| ad3d57d2 | 02-Aug-2024 |
Andrew Dinh |
Update links in CONTRIBUTING.md
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25073) |
| d0a49eea | 02-Aug-2024 |
Andrew Dinh |
Fix some small typos
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25073) |
| e5569e0b | 06-Jun-2024 |
Dmitry Belyavskiy |
Test vectors from rfc9579 and creation tests
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pul
Test vectors from rfc9579 and creation tests
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24577)
show more ...
|
| 38aa61e5 | 07-Jun-2024 |
Dmitry Belyavskiy |
Implementation of the RFC 9579, PBMAC1 in PKCS#12 - documentation
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.co
Implementation of the RFC 9579, PBMAC1 in PKCS#12 - documentation
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24577)
show more ...
|
| fe79159b | 07-Jun-2024 |
Dmitry Belyavskiy |
Implementation of the RFC 9579, PBMAC1 in PKCS#12
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openss
Implementation of the RFC 9579, PBMAC1 in PKCS#12
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24577)
show more ...
|
| 54933db9 | 30-Jul-2024 |
Pauli |
test: omit failing test when using a FIPS provider that supports eddsa_no_verify_digested
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
test: omit failing test when using a FIPS provider that supports eddsa_no_verify_digested
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| 09eaf167 | 30-Jul-2024 |
Pauli |
test: update EdDSA tests for FIPS and no pre-hashing
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/o
test: update EdDSA tests for FIPS and no pre-hashing
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| 2d759937 | 30-Jul-2024 |
Pauli |
EdDSA: disallow verification from a pregenerated hash when in FIPS
Also includes an indicator and the capability to bypass via configuration
or params.
Fixes #24937
Rev
EdDSA: disallow verification from a pregenerated hash when in FIPS
Also includes an indicator and the capability to bypass via configuration
or params.
Fixes #24937
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| 889277ef | 30-Jul-2024 |
Pauli |
fips: add no digested option to FIPS provider
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/
fips: add no digested option to FIPS provider
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| 5abd7e5f | 30-Jul-2024 |
Pauli |
param: add OSSL_SIGNATURE_PARAM_EDDSA_VERIFY_DIGESTED
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/
param: add OSSL_SIGNATURE_PARAM_EDDSA_VERIFY_DIGESTED
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| ab02a297 | 30-Jul-2024 |
Pauli |
doc: add verify-digested param for EdDSA
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/opens
doc: add verify-digested param for EdDSA
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| b00ea9a6 | 30-Jul-2024 |
Pauli |
doc: add documentation for -eddsa_no_verify_digested fipsinstall option
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from h
doc: add documentation for -eddsa_no_verify_digested fipsinstall option
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| 70b6d57f | 30-Jul-2024 |
Pauli |
fipsinstall: add ed_no_verify_digested option
FIPS doesn't permit message hashes to be processed by thee algorithms.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Sha
fipsinstall: add ed_no_verify_digested option
FIPS doesn't permit message hashes to be processed by thee algorithms.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/25032)
show more ...
|
| f98e49b3 | 24-Jul-2024 |
slontis |
Add FIPS DSA Keygen tests
Adjust the existing tests to disable DSA keygen in FIPS mode.
Allow evp_test to load DSA 'KeyParams' that can then be used to
perform a DSA KeyGen.
Add FIPS DSA Keygen tests
Adjust the existing tests to disable DSA keygen in FIPS mode.
Allow evp_test to load DSA 'KeyParams' that can then be used to
perform a DSA KeyGen.
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24978)
show more ...
|
| 49a35f0f | 24-Jul-2024 |
slontis |
Disallow DSA Keygen in the FIPS provider
This uses a FIPS indicator.
Since DSA KeyGen is only useful for DSA signing,
it reuses the DSA signing FIPS configuration option and settable
Disallow DSA Keygen in the FIPS provider
This uses a FIPS indicator.
Since DSA KeyGen is only useful for DSA signing,
it reuses the DSA signing FIPS configuration option and settable ctx name.
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24978)
show more ...
|
| d9346c59 | 24-Jul-2024 |
slontis |
Add KeyManagement keygen parameter getter/gettable functions.
