summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjmc <>2016-11-24 19:45:16 +0000
committerjmc <>2016-11-24 19:45:16 +0000
commit7202341c67bf9540414b1bb3d732e66d2a7489cf (patch)
tree1958620b54abb40ad02fb7ad32da3b248e0a08e6
parent9b1b99bbcc3876594d79bf14c8388c644db62f91 (diff)
downloadopenbsd-7202341c67bf9540414b1bb3d732e66d2a7489cf.tar.gz
openbsd-7202341c67bf9540414b1bb3d732e66d2a7489cf.tar.bz2
openbsd-7202341c67bf9540414b1bb3d732e66d2a7489cf.zip
various cleanup; leaving dangling PKCS7* Xr for now...
Diffstat
-rw-r--r--src/lib/libcrypto/man/PEM_read_bio_PrivateKey.348
-rw-r--r--src/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.36
-rw-r--r--src/lib/libcrypto/man/PKCS12_create.312
-rw-r--r--src/lib/libcrypto/man/PKCS12_parse.36
-rw-r--r--src/lib/libcrypto/man/PKCS7_decrypt.36
-rw-r--r--src/lib/libcrypto/man/PKCS7_encrypt.312
-rw-r--r--src/lib/libcrypto/man/PKCS7_sign.325
-rw-r--r--src/lib/libcrypto/man/PKCS7_sign_add_signer.316
-rw-r--r--src/lib/libcrypto/man/PKCS7_verify.36
9 files changed, 68 insertions, 69 deletions
diff --git a/src/lib/libcrypto/man/PEM_read_bio_PrivateKey.3 b/src/lib/libcrypto/man/PEM_read_bio_PrivateKey.3
index 8532ef1b27..1ffafd69ed 100644
--- a/src/lib/libcrypto/man/PEM_read_bio_PrivateKey.3
+++ b/src/lib/libcrypto/man/PEM_read_bio_PrivateKey.3
@@ -1,10 +1,9 @@
1.\" $OpenBSD: PEM_read_bio_PrivateKey.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PEM_read_bio_PrivateKey.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PEM_READ_BIO_PRIVATEKEY 3 4.Dt PEM_READ_BIO_PRIVATEKEY 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
7.Nm PEM ,
8.Nm PEM_read_bio_PrivateKey , 7.Nm PEM_read_bio_PrivateKey ,
9.Nm PEM_read_PrivateKey , 8.Nm PEM_read_PrivateKey ,
10.Nm PEM_write_bio_PrivateKey , 9.Nm PEM_write_bio_PrivateKey ,
@@ -516,7 +515,7 @@
516.Fc 515.Fc
517.Sh DESCRIPTION 516.Sh DESCRIPTION
518The PEM functions read or write structures in PEM format. 517The PEM functions read or write structures in PEM format.
519In this sense PEM format is simply base64 encoded data surrounded by 518In this sense PEM format is simply base64-encoded data surrounded by
520header lines. 519header lines.
521.Pp 520.Pp
522For more details about the meaning of arguments see the 521For more details about the meaning of arguments see the
@@ -542,7 +541,7 @@ structure.
542The write routines use "traditional" private key format and can handle 541The write routines use "traditional" private key format and can handle
543both RSA and DSA private keys. 542both RSA and DSA private keys.
544The read functions can additionally transparently handle PKCS#8 format 543The read functions can additionally transparently handle PKCS#8 format
545encrypted and unencrypted keys, too. 544encrypted and unencrypted keys too.
546.Pp 545.Pp
547.Fn PEM_write_bio_PKCS8PrivateKey 546.Fn PEM_write_bio_PKCS8PrivateKey
548and 547and
@@ -570,8 +569,7 @@ also write out a private key as a PKCS#8 EncryptedPrivateKeyInfo.
570However they use PKCS#5 v1.5 or PKCS#12 encryption algorithms instead. 569However they use PKCS#5 v1.5 or PKCS#12 encryption algorithms instead.
