GitHub/openssl
1
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-06-06 20:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
38,536 Commits 39 Branches 433 Tags
feature/engineremoval
Commit Graph
243 Commits
Author SHA1 Message Date
Daniel Van Geest d0899abb1b Implement KEMRecipientInfo (RFC9629) in CMS 
Also add support for ML-KEM in CMS (draft-ietf-lamps-cms-kyber).

Add the -recip_kdf and -recip_ukm parameters to `openssl cms -encrypt`
to allow the user to specify the KDF algorithm and optional user
keying material for each recipient.

A provider may indicate which RecipientInfo type is supported
for a key, otherwise CMS will try to figure it out itself. A
provider may also indicate which KDF to use in KEMRecipientInfo
if the user hasn't specified one.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27681)
 2025-07-30 11:39:04 +02:00
Daniel Van Geest d1a8d5a833 Add HKDF algorithms with fixed digests. 
Add HKDF-SHA256, HKDF-SHA384 and HKDF-SHA512 which are versions
of HKDF that have the digest pre-set. The digest cannot be changed
for contexts of these types.

RFC 8619 defines algorithm identifiers for these combinations.
These algorithm identifiers will be used in future features, e.g.
KEMRecipientInfo.

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/27247)
 2025-07-10 11:13:21 +10:00
fangming.fang 24f32f14e9 Implement AES-CBC-HMAC-SHA512 on aarch64 
This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha512 on
aarch64, aes-cbc and hmac-sha512 are interleaved to achieve better
performance.It only supports non-padding mode that means the length of
input data should be multiple of 16 bytes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/22949)
 2025-04-14 14:53:30 +01:00
fangming.fang 86408fa8de Implement interleaving aes-cbc-hmac-sha on aarch64 
This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha1/256,
aes-cbc and hmac-sha1/256 are interleaved to achieve better performance.
It only supports non-padding mode that means the length of input data
should be multiple of 16 bytes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/22949)
 2025-04-14 14:53:30 +01:00
Viktor Dukhovni b049ce0e35 Tweak case of [fs] variant letter in SLH-DSA algorithms 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26359)
 2025-01-11 14:39:03 +11:00
Viktor Dukhovni d31fce1972 Some PQ-related CSOR OIDs 
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26321)
 2025-01-07 23:01:44 +11:00
Jonathan M. Wilbur 9183306815 feat: add TCG / platform certificate OIDs 
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25312)
 2024-09-05 17:22:40 +02:00
Jonathan M. Wilbur 91432b9ea0 fix: alias auditEntity OID 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:38:44 +01:00
Jonathan M. Wilbur 9216859f7b feat: support auditIdentity X.509v3 extension 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:38:44 +01:00
Jonathan M. Wilbur bce3a8d57e fix: wrong name for OID -> auditIdentity 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24754)
 2024-08-26 10:25:23 +01:00
Mathis Marion 387491d537 Add OIDs id-kp-wisun-fan-device and id-on-hardwareModule 
Sub-OIDs for {iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) 45605} are recorded in the document "Wi-SUN
Assigned Value Registry" (WAVR).

OID id-on-hardwareModule is defined in RFC 4108.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23428)
 2024-08-07 19:53:19 +02:00
Job Snijders c5e097dec5 Add Content Type OID for id-ct-rpkiSignedPrefixList 
References: draft-ietf-sidrops-rpki-prefixlist
Title: "A profile for Signed Prefix Lists for Use in the Resource Public Key Infrastructure (RPKI)"

OID assigned under 'SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)'
https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23426)
 2024-03-15 09:10:22 +01:00
Jonathan M. Wilbur bac2f6db06 feat: add missing pki / pmi object identifiers 
Signed-off-by: Jonathan M. Wilbur <jonathan@wilbur.space>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21232)
 2023-06-29 09:29:56 +10:00
Dragan Zuvic f3afe15fb7 Adding some selected MS OIDs for #19630 added ms-corp alias for OID 1.3.6.1.4.1.311 
and changed hopefully all occurences for that OID

Signed-off-by: Dragan Zuvic <dragan.zuvic@mercedes-benz.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20986)
 2023-05-22 07:43:00 +01:00
Xu Yizhou de8f6a3e29 obj: Add SM4 XTS OID 
Add the following OID:

