aboutsummaryrefslogtreecommitdiffstats
path: root/doc/man7
Commit message (Collapse)AuthorAgeFilesLines
* Document the implications of setting engine-based low-level methodsTomas Mraz2024-01-311-0/+8
| | | | | | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23063)
* doc: "digest" must be explicitly set with deterministic ECDSA/DSAJames Muir2024-01-111-6/+9
| | | | | | | | Fixes #23205 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23250)
* Augment RSA provider to generate CRT coefficients on EVP_PKEY_fromdata()Neil Horman2024-01-091-0/+9
| | | | | | | | | | | | | | It would be helpful to be able to generate RSA's dmp1/dmq1/iqmp values when not provided in the param list to EVP_PKEY_fromdata. Augment the provider in ossl_rsa_fromdata to preform this generation iff: a) At least p q n e and e are provided b) the new parameter OSSL_PARAM_RSA_DERIVE_PQ is set to 1 Fixes #21826 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21875)
* provider-keymgmt.pod: fix typorilysh2024-01-031-1/+1
| | | | | | | | | | Fix a typo from asymmmetric to asymmetric CLA: trivial Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23164)
* gate calling of evp_method_id on having a non-zero name idNeil Horman2024-01-011-0/+4
| | | | | | | | | | | | | | | | | | | | | | | If a name is passed to EVP_<OBJ>_fetch of the form: name1:name2:name3 The names are parsed on the separator ':' and added to the store, but during the lookup in inner_evp_generic_fetch, the subsequent search of the store uses the full name1:name2:name3 string, which fails lookup, and causes subsequent assertion failures in evp_method_id. instead catch the failure in inner_evp_generic_fetch and return an error code if the name_id against a colon separated list of names fails. This provides a graceful error return path without asserts, and leaves room for a future feature in which such formatted names can be parsed and searched for iteratively Add a simple test to verify that providing a colon separated name results in an error indicating an invalid lookup. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/23110)
* Fix typos found by codespell in man pagesDimitri Papadopoulos2023-12-292-2/+2
| | | | | | Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23131)
* Ignore OSSL_MAC_PARAM_DIGEST_NOINIT/OSSL_MAC_PARAM_DIGEST_ONESHOTNeil Horman2023-12-261-0/+4
| | | | | | | | | | | | | | | | The hmac flags OSSL_MAC_PARAM_DIGEST_NOINIT and OSSL_MAC_PARAM_DIGEST_ONESHOT dont add any real value to the provider, and the former causes a segfault when the provider attempts to call EVP_MAC_init on an EVP_MAC object that has been instructed not to be initalized (as the update function will not have been set in the MAC object, which is unilaterally called from EVP_MAC_init Remove the tests for the above flags, and document them as being deprecated and ignored. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23054)
* AES: Document that the XTS, SIV, WRAP modes do not support streamingTomas Mraz2023-12-221-0/+13
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23028)
* SM4: Document that the XTS mode does not support streamingTomas Mraz2023-12-221-0/+9
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/23028)
* Removed extra spaces in documentationslontis2023-12-121-1/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22968)
* provider-storemgmt.pod: fix nits (unclosed '<' around name)Dr. David von Oheimb2023-12-121-2/+2
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22942)
* doc: improve documentation of EVP in-place encryptionMatthias St. Pierre2023-12-121-3/+7
| | | | | | | | | | | | | | | | | | | | The EVP interface explicitly allows in-place encryption/decryption, but this fact is just 'partially' documented in `EVP_EncryptUpdate(3)` (pun intended): the manual page mentions only operation failure in case of 'partial' overlaps. This is not even correct, because the check for partially overlapping buffers is only implemented in legacy code paths. Currently, in-place encryption/decryption is only documented for RSA (`RSA_public_encrypt(3)`) and DES (`DES_ecb_encrypt(3)`), as well as in the provider interface (`provider-cipher(7)`). This commit amends `EVP_EncryptUpdate(3)` and `provider-cipher(7)` to make the front-end and back-end documentation consistent. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22875)
* doc: improve display of KECCAK-KMAC128, KECCAK-KMAC256 defsJames Muir2023-12-041-2/+2
| | | | | | | | Do not allow mid-expression line breaks. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22814)
* rsa-doc: fix typoJames Muir2023-12-011-1/+1
| | | | | | | | "d_i in RFC8017" -> "d_i" in RFC8017 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22868)
* Fix EVP_RAND-SEED-SRC documentation exampleJamie Cui2023-11-301-1/+2
