Latest update

Configurations/00-base-templates.conf

@@ -102,6 +102,8 @@ my %targets=(
                                      ? "ranlib" : "" },
         RC              => "windres",
 
+        shared_extension => ".so",
+
         build_scheme    => [ "unified", "unix" ],
         build_file      => "Makefile",
     },
@@ -142,6 +144,8 @@ my %targets=(
         mtinflag        => "-manifest ",
         mtoutflag       => "-outputresource:",
 
+        shared_extension => ".dll",
+
         build_file      => "makefile",
         build_scheme    => [ "unified", "windows" ],
     },
@@ -160,6 +164,8 @@ my %targets=(
                     return [ @incs ];
                 }),
 
+        shared_extension => ".exe",
+
         build_file       => "descrip.mms",
         build_scheme     => [ "unified", "VMS" ],
     },

apps/s_cb.c

@@ -394,7 +394,8 @@ int ssl_print_groups(BIO *out, SSL *s, int noshared)
 int ssl_print_tmp_key(BIO *out, SSL *s)
 {
     EVP_PKEY *key;
-    if (!SSL_get_server_tmp_key(s, &key))
+
+    if (!SSL_get_peer_tmp_key(s, &key))
         return 1;
     BIO_puts(out, "Server Temp Key: ");
     switch (EVP_PKEY_id(key)) {

crypto/build.info

@@ -5,7 +5,7 @@ SUBDIRS=objects buffer bio stack lhash rand evp asn1 pem x509 x509v3 conf \
         md2 md4 md5 sha mdc2 gmac hmac ripemd whrlpool poly1305 blake2 \
         siphash sm3 des aes rc2 rc4 rc5 idea aria bf cast camellia \
         seed sm4 chacha modes bn ec rsa dsa dh sm2 dso engine \
-        err comp ocsp cms ts srp cmac ct async
+        err comp ocsp cms ts srp cmac ct async kmac
 
 LIBS=../libcrypto
 SOURCE[../libcrypto]=\

crypto/err/openssl.txt

@@ -803,6 +803,8 @@ EVP_F_EVP_SIGNFINAL:107:EVP_SignFinal
 EVP_F_EVP_VERIFYFINAL:108:EVP_VerifyFinal
 EVP_F_GMAC_CTRL:215:gmac_ctrl
 EVP_F_INT_CTX_NEW:157:int_ctx_new
+EVP_F_KMAC_CTRL:217:kmac_ctrl
+EVP_F_KMAC_INIT:218:kmac_init
 EVP_F_OK_NEW:200:ok_new
 EVP_F_PKCS5_PBE_KEYIVGEN:117:PKCS5_PBE_keyivgen
 EVP_F_PKCS5_V2_PBE_KEYIVGEN:118:PKCS5_v2_PBE_keyivgen
@@ -2249,6 +2251,7 @@ EVP_R_GET_RAW_KEY_FAILED:182:get raw key failed
 EVP_R_ILLEGAL_SCRYPT_PARAMETERS:171:illegal scrypt parameters
 EVP_R_INITIALIZATION_ERROR:134:initialization error
 EVP_R_INPUT_NOT_INITIALIZED:111:input not initialized
+EVP_R_INVALID_CUSTOM_LENGTH:185:invalid custom length
 EVP_R_INVALID_DIGEST:152:invalid digest
 EVP_R_INVALID_FIPS_MODE:168:invalid fips mode
 EVP_R_INVALID_KEY:163:invalid key

crypto/evp/c_allm.c

@@ -17,6 +17,8 @@ void openssl_add_all_macs_int(void)
 #endif
     EVP_add_mac(&gmac_meth);
     EVP_add_mac(&hmac_meth);
+    EVP_add_mac(&kmac128_meth);
+    EVP_add_mac(&kmac256_meth);
 #ifndef OPENSSL_NO_SIPHASH
     EVP_add_mac(&siphash_meth);
 #endif

crypto/evp/evp_err.c

@@ -143,6 +143,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_VERIFYFINAL, 0), "EVP_VerifyFinal"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_GMAC_CTRL, 0), "gmac_ctrl"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_INT_CTX_NEW, 0), "int_ctx_new"},
+    {ERR_PACK(ERR_LIB_EVP, EVP_F_KMAC_CTRL, 0), "kmac_ctrl"},
+    {ERR_PACK(ERR_LIB_EVP, EVP_F_KMAC_INIT, 0), "kmac_init"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_OK_NEW, 0), "ok_new"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_PKCS5_PBE_KEYIVGEN, 0), "PKCS5_PBE_keyivgen"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_PKCS5_V2_PBE_KEYIVGEN, 0),
@@ -215,6 +217,8 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
     "initialization error"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INPUT_NOT_INITIALIZED),
     "input not initialized"},
+    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_CUSTOM_LENGTH),
+    "invalid custom length"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_DIGEST), "invalid digest"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_FIPS_MODE), "invalid fips mode"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_KEY), "invalid key"},

crypto/evp/m_sha3.c

@@ -59,6 +59,11 @@ static int shake_init(EVP_MD_CTX *evp_ctx)
     return init(evp_ctx, '\x1f');
 }
 
+static int kmac_init(EVP_MD_CTX *evp_ctx)
+{
+    return init(evp_ctx, '\x04');
+}
+
 static int sha3_update(EVP_MD_CTX *evp_ctx, const void *_inp, size_t len)
 {
     KECCAK1600_CTX *ctx = evp_ctx->md_data;
@@ -395,6 +400,7 @@ const EVP_MD *EVP_shake##bitlen(void)           \
     };                                          \
     return &shake##bitlen##_md;                 \
 }
+
 #endif
 
 EVP_MD_SHA3(224)
@@ -404,3 +410,27 @@ EVP_MD_SHA3(512)
 
 EVP_MD_SHAKE(128)
 EVP_MD_SHAKE(256)
+
+
+# define EVP_MD_KECCAK_KMAC(bitlen)             \
+const EVP_MD *evp_keccak_kmac##bitlen(void)     \
+{                                               \
+    static const EVP_MD kmac_##bitlen##_md = {  \
+        -1,                                     \
+        0,                                      \
+        2 * bitlen / 8,                         \
+        EVP_MD_FLAG_XOF,                        \
+        kmac_init,                              \
+        sha3_update,                            \
+        sha3_final,                             \
+        NULL,                                   \
+        NULL,                                   \
+        (KECCAK1600_WIDTH - bitlen * 2) / 8,    \
+        sizeof(KECCAK1600_CTX),                 \
+        shake_ctrl                              \
+    };                                          \
+    return &kmac_##bitlen##_md;                 \
+}
+
+EVP_MD_KECCAK_KMAC(128)
+EVP_MD_KECCAK_KMAC(256)

crypto/include/internal/evp_int.h

@@ -131,9 +131,15 @@ struct evp_mac_st {
 extern const EVP_MAC cmac_meth;
 extern const EVP_MAC gmac_meth;
 extern const EVP_MAC hmac_meth;
+extern const EVP_MAC kmac128_meth;
+extern const EVP_MAC kmac256_meth;
 extern const EVP_MAC siphash_meth;
 extern const EVP_MAC poly1305_meth;
 
+/* Internal keccak algorithms used for KMAC */
+const EVP_MD *evp_keccak_kmac128(void);
+const EVP_MD *evp_keccak_kmac256(void);
+
 /*
  * This function is internal for now, but can be made external when needed.
  * The documentation would read:

