openbsd/src/regress/lib/libssl/client, branch masterA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=master2026-03-30T06:23:33+00:00libssl regress: adjust golden numbers for RSASSA-PSS2026-03-30T06:23:33+00:00tb2026-03-30T06:23:33+00:00urn:sha1:ccb38f6d4da1788074ffa4e9a4a99bc33073b703
Add the three RSASSA-PSS SignatureScheme 0x080b, 0x080a, 0x0809 in the
appropriate spots in (components of) the ClientHello and adjust various
length octets by adding 6.
Hook up X25519MKLEM768 to the TLS 1.3 handshake2025-12-04T21:16:17+00:00beck2025-12-04T21:16:17+00:00urn:sha1:dccd1f43a0c2de3852d9515f57353d756629c97a
This does the following:
1) Adds a second key share prediction to the TLS 1.3 handshake.
We only add one as we are unlikely to want to send more than
one PQ one, and one classical one and are unlikely to waste
bytes on a second PQ algorithm (anything that wants something
else that we support can HRR to get it)
2) Adds X25519MLKEM768 (4588) to our list of supported groups.
We add this to our preferred client and server key shares for TLS 1.3
and we now have a separate list for TLS 1.2 which does not do this,
cleaning up the old "full list" from the comments.
3) Updates the golden magic numbers in the regression tests to allow
for the above two things changing the handshake, so the regress
tests pass.
With this you can successfully hybrid PQ with servers and clients
that support it.
ok tb@ kenjiro@
Update for OPENSSL_cpu_caps() now being machine independent.2024-08-31T12:47:24+00:00jsing2024-08-31T12:47:24+00:00urn:sha1:bbff3f79e48b648b440e142bdf24e3eb6c6fe707Fix golden numbers after beck broke it months ago2024-07-20T18:37:38+00:00tb2024-07-20T18:37:38+00:00urn:sha1:aea3f73bd1458959d7328e6b91a2072e4e5f728d
(why is it always me who gets to clean up this shit?)
Instead of unhooking libssl/client regress tests, flag them as expected2024-04-22T07:31:54+00:00anton2024-04-22T07:31:54+00:00urn:sha1:b022ada74a226956fba793f2b4c2508e40c1707a
to fail.
ok tb@
Remove GOST and STREEBOG support from libssl.2024-02-03T15:58:34+00:00beck2024-02-03T15:58:34+00:00urn:sha1:20afa90e552d2efed2187dbafc92170a3895e921
This version of GOST is old and not anywhere close to compliant with
modern GOST standards. It is also very intrusive in libssl and
makes a mess everywhere. Efforts to entice a suitably minded anyone
to care about it have been unsuccessful.
At this point it is probably best to remove this, and if someone
ever showed up who truly needed a working version, it should be
a clean implementation from scratch, and have it use something
closer to the typical API in libcrypto so it would integrate less
painfully here.
This removes it from libssl in preparation for it's removal from
libcrypto with a future major bump
ok tb@
Fix last bit of the clienttest, needs ssl_pkt.c r1.662023-07-11T17:03:44+00:00tb2023-07-11T17:03:44+00:00urn:sha1:5b8e6e5418571fde05d7861d782a926b9a9e8311Fix most of the clienttest. With this only test cases 9 and 13 fail.2023-07-11T08:31:34+00:00tb2023-07-11T08:31:34+00:00urn:sha1:6b1a3304b9d77657f2e58bb165918cbf8b58891aFix the client test and the tlsext test to work with randomized2023-04-23T18:59:41+00:00tb2023-04-23T18:59:41+00:00urn:sha1:13ba643374d5ff84130d05ec7c88f7fd1e4c2308
TLS extensions (this involves unrandomizing the extension order
for the tests that rely on golden numbers.
zap trailing spaces2022-07-19T20:16:50+00:00tb2022-07-19T20:16:50+00:00urn:sha1:b68c1b66ce1a23d3f4dd1761befc74edf6f1e1f1