files
Move cast_asm_src file information to build.info files
Move rc4_asm_src file information to build.info files
Move rmd160_asm_src file information to build.info files
Move rc5_asm_src file information to build.info files
Move wp_asm_src file information to build.info files
Move cmll_asm_src file information to build.info files
Move modes_asm_src file information to build.info files
Move chacha_asm_src file information to build.info files
Move poly1305_asm_src file information to build.info files
Move keccak1600_asm_src file information to build.info files
Move padlock_asm_src file information to build.info files
Configure: final cleanup of asm related things
crypto/aes/build.info: Fix AES assembler specs
crypto/modes/build.conf: Fix MODES asm mistakes
Add extra error text in the property parser
Add tracing capability in test utilities
test/testutil/init.c, apps/openssl.c: add trace cleanup handle earlier
OSSL_TRACE: ensure it's initialised
crypto/trace.c: Remove unexisting categories
Enhance and update the docs of the internal ossl_provider API
Replumbing: add support for multiple names per algorithm
Add a namemap test
OSSL_NAMEMAP: make names case insensitive
ossl_provider_upref to ossl_provider_up_ref
Replumbing: re-implement error reporting for providers
FIPS module: adapt for the changed error reporting methods
test/recipes/02_test_errstr.t: Make it less fragile
test/evp_test.c: [ciphers] Test that we get back the same IV we gave
Make more use of OSSL_PARAM for ciphers
Adapt diverse EVP_CIPHER functions to use get_params and set_params interfaces
Adapt the provider AES for more use of OSSL_PARAM
Refactor apps/progs.* to be generate with 'make update'
Move the code for 'openssl list' to its own translation unit.
In documentation, consistently refer to OpenSSL 3.0
util/opensslwrap.sh: adjust to define OPENSSL_MODULES as well
Provider config module: allow providers to already be loaded
Correct some OSSL_PARAM documentation
util/find-doc-nits: fixups
doc: fix some links
test/enginetest.c: Make sure no config file is loaded
Cygwin: enable the use of Dl_info and dladdr()
Add basic EVP_KEYMGMT API and libcrypto <-> provider interface
Add evp_keymgmt_export_to_provider(), for key transfer between providers
Adapt int_ctx_new() to use with providers
Add evp_keymgmt_clear_pkey_cache() and use it
Add an internal API to access the KEYMGMT provider functions
Documentation: Add provider(7), for general description of providers
Documentation: Move the description of the fetching functions
Documentation: add provider-base(7), describing the base functions
provider-keymgmt(7): Document the KEYMGMT interface
Add a mechnism to save the name of fetched methods
Re-implement EVP_MD_name() and EVP_CIPHER_name() as functions
Add EVP_MD_provider() and EVP_CIPHER_provider()
Add OSSL_PROVIDER_name()
Add internal function ossl_algorithm_do_all()
Refactor ossl_method_construct() in terms of ossl_algorithm_do_all()
Add internal function evp_generic_do_all()
Add EVP_CIPHER_do_all_ex() and EVP_MD_do_all_ex()
Re-implement the cipher and digest listings for 'openssl list'
Describe OSSL_PARAM as a parameter descriptor
Replace OSSL_ITEM with OSSL_PARAM as parameter descriptor, everywhere
Adapt DH to use with KEYMGMT
Add functions to see if a provider is available for use.
test/evp_test.c: modify to use OSSL_PROVIDER_available()
test/recipes/30-test_evp.t: Modify to test with different providers
ERR: re-use the err_data field when possible
Move some macros from include/openssl/opensslconf.h.in, add OPENSSL_FUNC
ERR: refactor useful inner macros to err_locl.h. Add function name field
ERR: Add new building blocks for reporting errors
ERR: Implement the macros ERR_raise() and ERR_raise_data() and use them
ERR: Remove ERR_put_func_error() and reimplement ERR_put_error() as a macro
Refactor provider support for reporting errors
Adapt the FIPS provider to use the new core error functions
Avoid using ERR_put_error() directly in OpenSSL code
Document recent changes in NEWS and CHANGES
ERR: fix err_data_size inconsistencies
Configurations/unit-Makefile.tmpl: Don't clean away dotted files
Add OPENSSL_hexstr2buf_ex() and OPENSSL_buf2hexstr_ex()
Add OSSL_PARAM_construct_from_text() and OSSL_PARAM_allocate_from_text()
Make more use of OSSL_PARAM for digests
Adapt diverse EVP_MD functions to use get_params and set_params interfaces
Rework the provider digest constructor to provide implementation get_params
Adapt the provider digests for more use of OSSL_PARAM
HMAC: use EVP_MD_flags(), not EVP_MD_meth_get_flags()
30-test_evp.t: make the tested configs depend on what's been built
Add missing EVP param utility functions
Modify 'openssl list' to give more verbose descriptions
Add {get,set}table_params() functions for provider digests
crypto/engine/eng_openssl.c: define TEST_ENG_OPENSSL_RC4_P_INIT conditionally
Rename provider and core get_param_types functions
Prepare EVP_MAC infrastructure for moving all MACs to providers
Move BLAKE2 MACs to the providers
Move CMAC to providers
Move GMAC to providers
Move HMAC to providers
Move KMAC to providers
Move SipHash to providers
Move Poly1305 to providers
Remove init of MACs from EVP
Adapt apps/mac.c to use provider based MACs
Adapt diverse code to provider based MACs.