Added OSSL_FUNC_keymgmt_gen_get_params() and
OSSL_FUNC_keymgmt_gen_gettable_params()
This will allow a FIPS indicat
Add KeyManagement keygen parameter getter/gettable functions.
Added OSSL_FUNC_keymgmt_gen_get_params() and
OSSL_FUNC_keymgmt_gen_gettable_params()
This will allow a FIPS indicator parameter to be queried after keygen.
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24978)
show more ...
|
| 7f8ff7ab | 05-Aug-2024 |
slontis |
Fix evp_test HKDF failure in crosstest 3.1.2 FIPS provider with master
Fixes #25089
The test to check if the FIPS indicator was correct failed in 3.1.2
since EVP_PKEY_CTX_get_params(
Fix evp_test HKDF failure in crosstest 3.1.2 FIPS provider with master
Fixes #25089
The test to check if the FIPS indicator was correct failed in 3.1.2
since EVP_PKEY_CTX_get_params() returns 0 if there is no
gettable/getter.
The code has been modified to return 1 if there is no gettable.
Manually reproduced and tested by copying the 3.1.2 FIPS provider to master.
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25093)
show more ...
|
| 20bf3fe2 | 31-Jul-2024 |
Dimitri John Ledkov |
github: fix quoting in github workflow for jitter tests
Nested quoting got ignore previously. And this way one can specify
string name directly.
Successfully run with Jitter at
github: fix quoting in github workflow for jitter tests
Nested quoting got ignore previously. And this way one can specify
string name directly.
Successfully run with Jitter at
https://github.com/xnox/openssl/actions/runs/10223149419/job/28289017013
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25053)
show more ...
|
| aa3830c3 | 26-Jul-2024 |
pohsingwu |
Add new configurable item `pbkdf2-lower-bound-check`
Since FIPS provider performs lower bound check by default from v3.0, the
default value for new configurable item will be one.
Add new configurable item `pbkdf2-lower-bound-check`
Since FIPS provider performs lower bound check by default from v3.0, the
default value for new configurable item will be one.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24120)
show more ...
|
| a7f8378e | 11-Jul-2024 |
pohsingwu |
Add explicit indicator for PBKDF2
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/
Add explicit indicator for PBKDF2
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24120)
show more ...
|
| ca1d2db2 | 01-Aug-2024 |
Tomas Mraz |
Do not implicitly start connection with SSL_handle_events() or SSL_poll()
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from htt
Do not implicitly start connection with SSL_handle_events() or SSL_poll()
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25069)
show more ...
|
| b1f4aebb | 01-Aug-2024 |
Tomas Mraz |
Return infinity time from SSL_get_event_timeout when the connection is not started
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged
Return infinity time from SSL_get_event_timeout when the connection is not started
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25069)
show more ...
|
| b7f93c7f | 01-Aug-2024 |
Tomas Mraz |
Do not falsely start the connection through SSL_pending()/_has_pending()
Fixes #25054
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Do not falsely start the connection through SSL_pending()/_has_pending()
Fixes #25054
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25069)
show more ...
|
| 0beef0ba | 28-Jul-2024 |
Richard Levitte |
fix: util/mkinstallvars.pl mistreated LDLIBS on Unix (and Windows)
Don't do comma separation on those platforms.
Fixes #24986
Reviewed-by: Neil Horman <nhorman@openssl.org>
fix: util/mkinstallvars.pl mistreated LDLIBS on Unix (and Windows)
Don't do comma separation on those platforms.
Fixes #24986
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/25018)
show more ...
|
| ed7a8bfd | 30-Jul-2024 |
Tomas Mraz |
ssl_evp_cipher_fetch(): Avoid using 3DES from the FIPS provider
Avoid using a fetched cipher that is decrypt-only
which is the case for 3DES from the fips provider.
Add a decryp
ssl_evp_cipher_fetch(): Avoid using 3DES from the FIPS provider
Avoid using a fetched cipher that is decrypt-only
which is the case for 3DES from the fips provider.
Add a decrypt-only parameter to the EVP_CIPHER and test it
in libssl when fetching.
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25028)
show more ...
|