crypto/kmac/build.info

@@ -0,0 +1,3 @@
+LIBS=../../libcrypto
+SOURCE[../../libcrypto]=kmac.c
+

crypto/kmac/kmac.c

@@ -0,0 +1,469 @@
+/*
+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL license (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*
+ * See SP800-185 "Appendix A - KMAC, .... in Terms of Keccak[c]"
+ *
+ * Inputs are:
+ *    K = Key                  (len(K) < 2^2040 bits)
+ *    X = Input
+ *    L = Output length        (0 <= L < 2^2040 bits)
+ *    S = Customization String Default="" (len(S) < 2^2040 bits)
+ *
+ * KMAC128(K, X, L, S)
+ * {
+ *     newX = bytepad(encode_string(K), 168) ||  X || right_encode(L).
+ *     T = bytepad(encode_string(“KMAC”) || encode_string(S), 168).
+ *     return KECCAK[256](T || newX || 00, L).
+ * }
+ *
+ * KMAC256(K, X, L, S)
+ * {
+ *     newX = bytepad(encode_string(K), 136) ||  X || right_encode(L).
+ *     T = bytepad(encode_string(“KMAC”) || encode_string(S), 136).
+ *     return KECCAK[512](T || newX || 00, L).
+ * }
+ *
+ * KMAC128XOF(K, X, L, S)
+ * {
+ *     newX = bytepad(encode_string(K), 168) ||  X || right_encode(0).
+ *     T = bytepad(encode_string(“KMAC”) || encode_string(S), 168).
+ *     return KECCAK[256](T || newX || 00, L).
+ * }
+ *
+ * KMAC256XOF(K, X, L, S)
+ * {
+ *     newX = bytepad(encode_string(K), 136) ||  X || right_encode(0).
+ *     T = bytepad(encode_string(“KMAC”) || encode_string(S), 136).
+ *     return KECCAK[512](T || newX || 00, L).
+ * }
+ *
+ */
+
+#include <stdlib.h>
+#include <openssl/evp.h>
+#include "internal/cryptlib.h"
+#include "internal/evp_int.h"
+
+#define KMAC_MAX_BLOCKSIZE ((1600 - 128*2) / 8) /* 168 */
+#define KMAC_MIN_BLOCKSIZE ((1600 - 256*2) / 8) /* 136 */
+
+/* Length encoding will be  a 1 byte size + length in bits (2 bytes max) */
+#define KMAC_MAX_ENCODED_HEADER_LEN 3
+
+/*
+ * Custom string max size is chosen such that:
+ *   len(encoded_string(custom) + len(kmac_encoded_string) <= KMAC_MIN_BLOCKSIZE
+ *   i.e: (KMAC_MAX_CUSTOM + KMAC_MAX_ENCODED_LEN) + 6 <= 136
+ */
+#define KMAC_MAX_CUSTOM 127
+
+/* Maximum size of encoded custom string */
+#define KMAC_MAX_CUSTOM_ENCODED (KMAC_MAX_CUSTOM + KMAC_MAX_ENCODED_HEADER_LEN)
+
+/* Maximum key size in bytes = 2040 / 8 */
+#define KMAC_MAX_KEY 255
+
+/*
+ * Maximum Encoded Key size will be padded to a multiple of the blocksize
+ * i.e KMAC_MAX_KEY + KMAC_MAX_ENCODED_LEN = 258
+ * Padded to a multiple of KMAC_MAX_BLOCKSIZE
+ */
+#define KMAC_MAX_KEY_ENCODED (KMAC_MAX_BLOCKSIZE * 2)
+
+/* Fixed value of encode_string("KMAC") */
+static const unsigned char kmac_string[] = {
+    0x01, 0x20, 0x4B, 0x4D, 0x41, 0x43
+};
+
+
+#define KMAC_FLAG_XOF_MODE          1
+
+/* typedef EVP_MAC_IMPL */
+struct evp_mac_impl_st {
+    EVP_MD_CTX *ctx;
+    const EVP_MD *md;
+    size_t out_len;
+    int key_len;
+    int custom_len;
+    /* If xof_mode = 1 then we use right_encode(0) */
+    int xof_mode;
+    /* key and custom are stored in encoded form */
+    unsigned char key[KMAC_MAX_KEY_ENCODED];
+    unsigned char custom[KMAC_MAX_CUSTOM_ENCODED];
+};
+
+static int encode_string(unsigned char *out, int *out_len,
+                         const unsigned char *in, int in_len);
+static int right_encode(unsigned char *out, int *out_len, size_t bits);
+static int bytepad(unsigned char *out, int *out_len,
+                   const unsigned char *in1, int in1_len,
+                   const unsigned char *in2, int in2_len,
+                   int w);
+static int kmac_bytepad_encode_key(unsigned char *out, int *out_len,
+                                   const unsigned char *in, int in_len,
+                                   int w);
+static int kmac_ctrl_str(EVP_MAC_IMPL *kctx, const char *type,
+                         const char *value);
+
+
+static void kmac_free(EVP_MAC_IMPL *kctx)
+{
+    if (kctx != NULL) {
+        EVP_MD_CTX_free(kctx->ctx);
+        OPENSSL_cleanse(kctx->key, kctx->key_len);
+        OPENSSL_cleanse(kctx->custom, kctx->custom_len);
+        OPENSSL_free(kctx);
+    }
+}
+
+static EVP_MAC_IMPL *kmac_new(const EVP_MD *md)
+{
+    EVP_MAC_IMPL *kctx = NULL;
+
+    if ((kctx = OPENSSL_zalloc(sizeof(*kctx))) == NULL
+            || (kctx->ctx = EVP_MD_CTX_new()) == NULL) {
+        kmac_free(kctx);
+        return NULL;
+    }
+    kctx->md = md;
+    kctx->out_len = md->md_size;
+    return kctx;
+}
+
+static EVP_MAC_IMPL *kmac128_new(void)
+{
+    return kmac_new(evp_keccak_kmac128());
+}
+
+static EVP_MAC_IMPL *kmac256_new(void)
+{
+    return kmac_new(evp_keccak_kmac256());
+}
+
+static int kmac_copy(EVP_MAC_IMPL *gdst, EVP_MAC_IMPL *gsrc)
+{
+    gdst->md = gsrc->md;
+    gdst->out_len = gsrc->out_len;
+    gdst->key_len = gsrc->key_len;
+    gdst->custom_len = gsrc->custom_len;
+    gdst->xof_mode = gsrc->xof_mode;
+    memcpy(gdst->key, gsrc->key, gsrc->key_len);
+    memcpy(gdst->custom, gsrc->custom, gdst->custom_len);
+
+    return EVP_MD_CTX_copy(gdst->ctx, gsrc->ctx);
+}
+
+/*
+ * The init() assumes that any ctrl methods are set beforehand for
+ * md, key and custom. Setting the fields afterwards will have no
+ * effect on the output mac.
+ */
+static int kmac_init(EVP_MAC_IMPL *kctx)
+{
+    EVP_MD_CTX *ctx = kctx->ctx;
+    unsigned char out[KMAC_MAX_BLOCKSIZE];
+    int out_len, block_len;
+
+    /* Check key has been set */
+    if (kctx->key_len == 0) {
+        EVPerr(EVP_F_KMAC_INIT, EVP_R_NO_KEY_SET);
+        return 0;
+    }
+    if (!EVP_DigestInit_ex(kctx->ctx, kctx->md, NULL))
+        return 0;
+
+    block_len = EVP_MD_block_size(kctx->md);
+
+    /* Set default custom string if it is not already set */
+    if (kctx->custom_len == 0)
+        (void)kmac_ctrl_str(kctx, "custom", "");
+
+    return bytepad(out, &out_len, kmac_string, sizeof(kmac_string),
+                   kctx->custom, kctx->custom_len, block_len)
+           && EVP_DigestUpdate(ctx, out, out_len)
+           && EVP_DigestUpdate(ctx, kctx->key, kctx->key_len);
+}
+
+static size_t kmac_size(EVP_MAC_IMPL *kctx)
+{
+    return kctx->out_len;
+}
+
+static int kmac_update(EVP_MAC_IMPL *kctx, const unsigned char *data,
+                       size_t datalen)
+{
+    return EVP_DigestUpdate(kctx->ctx, data, datalen);
+}
+
+static int kmac_final(EVP_MAC_IMPL *kctx, unsigned char *out)
+{
+    EVP_MD_CTX *ctx = kctx->ctx;
+    int lbits, len;
+    unsigned char encoded_outlen[KMAC_MAX_ENCODED_HEADER_LEN];
+
+    /* KMAC XOF mode sets the encoded length to 0 */
+    lbits = (kctx->xof_mode ? 0 : (kctx->out_len * 8));
+
+    return right_encode(encoded_outlen, &len, lbits)
+           && EVP_DigestUpdate(ctx, encoded_outlen, len)
+           && EVP_DigestFinalXOF(ctx, out, kctx->out_len);
+}
+
+/*
+ * The following Ctrl functions can be set any time before final():
+ *     - EVP_MAC_CTRL_SET_SIZE: The requested output length.
+ *     - EVP_MAC_CTRL_SET_XOF: If set, this indicates that right_encoded(0) is
+ *                             part of the digested data, otherwise it uses
+ *                             right_encoded(requested output length).
+
+ * All other Ctrl functions should be set before init().
+ */
+static int kmac_ctrl(EVP_MAC_IMPL *kctx, int cmd, va_list args)
+{
+    const unsigned char *p;
+    size_t len;
+    size_t size;
+
+    switch (cmd) {
+    case EVP_MAC_CTRL_SET_XOF:
+        kctx->xof_mode = va_arg(args, int);
+        return 1;
+
+    case EVP_MAC_CTRL_SET_SIZE:
+        size = va_arg(args, size_t);
+        kctx->out_len = size;
+        return 1;
+
+    case EVP_MAC_CTRL_SET_KEY:
+        p = va_arg(args, const unsigned char *);
+        len = va_arg(args, size_t);
+        if (len < 4 || len > KMAC_MAX_KEY) {
+            EVPerr(EVP_F_KMAC_CTRL, EVP_R_INVALID_KEY_LENGTH);
+            return 0;
+        }
+        return kmac_bytepad_encode_key(kctx->key, &kctx->key_len, p, len,
+                                       EVP_MD_block_size(kctx->md));
+
+    case EVP_MAC_CTRL_SET_CUSTOM:
+        p = va_arg(args, const unsigned char *);
+        len = va_arg(args, size_t);
+        if (len > KMAC_MAX_CUSTOM) {
+            EVPerr(EVP_F_KMAC_CTRL, EVP_R_INVALID_CUSTOM_LENGTH);
+            return 0;
+        }
+        return encode_string(kctx->custom, &kctx->custom_len, p, len);
+
+    default:
+        return -2;
+    }
+}
+
+static int kmac_ctrl_int(EVP_MAC_IMPL *kctx, int cmd, ...)
+{
+    int rv;
+    va_list args;
+
+    va_start(args, cmd);
+    rv = kmac_ctrl(kctx, cmd, args);
+    va_end(args);
+
+    return rv;
+}
+
+static int kmac_ctrl_str_cb(void *kctx, int cmd, void *buf, size_t buflen)
+{
+    return kmac_ctrl_int(kctx, cmd, buf, buflen);
+}
+
+static int kmac_ctrl_str(EVP_MAC_IMPL *kctx, const char *type,
+                         const char *value)
+{
+    if (value == NULL)
+        return 0;
+
+    if (strcmp(type, "outlen") == 0)
+        return kmac_ctrl_int(kctx, EVP_MAC_CTRL_SET_SIZE, (size_t)atoi(value));
+    if (strcmp(type, "xof") == 0)
+        return kmac_ctrl_int(kctx, EVP_MAC_CTRL_SET_XOF, atoi(value));
+    if (strcmp(type, "key") == 0)
+        return EVP_str2ctrl(kmac_ctrl_str_cb, kctx, EVP_MAC_CTRL_SET_KEY,
+                            value);
+    if (strcmp(type, "hexkey") == 0)
+        return EVP_hex2ctrl(kmac_ctrl_str_cb, kctx, EVP_MAC_CTRL_SET_KEY,
+                            value);
+    if (strcmp(type, "custom") == 0)
+        return EVP_str2ctrl(kmac_ctrl_str_cb, kctx, EVP_MAC_CTRL_SET_CUSTOM,
+                            value);
+    if (strcmp(type, "hexcustom") == 0)
+        return EVP_hex2ctrl(kmac_ctrl_str_cb, kctx, EVP_MAC_CTRL_SET_CUSTOM,
+                            value);
+    return -2;
+}
+
+/*
+ * Encoding/Padding Methods.
+ */
+
+/* Returns the number of bytes required to store 'bits' into a byte array */
+static unsigned int get_encode_size(size_t bits)
+{
+    unsigned int cnt = 0, sz = sizeof(size_t);
+
+    while (bits && (cnt < sz)) {
+        ++cnt;
+        bits >>= 8;
+    }
+    /* If bits is zero 1 byte is required */
+    if (cnt == 0)
+        cnt = 1;
+    return cnt;
+}
+
+/*
+ * Convert an integer into bytes . The number of bytes is appended
+ * to the end of the buffer. Returns an array of bytes 'out' of size
+ * *out_len.
+ *
+ * e.g if bits = 32, out[2] = { 0x20, 0x01 }
+ *
+ */
+static int right_encode(unsigned char *out, int *out_len, size_t bits)
+{
+    unsigned int len = get_encode_size(bits);
+    int i;
+
+    /* The length is constrained to a single byte: 2040/8 = 255 */
+    if (len > 0xFF)
+        return 0;
+
+    /* MSB's are at the start of the bytes array */
+    for (i = len - 1; i >= 0; --i) {
+        out[i] = (unsigned char)(bits & 0xFF);
+        bits >>= 8;
+    }
+    /* Tack the length onto the end */
+    out[len] = (unsigned char)len;
+
+    /* The Returned length includes the tacked on byte */
+    *out_len = len + 1;
+    return 1;
+}
+
+/*
+ * Encodes a string with a left encoded length added. Note that the
+ * in_len is converted to bits (*8).
+ *
+ * e.g- in="KMAC" gives out[6] = { 0x01, 0x20, 0x4B, 0x4D, 0x41, 0x43 }
+ *                                 len   bits    K     M     A     C
+ */
+static int encode_string(unsigned char *out, int *out_len,
+                         const unsigned char *in, int in_len)
+{
+    if (in == NULL) {
+        *out_len = 0;
+    } else {
+        int i, bits, len;
+
+        bits = 8 * in_len;
+        len = get_encode_size(bits);
+        if (len > 0xFF)
+            return 0;
+
+        out[0] = len;
+        for (i = len; i > 0; --i) {
+            out[i] = (bits & 0xFF);
+            bits >>= 8;
+        }
+        memcpy(out + len + 1, in, in_len);
+        *out_len = (1 + len + in_len);
+    }
+    return 1;
+}
+
+/*
+ * Returns a zero padded encoding of the inputs in1 and an optional
+ * in2 (can be NULL). The padded output must be a multiple of the blocksize 'w'.
+ * The value of w is in bytes (< 256).
+ *
+ * The returned output is:
+ *    zero_padded(multiple of w, (left_encode(w) || in1 [|| in2])
+ */
+static int bytepad(unsigned char *out, int *out_len,
+                   const unsigned char *in1, int in1_len,
+                   const unsigned char *in2, int in2_len, int w)
+{
+    int len;
+    unsigned char *p = out;
+    int sz = w;
+
+    /* Left encoded w */
+    *p++ = 1;
+    *p++ = w;
+    /* || in1 */
+    memcpy(p, in1, in1_len);
+    p += in1_len;
+    /* [ || in2 ] */
+    if (in2 != NULL && in2_len > 0) {
+        memcpy(p, in2, in2_len);
+        p += in2_len;
+    }
+    /* Figure out the pad size (divisible by w) */
+    len = p - out;
+    while (len > sz) {
+        sz += w;
+    }
+    /* zero pad the end of the buffer */
+    memset(p, 0, sz - len);
+    *out_len = sz;
+    return 1;
+}
+
+/*
+ * Returns out = bytepad(encode_string(in), w)
+ */
+static int kmac_bytepad_encode_key(unsigned char *out, int *out_len,
+                                   const unsigned char *in, int in_len,
+                                   int w)
+{
+    unsigned char tmp[KMAC_MAX_KEY + KMAC_MAX_ENCODED_HEADER_LEN];
+    int tmp_len;
+
+    if (!encode_string(tmp, &tmp_len, in, in_len))
+        return 0;
+
+    return bytepad(out, out_len, tmp, tmp_len, NULL, 0, w);
+}
+
+const EVP_MAC kmac128_meth = {
+    EVP_MAC_KMAC128,
+    kmac128_new,
+    kmac_copy,
+    kmac_free,
+    kmac_size,
+    kmac_init,
+    kmac_update,
+    kmac_final,
+    kmac_ctrl,
+    kmac_ctrl_str
+};
+
+const EVP_MAC kmac256_meth = {
+    EVP_MAC_KMAC256,
+    kmac256_new,
+    kmac_copy,
+    kmac_free,
+    kmac_size,
+    kmac_init,
+    kmac_update,
+    kmac_final,
+    kmac_ctrl,
+    kmac_ctrl_str
+};
+

crypto/objects/obj_dat.h

@@ -1079,7 +1079,7 @@ static const unsigned char so[7767] = {
     0x28,0xCC,0x45,0x03,0x04,                      /* [ 7761] OBJ_gmac */
 };
 
