summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2020-04-23Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
2020-04-23PROV: Ensure that ED25519 & ED448 keys have a mandatory digestRichard Levitte
This adds handling of the parameter "mandatory-digest" and responds with an empty string, meaning that no digest may be used. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576)
2020-04-23EVP: add internal evp_keymgmt_util_get_deflt_digest_name() and use itRichard Levitte
evp_keymgmt_util_get_deflt_digest_name() is a refactor of the provider side key part of EVP_PKEY_get_default_digest_name(), that takes EVP_KEYMGMT and provider keydata pointers instead of an EVP_PKEY pointer. We also ensure that it uses SN_undef as the default name if the provider implementation gave us an empty string, since this is what EVP_PKEY_get_default_digest_name() responds when getting the digest name via a EVP_PKEY_ASN1_METHOD ctrl call that returns NID_undef. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11576)
2020-04-22params: add functionality to test if an OSSL_PARAM has been set.Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11588)
2020-04-22[crypto/ec] deprecate Jprojective_coordinates_GFp functionsBilly Brumley
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11527)
2020-04-21Add setter equivalents to X509_REQ_get0_signatureDirk-Willem van Gulik
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10563)
2020-04-20Fix descriptions of credentials and verification options for various appsDr. David von Oheimb
fix doc of s_client and s_server credentials and verification options fix doc of verification options also for s_time, x509, crl, req, ts, and verify correcting and extending texts regarding untrusted and trusted certs, making the order of options in the docs and help texts more consistent, etc. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11273)
2020-04-20Fix DH_get_nid() so that it does not cache values.Shane Lontis
DH_set0_pqg() is now responsible for caching the nid, q and length. DH with or without named safe prime groups now default to using the maximum private key length (BN_num_bits(q) - 1) when generating a DH private key. The code is now shared between fips and non fips mode for DH key generation. The OSSL_PKEY_PARAM_DH_PRIV_LEN parameter can be used during keygen to override the maximum private key length to be in the range (2 * strength ... bits(q) - 1). Where the strength depends on the length of p. Added q = (p - 1) / 2 safe prime BIGNUMS so that the code is data driven (To simplify adding new names). The BIGNUMS were code generated. Fix error in documented return value for DH_get_nid Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11562)
2020-04-20DOC: Extend EVP_PKEY-DSA(7) / EVP_PKEY_DH(7) with FFC informationShane Lontis
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11546)
2020-04-20DOC: Refactor provider-keymgmt(7) to give the keytypes their own pagesRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11546)
2020-04-19Undeprecate DH_get_length() and DH_set_length() functionsPauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225)
2020-04-19dhparam: update command line app to use EVP callsPauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11225)
2020-04-18DOC: Extend the description of EVP_PKEY_CTX_new_from_name()Richard Levitte
This adds text the should lead the user to documentation on different KEYMGMT implementations. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11220)
2020-04-18DOC: Add more description of EVP_PKEY_fromdata(), and examplesRichard Levitte
Fixes #11131 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11220)
2020-04-17doc: note that the FIPS provider contains some non-approved algorithms.Pauli
Also note how to select them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11371)
2020-04-17EVP: Fix calls to evp_pkey_export_to_provider()Richard Levitte
The calls weren't quite right, as this function has changed its behaviour. We also change the internal documentation of this function, and document evp_pkey_downgrade(). Fixes #11549 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11550)
2020-04-16Document X509_verify_ex() and X509_REQ_verify_ex()Matt Caswell
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11507)
2020-04-16Add DH keygen to providersShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11332)
2020-04-15Add DSA keygen to providerShane Lontis
Moved some shared FFC code into the FFC files. Added extra paramgen parameters for seed, gindex. Fixed bug in ossl_prov util to print bignums. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11303)
2020-04-15Document the new libctx aware private key functionsMatt Caswell
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11494)
2020-04-15EC: Refactor EVP_PKEY_CTX curve setting macros for param generationRichard Levitte
The macros are converted to functions, and are modified to support provider implementations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-15KEYMGMT: Add functions to get param/key generation parametersRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11328)
2020-04-14Add ex_data to EVP_PKEY.Aaron Thompson
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11515)
2020-04-11Fix some errors in documentationRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11476)
2020-04-11Add manpage entry for X509_check_purpose()Jake Maynard
Fixes #10263 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10301)
2020-04-09Document the new library context aware CT functionsMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11483)
2020-04-09Update RAND_METHOD definition in man pageJim Newsome
The `add` and `seed` callbacks were changed to return `int` instead of `void` in b6dcdbfc94c482f6c15ba725754fc9e827e41851 (first included in tag OpenSSL_1_1_0-pre1). The `add` callback was changed to take a `double` instead of an `int` in 853f757ecea74a271a7c5cdee3f3b5fe0d3ae863. CLA: trivial Fixes: #10199 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11486)
2020-04-09Add a null provider which implements no algorithms.Pauli
By loading the null provider into the default context, it is possible to verify that it is not accidentally being used. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11488)
2020-04-09Document the new X509_STORE_CTX_new_with_libctx() functionMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11457)
2020-04-08EVP: add EVP_PKEY_is_a() and EVP_PKEY_can_sign()Richard Levitte
EVP_PKEY_is_a() is the provider side key checking function corresponding to checking EVP_PKEY_id() or an EVP_PKEY against macros like EVP_PKEY_EC. It also works with legacy internal keys. We also add a warning indoc/man3/EVP_PKEY_set1_RSA.pod regarding the reliability of certain functions that only understand legacy keys. Finally, we take the opportunity to clean up doc/man3/EVP_PKEY_set1_RSA.pod to better conform with man-page layout norms, see man-pages(7) on Linux. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11358)
