summaryrefslogtreecommitdiffstats
path: root/doc/man7
AgeCommit message (Collapse)Author
2022-10-19ripemd: document as being present in the default providerPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19375)
2022-10-17Fix documentation for OFB/OCB in the FIPS providerJoachim Vandersmissen
CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19408)
2022-10-07Change all references to OpenSSL 3.1 to OpenSSL 3.2 in the master branchRichard Levitte
3.1 has been decided to be a FIPS 140-3 release, springing from the branch openssl-3.0, and the master branch to continue with the development of OpenSSL 3.2. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19350)
2022-09-23Add HPKE DHKEM provider support for EC, X25519 and X448.slontis
The code is derived from @sftcd's work in PR #17172. This PR puts the DHKEM algorithms into the provider layer as KEM algorithms for EC and ECX. This PR only implements the DHKEM component of HPKE as specified in RFC 9180. crypto/hpke/hpke_util.c has been added for fuctions that will be shared between DHKEM and HPKE. API's for EVP_PKEY_auth_encapsulate_init() and EVP_PKEY_auth_decapsulate_init() have been added to support authenticated encapsulation. auth_init() functions were chosen rather that a EVP_PKEY_KEM_set_auth() interface to support future algorithms that could possibly need different init functions. Internal code has been refactored, so that it can be shared between the DHKEM and other systems. Since DHKEM operates on low level keys it needs to be able to do low level ECDH and ECXDH calls without converting the keys back into EVP_PKEY/EVP_PKEY_CTX form. See ossl_ecx_compute_key(), ossl_ec_public_from_private() DHKEM requires API's to derive a key using a seed (IKM). This did not sit well inside the DHKEM itself as dispatch functions. This functionality fits better inside the EC and ECX keymanagers keygen, since they are just variations of keygen where the private key is generated in a different manner. This should mainly be used for testing purposes. See ossl_ec_generate_key_dhkem(). It supports this by allowing a settable param to be passed to keygen (See OSSL_PKEY_PARAM_DHKEM_IKM). The keygen calls code within ec and ecx dhkem implementation to handle this. See ossl_ecx_dhkem_derive_private() and ossl_ec_dhkem_derive_private(). These 2 functions are also used by the EC/ECX DHKEM implementations to generate the sender ephemeral keys. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19068)
2022-08-23Fix typo in migration guideTobias Nießen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19032)
2022-08-18Clarify documentation in regards to EC key parametersTomas Mraz
Also clarify that EVP_PKEY_fromdata ignores parameters that are unknown or incorrect for given selection. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18902)
2022-08-17SHAKE documentation updates for default output length.slontis
Fixes #18586 In order to not break existing applications the OpenSSL documentation related to SHAKE has been updated. Background: All digests algorithms (including XOF's) use the bitlen as the default output length. This results in a security strength of bitlen / 2. This means that SHAKE128 will by default have an output length of 16 bytes and a security strength of 64 bits. For SHAKE256 the default output length is 32 bytes and has a security strength of 128 bits. This behaviour was present in 1.1.1 and has been duplicated in the provider SHAKE algorithms for 3.0. The SHAKE XOF algorithms have a security strength of min(bitlen, output xof length in bits / 2). Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18622)
2022-08-04Change name of parameter in documentation from sigret to sigKurt Roeckx
The rest of the documentation talks about sig, not sigret Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18943)
2022-07-28Update EVP_KDF-X942-ASN1.podJoachim Vandersmissen
Replaced OSSL_KDF_PARAM_KEY with OSSL_KDF_PARAM_SECRET as that seems to be the intended value from the code (OSSL_KDF_PARAM_KEY is also supported but looks like a fallback). Fixed name for OSSL_KDF_PARAM_X942_USE_KEYBITS. CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18878)
2022-07-06Updated information for OSSL_SIGNATURE_PARAM_PSS_SALTLENAllan
Fixes #18066 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18736)
2022-06-28Add missing documentation of OSSL_FUNC_store_export_object()Tomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17554)
2022-06-28Correct doubled OSSL_OSSL when documenting OSSL_FUNC_.._fnTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17554)
2022-06-22Add deprecation macro for 3.1 and deprecate OPENSSL_LH_statsHugo Landau
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17937)
2022-06-16Fix for OSSL_PARAM sample code referencing OSSL_PARAM_UTF8_PTRMichael Baentsch
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18490)
2022-06-01doc: Fix keymgmt functions parameters Ladislav Marko
CLA: trivial Make OSSL_FUNC_keymgmt_import and OSSL_FUNC_keymgmt_export documentation correspond to core_dispatch.h signatures Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18423)
2022-05-19Add basic RISC-V cpuid and OPENSSL_riscvcapHenry Brausen
RISC-V cpuid implementation allows bitmanip extensions Zb[abcs] to be enabled at runtime using OPENSSL_riscvcap environment variable. For example, to specify 64-bit RISC-V with the G,C,Zba,Zbb,Zbc extensions, one could write: OPENSSL_riscvcap="rv64gc_zba_zbb_zbc" Architecture string parsing is still very primitive, but can be expanded in the future. Currently, only bitmanip extensions Zba, Zbb, Zbc and Zbs are supported. Includes implementation of constant-time CRYPTO_memcmp in riscv64 asm, as well as OPENSSL_cleanse. Assembly implementations are written using perlasm. Reviewed-by: Philipp Tomsich <philipp.tomsich@vrull.eu> Signed-off-by: Henry Brausen <henry.brausen@vrull.eu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17640)
2022-05-09Add documentation for key validation that indicates the difference between theslontis
EVP_PKEY_XXX_check() calls for the default and fips providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18235)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-03-31doc: fix example in ssh KDF man page.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17972)