571The algorithm to use is specified in the 570The algorithm to use is specified in the
572.Fa nid 571.Fa nid
573parameter and should be the NID of the corresponding OBJECT IDENTIFIER 572parameter and should be the NID of the corresponding OBJECT IDENTIFIER.
574(see NOTES section).
575.Pp 573.Pp
576The 574The
577.Sy PUBKEY 575.Sy PUBKEY
@@ -754,7 +752,7 @@ if an error occurred.
754.Pp 752.Pp
755The PEM functions which write private keys take an 753The PEM functions which write private keys take an
756.Fa enc 754.Fa enc
757parameter which specifies the encryption algorithm to use. 755parameter, which specifies the encryption algorithm to use.
758Encryption is done at the PEM level. 756Encryption is done at the PEM level.
759If this parameter is set to 757If this parameter is set to
760.Dv NULL , 758.Dv NULL ,
@@ -779,7 +777,7 @@ is ignored.
779.Pp 777.Pp
780If the 778If the
781.Fa cb 779.Fa cb
782parameters is set to 780parameter is set to
783.Dv NULL 781.Dv NULL
784and the 782and the
785.Fa u 783.Fa u
@@ -795,7 +793,7 @@ and
795.Fa u 793.Fa u
796are 794are
797.Dv NULL , 795.Dv NULL ,
798then the default callback routine is used which will typically 796then the default callback routine is used, which will typically
799prompt for the passphrase on the current terminal with echoing 797prompt for the passphrase on the current terminal with echoing
800turned off. 798turned off.
801.Pp 799.Pp
@@ -835,7 +833,7 @@ or 0 if an error occurred.
835.Ss PEM encryption format 833.Ss PEM encryption format
836This old 834This old
837.Sy PrivateKey 835.Sy PrivateKey
838routines use a non standard technique for encryption. 836routines use a non-standard technique for encryption.
839.Pp 837.Pp
840The private key (or other data) takes the following form: 838The private key (or other data) takes the following form:
841.Bd -literal -offset indent 839.Bd -literal -offset indent
@@ -852,9 +850,9 @@ The line beginning with
852contains two comma separated pieces of information: 850contains two comma separated pieces of information:
853the encryption algorithm name as used by 851the encryption algorithm name as used by
854.Xr EVP_get_cipherbyname 3 852.Xr EVP_get_cipherbyname 3
855and an 8 byte salt encoded as a set of hexadecimal digits. 853and an 8-byte salt encoded as a set of hexadecimal digits.
856.Pp 854.Pp
857After this is the base64 encoded encrypted data. 855After this is the base64-encoded encrypted data.
858.Pp 856.Pp
859The encryption key is determined using 857The encryption key is determined using
860.Xr EVP_BytesToKey 3 , 858.Xr EVP_BytesToKey 3 ,
@@ -874,7 +872,7 @@ applications most of them are set to 0 or
874.Pp 872.Pp
875Read a certificate in PEM format from a 873Read a certificate in PEM format from a
876.Vt BIO : 874.Vt BIO :
877.Bd -literal 875.Bd -literal -offset indent
878X509 *x; 876X509 *x;
879x = PEM_read_bio_X509(bp, NULL, 0, NULL); 877x = PEM_read_bio_X509(bp, NULL, 0, NULL);
880if (x == NULL) { 878if (x == NULL) {
@@ -883,7 +881,7 @@ if (x == NULL) {
883.Ed 881.Ed
884.Pp 882.Pp
885Alternative method: 883Alternative method:
886.Bd -literal 884.Bd -literal -offset indent
887X509 *x = NULL; 885X509 *x = NULL;
888if (!PEM_read_bio_X509(bp, &x, 0, NULL)) { 886if (!PEM_read_bio_X509(bp, &x, 0, NULL)) {
889 /* Error */ 887 /* Error */
@@ -892,7 +890,7 @@ if (!PEM_read_bio_X509(bp, &x, 0, NULL)) {
892.Pp 890.Pp
893Write a certificate to a 891Write a certificate to a
894.Vt BIO : 892.Vt BIO :
895.Bd -literal 893.Bd -literal -offset indent
896if (!PEM_write_bio_X509(bp, x)) { 894if (!PEM_write_bio_X509(bp, x)) {
