summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2020-01-15Add FIPS Self test kats for digestsShane Lontis
Added an API to optionally set a self test callback. The callback has the following 2 purposes (1) Output information about the KAT tests. (2) Allow the ability to corrupt one of the KAT's The fipsinstall program uses the API. Some KATS are not included in this PR since the required functionality did not yet exist in the provider. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10374)
2020-01-15Change returned -2 to 0 in EVP_Digest{Sign,Verify}Init()Richard Levitte
The returned -2 was to mark when these operations are unsupported. However, that breaks away from the previous API and expectations, and there's not enough justification for that not being zero. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10815)
2020-01-13Better documentation of -www,-WWW,-HTTP flagsRich Salz
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10134)
2020-01-13Refactor the tls/dlts version optionsRich Salz
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10134)
2020-01-13handle new findings of find-doc-nits on fn typedefs w/ extra spaceDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10673)
2020-01-13handle new findings of find-doc-nits for certain typedefsDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10673)
2020-01-12Deprecate the low level MDC2 functions.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10790)
2020-01-12Deprecate the low level MD4 functions.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10790)
2020-01-12Deprecate the low level MD2 functions.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10790)
2020-01-12Deprecate the low level RIPEMD160 functions.Pauli
Use of the low level RIPEMD160 functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use the EVP APIs, e.g. EVP_Digest, EVP_DigestInit_ex, EVP_DigestUpdate and EVP_DigestFinal_ex. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10789)
2020-01-12Add dsa signature alg to fips providerShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10615)
2020-01-10Add GCM support for EVP_CTRL_GCM_IV_GEN and EVP_CTRL_GCM_SET_IV_INV to providersShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10173)
2020-01-09EVP: Adapt KEYEXCH, SIGNATURE and ASYM_CIPHER to handle key types betterRichard Levitte
The adaptation is to handle the case when key types and operations that use these keys have different names. For example, EC keys can be used for ECDSA and ECDH. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10647)
2020-01-09CORE & EVP: Specify OP_query_operation_name() for KEYMGMTRichard Levitte
This will allow keymgmt implementation for key types that need it to specify the names of the diverse operation algorithms it can be used with. Currently, only one name per key type and operation is allowed. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10647)
2020-01-09DOCS: The interpretation of OPENSSL_API_COMPAT has changed, update docsRichard Levitte
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/10765)
2020-01-08Deprecate Low Level Blowfish APIsMatt Caswell
Applications should instead use the higher level EVP APIs, e.g. EVP_Encrypt*() and EVP_Decrypt*(). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10740)
2020-01-07Refactor -engine documentationRich Salz
Common wording courtesy Richard Levitte. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10128)
2020-01-07Fix KMAC docsShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9970)
2020-01-06Add `-passin` arg to `ocsp`kaysond
Fix #10682 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10718)
2020-01-06Move -nameopt to openssl.podRich Salz
Also clarify the description of the options. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10259)
2020-01-06Add AES_CBC_HMAC_SHA ciphers to providers.Shane Lontis
Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-02Add -iter option to pkcs12 commandIbrahim M. Ghazal
Fixes #8194 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10130)
2019-12-21Rename doc/man7/provider-asymcipher.podRichard Levitte
The correct name is doc/man7/provider-asym_cipher.pod, to match the name in the NAME section. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10621)
2019-12-21doc/man1/openssl-cmds.pod: Add invisble name 'openssl-cmds'Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10621)
2019-12-19Fix regression on x509 keyform argumentJussi Keranen
In OpenSSL pre 1.1.0, 'openssl x509 -keyform engine' was possible and supported. In 1.1.0, type of keyform argument is OPT_FMT_PEMDER which doesn't support engine. This changes type of keyform argument to OPT_FMT_PDE which means PEM, DER or engine and updates the manpage including keyform and CAkeyform. This restores the pre 1.1.0 behavior. This issue is very similar than https://github.com/openssl/openssl/issues/4366 CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10609)
2019-12-19Use a function to generate do-not-edit commentRich Salz
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10316)
2019-12-18BIO: Add BIO_f_prefix(), a text line prefixing filterRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10531)
2019-12-16Update the HISTORY entry for RSA_get0_pss_params()Matt Caswell
Make a note of when this function was first introduced Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10568) (cherry picked from commit e2af84bd45c017c0c6a0fa06ee5d7fcf11d7366d)
2019-12-14Deprecate most of debug-memoryRich Salz
Fixes #8322 The leak-checking (and backtrace option, on some platforms) provided by crypto-mdebug and crypto-mdebug-backtrace have been mostly neutered; only the "make malloc fail" capability remains. OpenSSL recommends using the compiler's leak-detection instead. The OPENSSL_DEBUG_MEMORY environment variable is no longer used. CRYPTO_mem_ctrl(), CRYPTO_set_mem_debug(), CRYPTO_mem_leaks(), CRYPTO_mem_leaks_fp() and CRYPTO_mem_leaks_cb() return a failure code. CRYPTO_mem_debug_{malloc,realloc,free}() have been removed. All of the above are now deprecated. Merge (now really small) mem_dbg.c into mem.c Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10572)
2019-12-12Various missing-link fixesRich Salz
Also, turn missing L<foo(3)> into foo(3) Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10104)
2019-12-12chunk 6 of CMP contribution to OpenSSLDr. David von Oheimb
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10297)
2019-12-11Fix docs for CRYPTO_secure_allocatedRich Salz
Fixes #9300 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10523)
2019-12-11Fix some typosVeres Lajos
Reported-by: misspell-fixer <https://github.com/vlajos/misspell-fixer> CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10544)
2019-12-08Difference between EVP_CipherInit and EVP_CipherInit_exDmitry Belyavskiy
