openbsd/src/usr.bin/openssl/pkcs8.c, branch OPENBSD_7_9 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2025-05-24T02:35:25+00:00 Switch default to PBES2 for openssl pkcs8 -topk8 2025-05-24T02:35:25+00:00 tb 2025-05-24T02:35:25+00:00 urn:sha1:106520eba95dd427fceddb90d7aade730c8b0d41 We currently use the glorious default of NID_pbeWithMD5AndDES_CBC which we inherited from OpenSSL. This could have been worse - there is also NID_pbeWithMD2AndDES_CBC... The way this diff works is that the undocumented PKCS8_encrypt() API uses the PKCS#5v2 code path when it's passed a NID of -1 and requires a cipher to succeed, otherwise it uses the PKCS#5v1.5 path. So pass in a sensible cipher, namely AES-CBC-256, and let layers of muppetry cascade to doing something resembling the right thing. This still uses the default of hmacWithSHA1 and a somewhat short salt, which will be improved in a subsequent commit. https://github.com/pyca/cryptography/issues/12949 https://github.com/libressl/portable/issues/1168 ok kenjiro joshua jsing openssl(1) doesn't need 6 .h files: fold progs.h into apps.h 2025-01-02T12:31:44+00:00 tb 2025-01-02T12:31:44+00:00 urn:sha1:8d0fcc0d460d9b0c35764534bef3e0d86dc8aab8 discussed with jsing sprinkle some void between () in function definitions 2023-07-23T11:39:29+00:00 tb 2023-07-23T11:39:29+00:00 urn:sha1:eabdbbf5a1b843359b80819568f27211a761880a Rename struct ${app}_config to plain cfg 2023-03-06T14:32:06+00:00 tb 2023-03-06T14:32:06+00:00 urn:sha1:2ba7dcfcbc2ef5aaeb8eb14f36f83bd57c22bcae All the structs are static and we need to reach into them many times. Having a shorter name is more concise and results in less visual clutter. It also avoids many overlong lines and we will be able to get rid of some unfortunate line wrapping down the road. Discussed with jsing Remove the legacy interactive mode from openssl(1). 2022-11-11T17:07:39+00:00 joshua 2022-11-11T17:07:39+00:00 urn:sha1:273d9e16fc9e481283c2b2302b348e4863e29f28 This removes the legacy interactive mode from openssl(1) since it is rarely used, complicates the code, and has also been removed from OpenSSL in version 3.x.x. ok tb@ jsing@ Mark the initialized struct options arrays as both static and const. 2019-07-14T03:30:46+00:00 guenther 2019-07-14T03:30:46+00:00 urn:sha1:ce9daaa0080f6ec467441aa485eb3f11ad6fb74a This moves them from .data to .data.rel.ro ok deraadt@ inoguchi@ update usage for pkcs8; 2018-08-24T22:56:45+00:00 jmc 2018-08-24T22:56:45+00:00 urn:sha1:b018265c126888b282ba3172d0ccc97fd5d2982c ok tb Stop handling broken PKCS#8 formats in openssl(1). 2018-08-24T20:09:56+00:00 tb 2018-08-24T20:09:56+00:00 urn:sha1:bdb1dca4a856ef4fffb5cd6d706b8ab7ed1502a6 ok jsing Indent labels with a single space so that diff prototypes are more useful. 2018-02-07T05:47:55+00:00 jsing 2018-02-07T05:47:55+00:00 urn:sha1:6d829832b5c1cafa0527a7c2595749b17b0b8efe rearrange pledge promises into the canonical order; easier to eyeball 2017-01-20T08:57:12+00:00 deraadt 2017-01-20T08:57:12+00:00 urn:sha1:ff6fa3ffece7ca61b2a5e2a66b4920c710d4e36b