2022-03-18Fix documentation for provider-signatureHugo Landau
Fixes #17909. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17914)
2022-03-18List missing operations in provider(7)Hugo Landau
Fixes #17910. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17915)
2022-03-14Fix documentation of parameters for DH and ECDH KEXTomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17859)
2022-03-10Add TFO support to socket BIO and s_client/s_serverTodd Short
Supports Linux, MacOS and FreeBSD Disabled by default, enabled via `enabled-tfo` Some tests Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8692)
2022-03-03Fix typo in EVP_MD-BLAKE2(7)Hugo Landau
Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17790)
2022-02-20doc: Refactored the example in crypto.podyangyangtiantianlonglong
Added return value and error code in the sample Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17721)
2022-02-09Fix small typo in EVP_KEYEXCH-ECDH.html doc exampleEasySec
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17657)
2022-02-01Fix bad HTML formatting in EVP_KEYEXCH-DH.html because of missing newline in ↵EasySec
pod file Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17609)
2022-01-05Fix typosDimitris Apostolou
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17392)
2021-12-13Enhance the explanation of selector bits in provider-keymgmt(7)Richard Levitte
This uncovers what has been a mere comment in an attempt to clarify that the use of selector bits is very much at the discretion of the provider implementation. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16765)
2021-11-30More detailed explanation how do engines work in 3.0Dmitry Belyavskiy
Related: #16868, #17081, #17107 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17115)
2021-11-28doc: remove non-existent callbacksPauli
These used to exist but were removed before release. Updating the documentation was missed. Fixes #17138 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17141)
2021-11-25doc: fix macro namePauli
OSSL_STORE_INFO_X509 doesn't exist. It should be OSSL_STORE_INFO_CERT. Fixes #17121 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17125)
2021-11-24Support different R_BITS lengths for KBKDFPatrick Uiterwijk
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17063)
2021-11-17Add documentation for some of the missing environment variables.Pauli
Where document already exists, it has been linked to. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17044)
2021-10-27Clarify the documentation for the "byname" functionsMatt Caswell
Make it clear that the cipher/digest objects returned from EVP_get_cipherbyname() and EVP_get_digestbyname() functions have no associated implementation fetched from a provider. Fixes #16864 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16893)
2021-10-27EVP: Allow a fallback for operations that work with an EVP_PKEYRichard Levitte
Functions like EVP_PKEY_sign_init() do an implicit fetch of the operation implementation (EVP_SIGNATURE in this case), then get the KEYMGMT from the same provider, and tries to export the key there if necessary. If an export of the key isn't possible (because the provider that holds the key is an HSM and therefore can't export), we would simply fail without looking any further. This change modifies the behaviour a bit by trying a second fetch of the operation implementation, but specifically from the provider of the EVP_PKEY that's being used. This is done with the same properties that were used with the initial operation implementation fetch, and should therefore be safe, allowing only what those properties allow. Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725)
2021-10-26test-rand: return failure on not enough data, allow parentPauli
The test-rand RNG was returning success when it had some but insufficient data. Now, it returns failure and doesn't advance the data pointer. The test-rand RNG was failing when a parent was specified. This case is now ignored. Fixes #16785 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16905)
2021-10-25migration_guide: Mention ERR_GET_FUNC() and function code removalTomas Mraz
Fixes #16817 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16879)
2021-10-22Permit no/empty digest in core_obj_add_sigidMichael Baentsch
Also add digest parameter documentation for add_sigid and permit NULL as digest name in the provider upcall. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16770)
2021-10-18Fix the signature newctx documentationMatt Caswell
The documentation omitted the propq parameter Fixes #16755 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16836)
2021-10-11doc: OPENSSL_CORE_CTX should never be cast to OSSL_LIB_CTXTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16771)
2021-10-09doc: document that property names are uniquePauli
Both queries and definitions only support each individual name appearing once. It is an error to have a name appear more than once. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16716)
2021-10-08Fix heading in random generator man7 pageTobias Nießen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16753)
2021-10-01doc: crypto(7) - fix typoAmit Kulkarni
CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16695)
2021-09-28doc: note that these KDFs require the legacy provider to be availablePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15968)
2021-09-28include PVK KDF in legacy provider algorithm listPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15968)
2021-09-28doc: add page for PVK KDFPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15968)
2021-09-28Fix variable name mis-match in example codeMattias Ellert
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16676)
2021-09-25doc: add note to indicate that the OBJ_ functions were not thread safe in 3.0Pauli
Also remove OBJ_thread from the list of non-threadsafe functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15713)
2021-09-25doc: Document that the OBJ creation functions are now thread safe.Pauli
With the OBJ_ thread locking in place, these documentation changes are not required. This reverts commit 0218bcdd3feab456135207c140998305df73ab7b. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15713)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-26 17:45:59 +0000