Adapt the MAC tests, and tests for other things that use EVP_MAC
Adjust some provider reason codes
OSSL_PARAM_construct_from_text(): handle non-hex octet string input
Rename the hash implementations KMAC{128,256} to KECCAK_KMAC{128,256}
Add EVP_MAC_provider()
Implement EVP_MAC_do_all_ex()
Re-implement 'openssl list -mac-algorithms'
Rename ctx_{get,set}_params to {get,set}_ctx_params
Windows UWP builds: determine automatically if asm should be disabled
Untangle / retangle opensslv.h, openssslconf.h and macros.h
Use macros internally for algorithm names
Fix ossl_param_bld_push_{utf8,octet}_string() / param_bld_convert()
Modify ossl_method_store_add() to handle reference counting
Modify ossl_method_store_add() to accept an OSSL_PROVIDER and check for it
Fix drbg_ossl_ctx_free() and drbg_nonce_ossl_ctx_free() to handle NULL
openssl dgst, openssl enc: check for end of input
Configure: Allow 'DEFINE[]=def'
crypto/bn/build.info: define OPENSL_IA32_SSE2 globally when needed
test/evp_test.c: distinguish parsing errors from processing errors
Remove MAC cruft
Get rid of the diversity of names for MAC parameters
Update EVP_MAC.pod
testing: set OPENSSL_MODULES to the providers directory by default
OPENSSL_info(): add the item OPENSSL_INFO_SEED_SOURCE and use it
Coverty fixes for MACs
Move print_param_types() to libapps, and give it indent argument
openssl provider: New sub-command, for provider discovery
Rework the documentation of our individual MAC implementations
Diverse ERR fixes
Refactor how KEYMGMT methods get associated with other methods
test/errtest.c: more conditions for checking __FILE__ and __LINE__
New function EVP_MD_free()
New function EVP_CIPHER_free()
Move libapps.a source to apps/lib
crypto/evp/kdf_meth.c: Add the reset function to the method
crypto/evp/pkey_kdf.c: Redo parameter processing
Fix memleaks in KDF implementations
PBKDF2 implementation: refactor to avoid memleak
More KDF cleanup
crypto/evp/pkey_kdf.c: further special treatment of "seed" and "info"
Deal with BUF_MEM_grow ambiguity
Do no mention private headers in public headers
Rework the perl fallback functionality
Clarify the status of bundled external perl modules
Update the bundled external perl module Text-Template to version 1.56
test/evp_test.c: try fetching algorithms
doc/man3/OSSL_PARAM.pod: conform to man-page standards
doc/man3/OSSL_PARAM.pod: remove a comment that isn't true any more
doc/man3/OSSL_PARAM.pod: add details about multiple elements with same key
util/perl/OpenSSL/Test.pm: Disable stdout/stderr redirection on non-verbosity
Rework test/run_tests.pl to support selective verbosity and TAP copy
Travis and Appveyor: use HARNESS_VERBOSE_FAILURE rather than HARNESS_VERBOSE
util/mkerr.pl: make it not depend on the function code
include/openssl/macros.h: Remove the PEDANTIC OPENSSL_FUNC definition
include/openssl/err.h: Depend on OPENSSL_NO_FILENAMES, not OPENSSL_NO_ERR
Modernise the ERR functionality further (new functions and deprecations)
Modernise ERR_print_errors_cb()
Document the deprecation of ERR_func_error_string()
Add a CHANGES entry for the recent ERR changes
util/dofile.pl, util/perl/OpenSSL/Template.pm: move parts of dofile.pl
confdata.pm.in: New template for configdata.pm
Deprecate the public definition of ERR_STATE
Deprecate ERR_get_state()
Document the deprecation of ERR_STATE and ERR_get_state()
Build files: Unify standard arguments for assembler generating scrips
build.info: For all assembler generators, remove all arguments
Unify all assembler file generators
crypto/bn/build.info: Correct use of SSE2 definition
Refactor TLS1-PRF to create the MAC contexts early
In provider implemented methods, save the name number, not the name string
Modify providers that keep track of underlying algorithms
Refactor TLS-PRF's kdf_tls1_prf_mkmacctx() to a provider utility
Refactor SSKDF to create the MAC contexts early
Remove name string from PROV_CIPHER and PROV_DIGEST
include/openssl/macros.h: Rework OPENSSL_FUNC for div C standards
include/openssl/macros.h: better OPENSSL_FUNC fallback
Rework cipher / digest fetching for legacy nids with multiple name support
DOC: fix documentation of som EVP_MD_CTX functions
Configure, build.info: make it possible to use variables in indexes
When building of modules is disabled, build the legacy provider into libcrypto
OSSL_PARAM.pod: document the mechanism to figure out buffer sizes
OSSL_PARAM functions: change to allow the data field to be NULL
Make doc/man7/ and doc/internal/man3/ conform with man-pages(7)
Funtion name with variable part in doc/man7/ and doc/internal/man3/
Make relevant tests more sensitive to 'no-fips'
Make ASYNC manuals conform with man-pages(7)
Make ASN1 manuals conform with man-pages(7)
Make manuals with TYPE conform with man-pages(7)
Adapt EVP_CIPHER_{param_to_asn1,asn1_to_param} for use with provider.
Remove EVP_CIPH_FLAG_DEFAULT_ASN1 from all provided implementations
Make EVP_CIPHER_is_a() work with legacy cipher implementations too
util/find-doc-nits: more precise option and function name checker
doc/man1: fix malformed options
Replumbing: make it possible for providers to specify multiple names
Adapt existing providers to posibly have name lists
Move all SHA digests completely to the default provider
Move MD5-SHA1 digest completely to the default provider
EVP_{CIPHER,MD}_CTX_ctrl(): make sure to return 0 or 1
Add documentation for PEM_{read,write}_bio_Parameters()
Command docs: fix ellipses, the easy cases
Command docs: remove ellipses for '-rand'
Command docs: replacables are in italics, options always start with a dash
Command docs: fix up command references
Command docs: fix links to other sections (sometimes in other manuals)
Command docs: wrap literal file names with F<>
Command docs: wrap literal input/output with C<>
Command docs: fix some engine references
Command docs: diverse small fixes
Command docs: rename openssl-tsget.pod to tsget.pod, and fix it
Command docs: more reference fixes
util/find-doc-nits: ignore tsget.pod name
Document build.info syntax internally
Configure: rework build.info grammar and attributes
Configure: Implement attributes for DEPEND[xxx]
Configurations/common.tmpl: Rework dependency resolution
Build files: Make it possible to source libraries into other libraries
Rework how our providers are built
Providers: move common exchange,kdfs,keymgmt,macs,signature
Providers: move default kdfs,macs
Providers: move all digests
Providers: move all ciphers
Cleanup: move providers/common/include/internal/provider_args.h
Cleanup: move remaining providers/common/include/internal/*.h
Cleanup: move provider mains up
Stop using EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
Doc: update internal build.info manual
POD: stop abusing comment
Fix EVP_Cipher() for provided cipher implementations
Providers: fix OSSL_FUNC_CIPHER_CIPHER functions
Remove EVP_CIPH_FLAG_CUSTOM_CIPHER in all our providers
KDF: clean away old EVP_KDF declarations
Restore MD5-SHA1 in legacy method database
Building: Add modules with DEPENDs to GENERATEd files
Move MD2, MD4 and MD5 digests completely to the providers
Add EVP_PKEY_CTX_new_provided()
doc/man3/EVP_PKEY_CTX_new.pod: change markup according to conventions
EVP_{CIPHER,MD}_CTX_ctrl(): make extra sure to return 0 or 1
For provided ciphers, EVP_CIPHER_CTX_ctrl() with EVP_CTRL_INIT always returns 1
Some docs cleanup
EVP: add missing common functionality
EVP: add name traversal functions to all fetchable types
EVP: add functions that return the name number
'openssl list' and 'openssl provider': adapt display of multiple names
evp_generic_do_all(): fix passing of method data
Rename internal function name_cmp() to v3_name_cmp()
Configure: break long lines in build files
PKEY: adapt the export_to_provider funtions to handle domain params too
DH: Add export of domain parameters to provider
DSA: Add export of domain parameters to provider
DH: Add export of keys and domain parameters from provider
DSA: Add export of keys and domain parameters from provider
Don't abuse the API when that's not what is tested
Added internal functions for easy getting and setting all RSA parameters.