Fixes #10455 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10550)
2019-12-05Add documentation for the newly added RSA_PKCS1_WITH_TLS_PADDINGMatt Caswell
Documentation for RSA_PKCS1_WITH_TLS_PADDING padding mode as per the previous commits, as well as the associated parameters for this mode. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10411)
2019-12-04add X509_cmp_timeframe() including its documentationDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10502)
2019-11-29PROV SERIALIZER: add support for writing RSA keysRichard Levitte
This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV SERIALIZER: add common functionality to serialize keysRichard Levitte
To support generic output of public keys wrapped in a X509_PUBKEY, additional PEM and i2d/d2i routines are added for that type. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29PROV BIO: add a BIO_vprintf() upcall, and a provider BIO libraryRichard Levitte
The BIO_vprintf() will allow the provider to print any text, given a BIO supplied by libcrypto. Additionally, we add a provider library with functions to collect all the currently supplied BIO upcalls, as well as wrappers around those upcalls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: add support for serializing EVP_PKEYsRichard Levitte
The following public functions is added: - OSSL_SERIALIZER_CTX_new_by_EVP_PKEY() - OSSL_SERIALIZER_CTX_set_cipher() - OSSL_SERIALIZER_CTX_set_passphrase() - OSSL_SERIALIZER_CTX_set_passphrase_cb() - OSSL_SERIALIZER_CTX_set_passphrase_ui() OSSL_SERIALIZER_CTX_new_by_EVP_PKEY() selects a suitable serializer for the given EVP_PKEY, and sets up the OSSL_SERIALIZER_CTX to function together with OSSL_SERIALIZER_to_bio() and OSSL_SERIALIZER_to_fp(). OSSL_SERIALIZER_CTX_set_cipher() indicates what cipher should be used to produce an encrypted serialization of the EVP_PKEY. This is passed directly to the provider using OSSL_SERIALIZER_CTX_set_params(). OSSL_SERIALIZER_CTX_set_passphrase() can be used to set a pass phrase to be used for the encryption. This is passed directly to the provider using OSSL_SERIALIZER_CTX_set_params(). OSSL_SERIALIZER_CTX_set_passphrase_cb() and OSSL_SERIALIZER_CTX_set_passphrase_ui() sets up a callback to be used to prompt for a passphrase. This is stored in the context, and is called via an internal intermediary at the time of serialization. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: add functions for serialization to fileRichard Levitte
These functions are added: - OSSL_SERIALIZER_to_bio() - OSSL_SERIALIZER_to_fp() (unless 'no-stdio') OSSL_SERIALIZER_to_bio() and OSSL_SERIALIZER_to_fp() work as wrapper functions, and call an internal "do_output" function with the given serializer context and a BIO to output the serialized result to. The internal "do_output" function must have intimate knowledge of the object being output. This will defined independently with context creators for specific OpenSSL types. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29SERIALIZER: New API for serialization of objects through providersRichard Levitte
Serialization is needed to be able to take a provider object (such as the provider side key data) and output it in PEM form, DER form, text form (for display), and possibly other future forms (XML? JSON? JWK?) The idea is that a serializer should be able to handle objects it has intimate knowledge of, as well as object data in OSSL_PARAM form. The latter will allow libcrypto to serialize some object with a different provider than the one holding the data, if exporting of that data is allowed and there is a serializer that can handle it. We will provide serializers for the types of objects we know about, which should be useful together with any other provider that provides implementations of the same type of object. Serializers are selected by method name and a couple of additional properties: - format used to tell what format the output should be in. Possibilities could include "format=text", "format=pem", "format=der", "format=pem-pkcs1" (traditional), "format=der-pkcs1" (traditional) - type used to tell exactly what type of data should be output, for example "type=public" (the public part of a key), "type=private" (the private part of a key), "type=domainparams" (domain parameters). This also adds a passphrase callback function type, OSSL_PASSPHRASE_CALLBACK, which is a bit like OSSL_CALLBACK, but it takes a few extra arguments to place the result in. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29CORE: ossl_namemap_add_names(): new function to add multiple namesRichard Levitte
This was originally the private add_names_to_namemap() in crypto/evp/evp_fetch.c, but made more generally useful. To make for more consistent function naming, ossl_namemap_add() and ossl_namemap_add_n() are renamed to ossl_namemap_add_name() and ossl_namemap_add_name_n(). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-29Disable mem leak checking for the self test lockMatt Caswell
The fips self test lock is deallocated in platform specific ways that may occur after we do mem leak checking. If we don't know how to free it for a particular platform then we just leak it deliberately. So we temporarily disable the mem leak checking while we allocate the lock. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9939)
2019-11-29Add doc/build.info to build the documentationRichard Levitte
This build.info is entirely generated when configuring Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6236)
2019-11-28Fix L<EVP_MD_CTX_set_pkey_ctx> linksmoehuster
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10420) (cherry picked from commit ca7c982821cd6d7546f92623da61a6f43ee32d0a)
2019-11-28Use option/parameter consistently.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10135)
2019-11-28Document more env var stuff, fix some typo'sRich Salz
Add openssl-env.pod Also fix up many other environment page formatting nits. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10135)
2019-11-27doc/man7/proxy-certificates.pod: New guide for proxy certificatesRichard Levitte
This replaces doc/HOWTO/proxy_certificates.txt Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10507)
2019-11-24Remove RANDFILE settings from configuration filesDr. Matthias St. Pierre
OpenSSL 1.1.1 introduced a new CSPRNG with an improved seeding mechanism, which makes it dispensable to define a RANDFILE for saving and restoring randomness. This commit removes the RANDFILE declarations from our own configuration files and adds documentation that this option is not needed anymore and retained mainly for compatibility reasons. Fixes #10433 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10436)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-28 18:35:19 +0000