897 /* Error */ 895 /* Error */
898} 896}
@@ -900,7 +898,7 @@ if (!PEM_write_bio_X509(bp, x)) {
900.Pp 898.Pp
901Write an unencrypted private key to a 899Write an unencrypted private key to a
902.Vt FILE : 900.Vt FILE :
903.Bd -literal 901.Bd -literal -offset indent
904if (!PEM_write_PrivateKey(fp, key, NULL, NULL, 0, 0, NULL)) { 902if (!PEM_write_PrivateKey(fp, key, NULL, NULL, 0, 0, NULL)) {
905 /* Error */ 903 /* Error */
906} 904}
@@ -908,8 +906,8 @@ if (!PEM_write_PrivateKey(fp, key, NULL, NULL, 0, 0, NULL)) {
908.Pp 906.Pp
909Write a private key (using traditional format) to a 907Write a private key (using traditional format) to a
910.Vt BIO 908.Vt BIO
911using triple DES encryption, the pass phrase is prompted for: 909using triple DES encryption; the pass phrase is prompted for:
912.Bd -literal 910.Bd -literal -offset indent
913if (!PEM_write_bio_PrivateKey(bp, key, EVP_des_ede3_cbc(), 911if (!PEM_write_bio_PrivateKey(bp, key, EVP_des_ede3_cbc(),
914 NULL, 0, 0, NULL)) { 912 NULL, 0, 0, NULL)) {
915 /* Error */ 913 /* Error */
@@ -919,7 +917,7 @@ if (!PEM_write_bio_PrivateKey(bp, key, EVP_des_ede3_cbc(),
919Write a private key (using PKCS#8 format) to a 917Write a private key (using PKCS#8 format) to a
920.Vt BIO 918.Vt BIO
921using triple DES encryption, using the pass phrase "hello": 919using triple DES encryption, using the pass phrase "hello":
922.Bd -literal 920.Bd -literal -offset indent
923if (!PEM_write_bio_PKCS8PrivateKey(bp, key, EVP_des_ede3_cbc(), 921if (!PEM_write_bio_PKCS8PrivateKey(bp, key, EVP_des_ede3_cbc(),
924 NULL, 0, 0, "hello")) { 922 NULL, 0, 0, "hello")) {
925 /* Error */ 923 /* Error */
@@ -929,7 +927,7 @@ if (!PEM_write_bio_PKCS8PrivateKey(bp, key, EVP_des_ede3_cbc(),
929Read a private key from a 927Read a private key from a
930.Vt BIO 928.Vt BIO
931using the pass phrase "hello": 929using the pass phrase "hello":
932.Bd -literal 930.Bd -literal -offset indent
933key = PEM_read_bio_PrivateKey(bp, NULL, 0, "hello"); 931key = PEM_read_bio_PrivateKey(bp, NULL, 0, "hello");
934if (key == NULL) { 932if (key == NULL) {
935 /* Error */ 933 /* Error */
@@ -939,7 +937,7 @@ if (key == NULL) {
939Read a private key from a 937Read a private key from a
940.Vt BIO 938.Vt BIO
941using a pass phrase callback: 939using a pass phrase callback:
942.Bd -literal 940.Bd -literal -offset indent
943key = PEM_read_bio_PrivateKey(bp, NULL, pass_cb, "My Private Key"); 941key = PEM_read_bio_PrivateKey(bp, NULL, pass_cb, "My Private Key");
944if (key == NULL) { 942if (key == NULL) {
945 /* Error */ 943 /* Error */
@@ -947,7 +945,7 @@ if (key == NULL) {
947.Ed 945.Ed
948.Pp 946.Pp
949Skeleton pass phrase callback: 947Skeleton pass phrase callback:
950.Bd -literal 948.Bd -literal -offset indent
951int 949int
952pass_cb(char *buf, int size, int rwflag, void *u) 950pass_cb(char *buf, int size, int rwflag, void *u)
953{ 951{
@@ -973,13 +971,13 @@ pass_cb(char *buf, int size, int rwflag, void *u)
973.Sh CAVEATS 971.Sh CAVEATS
974A frequent cause of problems is attempting to use the PEM routines like 972A frequent cause of problems is attempting to use the PEM routines like
975this: 973this:
976.Bd -literal 974.Bd -literal -offset indent
977X509 *x; 975X509 *x;
978PEM_read_bio_X509(bp, &x, 0, NULL); 976PEM_read_bio_X509(bp, &x, 0, NULL);
979.Ed 977.Ed
980.Pp 978.Pp
981This is a bug because an attempt will be made to reuse the data at 979This is a bug because an attempt will be made to reuse the data at
982.Fa x 980.Fa x ,
983which is an uninitialised pointer. 981which is an uninitialised pointer.
