summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2022-08-17SHAKE documentation updates for default output length.slontis
Fixes #18586 In order to not break existing applications the OpenSSL documentation related to SHAKE has been updated. Background: All digests algorithms (including XOF's) use the bitlen as the default output length. This results in a security strength of bitlen / 2. This means that SHAKE128 will by default have an output length of 16 bytes and a security strength of 64 bits. For SHAKE256 the default output length is 32 bytes and has a security strength of 128 bits. This behaviour was present in 1.1.1 and has been duplicated in the provider SHAKE algorithms for 3.0. The SHAKE XOF algorithms have a security strength of min(bitlen, output xof length in bits / 2). Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18622) (cherry picked from commit b7cf9dd2393de8e90a15e83466d9b8b781b18385)
2022-08-17Correct the documentation for OPENSSL_MALLOC_FDMatt Caswell
The documentation was misleading in that it suggests that this environment variable will record information about all allocations. While this is true it doesn't record the most useful information that you might expect such as the requested size of the allocation! It is mainly for use in conjunction with OPENSSL_MALLOC_FAILURES, and reports information about what chance an allocation has of failing. We also clarify that the mem_debug functions are actually no-ops in 3.0. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18967) (cherry picked from commit 2c35d61790603530d11f52eda9132ff8640f9852)
2022-08-04Properly document deprecation of DH_new() and related functionsTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18925) (cherry picked from commit 65b41ab31917e3bb25920c4b27017786db668850)
2022-08-04Fix EC_KEY_set_private_key() NULL priv_key docsRoberto Hueso Gomez
Updates the docs to describe EC_KEY_set_private_key() function behavior when a NULL priv_key argument is passed. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/18941)
2022-08-03Revert "Note that EVP_CIPHER_get_iv_length returns negative values on error"Matt Caswell
This reverts commit 2a6275f58bdb2371c603be7f89310f7b4906e5c0. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18946)
2022-08-03Note that EVP_CIPHER_get_iv_length returns negative values on errorPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18875) (cherry picked from commit 0a90577e717f76483525b2d8be6a42a9f04020d8)
2022-07-29Correction: uncompressed is the default valueGregoryTrzonkowski
CLA: trivial The description was incorrect. The uncompressed is the default value. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18889) (cherry picked from commit df274c334c523f7375d5aa60ff4b9a846c3e2a6c)
2022-07-28Update EVP_KDF-X942-ASN1.podJoachim Vandersmissen
Replaced OSSL_KDF_PARAM_KEY with OSSL_KDF_PARAM_SECRET as that seems to be the intended value from the code (OSSL_KDF_PARAM_KEY is also supported but looks like a fallback). Fixed name for OSSL_KDF_PARAM_X942_USE_KEYBITS. CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18878) (cherry picked from commit 08c00377cb82f7eefcf7433606e687f348b9e7a0)
2022-07-26Fix error in LHASH documentationPauli
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/18859) (cherry picked from commit 316fad64c1e541a530910a13160d48b7545ac1e0)
2022-07-22Fix error in example.Pauli
Fixes #18828 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18829) (cherry picked from commit 2752ab2eb61dcfc799775d34eaeda3621b85f95f)
2022-07-21X509_STORE_CTX_purpose_inherit(): add missing details to its documentationDr. David von Oheimb
Fixes #18801 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/18830) (cherry picked from commit c00fd2dece8ba54b2597a61c8db6a001025d05d5)
2022-07-19apps/x509: Improve doc fix for -CAserial anc -CAcreateserialDr. David von Oheimb
This follows up on https://github.com/openssl/openssl/pull/18373 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/18804) (cherry picked from commit 7a16f179ab0bc2c474a754c0ad7e35b40534a38e)
2022-07-15Added paragraph to free objects alloced by X509V3_add1_i2d()Allan
Fixes #18665 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18786) (cherry picked from commit 17004adacf74f9f7036b623dab31a6d12c32daf1)
2022-07-15Updated X509v3_get_ext_by_NID.pod and X509_CRL_get0_by_serial.podAllan
Updated these to the current documentation style. Moved X509v3_delete_ext() under BUGS to NOTES and added information to call free. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18786) (cherry picked from commit 1711f4824be2c6b41d26f221d2aa0e2236363995)
2022-07-14openssl-x509.pod.in: fix description of certificate serial number storageDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18373) (cherry picked from commit aa73b7d352c383e415d4d7567b79ce074c6762cd)
2022-07-14APPS/x509: With -CA but both -CAserial and -CAcreateserial not given, use ↵Dr. David von Oheimb