New RSA keymgmt implementation to handle import / export of RSA keys
test/keymgmt_internal_test.c: New test of keymgmt internals
evp_keymgmt_export_to_provider(): adjust OSSL_PARAM array for transfer
Move BLAKE2 digests completely to the default provider
Configure: get version from the file 'VERSION' instead of 'opensslv.h'
Generate include/openssl/opensslv.h
Remove the version number in README
Move the version function declarations to include/openssl/crypto.h
Doc for the added internal RSA functions
windows-makefile.tmpl: Convert all /I and /D to -I and -D
crypto/evp/pmeth_lib.c: Fix copy'n'paste error
crypto/s390xcap.c: Add guards around the GETAUXVAL checks
crypto/evp/evp_fetch.c: Make it more prominent that these functions are EVP
evp_pkey_ctx_free_old_ops(): Make sure to assign NULL to freed pointers
BIO_s_connect: add an error state and use it
Configure: Make --strict-warnings meaningful with MSVC cl
VMS: Added new method to gather entropy on VMS, based on SYS$GET_ENTROPY.
test/build.info: add missing inclusion for ssl_ctx_test
Fix OSSL_PARAM_set_BN() to fill the given buffer correctly.
test/params_api_test.c: Correct the checks of OSSL_PARAM_set_BN()
doc/man3/OSSL_PARAM.pod: Clarify return_size with integer types
Make EVP_PKEY_CTX initialization more precise
Change EVP_PKEY_CTX_new_provided() to take a library context too.
OSSL_STORE: constify the criterion parameter a bit more
X509_LOOKUP_store: new X509_LOOKUP_METHOD that works by OSSL_STORE URI
Add -CAstore and similar to all openssl commands that have -CApath
OSSL_STORE: add tracing
Add a basic test of -CAstore
Adapt two test programs that were using now deprecated functions
Document X509_LOOKUP_store
X509_LOOKUP_store: Add CHANGES note
Document added SSL functions related to X509_LOOKUP_store
EVP: Make the KEYEXCH implementation leaner
EVP: Make the SIGNATURE implementation leaner
Minimal adaptation of tests back to how it was before
util/*.num: deassign ordinal numbers from new symbols
OpenSSL::Ordinals: Handle symbols with unassigned ordinal numbers
OpenSSL::Ordinals: add a renumber() function, to assign unassigned symbols
OpenSSL::Ordinals: when validating, collect statistics on unassigned syms
util/mkdef.pl: writer_VMS(): handle symbols with no assigned number
util/mknum.pl: Call OpenSSL::Ordinals::renumber() for real releases
util/mknum.pl: output stats on unassigned symbols
test/recipes/02-test_ordinals.t: Take '?' and '?+' into account
Change the logic and behaviour surrounding '--api' and 'no-deprecated'
Update source files for deprecation at 3.0
Update source files for pre-3.0 deprecation
include/openssl/opensslconf.h.in: remove spurious HEADER_FILE_H definition
Update some inclusions of <openssl/macros.h>
Update the check surround the BN_zero() implementation
include/openssl/asn1.h: Remove version dependent inclusion of <openssl/bn.h>
Update INSTALL to document the changed '--api' and 'no-deprecated'
Add EVP functionality to create domain params and keys by user data
Add a test for EVP_PKEY_keymake() and EVP_PKEY_make()
Refactor PEM_read_bio_{PrivateKey,Parameters,DHparams}
Cleanup include/openssl/opensslv.h.in
Configuration: make Solaris builds with gcc recognise GNU ld
Final cleanup after move to leaner EVP_PKEY methods
Rename providers/common/provlib.c to nid_to_name.c
Reinstate the KDF error macros
util/perl/OpenSSL/ParseC.pm: Fix 'extern "C" DEPRECATEDIN_x_y(...)'
Deprecate ERR_load_KDF_strings()
Make sure KDF reason codes are conserved in their current state
Add a .pragma directive for configuration files
Add a tester of OpenSSL config files and test the current .pragma
SSL: Document SSL_add_{file,dir,store}_cert_subjects_to_stack()
CORE: Add a generic callback function type
CORE & PROV: make export of key data leaner through callback
PEM: constify PEM_write_ routines
Replumbing: pre-populate the EVP namemap with commonly known names
UI_UTIL_wrap_read_pem_callback(): when |cb| is NULL, use PEM_def_callback
doc/man7/proxy-certificates.pod: New guide for proxy certificates
util/find-doc-nits: Better parsing of links
test/cipher_overhead_test.c: build unconditionally
apps/ocsp.c: sock_timeout -> socket_timeout
configdata.pm.in, util/dofile.pl: load 'platform' unconditionally
Add the possibility to generate documentation at build time
Add doc/build.info to build the documentation
Adapt *.tmpl to generate docs at build time
Configure: make it possible to have generated generators
CORE: ossl_namemap_add_names(): new function to add multiple names
CORE: pass the full algorithm definition to the method constructor
SERIALIZER: New API for serialization of objects through providers
SERIALIZER: add functions for serialization to file
CORE: expose the property parsers and checker to the rest of the libraries
SERIALIZER: add support for serializing EVP_PKEYs
SERIALIZER: add hooks in PEM_write_bio_ and PEM_write_fp_ routines
SERIALIZER: add hooks in EVP_PKEY_print_ routines
PROV BIO: add a BIO_vprintf() upcall, and a provider BIO library
PROV SERIALIZER: add common functionality to serialize keys
PROV SERIALIZER: add support for writing RSA keys
PROV SERIALIZER: add support for writing DH keys and parameters
PROV SERIALIZER: add support for writing DSA keys and parameters
TEST: add tests of text and PEM printout of a provider made key
Add NEWS and CHANGES entries about OSSL_SERIALIZER
util/find-doc-nits: limit the prototype check
util/find-doc-nits: ignore macros ending in _fnsig
configdata.pm.in: Don't try to quotify undefined values
util/mkerr.pl: don't stop reading conserved symbols from the state file
Use leak sanitizer instead of internal mdebug to check for memory leaks
test/memleaktest.c: Modify for use with address/leak sanitizer
Disable devcryptoeng on newer OpenBSD versions
Configuration: compute openssl_other_defines and related info later
Move providers/common/{ciphers,digests}/* to providers/implementations
PROV: Move AES_CCM specialisation away from common cipher header
PROV: Move AES_GCM specialisation away from common cipher header
test/namemap_internal_test.c: use "cookie" instead of "foo"...