984.Sh BUGS 982.Sh BUGS
985The PEM read routines in some versions of OpenSSL will not correctly 983The PEM read routines in some versions of OpenSSL will not correctly
diff --git a/src/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 b/src/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3
index 12d3d781eb..3726a8b8b7 100644
--- a/src/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3
+++ b/src/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PEM_write_bio_PKCS7_stream.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PEM_write_bio_PKCS7_stream.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PEM_WRITE_BIO_PKCS7_STREAM 3 4.Dt PEM_WRITE_BIO_PKCS7_STREAM 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -23,7 +23,7 @@ outputs a PKCS7 structure in PEM format.
23It is otherwise identical to the function 23It is otherwise identical to the function
24.Xr SMIME_write_PKCS7 3 . 24.Xr SMIME_write_PKCS7 3 .
25.Pp 25.Pp
26This function is effectively a version of the 26This function is effectively a version of
27.Xr PEM_write_bio_PKCS7 3 27.Xr PEM_write_bio_PKCS7 3
28supporting streaming. 28supporting streaming.
29.Sh RETURN VALUES 29.Sh RETURN VALUES
diff --git a/src/lib/libcrypto/man/PKCS12_create.3 b/src/lib/libcrypto/man/PKCS12_create.3
index f638fbf82e..adca492d63 100644
--- a/src/lib/libcrypto/man/PKCS12_create.3
+++ b/src/lib/libcrypto/man/PKCS12_create.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS12_create.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS12_create.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS12_CREATE 3 4.Dt PKCS12_CREATE 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -74,7 +74,7 @@ and
74.Fa keytype 74.Fa keytype
75can all be set to zero and sensible defaults will be used. 75can all be set to zero and sensible defaults will be used.
76.Pp 76.Pp
77These defaults are: 40 bit RC2 encryption for certificates, triple DES 77These defaults are: 40-bit RC2 encryption for certificates, triple DES
78encryption for private keys, a key iteration count of 78encryption for private keys, a key iteration count of
79PKCS12_DEFAULT_ITER (currently 2048) and a MAC iteration count of 1. 79PKCS12_DEFAULT_ITER (currently 2048) and a MAC iteration count of 1.
80.Pp 80.Pp
@@ -86,11 +86,11 @@ should be set to PKCS12_DEFAULT_ITER.
86.Pp 86.Pp
87.Fa keytype 87.Fa keytype
88adds a flag to the store private key. 88adds a flag to the store private key.
89This is a non standard extension that is only currently interpreted by 89This is a non-standard extension that is only currently interpreted by
90MSIE. 90MSIE.
91If set to zero the flag is omitted, if set to 91If set to zero the flag is omitted; if set to
92.Dv KEY_SIG 92.Dv KEY_SIG
93the key can be used for signing only, and if set to 93the key can be used for signing only; and if set to
94.Dv KEY_EX 94.Dv KEY_EX
95it can be used for signing and encryption. 95it can be used for signing and encryption.