random serial. Also improve openssl-x509.pod.in and error handling of load_serial() in apps.c. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18373) (cherry picked from commit ec8a3409487c871b440fa52bff7c3ef33378494a)
2022-07-12OSSL_trace_set_channel.pod and openssl.pod: fix missing/inconsistent ↵Dr. David von Oheimb
category items Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/18763)
2022-07-08Updated information for OSSL_SIGNATURE_PARAM_PSS_SALTLENAllan
Fixes #18066 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18736) (cherry picked from commit d104c6ff7499b0638c82557ce94e284b00f74627)
2022-07-06http_client.c: fix comment and documentation of the memory BIOs usedDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18674) (cherry picked from commit 7d5019c15af8f88443a7edddd4b150a7dafeda5d)
2022-07-06OSSL_HTTP_open(): improve use of use_ssl and its documentationDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18674) (cherry picked from commit 35750cb9af007702dad92d62da57200fdf9ddaf4)
2022-07-06openssl-cmds.pod.in: add missing entry for cmpDr. David von Oheimb
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18653) (cherry picked from commit 33478aedafaff1f414cabd67fb30970c41996f5c)
2022-07-06Fix typos in SSL_CTX_use_certificate.pod fileEasySec
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18087) (cherry picked from commit a97931955da72c39287a860155ffe071a3125f9f)
2022-07-05Update copyright yearRichard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> Release: yes
2022-07-01Documentation update for EVP_set_default_propertiesslontis
Explicitly state that it is not thread safe. Fixes #18613 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18678) (cherry picked from commit 5c535e4692a5a4f2ec7691de4efc6290193a0882)
2022-06-28SSL_get_current_cipher() and SSL_get_pending_cipher() return 'const ↵olszomal
SSL_CIPHER *' Fix the documentation. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18599) (cherry picked from commit d842b6eff0940b6ce337536cb718a8d561290f50)
2022-06-28Add missing documentation of OSSL_FUNC_store_export_object()Tomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17554) (cherry picked from commit 13941d438458068d4150c5899f6bbc0add393cc4)
2022-06-28Correct doubled OSSL_OSSL when documenting OSSL_FUNC_.._fnTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17554) (cherry picked from commit 13b47155ba425ffd0683e1bff30f746c96a19049)
2022-06-27der_writer: Use uint32_t instead of long.Daniel Fiala
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18615) (cherry picked from commit 59196250cb45ecd128d2f8bbc47de612167606d3)
2022-06-24Added documentation for PEM_X509_INFO_read() and PEM_X509_INFO_read_bio()Allan
Fixes #18342 Fixes <propq> to I<propq> Updated copyright year Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18623) (cherry picked from commit 9454423bf1eac4c75e70ff4fd67456e4cfb05a92)
2022-06-21Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2022-06-16Fix documentation of BIO_FLAGS_BASE64_NO_NLFraser Tweedale
Commit 8bfb7506d210841f2ee4eda8afe96441a0e33fa5 updated `BIO_f_base64(3)` to improve the documentation of the `BIO_FLAGS_BASE64_NO_NL` flag. In particular, the updated text states that when this flag is used, all newlines in the input are ignored. This is incorrect, as the following program proves: ```c unsigned char *in_buf = "IlRoZSBxdWljayBicm93biBmb3gganVt\ncHMgb3ZlciBhIGxhenkgZG9nLiI=\n"; int main(int argc, char **argv) { BIO *b64 = BIO_new(BIO_f_base64()); if (b64 == NULL) return 1; BIO_set_flags(b64, BIO_get_flags(b64) | BIO_FLAGS_BASE64_NO_NL); int in_len = strlen(in_buf); BIO *in = BIO_new_mem_buf(in_buf, in_len); if (in == NULL) return 2; in = BIO_push(b64, in); unsigned char *out_buf = calloc(in_len, sizeof(unsigned char)); if (out_buf == NULL) return 3; size_t out_len; int r = BIO_read_ex(in, out_buf, in_len, &out_len); printf("rv = %d\n", r); printf("decoded = %s\n", out_buf); return 0; } ``` Update the text of `BIO_f_base64(3)` to clarify that when the flag is set, the data must be all on one line (with or without a trailing newline character). Signed-off-by: Fraser Tweedale <ftweedal@redhat.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18568) (cherry picked from commit 0edcbacca99ab2b716da395f204610fc2775ea83)
2022-06-16Fix for OSSL_PARAM sample code referencing OSSL_PARAM_UTF8_PTRMichael Baentsch
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18490) (cherry picked from commit 809526a06c1305d67a8f231ca15cd27ec800efce)
2022-06-09Update SIV mode documentationTodd Short
Fixes #18440 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18485) (cherry picked from commit 9cef2a70b151b6a92eb1770ceb5fa90331305934)
2022-06-01doc: Fix keymgmt functions parametersLadislav Marko
CLA: trivial Make OSSL_FUNC_keymgmt_import and OSSL_FUNC_keymgmt_export documentation correspond to core_dispatch.h signatures Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18423) (cherry picked from commit 70ed3046c5f156cab45a2bb2c8e36ab5d29a45ca)
2022-05-27The -no_legacy_server_connect option applies to clientTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/18296) (cherry picked from commit d1b3b6741380a1d7607da671b97f3fe5f54fa657)