Add better support for using deprecated symbols internally
Remove CRYPTO_secure_allocated from util/missingcrypto111.txt
EVP: make it possible to init EVP_PKEY_CTX with provided EVP_PKEY
crypto/bio/build.info: split the source files in categories
BIO: Add BIO_f_prefix(), a text line prefixing filter
APPS & TEST: Adapt to use the new BIO_f_prefix()
ASN1: Adapt ASN.1 output routines to use BIO_f_prefix()
EVP: Adapt EVP_PKEY_print_ routines to use BIO_f_prefix()
TEST: Add test recipe and help program to test BIO_f_prefix()
CRYPTO: split cipher_platform.h into algorithm specific headers
EVP & PROV: Fix all platform inclusions
perl: OpenSSL::Util::Pod::extract_pod_info() now saves the file contents
util/find-doc-nits: Better checking of missing documentation
Adjust all util/missing*.txt to include the section number
OpenSSL::Util::extract_pod_info(): Read the POD one paragraph at a time
OpenSSL::Util::extract_pod_info(): Allow invisible names
doc/man1/openssl-cmds.pod: Add invisble name 'openssl-cmds'
Rename doc/man7/provider-asymcipher.pod
util/find-doc-nits: when loading "missing" files, check if documented
Removed now documented stuff from util/missing*.txt
Configurations/windows-makefile.tmpl: HTMLDOCS are files, not directories
EVP: Fix method to determine if a PKEY is legacy or not
Add missing inclusion of "internal/deprecated.h"
Configuration: synchronise the variables on the build file templates
EVP: If a key can't be exported to provider, fallback to legacy
Add the DSA serializers to the default provider tools
DOCS: The interpretation of OPENSSL_API_COMPAT has changed, update docs
CORE & EVP: Specify OP_query_operation_name() for KEYMGMT
EVP: Adapt KEYEXCH, SIGNATURE and ASYM_CIPHER to handle key types better
PROV: Adjust the KEYMGMT name specs to include all names
When deprecated symbols are removed, ensure liblegacy has WHIRLPOOL
Configure: use $list_separator_re only for defines and includes
Fix EVP_Digest{Sign,Verify}Final() and EVP_Digest{Sign,Verify}() for provider only keys
PROV: Fix mixup between general and specialized GCM implementations
Change returned -2 to 0 in EVP_Digest{Sign,Verify}Init()
CRYPTO: Remove support for ex_data fields when building the FIPS module
PROV: Adapt the DSA keymgmt implementation to no ex_fields
Move the stored namemap pre-population to namemap construction
Build file templates: Use explicit files instead of $< or $? for pods
For all assembler scripts where it matters, recognise clang > 9.x
Modify EVP_CIPHER_is_a() and EVP_MD_is_a() to handle legacy methods too
EVP: make EVP_PKEY_{bits,security_bits,size} work with provider only keys
PROV: Adapt the RSA, DSA and DH KEYMGMT implementations
TEST: Adapt test/evp_pkey_provided_test.c to check the key size
DOC: New file for EVP_PKEY_size(), EVP_PKEY_bits() and EVP_PKEY_security_bits()
DOC: Make EVP_SignInit.pod conform with man-pages(7)
Add CHANGES entry regarding the documentation of EVP_PKEY_size() et al
DSA: Move DSA_security_bits() and DSA_bits()
CORE: renumber OSSL_FUNC_KEYMGMT macros
EVP: Add evp_pkey_make_provided() and refactor around it
Add GNU properties note for Intel CET in x86_64-xlate.pl
APPS & TEST: Eliminate as much use of EVP_PKEY_size() as possible
libcrypto: Eliminate as much use of EVP_PKEY_size() as possible
EVP: clear error when falling back from failed EVP_KEYMGMT_fetch()
PROV: Add support for error queue marks and implement in FIPS module
PROV: Fix bignum printout in text serializers
Add internal maxsize macros
EVP: Add EVP_PKEY_get_default_digest_name() and use it
Add answers for EVP_PKEY_get_default_digest_name() in RSA and DSA keymgmt
Configure: Better detection of '-static' in @{$config{LDFLAGS}}
EVP: Adapt EVP_PKEY Seal and Open for provider keys
test/recipes/30-test_evp.t: Fix multiple definition of @bffiles
OpenSSL::Test: bring back the relative paths
Adapt ASN1_item_sign_ctx() for use with provided keypairs
PROV: Adapt the DSA signature implementation to provide Algorithmidentifiers
test_evp_extra_test.c: don't rely on exact parameter position
Adapt X509_PUBKEY_set() for use with provided implementations
config: ensure the perl Configure run is the last statement
EVP: Small refactor of keymgmt library code
EVP_PKEY_assign_EC_KEY(): detect SM2 curve and set EVP_PKEY type accordingly
Add SM2 specific parameter and key generation
X509: Refactor X509_verify() and X509_REQ_verify() for better streamlining
Make SM3 a mandatory hash function for SM2.
Adapt tests for SM2 changes.
Adapt some 'openssl' commands for SM2 changes.