96This option was useful for old export grade software which could use 96This option was useful for old export grade software which could use
diff --git a/src/lib/libcrypto/man/PKCS12_parse.3 b/src/lib/libcrypto/man/PKCS12_parse.3
index 69786d49c0..d7bcd63b01 100644
--- a/src/lib/libcrypto/man/PKCS12_parse.3
+++ b/src/lib/libcrypto/man/PKCS12_parse.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS12_parse.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS12_parse.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS12_PARSE 3 4.Dt PKCS12_PARSE 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -44,7 +44,7 @@ can be
44.Dv NULL , 44.Dv NULL ,
45in which case additional certificates will be discarded. 45in which case additional certificates will be discarded.
46.Pf * Fa ca 46.Pf * Fa ca
47can also be a valid STACK in which case additional certificates are 47can also be a valid STACK, in which case additional certificates are
48appended to 48appended to
49.Pf * Fa ca . 49.Pf * Fa ca .
50If 50If
diff --git a/src/lib/libcrypto/man/PKCS7_decrypt.3 b/src/lib/libcrypto/man/PKCS7_decrypt.3
index fa006af0ad..1abd87df4b 100644
--- a/src/lib/libcrypto/man/PKCS7_decrypt.3
+++ b/src/lib/libcrypto/man/PKCS7_decrypt.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS7_decrypt.3,v 1.3 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS7_decrypt.3,v 1.4 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS7_DECRYPT 3 4.Dt PKCS7_DECRYPT 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -35,7 +35,7 @@ is an optional set of flags.
35about unknown algorithms will occur. 35about unknown algorithms will occur.
36.Pp 36.Pp
37Although the recipient's certificate is not needed to decrypt the data, 37Although the recipient's certificate is not needed to decrypt the data,
38it is needed to locate the appropriate (of possible several) recipients 38it is needed to locate the appropriate recipients
39in the PKCS#7 structure. 39in the PKCS#7 structure.
40.Pp 40.Pp
41If the 41If the
diff --git a/src/lib/libcrypto/man/PKCS7_encrypt.3 b/src/lib/libcrypto/man/PKCS7_encrypt.3
index 1ab99c917c..56c22c85e3 100644
--- a/src/lib/libcrypto/man/PKCS7_encrypt.3
+++ b/src/lib/libcrypto/man/PKCS7_encrypt.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS7_encrypt.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS7_encrypt.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS7_ENCRYPT 3 4.Dt PKCS7_ENCRYPT 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -33,7 +33,7 @@ though they do not have to be signed using the RSA algorithm.
33.Pp 33.Pp
34The algorithm passed in the 34The algorithm passed in the
35.Fa cipher 35.Fa cipher
36parameter must support ASN1 encoding of its parameters. 36parameter must support ASN.1 encoding of its parameters.
37.Pp 37.Pp
38Many browsers implement a "sign and encrypt" option which is simply an 38Many browsers implement a "sign and encrypt" option which is simply an
39S/MIME envelopedData containing an S/MIME signed message. 39S/MIME envelopedData containing an S/MIME signed message.
@@ -84,14 +84,14 @@ properly finalize the
84.Vt PKCS7 84.Vt PKCS7
85structure will give unpredictable results. 85structure will give unpredictable results.
86.Pp 86.Pp
87Several functions including 87Several functions, including
88.Xr SMIME_write_PKCS7 3 , 88.Xr SMIME_write_PKCS7 3 ,
89.Xr i2d_PKCS7_bio_stream 3 , 89.Xr i2d_PKCS7_bio_stream 3 ,
90and 90and
91.Xr PEM_write_bio_PKCS7_stream 3 91.Xr PEM_write_bio_PKCS7_stream 3 ,
92finalize the structure. 92finalize the structure.
93Alternatively finalization can be performed by obtaining the streaming 93Alternatively finalization can be performed by obtaining the streaming
94ASN1 94ASN.1
95.Vt BIO 95.Vt BIO
96directly using 96directly using
97.Xr BIO_new_PKCS7 3 . 97.Xr BIO_new_PKCS7 3 .
diff --git a/src/lib/libcrypto/man/PKCS7_sign.3 b/src/lib/libcrypto/man/PKCS7_sign.3
index 6dfdde2616..3ae651dd82 100644
--- a/src/lib/libcrypto/man/PKCS7_sign.3
+++ b/src/lib/libcrypto/man/PKCS7_sign.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS7_sign.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS7_sign.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS7_SIGN 3 4.Dt PKCS7_SIGN 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -49,17 +49,17 @@ are prepended to the data.