-#define NUM_NID 1197
+#define NUM_NID 1199
 static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"UNDEF", "undefined", NID_undef},
     {"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
@@ -2277,10 +2277,12 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"hmacWithSHA512-224", "hmacWithSHA512-224", NID_hmacWithSHA512_224, 8, &so[7745]},
     {"hmacWithSHA512-256", "hmacWithSHA512-256", NID_hmacWithSHA512_256, 8, &so[7753]},
     {"GMAC", "gmac", NID_gmac, 5, &so[7761]},
+    {"KMAC128", "kmac128", NID_kmac128},
+    {"KMAC256", "kmac256", NID_kmac256},
     {"ChaCha20-Poly1305-D", "chacha20-poly1305-draft", NID_chacha20_poly1305_draft },
 };
 
-#define NUM_SN 1188
+#define NUM_SN 1190
 static const unsigned int sn_objs[NUM_SN] = {
      364,    /* "AD_DVCS" */
      419,    /* "AES-128-CBC" */
@@ -2398,7 +2400,7 @@ static const unsigned int sn_objs[NUM_SN] = {
      417,    /* "CSPName" */
     1019,    /* "ChaCha20" */
     1018,    /* "ChaCha20-Poly1305" */
-    1196,    /* "chacha20-poly1305-draft" */
+    1198,    /* "chacha20-poly1305-draft" */
      367,    /* "CrlID" */
      391,    /* "DC" */
       31,    /* "DES-CBC" */
@@ -2447,6 +2449,8 @@ static const unsigned int sn_objs[NUM_SN] = {
      645,    /* "ITU-T" */
      646,    /* "JOINT-ISO-ITU-T" */
      773,    /* "KISA" */
+    1196,    /* "KMAC128" */
+    1197,    /* "KMAC256" */
     1063,    /* "KxANY" */
     1039,    /* "KxDHE" */
     1041,    /* "KxDHE-PSK" */
@@ -3472,7 +3476,7 @@ static const unsigned int sn_objs[NUM_SN] = {
     1093,    /* "x509ExtAdmission" */
 };
 
-#define NUM_LN 1188
+#define NUM_LN 1190
 static const unsigned int ln_objs[NUM_LN] = {
      363,    /* "AD Time Stamping" */
      405,    /* "ANSI X9.62" */
@@ -3851,7 +3855,7 @@ static const unsigned int ln_objs[NUM_LN] = {
      883,    /* "certificateRevocationList" */
     1019,    /* "chacha20" */
     1018,    /* "chacha20-poly1305" */
-    1196,    /* "ChaCha20-Poly1305-D" */
+    1198,    /* "ChaCha20-Poly1305-D" */
       54,    /* "challengePassword" */
      407,    /* "characteristic-two-field" */
      395,    /* "clearance" */
@@ -4269,6 +4273,8 @@ static const unsigned int ln_objs[NUM_LN] = {
      956,    /* "jurisdictionStateOrProvinceName" */
      150,    /* "keyBag" */
      773,    /* "kisa" */
+    1196,    /* "kmac128" */
+    1197,    /* "kmac256" */
     1063,    /* "kx-any" */
     1039,    /* "kx-dhe" */
     1041,    /* "kx-dhe-psk" */

crypto/objects/obj_mac.num

@@ -1193,4 +1193,6 @@ magma_mac		1192
 hmacWithSHA512_224		1193
 hmacWithSHA512_256		1194
 gmac		1195
-chacha20_poly1305_draft		1196
+kmac128		1196
+kmac256		1197
+chacha20_poly1305_draft		1198

crypto/objects/objects.txt

@@ -13,6 +13,10 @@ iso 3			: identified-organization
 
 # GMAC OID
 iso 0 9797 3 4                          : GMAC          : gmac
+
+# There are no OIDs for these yet...
+            : KMAC128   : kmac128
+            : KMAC256   : kmac256
  
 # HMAC OIDs
 identified-organization 6 1 5 5 8 1 1	: HMAC-MD5	: hmac-md5

crypto/siphash/siphash.c

@@ -94,7 +94,19 @@ int SipHash_set_hash_size(SIPHASH *ctx, size_t hash_size)
         && hash_size != SIPHASH_MAX_DIGEST_SIZE)
         return 0;
 
-    ctx->hash_size = hash_size;
+    /*
+     * It's possible that the key was set first.  If the hash size changes,
+     * we need to adjust v1 (see SipHash_Init().
+     */
+
+    /* Start by adjusting the stored size, to make things easier */
+    ctx->hash_size = siphash_adjust_hash_size(ctx->hash_size);
+
+    /* Now, adjust ctx->v1 if the old and the new size differ */
+    if ((size_t)ctx->hash_size != hash_size) {
+        ctx->v1 ^= 0xee;
+        ctx->hash_size = hash_size;
+    }
     return 1;
 }
 

doc/man1/x509.pod

@@ -578,7 +578,8 @@ Dump any field whose OID is not recognised by OpenSSL.
 B<sep_multiline>
 
 These options determine the field separators. The first character is
-between RDNs and the second between multiple AVAs (multiple AVAs are
+between Relative Distinguished Names (RDNs) and the second is between
+multiple Attribute Value Assertions (AVAs, multiple AVAs are
 very rare and their use is discouraged). The options ending in
 "space" additionally place a space after the separator to make it
 more readable. The B<sep_multiline> uses a linefeed character for

doc/man3/EVP_MAC.pod

@@ -169,9 +169,23 @@ This control expects two arguments: C<unsigned char *key>, C<size_t keylen>
 
 Some MAC implementations require an IV, this control sets the IV.
 
+=item B<EVP_MAC_CTRL_SET_CUSTOM>
+
+This control expects two arguments: C<unsigned char *key>, C<size_t keylen>
+
+Some MAC implementations (KMAC) require an Customization String,
+this control sets the Customization String. The default value is "".
+
+=item B<EVP_MAC_CTRL_SET_XOF>
+
+This control expects one argument: C<int xof>
+
+This option is used by KMAC.
+
+
 =item B<EVP_MAC_CTRL_SET_FLAGS>
 
-This control expects one arguments: C<unsigned long flags>
+This control expects one argument: C<unsigned long flags>
 
 These will set the MAC flags to the given numbers.
 Some MACs do not support this option.
@@ -335,6 +349,7 @@ F<./foo>)
 L<EVP_MAC_CMAC(7)>,
 L<EVP_MAC_GMAC(7)>,
 L<EVP_MAC_HMAC(7)>,
+L<EVP_MAC_KMAC(7)>,
 L<EVP_MAC_SIPHASH(7)>,
 L<EVP_MAC_POLY1305(7)>
 

doc/man3/SSL_CTX_set0_CA_list.pod

@@ -2,14 +2,32 @@
 
 =head1 NAME
 
-SSL_set0_CA_list, SSL_CTX_set0_CA_list, SSL_get0_CA_list,
+SSL_CTX_set_client_CA_list,
-SSL_CTX_get0_CA_list, SSL_add1_to_CA_list, SSL_CTX_add1_to_CA_list,
+SSL_set_client_CA_list,
-SSL_get0_peer_CA_list - get or set CA list
+SSL_get_client_CA_list,
+SSL_CTX_get_client_CA_list,
+SSL_CTX_add_client_CA,
+SSL_add_client_CA,
+SSL_set0_CA_list,
+SSL_CTX_set0_CA_list,
+SSL_get0_CA_list,
+SSL_CTX_get0_CA_list,
+SSL_add1_to_CA_list,
+SSL_CTX_add1_to_CA_list,
+SSL_get0_peer_CA_list
+- get or set CA list
 
 =head1 SYNOPSIS
 
  #include <openssl/ssl.h>
 
+ void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list);
+ void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list);
+ STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s);
+ STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx);
+ int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *cacert);
+ int SSL_add_client_CA(SSL *ssl, X509 *cacert);
+
  void SSL_CTX_set0_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list);
  void SSL_set0_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list);
  const STACK_OF(X509_NAME) *SSL_CTX_get0_CA_list(const SSL_CTX *ctx);
@@ -21,6 +39,70 @@ SSL_get0_peer_CA_list - get or set CA list
 
 =head1 DESCRIPTION
 
+The functions described here set and manage the list of CA names that are sent
+between two communicating peers.
+
+For TLS versions 1.2 and earlier the list of CA names is only sent from the
+server to the client when requesting a client certificate. So any list of CA
+names set is never sent from client to server and the list of CA names retrieved
+by SSL_get0_peer_CA_list() is always B<NULL>.
+
+For TLS 1.3 the list of CA names is sent using the B<certificate_authorities>
+extension and may be sent by a client (in the ClientHello message) or by
+a server (when requesting a certificate).
+
+In most cases it is not necessary to set CA names on the client side. The list
+of CA names that are acceptable to the client will be sent in plaintext to the
+server. This has privacy implications and may also have performance implications
+if the list is large. This optional capability was introduced as part of TLSv1.3
+and therefore setting CA names on the client side will have no impact if that
+protocol version has been disabled. Most servers do not need this and so this
+should be avoided unless required.
+
+The "client CA list" functions below only have an effect when called on the
+server side.
+
+SSL_CTX_set_client_CA_list() sets the B<list> of CAs sent to the client when
+requesting a client certificate for B<ctx>. Ownership of B<list> is transferred
+to B<ctx> and it should not be freed by the caller.
+
+SSL_set_client_CA_list() sets the B<list> of CAs sent to the client when
+requesting a client certificate for the chosen B<ssl>, overriding the
+setting valid for B<ssl>'s SSL_CTX object. Ownership of B<list> is transferred
+to B<s> and it should not be freed by the caller.
+
+SSL_CTX_get_client_CA_list() returns the list of client CAs explicitly set for
+B<ctx> using SSL_CTX_set_client_CA_list(). The returned list should not be freed
+by the caller.
+
+SSL_get_client_CA_list() returns the list of client CAs explicitly
+set for B<ssl> using SSL_set_client_CA_list() or B<ssl>'s SSL_CTX object with
+SSL_CTX_set_client_CA_list(), when in server mode. In client mode,
+SSL_get_client_CA_list returns the list of client CAs sent from the server, if
+any. The returned list should not be freed by the caller.
+
+SSL_CTX_add_client_CA() adds the CA name extracted from B<cacert> to the
+list of CAs sent to the client when requesting a client certificate for
+B<ctx>.
+
+SSL_add_client_CA() adds the CA name extracted from B<cacert> to the
+list of CAs sent to the client when requesting a client certificate for
+the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object.
+
+SSL_get0_peer_CA_list() retrieves the list of CA names (if any) the peer
+has sent. This can be called on either the server or the client side. The
+returned list should not be freed by the caller.
+
+The "generic CA list" functions below are very similar to the "client CA
+list" functions except that they have an effect on both the server and client
+sides. The lists of CA names managed are separate - so you cannot (for example)
+set CA names using the "client CA list" functions and then get them using the
+"generic CA list" functions. Where a mix of the two types of functions has been
+used on the server side then the "client CA list" functions take precedence.
+Typically, on the server side, the "client CA list " functions should be used in
+preference. As noted above in most cases it is not necessary to set CA names on
+the client side. 
+
 SSL_CTX_set0_CA_list() sets the list of CAs to be sent to the peer to
 B<name_list>. Ownership of B<name_list> is transferred to B<ctx> and
 it should not be freed by the caller.
@@ -30,10 +112,11 @@ overriding any list set in the parent B<SSL_CTX> of B<s>. Ownership of
 B<name_list> is transferred to B<s> and it should not be freed by the caller.
 