2020-04-08params: add a warning about the PTR types.Pauli
The warning is deter the unsure -- if in doubt the PTR type is almost certainly NOT what you should be using. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11480)
2020-04-07PROV: Add the beginning of a DER writing libraryRichard Levitte
This library is meant to be small and quick. It's based on WPACKET, which was extended to support DER writing. The way it's used is a bit unusual, as it's used to write the structures backward into a given buffer. A typical quick call looks like this: /* * Fill in this structure: * * something ::= SEQUENCE { * id OBJECT IDENTIFIER, * x [0] INTEGER OPTIONAL, * y [1] BOOLEAN OPTIONAL, * n INTEGER * } */ unsigned char buf[nnnn], *p = NULL; size_t encoded_len = 0; WPACKET pkt; int ok; ok = WPACKET_init_der(&pkt, buf, sizeof(buf) && DER_w_start_sequence(&pkt, -1) && DER_w_bn(&pkt, -1, bn) && DER_w_boolean(&pkt, 1, bool) && DER_w_precompiled(&pkt, -1, OID, sizeof(OID)) && DER_w_end_sequence(&pkt, -1) && WPACKET_finish(&pkt) && WPACKET_get_total_written(&pkt, &encoded_len) && (p = WPACKET_get_curr(&pkt)) != NULL; Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11450)
2020-04-03Expand the XTS documentationMatt Caswell
Explain that XTS does not support streaming, and that the IV value is the tweak. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11461)
2020-04-03Add data driven SELF TEST code for signatures and key agreementShane Lontis
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11036)
2020-04-02HTTP client: make server/proxy and port params more consistent; minor other ↵Dr. David von Oheimb
improvements Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
2020-04-02 Chunk 10 of CMP contribution to OpenSSL: CMP http client and related testsDr. David von Oheimb
Also improve the generic HTTP client w.r.t. proxy and no_proxy options. Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11404)
2020-04-02TLS Cipher Suite 0xC102 SupportNikolay Morozov
For GOST2012-GOST8912-GOST8912 was used 0xFF85 identifier, but new identifier 0xc102 was assigned. Because of old software we will support both numbers. https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 https://datatracker.ietf.org/doc/draft-smyshlyaev-tls12-gost-suites/ Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11403)
2020-04-01apps: support sendfile in s_server when ktls enabledTianjia Zhang
When the -WWW or -HTTP option is specified, s_server can choose to use SSL_sendfile to transmit the file requested by client with KTLS is enabled, taking full advantage of the performance advantages of Kernel TLS, and adding the '-sendfile' command line parameter to control this behavior. Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11318)
2020-04-01Add EVP_PKEY_gettable_params support for accessing EVP_PKEY key data fieldsShane Lontis
Currently only RSA, EC and ECX are supported (DH and DSA need to be added to the keygen PR's seperately because the fields supported have changed significantly). The API's require the keys to be provider based. Made the keymanagement export and get_params functions share the same code by supplying support functions that work for both a OSSL_PARAM_BLD as well as a OSSL_PARAM[]. This approach means that complex code is not required to build an empty OSSL_PARAM[] with the correct sized fields before then doing a second pass to populate the array. The RSA factor arrays have been changed to use unique key names to simplify the interface needed by the user. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11365)
2020-03-30Document the new X509v3_cache_extensions() functionMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
2020-03-30Add the X509v3_cache_extensions() functionMatt Caswell
Various functions cause the results of processing extensions to be cached. The processing itself requires a libctx, and so this implicit caching means that the default ctx is used which can lead to failures. By explicitly caching the extensions we can specify the libctx to be used. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11409)
2020-03-28Param builder: Remove the static size limit.Pauli
Prior to this, the param builder had a statically sized array internally. This changes it so that it uses a stack instead. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11390)
2020-03-28Param build: make structures opaque.Pauli
Since this is public, it is best to make the underlying structure opaque. This means converting from stack allocation to dynamic allocation for all usages. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11390)
2020-03-28NEWS: note OSSL_PARAM_BLD API as public.Pauli
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11390)
2020-03-28Param builder: make the OSSL_PARAM_BLD APIs public.Pauli
The catalyst for this is the difficult of passing BNs through the other OSSL_PARAM APIs. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11390)
2020-03-27Document various SRP related APIsMatt Caswell
This includes the newly added *_ex() variants that take a libctx/property query string. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11410)
2020-03-27Add OCSP_RESPID_set_by_key_ex() and OCSP_RESPID_match_ex()Matt Caswell
OCSP_RESPID_set_by_key() calculates a SHA1 hash of the supplied certificate. We need to be able to specify which libctx and property query string is used to fetch that algorithm so we introduce OCSP_RESPID_set_by_key_ex() which does the same thing but enables you to speicfy the library context and propery query string explicitly. OCSP_RESPID_match() matches with certificates based on the SHA1 hash. Therefore for the same reason we introduce OCSP_RESPID_match_ex(). Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11407)
2020-03-25EVP: Add EVP_PKEY_set_type_by_keymgmt() and use itRichard Levitte
This function intialises an EVP_PKEY to contain a provider side internal key. We take the opportunity to also document the older EVP_PKEY_set_type() and EVP_PKEY_set_type_str(). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11375)
2020-03-25Chunk 9 of CMP contribution to OpenSSL: CMP client and related testsDr. David von Oheimb
Certificate Management Protocol (CMP, RFC 4210) extension to OpenSSL Also includes CRMF (RFC 4211) and HTTP transfer (RFC 6712). Adds the CMP and CRMF API to libcrypto and the "cmp" app to the CLI. Adds extensive documentation and tests. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11300)
2020-03-25Fix whitespace nit in OSSL_SELF_TEST_new.pod which caused doc-nits warningDr. David von Oheimb
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11300)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-05 01:57:55 +0000