49If 49If
50.Dv PKCS7_NOCERTS 50.Dv PKCS7_NOCERTS
51is set, the signer's certificate will not be included in the PKCS7 51is set, the signer's certificate will not be included in the PKCS7
52structure, the signer's certificate must still be supplied in the 52structure, though the signer's certificate must still be supplied in the
53.Fa signcert 53.Fa signcert
54parameter though. 54parameter.
55This can reduce the size of the signature if the signers certificate can 55This can reduce the size of the signature if the signer's certificate can
56be obtained by other means: for example a previously signed message. 56be obtained by other means: for example a previously signed message.
57.Pp 57.Pp
58The data being signed is included in the 58The data being signed is included in the
59.Vt PKCS7 59.Vt PKCS7
60structure, unless 60structure, unless
61.Dv PKCS7_DETACHED 61.Dv PKCS7_DETACHED
62is set in which case it is omitted. 62is set, in which case it is omitted.
63This is used for PKCS7 detached signatures which are used in S/MIME 63This is used for PKCS7 detached signatures which are used in S/MIME
64plaintext signed messages for example. 64plaintext signed messages for example.
65.Pp 65.Pp
@@ -82,8 +82,8 @@ If
82is set, then just the SMIMECapabilities are omitted. 82is set, then just the SMIMECapabilities are omitted.
83.Pp 83.Pp
84If present, the SMIMECapabilities attribute indicates support for the 84If present, the SMIMECapabilities attribute indicates support for the
85following algorithms: triple DES, 128 bit RC2, 64 bit RC2, DES and 40 85following algorithms: triple DES, 128-bit RC2, 64-bit RC2, DES
86bit RC2. 86and 40-bit RC2.
87If any of these algorithms is disabled then it will not be included. 87If any of these algorithms is disabled then it will not be included.
88.Pp 88.Pp
89If the flags 89If the flags
@@ -117,13 +117,14 @@ properly finalize the
117.Vt PKCS7 117.Vt PKCS7
118structure will give unpredictable results. 118structure will give unpredictable results.
119.Pp 119.Pp
120Several functions including 120Several functions, including
121.Xr SMIME_write_PKCS7 3 , 121.Xr SMIME_write_PKCS7 3 ,
122.Xr i2d_PKCS7_bio_stream 3 , 122.Xr i2d_PKCS7_bio_stream 3 ,
123.Xr PEM_write_bio_PKCS7_stream 3 123and
124.Xr PEM_write_bio_PKCS7_stream 3 ,
124finalize the structure. 125finalize the structure.
125Alternatively finalization can be performed by obtaining the streaming 126Alternatively finalization can be performed by obtaining the streaming
126ASN1 127ASN.1
127.Vt BIO 128.Vt BIO
128directly using 129directly using
129.Xr BIO_new_PKCS7 3 . 130.Xr BIO_new_PKCS7 3 .
@@ -157,7 +158,7 @@ and
157.Fa pkey 158.Fa pkey
158are 159are
159.Dv NULL , 160.Dv NULL ,
160then a certificates only PKCS#7 structure is output. 161then a certificate-only PKCS#7 structure is output.