 SSL_CTX_get0_CA_list() retrieves any previously set list of CAs set for
-B<ctx>.
+B<ctx>. The returned list should not be freed by the caller.
 
-SSL_CTX_get0_CA_list() retrieves any previously set list of CAs set for
+SSL_get0_CA_list() retrieves any previously set list of CAs set for
-B<s> or if none are set the list from the parent B<SSL_CTX> is retrieved.
+B<s> or if none are set the list from the parent B<SSL_CTX> is retrieved. The
+returned list should not be freed by the caller.
 
 SSL_CTX_add1_to_CA_list() appends the CA subject name extracted from B<x> to the
 list of CAs sent to peer for B<ctx>.
@@ -42,47 +125,60 @@ SSL_add1_to_CA_list() appends the CA subject name extracted from B<x> to the
 list of CAs sent to the peer for B<s>, overriding the setting in the parent
 B<SSL_CTX>.
 
-SSL_get0_peer_CA_list() retrieves the list of CA names (if any) the peer
-has sent.
-
 =head1 NOTES
 
-These functions are generalised versions of the client authentication
+When a TLS/SSL server requests a client certificate (see
-CA list functions such as L<SSL_CTX_set_client_CA_list(3)>.
+B<SSL_CTX_set_verify(3)>), it sends a list of CAs, for which it will accept
+certificates, to the client.
 
-For TLS versions before 1.3 the list of CA names is only sent from the server
+This list must explicitly be set using SSL_CTX_set_client_CA_list() or
-to client when requesting a client certificate. So any list of CA names set
+SSL_CTX_set0_CA_list() for B<ctx> and SSL_set_client_CA_list() or
-is never sent from client to server and the list of CA names retrieved by
+SSL_set0_CA_list() for the specific B<ssl>. The list specified
-SSL_get0_peer_CA_list() is always B<NULL>.
+overrides the previous setting. The CAs listed do not become trusted (B<list>
+only contains the names, not the complete certificates); use
+L<SSL_CTX_load_verify_locations(3)> to additionally load them for verification.
 
-For TLS 1.3 the list of CA names is sent using the B<certificate_authorities>
+If the list of acceptable CAs is compiled in a file, the
-extension and will be sent by a client (in the ClientHello message) or by
+L<SSL_load_client_CA_file(3)> function can be used to help to import the
-a server (when requesting a certificate).
+necessary data.
+
+SSL_CTX_add_client_CA(), SSL_CTX_add1_to_CA_list(), SSL_add_client_CA() and
+SSL_add1_to_CA_list() can be used to add additional items the list of CAs. If no
+list was specified before using SSL_CTX_set_client_CA_list(),
+SSL_CTX_set0_CA_list(), SSL_set_client_CA_list() or SSL_set0_CA_list(), a
+new CA list for B<ctx> or B<ssl> (as appropriate) is opened.
 
 =head1 RETURN VALUES
 
-SSL_CTX_set0_CA_list() and SSL_set0_CA_list() do not return a value.
+SSL_CTX_set_client_CA_list(), SSL_set_client_CA_list(),
+SSL_CTX_set_client_CA_list(), SSL_set_client_CA_list(), SSL_CTX_set0_CA_list()
+and SSL_set0_CA_list() do not return a value.
 
-SSL_CTX_get0_CA_list() and SSL_get0_CA_list() return a stack of CA names
+SSL_CTX_get_client_CA_list(), SSL_get_client_CA_list(), SSL_CTX_get0_CA_list()
-or B<NULL> is no CA names are set.
+and SSL_get0_CA_list() return a stack of CA names or B<NULL> is no CA names are
+set.
 
-SSL_CTX_add1_to_CA_list() and SSL_add1_to_CA_list() return 1 for success and 0
+SSL_CTX_add_client_CA(),SSL_add_client_CA(), SSL_CTX_add1_to_CA_list() and
-for failure.
+SSL_add1_to_CA_list() return 1 for success and 0 for failure.
 
 SSL_get0_peer_CA_list() returns a stack of CA names sent by the peer or
 B<NULL> or an empty stack if no list was sent.
 
+=head1 EXAMPLES
+
+Scan all certificates in B<CAfile> and list them as acceptable CAs:
+
+ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));
+
 =head1 SEE ALSO
 
 L<ssl(7)>,
-L<SSL_CTX_set_client_CA_list(3)>,
-L<SSL_get_client_CA_list(3)>,
 L<SSL_load_client_CA_file(3)>,
 L<SSL_CTX_load_verify_locations(3)>
 
 =head1 COPYRIGHT
 
-Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the OpenSSL license (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy

doc/man3/SSL_CTX_set_client_CA_list.pod

@@ -1,103 +0,0 @@
-=pod
-
-=head1 NAME
-
-SSL_CTX_set_client_CA_list, SSL_set_client_CA_list, SSL_CTX_add_client_CA,
-SSL_add_client_CA - set list of CAs sent to the client when requesting a
-client certificate
-
-=head1 SYNOPSIS
-
- #include <openssl/ssl.h>
-
- void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list);
- void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list);
- int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *cacert);
- int SSL_add_client_CA(SSL *ssl, X509 *cacert);
-
-=head1 DESCRIPTION
-
-SSL_CTX_set_client_CA_list() sets the B<list> of CAs sent to the client when
-requesting a client certificate for B<ctx>.
-
-SSL_set_client_CA_list() sets the B<list> of CAs sent to the client when
-requesting a client certificate for the chosen B<ssl>, overriding the
-setting valid for B<ssl>'s SSL_CTX object.
-
-SSL_CTX_add_client_CA() adds the CA name extracted from B<cacert> to the
-list of CAs sent to the client when requesting a client certificate for
-B<ctx>.
-
-SSL_add_client_CA() adds the CA name extracted from B<cacert> to the
-list of CAs sent to the client when requesting a client certificate for
-the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object.
-
-=head1 NOTES
-
-When a TLS/SSL server requests a client certificate (see
-B<SSL_CTX_set_verify(3)>), it sends a list of CAs, for which
-it will accept certificates, to the client.
-
-This list must explicitly be set using SSL_CTX_set_client_CA_list() for
-B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list
-specified overrides the previous setting. The CAs listed do not become
-trusted (B<list> only contains the names, not the complete certificates); use
-L<SSL_CTX_load_verify_locations(3)>
-to additionally load them for verification.
-
-If the list of acceptable CAs is compiled in a file, the
-L<SSL_load_client_CA_file(3)>
-function can be used to help importing the necessary data.
-
-SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional
-items the list of client CAs. If no list was specified before using
-SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client
-CA list for B<ctx> or B<ssl> (as appropriate) is opened.
-
-These functions are only useful for TLS/SSL servers.
-
-=head1 RETURN VALUES
-
-SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return
-diagnostic information.
-
-SSL_CTX_add_client_CA() and SSL_add_client_CA() have the following return
-values:
-
-=over 4
-
-=item Z<>0
-
-A failure while manipulating the STACK_OF(X509_NAME) object occurred or
-the X509_NAME could not be extracted from B<cacert>. Check the error stack
-to find out the reason.
-
-=item Z<>1
-
-The operation succeeded.
-
-=back
-
-=head1 EXAMPLES
-
-Scan all certificates in B<CAfile> and list them as acceptable CAs:
-
- SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));
-
-=head1 SEE ALSO
-
-L<ssl(7)>,
-L<SSL_get_client_CA_list(3)>,
-L<SSL_load_client_CA_file(3)>,
-L<SSL_CTX_load_verify_locations(3)>
-
-=head1 COPYRIGHT
-
-Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
-
-Licensed under the OpenSSL license (the "License").  You may not use
-this file except in compliance with the License.  You can obtain a copy
-in the file LICENSE in the source distribution or at
-L<https://www.openssl.org/source/license.html>.
-
-=cut

doc/man3/SSL_get_client_CA_list.pod

@@ -1,62 +0,0 @@
-=pod
-
-=head1 NAME
-
-SSL_get_client_CA_list, SSL_CTX_get_client_CA_list - get list of client CAs
-
-=head1 SYNOPSIS
-
- #include <openssl/ssl.h>
-
- STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s);
- STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx);
-
-=head1 DESCRIPTION
-
-SSL_CTX_get_client_CA_list() returns the list of client CAs explicitly set for
-B<ctx> using L<SSL_CTX_set_client_CA_list(3)>.
-
-SSL_get_client_CA_list() returns the list of client CAs explicitly
-set for B<ssl> using SSL_set_client_CA_list() or B<ssl>'s SSL_CTX object with
-L<SSL_CTX_set_client_CA_list(3)>, when in
-server mode. In client mode, SSL_get_client_CA_list returns the list of
-client CAs sent from the server, if any.
-
-=head1 RETURN VALUES
-
-SSL_CTX_set_client_CA_list() and SSL_set_client_CA_list() do not return
-diagnostic information.
-
-SSL_CTX_add_client_CA() and SSL_add_client_CA() have the following return
-values:
-
-=over 4
-
-=item STACK_OF(X509_NAMES)
-
-List of CA names explicitly set (for B<ctx> or in server mode) or send
-by the server (client mode).
-
-=item NULL
-
-No client CA list was explicitly set (for B<ctx> or in server mode) or
-the server did not send a list of CAs (client mode).
-
-=back
-
-=head1 SEE ALSO
-
-L<ssl(7)>,
-L<SSL_CTX_set_client_CA_list(3)>,
-L<SSL_CTX_set_client_cert_cb(3)>
-
-=head1 COPYRIGHT
-
-Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
-
-Licensed under the OpenSSL license (the "License").  You may not use
-this file except in compliance with the License.  You can obtain a copy
-in the file LICENSE in the source distribution or at
-L<https://www.openssl.org/source/license.html>.
-
-=cut

doc/man3/SSL_get_peer_signature_nid.pod

@@ -2,8 +2,9 @@
 
 =head1 NAME
 
-SSL_get_peer_signature_nid, SSL_get_peer_signature_type_nid - get TLS
+SSL_get_peer_signature_nid, SSL_get_peer_signature_type_nid,
-message signing types
+SSL_get_signature_nid, SSL_get_signature_type_nid - get TLS message signing
+types
 
 =head1 SYNOPSIS
 
@@ -11,6 +12,8 @@ message signing types
 
  int SSL_get_peer_signature_nid(SSL *ssl, int *psig_nid);
  int SSL_get_peer_signature_type_nid(const SSL *ssl, int *psigtype_nid);
+ int SSL_get_signature_nid(SSL *ssl, int *psig_nid);
+ int SSL_get_signature_type_nid(const SSL *ssl, int *psigtype_nid);
 
 =head1 DESCRIPTION
 
@@ -24,12 +27,15 @@ where it is B<EVP_PKEY_RSA_PSS>. To differentiate between
 B<rsa_pss_rsae_*> and B<rsa_pss_pss_*> signatures, it's necessary to check
 the type of public key in the peer's certificate.
 
