A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=master 2026-04-03T14:16:38+00:00 2026-04-03T14:16:38+00:00 jsing 2026-04-03T14:16:38+00:00 urn:sha1:83af2b7df80e8a0adb0622cd22bb59b2f6484960 This is all unhelpful historical cruft. Discussed with tb@ 2026-04-03T13:11:00+00:00 jsing 2026-04-03T13:11:00+00:00 urn:sha1:9726691a1e7289634e04b2e44da815e69091af49 We no longer support TLSv1.0 and definitely do not support SSLv3 - remove the empty fragments workaround for the CBC vulnerability in these protocols. ok kenjiro@ tb@ 2026-04-03T12:58:19+00:00 jsing 2026-04-03T12:58:19+00:00 urn:sha1:42d1ecbb4220b6260fa2da63402ec3f5cbad849a TLS versions prior to TLSv1.2 were disabled a while ago, however this was done in the version handling code. Remove TLSv1.1 and earlier from ssl_get_method() and add an explicit min version check in the legacy client and server, to provide a stronger guarantee. ok kenjiro@ tb@ 2026-04-03T07:26:20+00:00 jsing 2026-04-03T07:26:20+00:00 urn:sha1:ba2c2f6b31a0d325528b48899a6a12f650464c2f This has not been reachable since we made the TLSv1.3 stack the default entry point - tls13_record_layer_read_record() will send a protocol version alert and raise an error, which means we never transition into the legacy stack. ok kenjiro@ 2026-04-03T07:17:36+00:00 jsing 2026-04-03T07:17:36+00:00 urn:sha1:34c9ebaffbf06ba9d8883c4adf8061fd670f54c4 This is a left over from when we accepted SSLv2 ClientHello messages. ok kenjiro@ 2026-03-30T06:20:08+00:00 tb 2026-03-30T06:20:08+00:00 urn:sha1:22f6fa080aa393c2a6455f88e99334d5b461444b Announce the signature schemes for RSASSA-PSS with pubkey OID RSASSA-PSS between RSASSA-PSS with pubkey OID rsaEncryption and RSASSA-PKCS1-v1_5. This is the last step in the everlasting saga for making these signature schemes and certificates with RSASSA-PSS OID work. Fortunately, these are rarely used since they are extremely complex and inefficient also due to the large size of the parameters. This addresses bug reports by Steffen Ullrich and Tom Lane. Tested by bluhm. ok djm jsing kenjiro 2026-03-30T06:02:21+00:00 tb 2026-03-30T06:02:21+00:00 urn:sha1:2cce484ddc397481c8dab3c2e72dc77bbefcfddb This fixes a long-standing logic error that hasn't been noticed because we never announced the rsa_pss_pss_sha{256,384,512} SignatureScheme. The EVP_PKEY_id() of a RSA-PSS pubkey is EVP_PKEY_RSA_PSS, not EVP_PKEY_RSA. Thanks to beck for helping me figure out how to fix this correctly. It drove me nuts for a very long time. Problem also noticed by Tom Lane due to some PostgreSQL regress failures. ok djm jsing kenjiro 2026-03-30T05:49:31+00:00 tb 2026-03-30T05:49:31+00:00 urn:sha1:981fa719b7606cbf7df120993df445357b9b2df7 2026-01-01T12:47:52+00:00 tb 2026-01-01T12:47:52+00:00 urn:sha1:10bebbca92ef87af97bc15c6337afbbe050bb96e RANK768 and RANK1024 are awfully short and generic names for public constants. Before we make it worse with similarly named constants for ML-DSA, let's fix this. This follows the naming convention used by the other macros in the mlkem code. ok kenjiro jsing 2025-12-04T21:16:17+00:00 beck 2025-12-04T21:16:17+00:00 urn:sha1:dccd1f43a0c2de3852d9515f57353d756629c97a This does the following: 1) Adds a second key share prediction to the TLS 1.3 handshake. We only add one as we are unlikely to want to send more than one PQ one, and one classical one and are unlikely to waste bytes on a second PQ algorithm (anything that wants something else that we support can HRR to get it) 2) Adds X25519MLKEM768 (4588) to our list of supported groups. We add this to our preferred client and server key shares for TLS 1.3 and we now have a separate list for TLS 1.2 which does not do this, cleaning up the old "full list" from the comments. 3) Updates the golden magic numbers in the regression tests to allow for the above two things changing the handshake, so the regress tests pass. With this you can successfully hybrid PQ with servers and clients that support it. ok tb@ kenjiro@