SM4-XTS: 1.2.156.10197.1.104.10

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19619)
 2022-11-29 16:17:30 +01:00
Todd Short caf9317d7d Add ZSTD compression support (RFC8478bis) 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18186)
 2022-10-18 09:30:21 -04:00
Todd Short 12e96a2360 Add brotli compression support (RFC7924) 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18186)
 2022-10-18 09:30:18 -04:00
Matt Caswell c9ee6e3646 Reimplement brainpool TLSv1.3 support group support 
Create new TLS_GROUP_ENTRY values for these groups.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19315)
 2022-10-07 10:01:48 +01:00
Job Snijders fcae2ae4f6 Add Content Type OID for RPKI id-ct-signedTAL 
References: draft-ietf-sidrops-signed-tal
Title: "RPKI Signed Object for Trust Anchor Key"

OID permanently assigned under 'SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)'
https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1

CLA: trivial

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19221)
 2022-10-03 11:49:04 +11:00
Graham Woodward e869c867c1 Allow PKCS12 export to set arbitrary bag attributes 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19025)
 2022-09-23 17:40:02 +01:00
K1 48963ff6d0 Add support for PBE using hmacWithSM3 
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19204)
 2022-09-15 17:03:56 +02:00
Lutz Jaenicke 5f7d4e9111 Objects: Add OIDs needed for CAdES-Processing 
Add objects from ETSI-specification(s) used in CAdES processing.
Main document referenced is ETSI EN 319 122-1 V1.2.1.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18655)
 2022-06-28 17:12:06 +02:00
Dr. David von Oheimb 34959f7a22 objects.txt: Add newly registered OIDs according to CMP Updates, for use in extended CMPv2 
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/15778)
 2022-05-04 13:23:31 +02:00
Dr. David von Oheimb 0088ef48c3 Update troublesome copyright years of auto-generated files to 2022 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17398)
 2022-01-03 13:41:16 +01:00
Job Snijders b0c1214e1e Add OID for RPKI id-ct-ASPA 
References: draft-ietf-sidrops-aspa-profile
"A Profile for Autonomous System Provider Authorization" (ASPA)

OID permanently assigned under 'SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)'
https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17002)
 2021-11-11 13:02:29 +01:00
Tianjia Zhang a596d38a8c obj: Add SM4 GCM/CCM OID 
Add the following OID:

  SM4-GCM: 1.2.156.10197.1.104.8
  SM4-CCM: 1.2.156.10197.1.104.9

Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16731)
 2021-10-05 12:47:37 +02:00
Job Snijders 7303c58217 Add OID for RPKI id-ct-signedChecklist 
References: draft-ietf-sidrops-rpki-rsc - Resource Public Key Infrastructure
(RPKI) object profile for Signed Checklist (RSC)

OID listed under 'SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)'
https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#security-smime-1

CLA: Trivial

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15207)
 2021-05-12 15:06:22 +10:00
Job Snijders f2d785364c Add OID for draft-ietf-opsawg-finding-geofeeds detached CMS signature 
RFC 8805 Geofeed files can be authenticated with RPKI

CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14050)
 2021-02-12 12:34:19 +10:00
Job Snijders d3372c2f35 Add some PKIX-RPKI objects 
References:

RFC6482 - A Profile for Route Origin Authorizations (ROAs)
RFC6484 - Certificate Policy (CP) for the RPKI
RFC6493 - The RPKI Ghostbusters Record
RFC8182 - The RPKI Repository Delta Protocol (RRDP)
RFC8360 - RPKI Validation Reconsidered
draft-ietf-sidrops-rpki-rta - A profile for RTAs

CLA: trivial

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/13948)
 2021-02-02 10:32:27 +01:00
Dr. David von Oheimb 38b57c4c52 Update copyright years of auto-generated headers (make update) 
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/13764)
 2021-01-04 07:15:24 +01:00
Dmitry Belyavskiy 856198aac7 Some OIDs used in Russian X.509 certificates. 
OBJ_OGRNIP denotes a specific legal status of the certificate owner.
OBJ_classSignTool* denotes a level of certification of the software
created the certificate.

http://www.garant.ru/products/ipo/prime/doc/70033464/ is the relevant
link (in Russian).