+SSL_get_signature_nid() and SSL_get_signature_type_nid() return the equivalent
+information for the local end of the connection.
+
 =head1 RETURN VALUES
 
 These functions return 1 for success and 0 for failure. There are several
 possible reasons for failure: the cipher suite has no signature (e.g. it
 uses RSA key exchange or is anonymous), the TLS version is below 1.2 or
-the functions were called before the peer signed a message.
+the functions were called too early, e.g. before the peer signed a message.
 
 =head1 SEE ALSO
 

doc/man3/SSL_get_peer_tmp_key.pod

@@ -2,26 +2,36 @@
 
 =head1 NAME
 
-SSL_get_server_tmp_key - get information about the server's temporary key used
+SSL_get_peer_tmp_key, SSL_get_server_tmp_key, SSL_get_tmp_key - get information
-during a handshake
+about temporary keys used during a handshake
 
 =head1 SYNOPSIS
 
  #include <openssl/ssl.h>
 
+ long SSL_get_peer_tmp_key(SSL *ssl, EVP_PKEY **key);
  long SSL_get_server_tmp_key(SSL *ssl, EVP_PKEY **key);
+ long SSL_get_tmp_key(SSL *ssl, EVP_PKEY **key);
 
 =head1 DESCRIPTION
 
-SSL_get_server_tmp_key() returns the temporary key provided by the server and
+SSL_get_peer_tmp_key() returns the temporary key provided by the peer and
 used during key exchange. For example, if ECDHE is in use, then this represents
-the server's public ECDHE key. On success a pointer to the key is stored in
+the peer's public ECDHE key. On success a pointer to the key is stored in
 B<*key>. It is the caller's responsibility to free this key after use using
-L<EVP_PKEY_free(3)>. This function may only be called by the client.
+L<EVP_PKEY_free(3)>.
+
+SSL_get_server_tmp_key() is a backwards compatibility alias for
+SSL_get_peer_tmp_key().
+Under that name it worked just on the client side of the connection, its
+behaviour on the server end is release-dependent.
+
+SSL_get_tmp_key() returns the equivalent information for the local
+end of the connection.
 
 =head1 RETURN VALUES
 
-SSL_get_server_tmp_key() returns 1 on success or 0 otherwise.
+All these functions return 1 on success and 0 otherwise.
 
 =head1 NOTES
 

doc/man7/EVP_MAC_KMAC.pod

@@ -0,0 +1,94 @@
+=pod
+
+=head1 NAME
+
+EVP_MAC_KMAC - The KMAC EVP_MAC implementation
+
+=head1 DESCRIPTION
+
+Support for computing KMAC MACs through the B<EVP_MAC> API.
+
+=head2 Numeric identity
+
+B<EVP_MAC_KMAC128> and B<EVP_MAC_KMAC256> are the numeric identities for this
+implementation, and can be used in functions like EVP_MAC_CTX_new_id() and
+EVP_get_macbynid().
+
+=head2 Supported controls
+
+The supported controls are:
+
+=over 4
+
+=item B<EVP_MAC_CTRL_SET_KEY>
+
+This must be set before calling EVP_MAC_init().
+
+EVP_MAC_ctrl_str() takes two type strings for this control:
+
+=over 4
+
+=item "key"
+
+The value string is used as is.
+
+=item "hexkey"
+
+The value string is expected to be a hexadecimal number, which will be
+decoded before passing on as control value.
+
+=back
+
+=item B<EVP_MAC_CTRL_SET_CUSTOM>
+
+This is an optional string value that can be set before calling EVP_MAC_init().
+If it is not set it uses the default value "".
+
+EVP_MAC_ctrl_str() takes two type strings for this control:
+
+=over 4
+
+=item "custom"
+
+The value string is used as is.
+
+=item "hexcustom"
+
+The value string is expected to be a hexadecimal number, which will be
+decoded before passing on as control value.
+
+=back
+
+=item B<EVP_MAC_CTRL_SET_SIZE>
+
+EVP_MAC_ctrl_str() type string: "outlen"
+
+This is an optional value string containing a decimal number. If it is not set
+it uses the default value of 32 for EVP_MAC_KMAC128 and 64 for EVP_MAC_KMAC256.
+This can be called any time before EVP_MAC_final().
+
+=item B<EVP_MAC_CTRL_SET_XOF>
+
+EVP_MAC_ctrl_str() type string: "xof"
+
+The value string is expected to be an integer value of 1 or 0. Use 1 to enable
+XOF mode. If XOF is enabled then the output len that is encoded as part of the
+input stream is set to zero.
+This can be called any time before EVP_MAC_final().
+
+=back
+
+=head1 SEE ALSO
+
+L<EVP_MAC_ctrl(3)>, L<EVP_MAC(3)/CONTROLS>
+
+=head1 COPYRIGHT
+
+Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the OpenSSL license (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

include/openssl/evp.h

@@ -717,6 +717,7 @@ const EVP_MD *EVP_sha3_384(void);
 const EVP_MD *EVP_sha3_512(void);
 const EVP_MD *EVP_shake128(void);
 const EVP_MD *EVP_shake256(void);
+
 # ifndef OPENSSL_NO_MDC2
 const EVP_MD *EVP_mdc2(void);
 # endif
@@ -991,6 +992,8 @@ void EVP_MD_do_all_sorted(void (*fn)
 # define EVP_MAC_CMAC           NID_cmac
 # define EVP_MAC_GMAC           NID_gmac
 # define EVP_MAC_HMAC           NID_hmac
+# define EVP_MAC_KMAC128        NID_kmac128
+# define EVP_MAC_KMAC256        NID_kmac256
 # define EVP_MAC_SIPHASH        NID_siphash
 # define EVP_MAC_POLY1305       NID_poly1305
 
@@ -1028,6 +1031,8 @@ void EVP_MAC_do_all_sorted(void (*fn)
 # define EVP_MAC_CTRL_SET_CIPHER        0x05 /* EVP_CIPHER * */
 # define EVP_MAC_CTRL_SET_SIZE          0x06 /* size_t */
 # define EVP_MAC_CTRL_SET_IV            0x07 /* unsigned char *, size_t */
+# define EVP_MAC_CTRL_SET_CUSTOM        0x08 /* unsigned char *, size_t */
+# define EVP_MAC_CTRL_SET_XOF           0x09 /* int */
 
 /* PKEY stuff */
 int EVP_PKEY_decrypt_old(unsigned char *dec_key,

include/openssl/evperr.h

@@ -113,6 +113,8 @@ int ERR_load_EVP_strings(void);
 # define EVP_F_EVP_VERIFYFINAL                            108
 # define EVP_F_GMAC_CTRL                                  215
 # define EVP_F_INT_CTX_NEW                                157
+# define EVP_F_KMAC_CTRL                                  217
+# define EVP_F_KMAC_INIT                                  218
 # define EVP_F_OK_NEW                                     200
 # define EVP_F_PKCS5_PBE_KEYIVGEN                         117
 # define EVP_F_PKCS5_V2_PBE_KEYIVGEN                      118
@@ -159,6 +161,7 @@ int ERR_load_EVP_strings(void);
 # define EVP_R_ILLEGAL_SCRYPT_PARAMETERS                  171
 # define EVP_R_INITIALIZATION_ERROR                       134
 # define EVP_R_INPUT_NOT_INITIALIZED                      111
+# define EVP_R_INVALID_CUSTOM_LENGTH                      185
 # define EVP_R_INVALID_DIGEST                             152
 # define EVP_R_INVALID_FIPS_MODE                          168
 # define EVP_R_INVALID_KEY                                163

include/openssl/obj_mac.h

@@ -49,6 +49,14 @@
 #define NID_gmac                1195
 #define OBJ_gmac                OBJ_iso,0L,9797L,3L,4L
 
+#define SN_kmac128              "KMAC128"
+#define LN_kmac128              "kmac128"
+#define NID_kmac128             1196
+
+#define SN_kmac256              "KMAC256"
+#define LN_kmac256              "kmac256"
+#define NID_kmac256             1197
+
 #define SN_hmac_md5             "HMAC-MD5"
 #define LN_hmac_md5             "hmac-md5"
 #define NID_hmac_md5            780
@@ -4818,7 +4826,7 @@
 
 #define SN_chacha20_poly1305_draft      "ChaCha20-Poly1305-D"
 #define LN_chacha20_poly1305_draft      "chacha20-poly1305-draft"
-#define NID_chacha20_poly1305_draft     1195
+#define NID_chacha20_poly1305_draft     1198
 
 #define SN_dhpublicnumber               "dhpublicnumber"
 #define LN_dhpublicnumber               "X9.42 DH"

include/openssl/ssl.h

@@ -1272,7 +1272,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 # define SSL_CTRL_SET_VERIFY_CERT_STORE          106
 # define SSL_CTRL_SET_CHAIN_CERT_STORE           107
 # define SSL_CTRL_GET_PEER_SIGNATURE_NID         108
-# define SSL_CTRL_GET_SERVER_TMP_KEY             109
+# define SSL_CTRL_GET_PEER_TMP_KEY               109
 # define SSL_CTRL_GET_RAW_CIPHERLIST             110
 # define SSL_CTRL_GET_EC_POINT_FORMATS           111
 # define SSL_CTRL_GET_CHAIN_CERTS                115
@@ -1291,6 +1291,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG   129
 # define SSL_CTRL_GET_MIN_PROTO_VERSION          130
 # define SSL_CTRL_GET_MAX_PROTO_VERSION          131
+# define SSL_CTRL_GET_SIGNATURE_NID              132
+# define SSL_CTRL_GET_TMP_KEY                    133
 # define SSL_CERT_SET_FIRST                      1
 # define SSL_CERT_SET_NEXT                       2
 # define SSL_CERT_SET_SERVER                     3
@@ -1411,10 +1413,14 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
                      (char *)(clist))
 # define SSL_set1_client_certificate_types(s, clist, clistlen) \
         SSL_ctrl(s,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)(clist))
+# define SSL_get_signature_nid(s, pn) \
+        SSL_ctrl(s,SSL_CTRL_GET_SIGNATURE_NID,0,pn)
 # define SSL_get_peer_signature_nid(s, pn) \
         SSL_ctrl(s,SSL_CTRL_GET_PEER_SIGNATURE_NID,0,pn)
-# define SSL_get_server_tmp_key(s, pk) \
+# define SSL_get_peer_tmp_key(s, pk) \
-        SSL_ctrl(s,SSL_CTRL_GET_SERVER_TMP_KEY,0,pk)
+        SSL_ctrl(s,SSL_CTRL_GET_PEER_TMP_KEY,0,pk)
+# define SSL_get_tmp_key(s, pk) \
+        SSL_ctrl(s,SSL_CTRL_GET_TMP_KEY,0,pk)
 # define SSL_get0_raw_cipherlist(s, plst) \
         SSL_ctrl(s,SSL_CTRL_GET_RAW_CIPHERLIST,0,plst)
 # define SSL_get0_ec_point_formats(s, plst) \
@@ -1436,6 +1442,12 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 # define SSL_get_max_proto_version(s) \
         SSL_ctrl(s, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL)
 
+/* Backwards compatibility, original 1.1.0 names */
+# define SSL_CTRL_GET_SERVER_TMP_KEY \
+         SSL_CTRL_GET_PEER_TMP_KEY
+# define SSL_get_server_tmp_key(s, pk) \
+         SSL_get_peer_tmp_key(s, pk)
+
 /*
  * The following symbol names are old and obsolete. They are kept
  * for compatibility reasons only and should not be used anymore.

include/openssl/tls1.h

@@ -251,6 +251,7 @@ __owur int SSL_export_keying_material_early(SSL *s, unsigned char *out,
                                             size_t contextlen);
 
 int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid);
+int SSL_get_signature_type_nid(const SSL *s, int *pnid);
 
 int SSL_get_sigalgs(SSL *s, int idx,
                     int *psign, int *phash, int *psignandhash,

ssl/s3_lib.c

@@ -3735,9 +3735,15 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         *(int *)parg = s->s3->tmp.peer_sigalg->hash;
         return 1;
 