CHANGES: Add note about the refactoring of SM2 EVP_PKEYs
Fix krb5 external test failure
Decentralize legacy_ctrl_str_to_param()
Don't pass a digest-size to signature implementations
PROV: Implement padding mode words in the RSA ASYM_CIPHER implementation
PROV: Fix the DSA SIGNATURE implementation for better digests handling
EVP_MD_CTX_ctrl(): Remove unnecessary control
Reorganize the internal evp_keymgmt functions
Redesign the KEYMGMT libcrypto <-> provider interface - the basics
Adapt existing KEYMGMT implementations to the redesigned interface
Adapt test/keymgmt_internal_test.c to the redesigned interface
Adapt existing SERIALIZER implementations to the redesigned interface
KEYMGMT: Require both get_params and gettable_params, or none
Configure: Add easy to use disabled deprecated functionality indicators
Adapt all build.info and test recipes to the new $disabled{'deprecated-x.y'}
PROV: Ensure the AlgorithmIdentifier registers in DSA signature impl
X509_PUBKEY_set(): Fix memory leak
test/recipes/15-test_dsa.t: Deal with deprecation of 'openssl dsa'
test/recipes/80-test_ssl_old.t: Replace 'openssl gendsa'
Add OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friends
Adapt i2d_PrivateKey for provider only keys
Adapt i2d_PUBKEY for provider only keys
PROV: Build the main FIPS module code with FIPS_MODE defined
Document OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friends
DOC: document in more detail what a BIO_read_ex() via BIO_f_buffer() does
include/openssl/whrlpool.h: correct unbalanced deprecation guards
Make util/find-doc-nits runnable from the build tree
Fix podchecker warnings
DOC: Add documentation related to X509_LOOKUPs
TEST: Create test specific output directories
TEST: Modify test/recipes/15-test_mp_rsa.t to leave artifacts behind
TEST: Modify test/recipes/15-test_rsapss.t to leave artifacts behind
TEST: Modify test/recipes/20-test_dgst.t to leave artifacts behind
TEST: Modify test/recipes/20-test_enc.t to leave artifacts behind
TEST: Modify test/recipes/25-test_crl.t to leave artifacts behind
TEST: Modify test/recipes/25-test_req.t to leave artifacts behind
TEST: Modify test/recipes/25-test_x509.t to leave artifacts behind
TEST: Modify test/recipes/20-test_enc_more.t to leave artifacts behind
TEST: Modify test/recipes/20-test_pkeyutl.t to leave artifacts behind
TEST: Modify test/recipes/80-test_ca.t to leave artifacts behind
TEST: Modify test/recipes/80-test_cms.t to leave artifacts behind
TEST: Modify test/recipes/80-test_ocsp.t to leave artifacts behind
TEST: Modify test/recipes/80-test_ssl_new.t to leave artifacts behind
TEST: Modify test/recipes/80-test_ssl_old.t to leave artifacts behind
TEST: Modify test/recipes/tconversion.pl to leave artifacts behind
TEST: Optionally silence OpenSSL::Test::setup()
PROV: add RSA signature implementation
rsa_get0_all_params(): Allow zero CRT params
test/evp_extra_test.c: adapt for RSA signature tests
test/recipes/30-test_evp_data/evppkey.txt
PROV: Avoid MDC2 in the RSA signature implementation in the FIPS module
doc/man3/EVP_PKEY_CTX_ctrl.pod: cleanup
DSA: More conforming names in crypto/dsa/dsa_aid.c
Refactor evp_pkey_make_provided() to do legacy to provider export
Fix default provider merge glitch
VMS: mitigate for the C++ compiler that doesn't understand certain pragmas
TEST: add util/wrap.pl and use it
Build file templates: don't set OPENSSL_{ENGINES,MODULES}
Replace util/shlib_wrap.sh with util/wrap.pl in diverse docs
Deprecate ASN1_sign(), ASN1_verify() and ASN1_digest()
Fix util/mktar.sh to use the new VERSION information
Rethink the EVP_PKEY cache of provider side keys
EVP: Add evp_pkey_upgrade_to_provider(), for EVP_PKEY upgrades
DOCS: Add internal docs for EVP_PKEY and the export functions
DOCS: Add and modify docs for internal EVP_KEYMGMT utility functions
crypto/perlasm/x86_64-xlate.pl: detect GNU as to deal with quirks
EVP: Adapt EVP_PKEY_missing_parameters() for provider keys
KEYMGMT: Add a keydata matching function
EVP: Add support for comparing provided EVP_PKEYs
KEYMGMT: Add a keydata copy function
EVP: Add support for copying provided EVP_PKEYs
PROV: Add a OP_keymgmt_match() function to our DH, DSA, RSA and EC_KEY impl
build.info: Make it possible to have more than one item in KEYWORD[]
build.info: Implement simply substitutions in variable values
Build: Generate apps/progs.c and apps/progs.h in build time
Configure: Diverse cleanups
Remove apps/progs.c and apps/progs.h
.travis.yml: Remove NOUPDATE support
.travis.yml: where it matters, have build and source nesting levels differ
config, Configure: move the check of removed crypto/ sub-systems
Refactor CRMF_poposigningkey_init() to work with provider keys
util/wrap.pl: do not look at EXE_SHELL
DOCS: Fix documentation on asymmetric keydata types
EVP: Check that key methods aren't foreign when exporting
DH: add internal dh_get_method()
DOCS: Start restructuring our provider and implementation documentation
DOCS: Move implementation specific docs away from provider-digest(7)
DOCS: Add missing documentation in util/missingcrypto.txt
DOCS: Add translation information for EVP_MD_CTX_ctrl()
DOCS: Clean up doc/man3/EVP_DigestInit.pod
CORE: Add the key object generator libcrypto<->provider interface
EVP: Add new domparams and key generation functionality
PROV: Add RSA functionality for key generation
test/evp_test.c: fix keygen_test_run()
test/recipes/30-test_evp_data/evppkey.txt: Change an expected KeyGen result
Andoid cross compile: change ANDROID_NDK_HOME to ANDROID_NDK_ROOT
Configurations: Fix "android" configuration target
Fix RSA structure
DOCS: Fix the description of OSSL_PARAM_allocate_from_text()
Fix legacy_ctrl_to_param() to pay better attention to keytype
EVP: Don't call digest_custom() quite so early
X509: Rename X509_set0_sm2_id() and friends
SM2: Make the EVP_PKEY_METHOD ctrl_str function listen to distid
APPS: Add ctrl_str()-like functionality for X509 and X509_REQ
APPS: Remove all traces of special SM2 treatment.
