<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">An OMC vote deeming that adding error checks like this are or are not considered breaking changes.<div class=""><br class=""></div><div class="">My view is that detecting an error condition and returning an error code is a bug fix rather than a breaking change.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Pauli<br class=""><div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">-- <br class="">Dr Paul Dale | Distinguished Architect | Cryptographic Foundations <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline">
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 11 Nov 2020, at 7:10 pm, Matt Caswell <<a href="mailto:matt@openssl.org" class="">matt@openssl.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I have no problem with the proposal or the vote text. I only wonder</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">whether, as a breaking change an OMC vote is required? Or is an OTC vote</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">sufficient?</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Matt</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">On 10/11/2020 16:15, Nicola Tuveri wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">## Background<br class=""><br class="">As part of the discussion in [issue #8435], it was highlighted that both<br class="">in 1.1.1 and master we are missing tests to validate decoded SM2 keys.<br class="">The `openssl pkey -check` (or `pkey -pubcheck` to validate only the<br class="">public key component) command allows to explicitly execute the<br class="">validation checks, while on regular operations (e.g., using `pkeyutl` or<br class="">`dgst`) no validation of the input keys is normally done (probably by<br class="">design).<br class=""><br class="">In [PR 13359] I am adding new tests, using `openssl pkey -check` to<br class="">validate specific key corner cases, for P-256 as an exemplar for EC keys<br class="">and for SM2 keys.<br class="">Unfortunately `openssl pkey -check` behavior currently shows the result<br class="">of the validation only in the text output, so parsing of `stdout` would<br class="">require measuring the test results.<br class="">In the PR I am proposing to change the behavior of `openssl pkey` so<br class="">that an early exit is triggered if `-check` or `-pubcheck` validation<br class="">fails, exiting with a failure exit status: [apps/pkey.c changes].<br class=""><br class="">This is a breaking change in the behavior of `openssl pkey` and the<br class="">reason why I am planning to raise a vote to approve this change.<br class=""><br class="">Note that during our OTC meeting today it was proposed as an alternative<br class="">to have a more generic vote on approving this kind of change in general<br class="">for all similar situations across all the apps.<br class="">While I am not opposed to such a decision, I am afraid having such a<br class="">generic vote might be quite difficult:<br class=""><br class="">- I am not sure I can express in a clear and unambiguous what are the<br class=""> conditions to fall within "similar situations", making such a<br class=""> decision hard to execute in practical terms;<br class="">- I personally cannot commit to execute such vote across all apps and<br class=""> all relevant conditions: doing so requires extensive review of the<br class=""> apps logic in parsing the CLI switches, of conformity with existing<br class=""> documentation and an exploration of existing use patterns in the user<br class=""> codebase to see what are the expectations and estimate the impact of<br class=""> such changes. It would also require writing an extensive battery of<br class=""> tests to ensure we behave as documented/expected across apps and CLI<br class=""> switches.<br class="">- The amount of work to which we would commit after such a generic<br class=""> decision, and the impact it could have on the behavior consistency<br class=""> w.r.t. 3.0 and 1.1.1, would make me think such a decision is more in<br class=""> the realm of strategic objectives, for which an OMC vote would be more<br class=""> appropriate.<br class=""><br class="">For these reasons, at this time, I am opting to propose an OTC vote on<br class="">the single case of the behavior change of `pkey -check`/`pkey -pubcheck`<br class="">rather than a more generic one, and I will let others decide if a more<br class="">generic vote is also required/appropriate and if it can be framed<br class="">exclusively within the technical prerogatives of the OTC decision<br class="">process.<br class=""><br class="">## Proposed vote text<br class=""><br class=""> Change the behavior of `pkey -check`<br class=""> and `pkey -pubcheck` in 3.0 to trigger an<br class=""> early exit if validation fails, returning a<br class=""> failure exit status to the parent process.<br class=""><br class="">---<br class=""><br class="">Please leave feedback relevant to the proposed vote text and the scope<br class="">of the vote.<br class="">In absence of feedback I plan to open the actual vote in 24h.<br class=""><br class=""><br class=""><br class="">Cheers,<br class=""><br class="">Nicola<br class=""><br class="">---<br class=""><br class="">[issue #8435]: <<a href="https://urldefense.com/v3/__https://github.com/openssl/openssl/issues/8435__;!!GqivPVa7Brio!Iiq8eSK65cKttwL_M-jL1JwQw-V9roGNZaxYAPw08zcLEiuEMvGtYPDvrBSYf2E$" class="">https://urldefense.com/v3/__https://github.com/openssl/openssl/issues/8435__;!!GqivPVa7Brio!Iiq8eSK65cKttwL_M-jL1JwQw-V9roGNZaxYAPw08zcLEiuEMvGtYPDvrBSYf2E$</a><span class="Apple-converted-space"> </span>><br class="">[PR 13359]: <<a href="https://urldefense.com/v3/__https://github.com/openssl/openssl/pull/13359__;!!GqivPVa7Brio!Iiq8eSK65cKttwL_M-jL1JwQw-V9roGNZaxYAPw08zcLEiuEMvGtYPDvd5hDbWk$" class="">https://urldefense.com/v3/__https://github.com/openssl/openssl/pull/13359__;!!GqivPVa7Brio!Iiq8eSK65cKttwL_M-jL1JwQw-V9roGNZaxYAPw08zcLEiuEMvGtYPDvd5hDbWk$</a><span class="Apple-converted-space"> </span>><br class="">[apps/pkey.c changes]:<br class=""><<a href="https://urldefense.com/v3/__https://github.com/openssl/openssl/pull/13359/files*diff-810c047ab642e686cab85b16802e9190bbc9f2f9bfce8a55fb8d6b744caa9091__;Iw!!GqivPVa7Brio!Iiq8eSK65cKttwL_M-jL1JwQw-V9roGNZaxYAPw08zcLEiuEMvGtYPDv8zOO9ys$" class="">https://urldefense.com/v3/__https://github.com/openssl/openssl/pull/13359/files*diff-810c047ab642e686cab85b16802e9190bbc9f2f9bfce8a55fb8d6b744caa9091__;Iw!!GqivPVa7Brio!Iiq8eSK65cKttwL_M-jL1JwQw-V9roGNZaxYAPw08zcLEiuEMvGtYPDv8zOO9ys$</a><span class="Apple-converted-space"> </span>></blockquote></div></blockquote></div><br class=""></div></body></html>