| | | | | | | | Fixes #22810 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22857)
* doc: fix description of mac "block-size" parameterJames Muir2023-11-224-11/+14
| | | | | | | | | | | | The macro for "block-size" is OSSL_MAC_PARAM_BLOCK_SIZE, and this parameter is not settable. Refer to the "customization string" rather than the "custom value" (in the Blake2 spec, this is called the personalization string). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22763)
* doc: better description of KECCAK-KMAC XOFJames Muir2023-11-221-8/+13
| | | | | | | | | | | | | | | | KECCAK-KMAC-128 and KECCAK-KMAC-256 are extendable output functions that have been defined because they are convenient for implementing KMAC. Give definitions for them so that users aren't left to figure that out themselves. KECCAK-KMAC-128 is very similar to SHAKE-128, and KECCAK-KMAC-256 is very similar to SHAKE-256. Related to #22619. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22755)
* Update the provider documentationMatt Caswell2023-11-224-22/+226
| | | | | | | | | Make the documentation match reality. Add lots of missing algorithms. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22694)
* augment quic demos to support ipv4/6 connectionsNeil Horman2023-11-212-3/+5
| | | | | | | | | | | | | | | | Because the quicserver utility supports expressly listening in ipv4/6 mode, its possible/likely that the server will listen on an ipv4 address, while the clients will connect via ipv6, leading to connection failures. Augment quic demo clients to afford them the same -6 option that the server has so that connection family can be co-ordinated Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22577)
* Properly limit the variable output size for BLAKE2Tomas Mraz2023-11-131-4/+16
| | | | | | | | | The upper limit of the output size is the default output size of the respective algorithm variants. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/22659)
* Add EVP_DigestSqueeze() API.slontis2023-11-105-40/+119
| | | | | | | | | | | | | | | | | | | | | | | | Fixes #7894 This allows SHAKE to squeeze multiple times with different output sizes. The existing EVP_DigestFinalXOF() API has been left as a one shot operation. A similar interface is used by another toolkit. The low level SHA3_Squeeze() function needed to change slightly so that it can handle multiple squeezes. This involves changing the assembler code so that it passes a boolean to indicate whether the Keccak function should be called on entry. At the provider level, the squeeze is buffered, so that it only requests a multiple of the blocksize when SHA3_Squeeze() is called. On the first call the value is zero, on subsequent calls the value passed is 1. This PR is derived from the excellent work done by @nmathewson in https://github.com/openssl/openssl/pull/7921 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21511)
* Use proper KDF SS parameter nameDmitry Belyavskiy2023-11-061-3/+3
| | | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22636)
* Fix documentation regarding KMAC sizesMichael Hinz2023-11-061-1/+1
| | | | | | | | | | | | | | | | As per recommendation by jfinkhaeuser, this documents the defaults for KMAC-128 as 32 and for KMAC-256 as 64. The code already accomodates for these values, so no changes are needed there. Fixes #22381 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22614)
* Update the OpenSSL Guide tutorials with changes to the demosMatt Caswell2023-11-024-26/+84
| | | | | | | | | | | The demo code has changed to accept the hostname/port on the command line. We update the tutorials to keep in sync with the demo code. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22552)
* Update README-QUIC.mdMatt Caswell2023-10-301-3/+56
| | | | | | | | | | | We move some of the "why QUIC" content into the guide and just provide a summary in README-QUIC.md. We also clarify how to use s_client with QUIC. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22505)
* EVP_PKEY_get_size.pod and provider-keymgmt.pod: document their relationDr. David von Oheimb2023-10-261-0/+6
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22459)
* doc: change "certifictes" to "certificates"James Muir2023-10-261-2/+2
| | | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22446)
* Blake2b: Use OSSL_DIGEST_PARAM_SIZE as settable instead of XOFLENTomas Mraz2023-10-251-0/+15
| | | | | | | | | | | | | | | | | BLAKE2 is not really an extensible output function unlike SHAKE as the digest size must be set during the context initialization. Thus it makes no sense to use OSSL_DIGEST_PARAM_XOFLEN. We also need to adjust EVP_DigestFinal_ex() to query the OSSL_DIGEST_PARAM_SIZE as gettable ctx param for the size. Fixes #22488 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22491)