TEST: Adapt all applicable tests to the new distinguishing ID
EVP: fetch the EVP_KEYMGMT earlier
evp_test: the tests using MDC2 need the legacy provider
DH, DSA, EC_KEY: Fix exporters to allow domain parameter keys
util/wrap.pl: Correct exit code when signalled
EC: Refactor ec_curve_name2nid() to accept NIST curve names
EVP: Clarify the states of an EVP_PKEY
EVP: Add EVP_PKEY_set_type_by_keymgmt() and use it
EVP: Downgrade keys rather than upgrade
test/evp_pkey_provided_test.c: Add test of EVP_PKEY_copy_parameters()
EVP: Implement support for key downgrading in backends
EVP: Limit the diverse key parameter functions to domain params only
PROV: Fix EC_KEY exporters to allow domain parameter keys
Windows makefile generator: Don't delete long lists of files in one go
Fixups in CHANGES.md
Add perl support to parse and DER encode ASN.1 OID specs
PROV: Add the beginning of a DER writing library
PROV: Add DERlib support for RSA
PROV: Add DERlib support for DSA
PROV: Add DERlib support for ECDSA and EC keys
EVP: add EVP_PKEY_is_a() and EVP_PKEY_can_sign()
EVP & TLS: Add necessary EC_KEY data extraction functions, and use them
Fix export of provided EC keys
TLS: Temporarly downgrade newly generated EVP_PKEYs to legacy
OpenSSL::OID: Don't use List::Util
Add common internal crypto/ modules in liblegacy.a
CMS KARI: Temporarly downgrade newly generated EVP_PKEYs to legacy
EVP: legacy_ctrl_to_param() to handle provider side keys
Rework util/find-doc-nits to distinguish internal documentation
Initialize files that declare internal symbols
Fix some errors in documentation
KEYMGMT: Add functions to get param/key generation parameters
PROV: Implement EC param / key generation
EC: Refactor EVP_PKEY_CTX curve setting macros for param generation
EVP: Add a temporary SM2 hack to key generation
EVP: fix memleak in evp_pkey_downgrade()
EVP: Fix calls to evp_pkey_export_to_provider()
TEST: Add a test of keygen with an empty template in test/evp_extra_test.c
INSTALL: document 'no-ui-console' rather than 'no-ui'
DOC: Add more description of EVP_PKEY_fromdata(), and examples
DOC: Extend the description of EVP_PKEY_CTX_new_from_name()
TEST: make and use a fipsinstall script
Build files: add module installation targets
DOC: Refactor provider-keymgmt(7) to give the keytypes their own pages
Developer scripts: Release script
Revert "TEST: make and use a fipsinstall script"
EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use it
EVP: Fix EVP_Digest{Sign,Verify}Init() to handle no default digest
PROV: Ensure that ED25519 & ED448 keys have a mandatory digest
PROV: Ensure that EC keys have a default digest
Robbie Harwood (2):
[KDF] Add KBKDF implementation for counter-mode HMAC
[KDF] Add feedback-mode and CMAC support to KBKDF
Roger Ning (1):
fix a minor bug of s_client
Ross Kinsey (1):
Author: Ross Kinsey <RossIKinsey at gmail.com> Date: Wed Jan 29 00:19:40 2020 -0500
Sam Roberts (3):
Make some simple getters take const SSL/SSL_CTX
Remove unnecessary trailing whitespace
Ignore cipher suites when setting cipher list
Sambit Kumar Dash (3):
Doc update: minor typo in CMS_verify.pod CLA: trivial
Update EVP_VerifyInit.pod
Update X509_STORE_new.pod
Santhosh Rameshwarapu (1):
Cross-linked the man(1) pages of kdf & pkeyutl.
Saritha (1):
apps/speed.c: Fix eddsa sign and verify output with -multi option
Scott Arciszewski (1):
Fix comment placement in ecp_nistp256.ci
Scott Wilson (1):
Fix potential memory leak in dh_ameth.c
Shane Lontis (142):
Added DRBG_HMAC & DRBG_HASH + Added defaults for setting DRBG for master/public/private + renamed generate_counter back to reseed_counter + generated new cavs data tests
Change DRBG's to DRBGs
KMAC implementation using EVP_MAC
Updated test command line parsing to support commmon commands
cfi build fixes in x86-64 ghash assembly
FIPS AES_GCM IV gen changes
openssl app for macs that uses the new EVP_MAC interface (the code inside dgst uses EVP_PKEY)
fix truncation of integers on 32bit AIX
FIPS 186-4 RSA Generation & Validation
added generated files
coverity fixes for bntest.c
Added NULL check to BN_clear() & BN_CTX_end()
Single step kdf implementation
removed BN_clear NULL checks
Updated doc for BN_clear, BN_CTX_end when param is NULL
fixed mismatching #ifdef cpp
replaced snprintf with BIO version (for windows builds)
style nit fix
coverity fixes for SSKDF + mac_app + kdf test cleanup
Fixed unmatched BN_CTX_start/end if an invalid exponent is used.
fixed public range check in ec_GF2m_simple_oct2point
coverity resource leak fixes in apps/pkeyutl
Coverity: hkdf ENV_MD_size() is an int that can be negative
EC keygen updates + changed ecdsa_sign to use BN_secure_new
Fixed linux_x86_icc compiler errors in EC code related to __uint128_t/__int128_t
Added Test::ok_nofips, Test::is_nofips & Test::isnt_nofips methods. Used to check that a test fails in fips mode i.e. ok_nofips(run(...))
added code to validate EC named curve parameters
doc fixups
ec key validation checks updated
Added app for EVP_KDF
added openssl app 'kdf' and 'mac' to the NEWS and CHANGES docs
Added EVP_KDF (similiar to the EVP_MAC)
Added generated files for EVP_KDF changes
Fixed 32bit issue for kdf_opts
Added X963KDF API
Add d2i_KeyParams/i2d_KeyParams API's.
fix timeout in 30-test_evp_pkey_dparam
Add the content type attribute to additional CMS signerinfo.
Move digests to providers
Coverity fixes
rename the digest provider files to avoid any name clashes with other folders
Fix Keccak structure name reference in S390 legacy code
Make EVP_MD_CTX_ctrl() work for legacy use cases (ssl3).
PBKDF2 updates to conform to SP800-132
Add defines to indicate if intypes.h and stdint.h are unavailable
Fix Windows Compile failure due to missing <inttypes.h>
Fix app opt compile failure due to missing <inttypes.h>
EC only uses approved curves in FIPS mode.
Add X9.42 KDF.
Add Common shared code needed to move aes ciphers to providers
Cleanup use of X509 STORE locks
Fix S390X compile error due to missing defines
Add evp_util macros
Rename X509_STORE ptr stored in opaque struct X509_STORE_CTX
Add gcm ciphers (aes and aria) to providers.
GCM cipher in provider now fails if passed bad keylength
Change EVP_CIPHER_CTX_iv_length() to return current ivlen for some modes
Fix document nit in EVP_MAC.pod
Add missing SIZE_MAX define for windows
Fix windows compile errors in params.c
Add fips provider code for handling self test data
cipher cleanups.
Add aes_ccm to provider
cleanup provider digests
Add basic aria and camellia ciphers modes to default provider
Add app for fips installation
Fix Issue OSS-Fuzz: Branch on uninitialized memory (in ccm code).
Cleanup ciphers and Add 3des ciphers.