-    case SSL_CTRL_GET_SERVER_TMP_KEY:
+    case SSL_CTRL_GET_SIGNATURE_NID:
+        if (s->s3->tmp.sigalg == NULL)
+            return 0;
+        *(int *)parg = s->s3->tmp.sigalg->hash;
+        return 1;
+
+    case SSL_CTRL_GET_PEER_TMP_KEY:
 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
-        if (s->server || s->session == NULL || s->s3->peer_tmp == NULL) {
+        if (s->session == NULL || s->s3->peer_tmp == NULL) {
             return 0;
         } else {
             EVP_PKEY_up_ref(s->s3->peer_tmp);
@@ -3747,6 +3753,20 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 #else
         return 0;
 #endif
+
+    case SSL_CTRL_GET_TMP_KEY:
+#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)
+        if (s->session == NULL || s->s3->tmp.pkey == NULL) {
+            return 0;
+        } else {
+            EVP_PKEY_up_ref(s->s3->tmp.pkey);
+            *(EVP_PKEY **)parg = s->s3->tmp.pkey;
+            return 1;
+        }
+#else
+        return 0;
+#endif
+
 #ifndef OPENSSL_NO_EC
     case SSL_CTRL_GET_EC_POINT_FORMATS:
         {

ssl/ssl_cert.c

@@ -501,17 +501,17 @@ const STACK_OF(X509_NAME) *SSL_get0_CA_list(const SSL *s)
 
 void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)
 {
-    SSL_CTX_set0_CA_list(ctx, name_list);
+    set0_CA_list(&ctx->client_ca_names, name_list);
 }
 
 STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
 {
-    return ctx->ca_names;
+    return ctx->client_ca_names;
 }
 
 void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)
 {
-    SSL_set0_CA_list(s, name_list);
+    set0_CA_list(&s->client_ca_names, name_list);
 }
 
 const STACK_OF(X509_NAME) *SSL_get0_peer_CA_list(const SSL *s)
@@ -523,7 +523,8 @@ STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s)
 {
     if (!s->server)
         return s->s3 != NULL ?  s->s3->tmp.peer_ca_names : NULL;
-    return s->ca_names != NULL ?  s->ca_names : s->ctx->ca_names;
+    return s->client_ca_names != NULL ?  s->client_ca_names
+                                      : s->ctx->client_ca_names;
 }
 
 static int add_ca_name(STACK_OF(X509_NAME) **sk, const X509 *x)
@@ -561,12 +562,12 @@ int SSL_CTX_add1_to_CA_list(SSL_CTX *ctx, const X509 *x)
  */
 int SSL_add_client_CA(SSL *ssl, X509 *x)
 {
-    return add_ca_name(&ssl->ca_names, x);
+    return add_ca_name(&ssl->client_ca_names, x);
 }
 
 int SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
 {
-    return add_ca_name(&ctx->ca_names, x);
+    return add_ca_name(&ctx->client_ca_names, x);
 }
 
 static int xname_cmp(const X509_NAME *a, const X509_NAME *b)

ssl/ssl_lib.c

@@ -1260,6 +1260,7 @@ void SSL_free(SSL *s)
     EVP_MD_CTX_free(s->pha_dgst);
 
     sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
+    sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
 
     sk_X509_pop_free(s->verified_chain, X509_free);
 
@@ -3019,6 +3020,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
     if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL)
         goto err;
 
+    if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL)
+        goto err;
+
     if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data))
         goto err;
 
@@ -3176,6 +3180,7 @@ void SSL_CTX_free(SSL_CTX *a)
     sk_SSL_CIPHER_free(a->tls13_ciphersuites);
     ssl_cert_free(a->cert);
     sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);
+    sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);
     sk_X509_pop_free(a->extra_certs, X509_free);
     a->comp_methods = NULL;
 #ifndef OPENSSL_NO_SRTP
@@ -3721,10 +3726,38 @@ const char *SSL_get_version(const SSL *s)
     return ssl_protocol_to_string(s->version);
 }
 
-SSL *SSL_dup(SSL *s)
+static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src)
 {
     STACK_OF(X509_NAME) *sk;
     X509_NAME *xn;
+    int i;
+
+    if (src == NULL) {
+        *dst = NULL;
+        return 1;
+    }
+
+    if ((sk = sk_X509_NAME_new_null()) == NULL)
+        return 0;
+    for (i = 0; i < sk_X509_NAME_num(src); i++) {
+        xn = X509_NAME_dup(sk_X509_NAME_value(src, i));
+        if (xn == NULL) {
+            sk_X509_NAME_pop_free(sk, X509_NAME_free);
+            return 0;
+        }
+        if (sk_X509_NAME_insert(sk, xn, i) == 0) {
+            X509_NAME_free(xn);
+            sk_X509_NAME_pop_free(sk, X509_NAME_free);
+            return 0;
+        }
+    }
+    *dst = sk;
+
+    return 1;
+}
+
+SSL *SSL_dup(SSL *s)
+{
     SSL *ret;
     int i;
 
@@ -3831,18 +3864,10 @@ SSL *SSL_dup(SSL *s)
     }
 
     /* Dup the client_CA list */
-    if (s->ca_names != NULL) {
+    if (!dup_ca_names(&ret->ca_names, s->ca_names)
-        if ((sk = sk_X509_NAME_dup(s->ca_names)) == NULL)
+            || !dup_ca_names(&ret->client_ca_names, s->client_ca_names))
-            goto err;
+        goto err;
-        ret->ca_names = sk;
+
-        for (i = 0; i < sk_X509_NAME_num(sk); i++) {
-            xn = sk_X509_NAME_value(sk, i);
-            if (sk_X509_NAME_set(sk, i, X509_NAME_dup(xn)) == NULL) {
-                X509_NAME_free(xn);
-                goto err;
-            }
-        }
-    }
     return ret;
 
  err:

ssl/ssl_locl.h

@@ -892,9 +892,11 @@ struct ssl_ctx_st {
     /*
      * What we put in certificate_authorities extension for TLS 1.3
      * (ClientHello and CertificateRequest) or just client cert requests for
-     * earlier versions.
+     * earlier versions. If client_ca_names is populated then it is only used
+     * for client cert requests, and in preference to ca_names.
      */
     STACK_OF(X509_NAME) *ca_names;
+    STACK_OF(X509_NAME) *client_ca_names;
 
     /*
      * Default values to use in SSL structures follow (these are copied by
@@ -1273,8 +1275,14 @@ struct ssl_st {
     long verify_result;
     /* extra application data */
     CRYPTO_EX_DATA ex_data;
-    /* for server side, keep the list of CA_dn we can use */
+    /*
+     * What we put in certificate_authorities extension for TLS 1.3
+     * (ClientHello and CertificateRequest) or just client cert requests for
+     * earlier versions. If client_ca_names is populated then it is only used
+     * for client cert requests, and in preference to ca_names.
+     */
     STACK_OF(X509_NAME) *ca_names;
+    STACK_OF(X509_NAME) *client_ca_names;
     CRYPTO_REF_COUNT references;
     /* protocol behaviour */
     uint32_t options;
@@ -2611,6 +2619,7 @@ __owur int tls1_process_sigalgs(SSL *s);
 __owur int tls1_set_peer_legacy_sigalg(SSL *s, const EVP_PKEY *pkey);
 __owur int tls1_lookup_md(const SIGALG_LOOKUP *lu, const EVP_MD **pmd);
 __owur size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs);
+__owur int tls_check_sigalg_curve(const SSL *s, int curve);
 __owur int tls12_check_peer_sigalg(SSL *s, uint16_t, EVP_PKEY *pkey);
 __owur int ssl_set_client_disabled(SSL *s);
 __owur int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op, int echde);

ssl/statem/extensions.c

@@ -1198,7 +1198,7 @@ static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt,
                                                         X509 *x,
                                                         size_t chainidx)
 {
-    const STACK_OF(X509_NAME) *ca_sk = SSL_get0_CA_list(s);
+    const STACK_OF(X509_NAME) *ca_sk = get_ca_names(s);
 
     if (ca_sk == NULL || sk_X509_NAME_num(ca_sk) == 0)
         return EXT_RETURN_NOT_SENT;
@@ -1211,7 +1211,7 @@ static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt,
         return EXT_RETURN_FAIL;
     }
 
-    if (!construct_ca_names(s, pkt)) {
+    if (!construct_ca_names(s, ca_sk, pkt)) {
         /* SSLfatal() already called */
         return EXT_RETURN_FAIL;
     }

ssl/statem/statem_lib.c

@@ -1506,7 +1506,8 @@ static int ssl_method_error(const SSL *s, const SSL_METHOD *method)
  */
 static int is_tls13_capable(const SSL *s)
 {
-    int i;
+    int i, curve;
+    EC_KEY *eckey;
 
 #ifndef OPENSSL_NO_PSK
     if (s->psk_server_callback != NULL)
@@ -1527,7 +1528,20 @@ static int is_tls13_capable(const SSL *s)
         default:
             break;
         }
-        if (ssl_has_cert(s, i))
+        if (!ssl_has_cert(s, i))
+            continue;
+        if (i != SSL_PKEY_ECC)
+            return 1;
+        /*
+         * Prior to TLSv1.3 sig algs allowed any curve to be used. TLSv1.3 is
+         * more restrictive so check that our sig algs are consistent with this
+         * EC cert. See section 4.2.3 of RFC8446.
+         */
+        eckey = EVP_PKEY_get0_EC_KEY(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
+        if (eckey == NULL)
+            continue;
+        curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey));
+        if (tls_check_sigalg_curve(s, curve))
             return 1;
     }
 
@@ -2295,10 +2309,24 @@ int parse_ca_names(SSL *s, PACKET *pkt)
     return 0;
 }
 
-int construct_ca_names(SSL *s, WPACKET *pkt)
+const STACK_OF(X509_NAME) *get_ca_names(SSL *s)
 {
-    const STACK_OF(X509_NAME) *ca_sk = SSL_get0_CA_list(s);
+    const STACK_OF(X509_NAME) *ca_sk = NULL;;
 
+    if (s->server) {
+        ca_sk = SSL_get_client_CA_list(s);
+        if (ca_sk != NULL && sk_X509_NAME_num(ca_sk) == 0)
+            ca_sk = NULL;
+    }
+
+    if (ca_sk == NULL)
+        ca_sk = SSL_get0_CA_list(s);
+
+    return ca_sk;
+}
+
+int construct_ca_names(SSL *s, const STACK_OF(X509_NAME) *ca_sk, WPACKET *pkt)
+{
     /* Start sub-packet for client CA list */
     if (!WPACKET_start_sub_packet_u16(pkt)) {
         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_CA_NAMES,

ssl/statem/statem_locl.h

@@ -61,7 +61,8 @@ int create_synthetic_message_hash(SSL *s, const unsigned char *hashval,
                                   size_t hashlen, const unsigned char *hrr,
                                   size_t hrrlen);
 int parse_ca_names(SSL *s, PACKET *pkt);
-int construct_ca_names(SSL *s, WPACKET *pkt);
+const STACK_OF(X509_NAME) *get_ca_names(SSL *s);
+int construct_ca_names(SSL *s, const STACK_OF(X509_NAME) *ca_sk, WPACKET *pkt);
 size_t construct_key_exchange_tbs(SSL *s, unsigned char **ptbs,
                                   const void *param, size_t paramlen);
 

ssl/statem/statem_srvr.c

@@ -2881,7 +2881,7 @@ int tls_construct_certificate_request(SSL *s, WPACKET *pkt)
         }
     }
 
-    if (!construct_ca_names(s, pkt)) {
+    if (!construct_ca_names(s, get_ca_names(s), pkt)) {
         /* SSLfatal() already called */
         return 0;
     }

ssl/t1_lib.c

@@ -949,6 +949,37 @@ size_t tls12_get_psigalgs(SSL *s, int sent, const uint16_t **psigs)
     }
 }
 