2022-05-26Fix the defective check of EVP_PKEY_get_paramsPeiwei Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18367) (cherry picked from commit 7e5e91176b770a68bdaf73a5c647f1fc0d7f2900)
2022-05-18Documentation: X509_V_ERR_CERT_CHAIN_TOO_LONG is not unusedThomas Bellebaum
The Error `X509_V_ERR_CERT_CHAIN_TOO_LONG` is not unused. See e.g. here: https://github.com/openssl/openssl/blob/598bd7741568a1aae678e5472f18aae1ab991e8d/crypto/x509/x509_vfy.c#L3318-L3319 CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18330) (cherry picked from commit 0db53e9312f9648874b283124655f9772dfa1690)
2022-05-16Fix BIO_get_ktls_send/recv to return 0 or 1 onlyTomas Mraz
Fixes #18176 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/18178) (cherry picked from commit 524bac570702a79366b85ff1f66e07d3e002370c)
2022-05-09Correct padding mode flag name for EVP_PKEY_decrypt/encrypt() examplesDimitry Andric
The example code in EVP_PKEY_decrypt(3) and EVP_PKEY_encrypt(3) and uses a nonexistent padding mode `RSA_OAEP_PADDING`, which should be `RSA_PKCS1_OAEP_PADDING` instead. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18255) (cherry picked from commit ecb1ed1b0e5aea5b71e8a98e95b6f9f022d61c89)
2022-05-09doc: Fix RSA public key parametersAhmed JELIJLI
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18253) (cherry picked from commit be92036b347e381fd606e100b6c91f1bab4b7718)
2022-05-09Add documentation for key validation that indicates the difference between theslontis
EVP_PKEY_XXX_check() calls for the default and fips providers. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18235) (cherry picked from commit 0b3d2594d060dc19269d3740ad672f065ec6398a)
2022-05-05Make it possible to remove methods by the provider that provides themRichard Levitte
This adds ossl_method_store_remove_all_provided(), which selectively removes methods from the given store that are provided by the given provider. This also adds the EVP specific evp_method_store_remove_all_provided(), which matches ossl_method_store_remove_all_provided() but can also retrieve the correct store to manipulate for EVP functions. This allows us to modify ossl_provider_self_test() to do the job it's supposed to do, but through clearly defined functions instead of a cache flushing call that previously did more than that. ossl_provider_deactivate() is also modified to remove methods associated with the deactivated provider, and not just clearing the cache. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151) (cherry picked from commit 2e4d0677ea858c619a33235265dbee19520a9d35)
2022-05-05Don't empty the method store when flushing the query cacheRichard Levitte
When evp_method_store_flush() flushed the query cache, it also freed all methods in the EVP method store, through an unfortunate call of ossl_method_store_flush_cache() with an argument saying that all methods should indeed be dropped. To undo some of the confusion, ossl_method_store_flush_cache() is renamed to ossl_method_store_cache_flush_all(), and limited to do only that. Some if the items in the internal ALGORITHM structure are also renamed and commented to clarify what they are for. Fixes #18150 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151) (cherry picked from commit 60640d79ca7ea0980dc09c71fe6a297b5f8588a2)
2022-05-05Drop ossl_provider_clear_all_operation_bits() and all uses of itRichard Levitte
This is a misused function, as it was called during query cache flush, when the provider operation bits were meant to record if methods for a certain operation has already been added to the method store. Fixes #18150 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18151) (cherry picked from commit 20b6d85ab2b9cfa4cd29d2422d69c3e3f4db0a41)
2022-05-05crmf_lib.c: Make sure Ed signature for POPO is called without digestDr. David von Oheimb
Fixes #18184 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18230) (cherry picked from commit de56f726e163e99128ff93a04d74a8461f5a724b)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-05-03Update Paul's pgp key signaturePauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18219)
2022-04-27Add SSL_(CTX_)?get0_(verify|chain)_cert_store functionsHugo Landau
Currently we do not have any way to retrieve these values once set. Fixes #18035. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18038) (cherry picked from commit 948cf521798a801cfde47a137343e6f958d71f04)
2022-04-27doc: replace "symmetric cipher" phrase in EVP_MD manpagesJan Engelhardt
CLA: trivial Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18169) (cherry picked from commit ae2efd63c6fcd9b7e043692184762da19c5eb99b)
2022-04-26pem_password_cb(3): References to other man pagesEasySec
Refer to OSSL_ENCODER_to_bio and OSSL_DECODER_from_bio man pages. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18164) (cherry picked from commit 7510aee28a3262cde442230c06daffa1e7609fd6)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-18 22:09:36 +0000