Fix platform specific issues with provider ciphers
Change provider params from int to size_t
Add EVP_CIPHER_CTX_tag_length()
Fix S390X bad size_t that causes memory trash in legacy ciphers
Add aes_xts cipher to providers
Fix aesni_xts compile error
Fix compile error detected by Solaris build
Add fips module integrity check
Add blowfish ciphers to default provider
Fix Solaris aes_hw_t4 compile issue
Fix Coverity CID:1453685 'unreachable code' in aes_xts code.
Fix Compiler error/warning for windows icl build
Add IDEA ciphers to default provider
Add cast5 ciphers to default provider
Add SEED ciphers to default provider
Add sm4 ciphers to default provider
Add aes_ocb cipher to providers
Fix Solaris compile errors in provider ciphers
Move gcm decryption tag check higher up in the callstack
Fix missing bn_mul_mont symbol in solaris fips module
Add aes_wrap cipher to providers
Add des ciphers to default provider
Add rc4 cipher to default provider
Fix Coverity issues
Add rc5 ciphers to default provider
Move cipher ctx 'original iv' parameter into the provider
Add rc2 ciphers to default provider
Fix CMP test error on platforms which set OPENSSL_FUNC to '(unknown function)'
Fix missing Assembler defines
Add ChaCha related ciphers to default provider
Add AES SIV ciphers to default provider
Add rc4_hmac_md5 cipher to default provider
Fix Use after free when copying cipher ctx
fix s390 compile error due to missing comma.
Cache constants for fetched EVP_cipher
Cleanup legacy digest methods.
Fix travis timeout by excluding arm64 gcc -fsanitize=address build
Remove asn1 module dependency from RSASSA-PKCS1-v1_5 implementation.
Add fips self test DEP for solaris and hpux
Add AES_CBC_HMAC_SHA ciphers to providers.
Fix KMAC docs
Make ECDSA_size() use consistent asn1 encoder.
Add GCM support for EVP_CTRL_GCM_IV_GEN and EVP_CTRL_GCM_SET_IV_INV to providers
Add dsa signature alg to fips provider
Add FIPS Self test kats for digests
Re-remove TS_VERIFY_CTX_set_certs entry from missingcrypto.txt
Check ECC-CDH is compliant with SP800-56A-r3
Add DH key exchange to fips provider
Modify DSA and DH keys to use a shared FFC_PARAMS struct
Add RSA key validation to default provider
Add support for DH 'modp' group parameters (RFC 3526)
Fix coverity issues CID 1457745...1457752, 1457853, 1457854
Add FFC param/key generation
Fix coverity issues
Add FFC param/key validation
Add DRBG self tests
Add pairwise consistency self tests to asym keygenerators
Add Serializers for EC
Add DH key validation to default provider
Add DSA Key validation to default provider
Change DH_get_nid() to set the value of q if it is not already set
Add EC key validation to default provider
Add ECDH to fips provider
Add RSA sign to the fips provider
Add ECDSA to providers
Add support for passing the libctx to the config loader
Add EVP_PKEY_gettable_params support for accessing EVP_PKEY key data fields
Add data driven SELF TEST code for signatures and key agreement
Move legacy ciphers into the legacy provider
Fix Dynamic engine loading so that the call to ENGINE_load_builtin_engines() is performed.
Add DSA keygen to provider
Add DH keygen to providers
DOC: Extend EVP_PKEY-DSA(7) / EVP_PKEY_DH(7) with FFC information
Fix DH_get_nid() so that it does not cache values.
Shigeki Ohtsu (2):
s_client: fix not to send a command letter of R
Fix doc to remove const arg in GEN_SESSION_CB
Shreya Bhandare (1):
EVP_PKEY_size declared to take a const parameter
Simo Sorce (6):
Implement SSH KDF
Add SSHKDF in evp_kdf_test
Change the digest string from "md" to "digest"
Fix input checks wrt legacy code
Add SSKDF test vectors from RFC 8636
Add KRB5KDF from RFC 3961
Simon Cornish (1):
Handle max_fragment_length overflow for DTLS
Soujyu Tanaka (4):
Avoid linking error on WCE700 for _InterlockedExchangeAdd(). This implementation is referenced to https://www.boost.org/doc/libs/1_69_0/boost/detail/interlocked.hpp
Avoid linking error for InitializeCriticalSectionAndSpinCount(). Replace it with InitializeCriticalSection()
Circumvent a problem of lacking GetEnvironmentVariable() in WindowsCE.
For the lack of GetModuleHandleEx(), we use DSO route for WinCE. Revert win32_pathbyaddr() which is used in DSO_dsobyaddr().
Tanzinul Islam (1):
Fix find/rm command in Unix clean recipe
Tianjia Zhang (1):
apps: support sendfile in s_server when ktls enabled
Tobias Nießen (3):
Trivial test improvements
Allow specifying the tag after AAD in CCM mode
Allow EVP_PKEY_get0_RSA for RSA-PSS keys
Tobias Stoeckmann (1):
Fixed typo (vi leftover).
Todd Short (10):
Add RFC5297 AES-SIV support
Fixes #7879: AES-SIV to use EVP_MAC APIs
Fix d2i_PublicKey() for EC keys
Update d2i_PrivateKey documentation
Add option to disable Extended Master Secret
Modify OCSP to use alt MD for cert IDs in responses
Collapse ssl3_state_st (s3) into ssl_st
Add documentation for running unit tests under Valgrind
Change cipher default strings to a function
Fix SSL_CTX_set_session_id_context() docs
Tomas Mraz (30):
Fix copy&paste error found in Coverity scan
Unbreak SECLEVEL 3 regression causing it to not accept any ciphers.
Remove stray -modulus option from the ec manual page.
Allow the syntax of the .include directive to optionally have '='
Print all loaded engines with openssl list -engines
Use AI_ADDRCONFIG hint with getaddrinfo if available.
Fix for BIO_get_mem_ptr and related regressions
Add testing of RDONLY memory BIOs
Add documentation for the BIO_s_mem pecularities
Add test for the BIO_s_mem rdwr->rdonly->rdwr use-case
The SHA256 is not a mandatory digest for DSA.
BIO_lookup_ex: Retry with AI_ADDRCONFIG cleared if getaddrinfo fails
ts: Use sha256 as default digest for TS query
ts: Fix awkward sentences in the documentation and the default digest
Fix and document BIO_FLAGS_NONCLEAR_RST behavior on memory BIO
Clarify documentation of SSL_CTX_set_verify client side behavior
BIO_lookup_ex: Always retry the lookup on failure with AI_NUMERICHOST set
BIO_lookup_ex: Do not retry on EAI_MEMORY
BIO_f_zlib: Properly handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.