+/*
+ * Called by servers only. Checks that we have a sig alg that supports the
+ * specified EC curve.
+ */
+int tls_check_sigalg_curve(const SSL *s, int curve)
+{
+   const uint16_t *sigs;
+   size_t siglen, i;
+
+    if (s->cert->conf_sigalgs) {
+        sigs = s->cert->conf_sigalgs;
+        siglen = s->cert->conf_sigalgslen;
+    } else {
+        sigs = tls12_sigalgs;
+        siglen = OSSL_NELEM(tls12_sigalgs);
+    }
+
+    for (i = 0; i < siglen; i++) {
+        const SIGALG_LOOKUP *lu = tls1_lookup_sigalg(sigs[i]);
+
+        if (lu == NULL)
+            continue;
+        if (lu->sig == EVP_PKEY_EC
+                && lu->curve != NID_undef
+                && curve == lu->curve)
+            return 1;
+    }
+
+    return 0;
+}
+
 /*
  * Check signature algorithm is consistent with sent supported signature
  * algorithms and if so set relevant digest and signature scheme in
@@ -1091,6 +1122,14 @@ int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid)
     return 1;
 }
 
+int SSL_get_signature_type_nid(const SSL *s, int *pnid)
+{
+    if (s->s3->tmp.sigalg == NULL)
+        return 0;
+    *pnid = s->s3->tmp.sigalg->sig;
+    return 1;
+}
+
 /*
  * Set a mask of disabled algorithms: an algorithm is disabled if it isn't
  * supported, doesn't appear in supported signature algorithms, isn't supported

test/certs/server-ecdsa-brainpoolP256r1-cert.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICgzCCAWugAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
+IENBMCAXDTE4MTAyNDEzNDUwOFoYDzIxMTgxMDI1MTM0NTA4WjAsMSowKAYDVQQD
+DCFTZXJ2ZXIgRUNEU0EgYnJhaW5wb29sUDI1NnIxIGNlcnQwWjAUBgcqhkjOPQIB
+BgkrJAMDAggBAQcDQgAETYDLIgpvvoxSBJxB5apcNrTZ0vYpVyG18hDEOplqkyln
+W7kekN9a83WtIwPRoSwhczgFg/MhvLZ/BHQJW2SU3qOBkTCBjjAdBgNVHQ4EFgQU
+it8K0UIpDYE264JfNmQ/44H1WMUwHwYDVR0jBBgwFoAUcH8uroNoWZgEIyrN6z4X
+zSTdAUkwCQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAsBgNVHREEJTAj
+giFTZXJ2ZXIgRUNEU0EgYnJhaW5wb29sUDI1NnIxIGNlcnQwDQYJKoZIhvcNAQEL
+BQADggEBAKCEUMQlB+M6crHe2zfGmQJnsEGzY4fJUFYdFfOM359dXR8Xs+JHF2XP
+0BHJ64BHLzy+3eoa9w/B+/i6OVJo3VhCoCChcP+gnGzQVQy5Maxq55DlsVdpellS
+Tml/BnLcqcZFAP63qEpcuZuC4CytZcHYCU+NLI/3JGzH1/xHxk4UgRTa2B7OhjXt
+Ptl3vLaSqJXEmVeCP0hibhhiszs0zR14fJqmVn0V5MKC7twmG8CBlW03ksLjzzvn
+m7WAy7q5WcFcAcrFR3zAPqcx4UQSS9FiwJ+OOZGqIasMk9i9zxqh0ic5M5ls7Qaf
+roudyLLkkvDFkcb88RwYGKrdVFGDgF0=
+-----END CERTIFICATE-----

test/certs/server-ecdsa-brainpoolP256r1-key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGIAgEAMBQGByqGSM49AgEGCSskAwMCCAEBBwRtMGsCAQEEIKZSRhbD6lGhKbIm
+5JVgxnN8MHGB0whroUsSf0zmsAz+oUQDQgAETYDLIgpvvoxSBJxB5apcNrTZ0vYp
+VyG18hDEOplqkylnW7kekN9a83WtIwPRoSwhczgFg/MhvLZ/BHQJW2SU3g==
+-----END PRIVATE KEY-----

test/certs/setup.sh

@@ -365,3 +365,7 @@ REQMASK=MASK:0x800 ./mkcert.sh req badalt7-key "O = Bad NC Test Certificate 7" \
 # SHA256
 ./mkcert.sh genee PSS-SHA256 ee-key ee-pss-sha256-cert ca-key ca-cert \
     -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:digest
+
+OPENSSL_KEYALG=ec OPENSSL_KEYBITS=brainpoolP256r1 ./mkcert.sh genee \
+    "Server ECDSA brainpoolP256r1 cert" server-ecdsa-brainpoolP256r1-key \
+    server-ecdsa-brainpoolP256r1-cert rootkey rootcert

test/evp_test.c

@@ -847,6 +847,8 @@ typedef struct mac_data_st {
     /* Expected output */
     unsigned char *output;
     size_t output_len;
+    unsigned char *custom;
+    size_t custom_len;
     /* Collection of controls */
     STACK_OF(OPENSSL_STRING) *controls;
 } MAC_DATA;
@@ -929,6 +931,7 @@ static void mac_test_cleanup(EVP_TEST *t)
     OPENSSL_free(mdat->alg);
     OPENSSL_free(mdat->key);
     OPENSSL_free(mdat->iv);
+    OPENSSL_free(mdat->custom);
     OPENSSL_free(mdat->input);
     OPENSSL_free(mdat->output);
 }
@@ -942,6 +945,8 @@ static int mac_test_parse(EVP_TEST *t,
         return parse_bin(value, &mdata->key, &mdata->key_len);
     if (strcmp(keyword, "IV") == 0)
         return parse_bin(value, &mdata->iv, &mdata->iv_len);
+    if (strcmp(keyword, "Custom") == 0)
+        return parse_bin(value, &mdata->custom, &mdata->custom_len);
     if (strcmp(keyword, "Algorithm") == 0) {
         mdata->alg = OPENSSL_strdup(value);
         if (!mdata->alg)
@@ -1124,6 +1129,17 @@ static int mac_test_run_mac(EVP_TEST *t)
         t->err = "MAC_CTRL_ERROR";
         goto err;
     }
+    if (expected->custom != NULL) {
+        rv = EVP_MAC_ctrl(ctx, EVP_MAC_CTRL_SET_CUSTOM,
+                          expected->custom, expected->custom_len);
+        if (rv == -2) {
+            t->err = "MAC_CTRL_INVALID";
+            goto err;
+        } else if (rv <= 0) {
+            t->err = "MAC_CTRL_ERROR";
+            goto err;
+        }
+    }
 
     if (expected->iv != NULL) {
         rv = EVP_MAC_ctrl(ctx, EVP_MAC_CTRL_SET_IV,

test/handshake_helper.c

@@ -1673,7 +1673,7 @@ static HANDSHAKE_RESULT *do_handshake_internal(
             *serv_sess_out = SSL_SESSION_dup(tmp);
     }
 
-    if (SSL_get_server_tmp_key(client.ssl, &tmp_key)) {
+    if (SSL_get_peer_tmp_key(client.ssl, &tmp_key)) {
         ret->tmp_key_type = pkey_type(tmp_key);
         EVP_PKEY_free(tmp_key);
     }

test/recipes/30-test_evp_data/evpmac.txt

@@ -134,7 +134,7 @@ MAC = SipHash
 Ctrl = digestsize:8
 Key = 000102030405060708090A0B0C0D0E0F
 Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E
-Output = B96AB0B9D449A78A
+Output = 724506EB4C328A95
 
 # SIPHASH - default values: 2,4 rounds, explicit 16-byte mac
 
@@ -455,6 +455,92 @@ Input = 68F2E77696CE7AE8E2CA4EC588E541002E58495C08000F101112131415161718191A1B1C
 Output = 00BDA1B7E87608BCBF470F12157F4C07
 
 
+Title = KMAC Tests (From NIST)
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = ""
+Output = E5780B0D3EA6F7D3A429C5706AA43A00FADBD7D49628839E3187243F456EE14E
+Ctrl = xof:0
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 3B1FBA963CD8B0B59E8C1A6D71888B7143651AF8BA0A7070C0979E2811324AA5
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = 1F5B4E6CCA02209E0DCB5CA635B89A15E271ECC760071DFD805FAA38F9729230
+Ctrl = outlen:32
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 20C570C31346F703C9AC36C61C03CB64C3970D0CFC787E9B79599D273A68D2F7F69D4CC3DE9D104A351689F27CF6F5951F0103F33F4F24871024D9C27773A8DD
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = ""
+Output = 75358CF39E41494E949707927CEE0AF20A3FF553904C86B08F21CC414BCFD691589D27CF5E15369CBBFF8B9A4C2EB17800855D0235FF635DA82533EC6B759B69
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = B58618F71F92E1D56C1B8C55DDD7CD188B97B4CA4D99831EB2699A837DA2E4D970FBACFDE50033AEA585F1A2708510C32D07880801BD182898FE476876FC8965
+Ctrl = outlen:64
+
+Title = KMAC XOF Tests (From NIST)
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Output = CD83740BBD92CCC8CF032B1481A0F4460E7CA9DD12B08A0C4031178BACD6EC35
+Ctrl = xof:1
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 31A44527B4ED9F5C6101D11DE6D26F0620AA5C341DEF41299657FE9DF1A3B16C
+Ctrl = xof:1
+
+MAC = KMAC128
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F
+Ctrl = xof:1
+Ctrl = outlen:32
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 00010203
+Custom = "My Tagged Application"
+Output = 1755133F1534752AAD0748F2C706FB5C784512CAB835CD15676B16C0C6647FA96FAA7AF634A0BF8FF6DF39374FA00FAD9A39E322A7C92065A64EB1FB0801EB2B
+Ctrl = xof:1
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = ""
+Output = FF7B171F1E8A2B24683EED37830EE797538BA8DC563F6DA1E667391A75EDC02CA633079F81CE12A25F45615EC89972031D18337331D24CEB8F8CA8E6A19FD98B
+Ctrl = xof:1
+
+MAC = KMAC256
+Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F
+Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7
+Custom = "My Tagged Application"
+Output = D5BE731C954ED7732846BB59DBE3A8E30F83E77A4BFF4459F2F1C2B4ECEBB8CE67BA01C62E8AB8578D2D499BD1BB276768781190020A306A97DE281DCC30305D
+Ctrl = outlen:64
+Ctrl = xof:1
+
+
 Title = Poly1305 Tests (from RFC 7539 and others)
 
 MAC = Poly1305

test/recipes/90-test_shlibload.t

@@ -6,8 +6,7 @@
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
 
-
+use OpenSSL::Test qw/:DEFAULT bldtop_dir bldtop_file/;
-use OpenSSL::Test qw/:DEFAULT bldtop_dir/;
 use OpenSSL::Test::Utils;
 
 #Load configdata.pm
@@ -23,12 +22,13 @@ plan skip_all => "Test is disabled on AIX" if config('target') =~ m|^aix|;
 
 plan tests => 4;
 
-my $libcrypto_idx = $unified_info{rename}->{libcrypto} // "libcrypto";
+# When libssl and libcrypto are compiled on Linux with "-rpath", but not
-my $libssl_idx = $unified_info{rename}->{libssl} // "libssl";
+# "--enable-new-dtags", the RPATH takes precedence over LD_LIBRARY_PATH,
-my $libcrypto =
+# and we end up running with the wrong libraries.  This is resolved by
-    $unified_info{sharednames}->{$libcrypto_idx}.$target{shared_extension_simple};
+# using paths to the shared objects, not just the names.
-my $libssl =
+
-    $unified_info{sharednames}->{$libssl_idx}.$target{shared_extension_simple};
+my $libcrypto = bldtop_file(shlib('libcrypto'));
+my $libssl = bldtop_file(shlib('libssl'));
 
 ok(run(test(["shlibloadtest", "-crypto_first", $libcrypto, $libssl])),
    "running shlibloadtest -crypto_first");
@@ -39,3 +39,14 @@ ok(run(test(["shlibloadtest", "-just_crypto", $libcrypto, $libssl])),
 ok(run(test(["shlibloadtest", "-dso_ref", $libcrypto, $libssl])),
    "running shlibloadtest -dso_ref");
 