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8309)
 2020-10-05 12:14:17 +03:00
Dr. David von Oheimb 15633d74dc Add 4 new OIDs for PKIX key purposes and 3 new CMP information types 
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12807)
 2020-09-08 23:22:29 +02:00
Dmitry Belyavskiy 0e139a02d5 GOST-related objects changes 
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11442)
 2020-05-19 13:02:43 +03:00
Dmitry Belyavskiy ad16671d49 GOST cipher names adjustment 
The erroneously introduced names grasshopper-* replaced with
kuznyechik-* according to official algorithm name translation.

Too long symbolic names replaced with human-enterable ones.

Also the mechanism of deprecating names in objects.txt is implemented

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/11440)
 2020-04-17 16:21:51 +03:00
Shane Lontis ca2bf555cd Add support for DH 'modp' group parameters (RFC 3526) 
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10897)
 2020-01-31 08:18:46 +10:00
Matt Caswell e7b834b6bb Run make update 
The New Year has caused various files to appear out of date to "make
update". This causes Travis to fail. Therefore we update those file.

Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
(Merged from https://github.com/openssl/openssl/pull/10738)
 2020-01-02 14:39:34 +00:00
Jan-Frederik Rieckers f5e77bb0fa Add support for otherName:NAIRealm in output 
This commit adds support for displaying RFC 7585 otherName:NAIRealm in
the text output of openssl

CLA: trivial

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/10594)
 2019-12-11 22:29:19 +03:00
Michael Osipov 648b53b88e Fix long name of some Microsoft objects 
CLA: trivial

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10029)
 2019-10-03 08:24:38 +10:00
Dmitry Belyavskiy 4baee2d72e Support printing out some otherName variants 
The supported variants are
- SmtpUTF8Name
- xmppAddr
- MS UPN
- SRVName

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9965)
 2019-09-24 10:27:09 +03:00
Shane Lontis 1aec7716c1 Add X9.42 KDF. 
Move the KDF code for CMS DH key agreement into an EVP_KDF object.
There are 2 specifications for X9.42 KDF. This implementation uses DER for
otherinfo which embeds the KDF loop counter inside the DER object.

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8898)
 2019-07-09 09:33:18 +10:00
Pauli 3f1679b261 Add OIDs for kmac128, kmac256 and blake2. 
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9277)
 2019-07-01 17:41:31 +10:00
voev 53bfacf220 Fix GOST OID 
CLA: trivial

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/8979)
 2019-05-22 19:41:09 +03:00
Shane Lontis 8bbeaaa4fc Added X963KDF API 
X963 KDF is used for CMS ec keyagree Recipient Info.
The X963 KDF that is used by CMS EC Key Agreement has been moved
into a EVP_KDF object. This KDF is almost identical to the the SSKDF
hash variant, so it has been implemented inside the SSKDF code with
its own method table.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8902)
 2019-05-16 11:43:41 +10:00
Shane Lontis 9537fe5757 Single step kdf implementation 
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8230)
 2019-03-19 11:03:45 +00:00
杨洋 8267becb8b Support SM2 certificate verification 
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8321)
 2019-03-13 15:29:39 +08:00
Simo Sorce 8d76481b18 Implement SSH KDF 
SSH's KDF is defined in RFC 4253 in Section 7.2

Signed-off-by: Simo Sorce <simo@redhat.com>

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7290)
 2019-02-27 11:02:54 +00:00
Antoine Salon d1ad7c834e blake2: register MAC objects 
Signed-off-by: Antoine Salon <asalon@vmware.com>

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7726)
 2019-02-06 09:18:43 +00:00
Matt Caswell 51adf14a94 make update 
Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
(Merged from https://github.com/openssl/openssl/pull/7972)
 2019-01-03 09:21:39 +00:00
Todd Short b1ceb439f2 Add RFC5297 AES-SIV support 
Based originally on github.com/dfoxfranke/libaes_siv

This creates an SIV128 mode that uses EVP interfaces for the CBC, CTR
and CMAC code to reduce complexity at the cost of perfomance. The
expected use is for short inputs, not TLS-sized records.

Add multiple AAD input capacity in the EVP tests.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3540)
 2018-12-12 08:16:10 +10:00
Richard Levitte 3f870de74e Following the license change, modify the boilerplates in crypto/objects/ 
[skip ci]

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/7804)
 2018-12-06 15:07:30 +01:00