161.Pp 162.Pp
162In versions of OpenSSL before 1.0.0 the 163In versions of OpenSSL before 1.0.0 the
163.Fa signcert 164.Fa signcert
diff --git a/src/lib/libcrypto/man/PKCS7_sign_add_signer.3 b/src/lib/libcrypto/man/PKCS7_sign_add_signer.3
index 9ec6a54818..11000196a1 100644
--- a/src/lib/libcrypto/man/PKCS7_sign_add_signer.3
+++ b/src/lib/libcrypto/man/PKCS7_sign_add_signer.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS7_sign_add_signer.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS7_sign_add_signer.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS7_SIGN_ADD_SIGNER 3 4.Dt PKCS7_SIGN_ADD_SIGNER 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -35,7 +35,7 @@ structure should be obtained from an initial call to
35.Xr PKCS7_sign 3 35.Xr PKCS7_sign 3
36with the flag 36with the flag
37.Dv PKCS7_PARTIAL 37.Dv PKCS7_PARTIAL
38set, or in the case or re-signing, a valid 38set or, in the case or re-signing, a valid
39.Vt PKCS7 39.Vt PKCS7
40signed data structure. 40signed data structure.
41.Pp 41.Pp
@@ -88,9 +88,9 @@ If
88.Dv PKCS7_NOCERTS 88.Dv PKCS7_NOCERTS
89is set, the signer's certificate will not be included in the 89is set, the signer's certificate will not be included in the
90.Vt PKCS7 90.Vt PKCS7
91structure, the signer's certificate must still be supplied in the 91structure, though the signer's certificate must still be supplied in the
92.Fa signcert 92.Fa signcert
93parameter though. 93parameter.
94This can reduce the size of the signature if the signers certificate can 94This can reduce the size of the signature if the signers certificate can
95be obtained by other means: for example a previously signed message. 95be obtained by other means: for example a previously signed message.
96.Pp 96.Pp
@@ -105,14 +105,14 @@ If
105is set, then just the SMIMECapabilities are omitted. 105is set, then just the SMIMECapabilities are omitted.
106.Pp 106.Pp
107If present, the SMIMECapabilities attribute indicates support for the 107If present, the SMIMECapabilities attribute indicates support for the
108following algorithms: triple DES, 128 bit RC2, 64 bit RC2, DES and 40 108following algorithms: triple DES, 128-bit RC2, 64-bit RC2, DES
109bit RC2. 109and 40-bit RC2.
110If any of these algorithms is disabled, then it will not be included. 110If any of these algorithms is disabled, then it will not be included.
111.Pp 111.Pp
112.Fn PKCS7_sign_add_signer 112.Fn PKCS7_sign_add_signer
113returns an internal pointer to the 113returns an internal pointer to the
114.Vt PKCS7_SIGNER_INFO 114.Vt PKCS7_SIGNER_INFO
115structure just added, this can be used to set additional attributes 115structure just added, which can be used to set additional attributes
116before it is finalized. 116before it is finalized.
117.Sh RETURN VALUES 117.Sh RETURN VALUES
118.Fn PKCS7_sign_add_signer 118.Fn PKCS7_sign_add_signer
diff --git a/src/lib/libcrypto/man/PKCS7_verify.3 b/src/lib/libcrypto/man/PKCS7_verify.3
index 11439915bd..8d1b9f6a0c 100644
--- a/src/lib/libcrypto/man/PKCS7_verify.3
+++ b/src/lib/libcrypto/man/PKCS7_verify.3
@@ -1,6 +1,6 @@
1.\" $OpenBSD: PKCS7_verify.3,v 1.2 2016/11/06 15:52:50 jmc Exp $ 1.\" $OpenBSD: PKCS7_verify.3,v 1.3 2016/11/24 19:45:16 jmc Exp $
2.\" 2.\"
3.Dd $Mdocdate: November 6 2016 $ 3.Dd $Mdocdate: November 24 2016 $
4.Dt PKCS7_VERIFY 3 4.Dt PKCS7_VERIFY 3
5.Os 5.Os
6.Sh NAME 6.Sh NAME
@@ -93,7 +93,7 @@ If any chain verify fails an error code is returned.
93.Pp 93.Pp
94Finally, the signed content is read (and written to 94Finally, the signed content is read (and written to
95.Fa out 95.Fa out
96is it is not 96if it is not
97.Dv NULL ) 97.Dv NULL )
98and the signature's checked. 98and the signature's checked.
99.Pp 99.Pp
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 04:27:17 +0000