openbsd/src/lib/libcrypto/evp/evp.h, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2025-07-02T06:36:52+00:00Const correct EVP_PKEY_get{0,1}_{DH,DSA,EC_KEY,RSA}()2025-07-02T06:36:52+00:00tb2025-07-02T06:36:52+00:00urn:sha1:ee8028bd119b3e4cd917dc91bde28658b6256b9f
These are safe to call concurrently and they don't modify the memory
region pointed to by the pkey - they only bump the refcount of the
key hanging off of it. The returned "legacy" key has to be handled with
care in threaded constexts, so it is handed back as non-const. This also
matches what EVP_PKEY_get0() always had.
This way our signature is identical to BoringSSL's and doesn't cause
compiler warnings in code that overuses const because one of the many
API incoherencies added by OpenSSL 3 was to turn get0 into a function
that takes and returns const while leaving get1 as it was.
dlg agrees
ok kenjiro
Nuke the whrlpool (named after the galaxy) from orbit2024-08-31T10:38:49+00:00tb2024-08-31T10:38:49+00:00urn:sha1:74a335fca70cbc1c69a8939c41ad12d0a6414a99
It's just gross. Only used by a popular disk encryption utility on an
all-too-popular OS one or two decades back.
ok beck jsing
Remove EVP_PKEY_*check again2024-08-31T09:14:21+00:00tb2024-08-31T09:14:21+00:00urn:sha1:4d0ecb9ca6915541794e3cc736907b89e9a1dd6c
This API turned out to be a really bad idea. OpenSSL 3 extended it, with
the result that basically every key type had its own DoS issues fixed in
a recent security release. We eschewed these by having some upper bounds
that kick in when keys get insanely large.
Initially added on tobhe's request who fortunately never used it in iked,
this was picked up only by ruby/openssl (one of the rare projects doing
proper configure checks rather than branching on VERSION defines) and of
course xca, since it uses everything it can. So it was easy to get rid of
this again.
ok beck jsing
Add EVP_PKEY_TLS1_PRF as alias for NID_tls1_prf2024-07-09T16:15:37+00:00tb2024-07-09T16:15:37+00:00urn:sha1:75546869497f7c0b969d06d1b13812a57f0ecc8d
ok jsing
Delete a few more GOST remnants2024-04-14T14:14:14+00:00tb2024-04-14T14:14:14+00:00urn:sha1:ba8aabd35ad495048ba4bbac4b9eb5123d8ccc40
When I unifdefed GOST support, the tree wasn't fully unlocked, so I didn't
want to touch a public header. All this code is in #ifndef OPENSSL_NO_GOST,
which we define.
ok jsing
Hide deprecated functions in evp.h2024-04-10T15:00:38+00:00beck2024-04-10T15:00:38+00:00urn:sha1:20ec75270d82cdbe18bc78b00516a72ae16b122e
use LCRYPTO_UNUSED and remove the LIBRESSL_INTERNAL guard around them.
ok tb@
Garbage collect CUSTOM_KEY_LENGTH/SET_KEY_LENGTH2024-03-02T10:21:12+00:00tb2024-03-02T10:21:12+00:00urn:sha1:474387b306decca4ad18d10dde947d4e106601e7
These are unused defines that used to add unwanted complications in
EVP_CIPHER_CTX_set_key_lenght().
ok jsing
Remove more PBE stuff from the public API2024-03-02T10:20:27+00:00tb2024-03-02T10:20:27+00:00urn:sha1:207b3a197be2d83ff1333f7fa2dccd6d5271b120
This is still needed internally for CMS and its predecessors. This
removal will enable disentangling some of its innards.
ok jsing
Remove RC4-HMAC-MD5 and AES-{128,256}-CBC-HMAC-SHA-12024-03-02T10:13:13+00:00tb2024-03-02T10:13:13+00:00urn:sha1:feacafd961cf1e2403e9dcb6c3f6a0722730e87d
"Stitched" mode AEADs were removed from libssl a long time ago. Nothing
uses these CIPHERs anymore.
ok jsing
Make legacy cipher methods internal2024-03-02T10:08:29+00:00tb2024-03-02T10:08:29+00:00urn:sha1:6952f7a4dea03a42ca5c0da4f3344dd7ddaf041e
These are ASN.1 handlers for CIPHERs, still used by CMS and its
predecessors. They should never have been public.
ok jsing