20-test_enc_more.t: Replace deprecated -ciphers option with -list
Delete recently documented functions from missingcrypto
A few fixes in the EVP_KDF-KB and EVP_KDF-KRB5KDF manpages
Avoid arm64 builds timeout due to silent make taking too long time
Correct two small documentation issues
s_server: Properly indicate ALPN protocol mismatch
Allow certificates with Basic Constraints CA:false, pathlen:0
Set X509_V_ERR_INVALID_EXTENSION error for invalid basic constraints
Add test cases for the non CA certificate with pathlen:0
Travis build matrix adjustments
Fix no-pic static builds
Valentin Robert (1):
Fix typo in NOTES.PERL
Vedran Miletić (1):
Add missing dots in dgst man page
Veres Lajos (1):
Fix some typos
Victor Stinner (1):
EVP_PBE_scrypt() handles salt=NULL as salt=""
Viktor Dukhovni (10):
Only CA certificates can be self-issued
Apply self-imposed path length also to root CAs
Added missing signature algorithm reflection functions
Eliminate NOP cast
Cleaner disposal of ephemeral engine ids and names
Update generator copyright year.
More configurable crypto and ssl library initialization
Actually silently ignore GET / OCSP requests
Undeprecate OpenSSL_version_num and OPENSSL_VERSION_NUMBER
Ignore empty ALPN elements in CLI args
Viktor Szakats (2):
minor fixes for Windows
Fix unused goto label gcc warning
Vitezslav Cizek (5):
DSA: Check for sanity of input parameters
openssl_strerror_r: Fix handling of GNU strerror_r
apps/speed.c: skip binary curves when compiling with OPENSSL_NO_EC2M
apps/speed.c: properly address NO_EC2M on systems without SIGALRM
build_SYS_str_reasons: Fix a crash caused by overlong locales
Vladimir Kotal (4):
make ecp_nistz256_point_add_vis3() local
mention what happens if OPENSSL_NO_RC2 is defined
use native atomic increment function on Solaris
enable DECLARE_DEPRECATED macro for Oracle Developer Studio compiler
Vladimir Panteleev (3):
.gitignore: Add /apps/progs.{c,h}
.github/PULL_REQUEST_TEMPLATE.md: Fix link to contributors guide
spkac: Check return values of NETSCAPE_SPKI functions
Wataru Ashihara (1):
crypto/bn: fix debug build
Wojciech Kaluza (2):
Add RCFLAGS variable in Windows build file, and use it
Allow setting RCFLAGS as Configure option or environment variable
Xiaokang Qian (2):
Fix the issue that aes-xxx-siv algorithms failed in OpenSSL speed test
Fix the compile error once enabled Werror
XiaokangQian (1):
Optimize AES-ECB mode in OpenSSL for both aarch64 and aarch32
agnosticdev (5):
typo-fixes: miscellaneous typo fixes
issue-8973: Added const to parameters for values that were not altered
issue-8998: Ensure that the alert is generated and reaches the remote
issue-9316: Update return documentation for RAND_set_rand_engine
Update dgst.c to show a list of message digests
armfazh (1):
Fix tls_cbc_digest_record is slow using SHA-384 and short messages
avas (1):
Move U64 macro from sha.h to sha512.c
batist73 (1):
Android build: fix usage of NDK home variable ($ndk_var)
cclauss (2):
print() is a function in Python 3
Travis CI: Use flake8 to find Python syntax errors or undefined names
dcruette (1):
Update tls13_enc.c
dyrock (1):
Check if num is 0 before trying to malloc memory. Otherwise for client hellos without extensions SSL_client_hello_get1_extensions_present will return MALLOC_FAILURE.
fangming.fang (1):
Fix disabled ecdsa in apps/speed
jayaram (3):
fix for dsa key size feature request issue: pkey -text or -text_pub should show dsa key size
fixed the RETURN VALUES section in the EC_GROUP documentation for the following functions.
fix for Missing null check after OPENSSL_zalloc
joe2018Outlookcom (1):
Fix warning C4164 in MSVC.
kaysond (1):
Add `-passin` arg to `ocsp` Fix #10682
kinichiro (4):
Check return value after loading config file
Return 1 when openssl req -addext kv is duplicated
Avoid leak in error path of asn1_parse2
Avoid leak in error path of PKCS5_PBE_keyivgen
moehuster (1):
Fix L<EVP_MD_CTX_set_pkey_ctx> links
ning (1):
pkcs12 demo: output correct file names on error.
nxtstep (1):
typo ANS1 -> ASN1
opensslonzos-github (1):
Add missing EBCDIC strings
raja-ashok (15):
TLS1.3 FFDHE Support
Add testcase for TLS1.3 FFDHE
Update docs for TLS1.3 FFDHE
Fix typo mistake on calls to SSL_ctrl in ssl.h
Use allow_early_data_cb from SSL instead of SSL_CTX
API to get negotiated key exchange algorithm in TLS1.3
Test SSL_get_negotiated_group() API
Update man page for new API SSL_get_negotiated_group()
Restrict usage of bio_dgram_sctp_data only to DGRAM SCTP methods
Fix SSL_set_ciphersuites to set even if no call to SSL_set_cipher_list
Test SSL_set_ciphersuites
Add TLS version options to s_time
Update new TLS version options to s_time man page
Fix leak with no-ec config
Set argument only after successful dup on CMP APIs
raniervf (2):
conf_def.c: Avoid calling strlen() in a loop
commit a6efbe123af3d98b4d10d4fcdfe68dc5303212f8 Author: raniervf <ranier_gyn at hotmail.com> Date: Thu Nov 7 18:59:11 2019 -0300
scott (1):
BIO_do_accept: correct error return value
simplelins (1):
Fix a bug for aarch64 BigEndian FIXES #10692 #10638 a bug for aarch64 bigendian with instructions 'st1' and 'ld1' on AES-GCM mode.
terry zhao (1):
Update kmac.c
thekuwayama (1):
Fix small misspelling in doc for OCSP_response_status
voev (1):
Fix GOST OID
weinholtendian (1):
Fix error message for s_server -psk option
x753 (1):
Fixed typo in enc.c warning
zero (1):
Update NOTES.ANDROID for newer NDK versions + small fixes.
Ԝеѕ (1):
Cleanup typos and grammar in DES_random_key.pod
张盛豪 (1):
apps/speed: fix invalid final report when run SM2 benchmarks in parallel
杨洋 (1):
Support SM2 certificate verification
-----------------------------------------------------------------------
More information about the openssl-commits
mailing list