* quic: documentation and demo nitsJames Muir2023-10-251-3/+3
| | | | | | | | | | | | | | | The code for the quic demos (from the openssl guide) is presented as modifications of tls-client-block.c. Make it so that the quic code better matches the tls code (drop unneeded assignments to "ret", use the same comment on SSL_connect(), add the same printf() statement). Also fix some minor typos. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22483)
* rand: add callbacks to cleanup the user entropy resp. nonceMatthias St. Pierre2023-10-201-7/+19
| | | | | | | | | | | | | The `get_user_{entropy,nonce}` callbacks were add recently to the dispatch table in commit 4cde7585ce8e. Instead of adding corresponding `cleanup_user_{entropy,nonce}` callbacks, the `cleanup_{entropy,nonce}` callbacks were reused. This can cause a problem in the case where the seed source is replaced by a provider: the buffer gets allocated by the provider but cleared by the core. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22423)
* Copyright year updatesMatt Caswell2023-09-283-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* fips: use seed source requestedPauli2023-09-272-5/+30
| | | | | | | | Fixes #21909 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21964)
* Add provider documentation for the new open_exSimo Sorce2023-09-191-0/+12
| | | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20131)
* Fix new typos found by codespellDimitri Papadopoulos2023-09-181-2/+2
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22098)
* Store: API for deletion - documentationDmitry Belyavskiy2023-09-151-0/+12
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21901)
* Fix typos found by codespellDimitri Papadopoulos2023-09-134-8/+8
| | | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22063)
* augment man pages with information about PKCS12KDF in FIPS modeVladimir Kotal2023-09-112-1/+14
| | | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21965)
* Return NULL if we fail to create a BIO in the demos/quicserverMatt Caswell2023-09-082-4/+8
| | | | | | | | | Strictly speaking the previous code was still correct since BIO_set_fd is tolerant of a NULL BIO. But this way is more clear. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21950)
* Add a missing call to BIO_closesocket()Matt Caswell2023-09-081-0/+1
| | | | | | | | A couple of the demos missed a call to this function in an error case. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21950)
* Expand the explanation of how to go and do useful work in non-blockingMatt Caswell2023-09-082-6/+31
| | | | | | | | | Add additional commentary to the non-blocking examples explaining where to add code to go and do other useful work. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21950)
* Add a new guide page on writing a non-blocking QUIC clientMatt Caswell2023-09-083-1/+446
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21950)
* Add a new guide page on writing a non-blocking TLS clientMatt Caswell2023-09-083-1/+364
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21950)
* Copyright year updatesMatt Caswell2023-09-0726-26/+26
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* Add a link to the multi-stream QUIC client tutorial from the introductionMatt Caswell2023-08-251-0/+2
| | | | | | | | We've added a new page to the guide so we should add a link to it. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
* Update demos/tutorial to distinguish between stream and connection errorsMatt Caswell2023-08-252-16/+100
| | | | | | | | We can use SSL_get_stream_read_state() to distinguish these cases. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
* Clarify SSL_accept_stream/SSL_new_stream behaviour with a default streamMatt Caswell2023-08-252-9/+4
| | | | | | | | | Explain what happens if you call those functions and there is no default stream present yet. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
* Add some additional comments to the demosMatt Caswell2023-08-251-0/+1
| | | | | | | | | Add some additional explanation for some code lines in the demos that did not have a comment. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
* Provide introduction/tutorial page for QUIC multi-streamMatt Caswell2023-08-252-4/+343
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
* Add an initial guide page for writing a multi-stream QUIC clientMatt Caswell2023-08-251-0/+36
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
* Update some links within the guide to not use crypto(7)Matt Caswell2023-08-254-18/+23
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21765)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-07 08:03:18 +0000