openbsd/src/lib/libcrypto, branch libressl-v3.4.1A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=libressl-v3.4.12021-09-30T18:16:13+00:00This commit was manufactured by cvs2git to create branch 'OPENBSD_7_0'.2021-09-30T18:16:13+00:00cvs2svnadmin@example.com2021-09-30T18:16:13+00:00urn:sha1:d7513e7d4daf94905fd4cb0a5e5c89109d2874f7bump to LibreSSL 3.4.12021-09-15T17:14:26+00:00tb2021-09-15T17:14:26+00:00urn:sha1:87ad048671e38be9ceea42ed9e24726a49a0167bAs suggested by tb@, merge the description of OPENSSL_EC_NAMED_CURVE2021-09-14T13:47:59+00:00schwarze2021-09-14T13:47:59+00:00urn:sha1:8516f8e8e45c406ec2ca34ec57684ee01de472a5
and OPENSSL_EC_EXPLICIT_CURVE
from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000
after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE
in ec/ec_lib.c rev. 1.41,
which is the same default that OpenSSL uses since 1.1.0.
While merging, drop the description of the pre-1.1.0 behaviour.
It seems irrelevant to me because tb@ found no application in Debian
codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default
that was probably never relied upon by anyone does not need to be
documented.
In X509_check_issued() do the same dance around x509v3_cache_extensions()2021-09-13T15:26:53+00:00claudio2021-09-13T15:26:53+00:00urn:sha1:a8af1574ae71c3f2012323155f8e2c784780de4c
as in all other palces. Check the EXFLAG_SET flag first and if not set
grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions().
OK tb@ beck@
Default to using named curve parameter encoding2021-09-12T16:23:19+00:00tb2021-09-12T16:23:19+00:00urn:sha1:10e8e3b7f398be5d656d5725a95663a364220e35
The pre-OpenSSL 1.1.0 default was to use explicit curve parameter
encoding. Most applications want to use named curve parameter encoding
and have to opt into this explicitly.
Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years
ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into
the old default. According to Debian's codesearch, no application
currently does this, which indicates that we currently have a bad default.
In the future it is more likely that applications expect the new
default, so we follow OpenSSL to avoid problems.
Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing.
ok beck inoguchi jsing
Merge documentation of EC_GROUP_order_bits(3) from the OpenSSL 1.1.12021-09-11T17:59:04+00:00schwarze2021-09-11T17:59:04+00:00urn:sha1:6b26e78c6c668c2d81ebf87b49fe16389f658275
branch, which is still under a free license.
While here, also merge a few other improvements, mostly regarding
EC_GROUP_get_order(3) and EC_GROUP_get_cofactor(3); in particular,
some statements below RETURN VALUES were outright wrong.
This patch includes a few minor tweaks and an addition to HISTORY by me.
Feedback and OK tb@.
Add BGPSec Router (RFC 8209) Key Purpose OID2021-09-11T13:31:31+00:00job2021-09-11T13:31:31+00:00urn:sha1:08b230186e0fd125a82664490d49f98aeb69a858
OK tb@
Merge documentation for BN_bn2binpad(3), BN_bn2lebinpad(3),2021-09-11T08:45:47+00:00schwarze2021-09-11T08:45:47+00:00urn:sha1:b0b3e4e847df0c7cb16cc4610638c96e86735cd5
and BN_lebin2bn(3) from the OpenSSL 1.1.1 branch,
which is still under a free license.
While here, tweak a number of details for clarity.
OK tb@
Calling OpenSSL_add_all_digests() is no longer needed since the library2021-09-10T18:58:43+00:00millert2021-09-10T18:58:43+00:00urn:sha1:edb71847e4b064c69f7e2779246ba6107a148526
automatically initializes itself. OK tb@
crank major for libcrypto as well2021-09-10T15:09:40+00:00tb2021-09-10T15:09:40+00:00urn:sha1:e67556b7e7a767eee9960a3f964bb8ef6083c9b3
'may as well' deraadt