+sub shlib {
+    my $lib = shift;
+    $lib = $unified_info{rename}->{$lib}
+        if defined $unified_info{rename}->{$lib};
+    $lib = $unified_info{sharednames}->{$lib}
+        . ($target{shlib_variant} || "")
+        . ($target{shared_extension} || ".so");
+    $lib =~ s|\.\$\(SHLIB_VERSION_NUMBER\)
+             |.$config{shlib_version_number}|x;
+    return $lib;
+}

test/ssl-tests/20-cert-select.conf

@@ -1,56 +1,58 @@
 # Generated with generate_ssl_tests.pl
 
-num_tests = 49
+num_tests = 51
 
 test-0 = 0-ECDSA CipherString Selection
 test-1 = 1-ECDSA CipherString Selection
 test-2 = 2-ECDSA CipherString Selection
 test-3 = 3-Ed25519 CipherString and Signature Algorithm Selection
 test-4 = 4-Ed448 CipherString and Signature Algorithm Selection
-test-5 = 5-RSA CipherString Selection
+test-5 = 5-ECDSA with brainpool
-test-6 = 6-RSA-PSS Certificate CipherString Selection
+test-6 = 6-RSA CipherString Selection
-test-7 = 7-P-256 CipherString and Signature Algorithm Selection
+test-7 = 7-RSA-PSS Certificate CipherString Selection
-test-8 = 8-Ed25519 CipherString and Curves Selection
+test-8 = 8-P-256 CipherString and Signature Algorithm Selection
-test-9 = 9-Ed448 CipherString and Curves Selection
+test-9 = 9-Ed25519 CipherString and Curves Selection
-test-10 = 10-ECDSA CipherString Selection, no ECDSA certificate
+test-10 = 10-Ed448 CipherString and Curves Selection
-test-11 = 11-ECDSA Signature Algorithm Selection
+test-11 = 11-ECDSA CipherString Selection, no ECDSA certificate
-test-12 = 12-ECDSA Signature Algorithm Selection SHA384
+test-12 = 12-ECDSA Signature Algorithm Selection
-test-13 = 13-ECDSA Signature Algorithm Selection SHA1
+test-13 = 13-ECDSA Signature Algorithm Selection SHA384
-test-14 = 14-ECDSA Signature Algorithm Selection compressed point
+test-14 = 14-ECDSA Signature Algorithm Selection SHA1
-test-15 = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate
+test-15 = 15-ECDSA Signature Algorithm Selection compressed point
-test-16 = 16-RSA Signature Algorithm Selection
+test-16 = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate
-test-17 = 17-RSA-PSS Signature Algorithm Selection
+test-17 = 17-RSA Signature Algorithm Selection
-test-18 = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection
+test-18 = 18-RSA-PSS Signature Algorithm Selection
-test-19 = 19-RSA-PSS Certificate Unified Signature Algorithm Selection
+test-19 = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection
-test-20 = 20-Only RSA-PSS Certificate
+test-20 = 20-RSA-PSS Certificate Unified Signature Algorithm Selection
-test-21 = 21-RSA-PSS Certificate, no PSS signature algorithms
+test-21 = 21-Only RSA-PSS Certificate
-test-22 = 22-RSA key exchange with all RSA certificate types
+test-22 = 22-RSA-PSS Certificate, no PSS signature algorithms
-test-23 = 23-RSA key exchange with only RSA-PSS certificate
+test-23 = 23-RSA key exchange with all RSA certificate types
-test-24 = 24-Suite B P-256 Hash Algorithm Selection
+test-24 = 24-RSA key exchange with only RSA-PSS certificate
-test-25 = 25-Suite B P-384 Hash Algorithm Selection
+test-25 = 25-Suite B P-256 Hash Algorithm Selection
-test-26 = 26-TLS 1.2 Ed25519 Client Auth
+test-26 = 26-Suite B P-384 Hash Algorithm Selection
-test-27 = 27-TLS 1.2 Ed448 Client Auth
+test-27 = 27-TLS 1.2 Ed25519 Client Auth
-test-28 = 28-Only RSA-PSS Certificate, TLS v1.1
+test-28 = 28-TLS 1.2 Ed448 Client Auth
-test-29 = 29-TLS 1.3 ECDSA Signature Algorithm Selection
+test-29 = 29-Only RSA-PSS Certificate, TLS v1.1
-test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
+test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection
-test-31 = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
+test-31 = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
-test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
+test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
-test-33 = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
+test-33 = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
-test-34 = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
+test-34 = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
-test-35 = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS
+test-35 = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
-test-36 = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection
+test-36 = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS
-test-37 = 37-TLS 1.3 Ed25519 Signature Algorithm Selection
+test-37 = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection
-test-38 = 38-TLS 1.3 Ed448 Signature Algorithm Selection
+test-38 = 38-TLS 1.3 Ed25519 Signature Algorithm Selection
-test-39 = 39-TLS 1.3 Ed25519 CipherString and Groups Selection
+test-39 = 39-TLS 1.3 Ed448 Signature Algorithm Selection
-test-40 = 40-TLS 1.3 Ed448 CipherString and Groups Selection
+test-40 = 40-TLS 1.3 Ed25519 CipherString and Groups Selection
-test-41 = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection
+test-41 = 41-TLS 1.3 Ed448 CipherString and Groups Selection
-test-42 = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
+test-42 = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection
-test-43 = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
+test-43 = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
-test-44 = 44-TLS 1.3 Ed25519 Client Auth
+test-44 = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
-test-45 = 45-TLS 1.3 Ed448 Client Auth
+test-45 = 45-TLS 1.3 Ed25519 Client Auth
-test-46 = 46-TLS 1.2 DSA Certificate Test
+test-46 = 46-TLS 1.3 Ed448 Client Auth
-test-47 = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
+test-47 = 47-TLS 1.3 ECDSA with brainpool
-test-48 = 48-TLS 1.3 DSA Certificate Test
+test-48 = 48-TLS 1.2 DSA Certificate Test
+test-49 = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
+test-50 = 50-TLS 1.3 DSA Certificate Test
 # ===========================================================
 
 [0-ECDSA CipherString Selection]
@@ -223,14 +225,43 @@ ExpectedServerSignType = Ed448
 
 # ===========================================================
 
-[5-RSA CipherString Selection]
+[5-ECDSA with brainpool]
-ssl_conf = 5-RSA CipherString Selection-ssl
+ssl_conf = 5-ECDSA with brainpool-ssl
 
-[5-RSA CipherString Selection-ssl]
+[5-ECDSA with brainpool-ssl]
-server = 5-RSA CipherString Selection-server
+server = 5-ECDSA with brainpool-server
-client = 5-RSA CipherString Selection-client
+client = 5-ECDSA with brainpool-client
 
-[5-RSA CipherString Selection-server]
+[5-ECDSA with brainpool-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
+CipherString = DEFAULT
+Groups = brainpoolP256r1
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
+
+[5-ECDSA with brainpool-client]
+CipherString = aECDSA
+Groups = brainpoolP256r1
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-5]
+ExpectedResult = Success
+ExpectedServerCANames = empty
+ExpectedServerCertType = brainpoolP256r1
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[6-RSA CipherString Selection]
+ssl_conf = 6-RSA CipherString Selection-ssl
+
+[6-RSA CipherString Selection-ssl]
+server = 6-RSA CipherString Selection-server
+client = 6-RSA CipherString Selection-client
+
+[6-RSA CipherString Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -242,13 +273,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[5-RSA CipherString Selection-client]
+[6-RSA CipherString Selection-client]
 CipherString = aRSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-5]
+[test-6]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignType = RSA-PSS
@@ -256,14 +287,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[6-RSA-PSS Certificate CipherString Selection]
+[7-RSA-PSS Certificate CipherString Selection]
-ssl_conf = 6-RSA-PSS Certificate CipherString Selection-ssl
+ssl_conf = 7-RSA-PSS Certificate CipherString Selection-ssl
 
-[6-RSA-PSS Certificate CipherString Selection-ssl]
+[7-RSA-PSS Certificate CipherString Selection-ssl]
-server = 6-RSA-PSS Certificate CipherString Selection-server
+server = 7-RSA-PSS Certificate CipherString Selection-server
-client = 6-RSA-PSS Certificate CipherString Selection-client
+client = 7-RSA-PSS Certificate CipherString Selection-client
 
-[6-RSA-PSS Certificate CipherString Selection-server]
+[7-RSA-PSS Certificate CipherString Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -277,13 +308,13 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[6-RSA-PSS Certificate CipherString Selection-client]
+[7-RSA-PSS Certificate CipherString Selection-client]
 CipherString = aRSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-6]
+[test-7]
 ExpectedResult = Success
 ExpectedServerCertType = RSA-PSS
 ExpectedServerSignType = RSA-PSS
@@ -291,14 +322,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[7-P-256 CipherString and Signature Algorithm Selection]
+[8-P-256 CipherString and Signature Algorithm Selection]
-ssl_conf = 7-P-256 CipherString and Signature Algorithm Selection-ssl
+ssl_conf = 8-P-256 CipherString and Signature Algorithm Selection-ssl
 
-[7-P-256 CipherString and Signature Algorithm Selection-ssl]
+[8-P-256 CipherString and Signature Algorithm Selection-ssl]
-server = 7-P-256 CipherString and Signature Algorithm Selection-server
+server = 8-P-256 CipherString and Signature Algorithm Selection-server
-client = 7-P-256 CipherString and Signature Algorithm Selection-client
+client = 8-P-256 CipherString and Signature Algorithm Selection-client
 
-[7-P-256 CipherString and Signature Algorithm Selection-server]
+[8-P-256 CipherString and Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -310,65 +341,30 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[7-P-256 CipherString and Signature Algorithm Selection-client]
+[8-P-256 CipherString and Signature Algorithm Selection-client]
 CipherString = aECDSA
 MaxProtocol = TLSv1.2
 SignatureAlgorithms = ECDSA+SHA256:ed25519
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-7]
-ExpectedResult = Success
-ExpectedServerCertType = P-256
-ExpectedServerSignHash = SHA256
-ExpectedServerSignType = EC
-
-
-# ===========================================================
-
-[8-Ed25519 CipherString and Curves Selection]
-ssl_conf = 8-Ed25519 CipherString and Curves Selection-ssl
-
-[8-Ed25519 CipherString and Curves Selection-ssl]
-server = 8-Ed25519 CipherString and Curves Selection-server
-client = 8-Ed25519 CipherString and Curves Selection-client
-
-[8-Ed25519 CipherString and Curves Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.2
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[8-Ed25519 CipherString and Curves Selection-client]
-CipherString = aECDSA
-Curves = X25519
-MaxProtocol = TLSv1.2
-SignatureAlgorithms = ECDSA+SHA256:ed25519
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
 [test-8]
 ExpectedResult = Success
-ExpectedServerCertType = Ed25519
+ExpectedServerCertType = P-256
-ExpectedServerSignType = Ed25519
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = EC
 
 
 # ===========================================================
 
-[9-Ed448 CipherString and Curves Selection]
+[9-Ed25519 CipherString and Curves Selection]
-ssl_conf = 9-Ed448 CipherString and Curves Selection-ssl
+ssl_conf = 9-Ed25519 CipherString and Curves Selection-ssl
 
-[9-Ed448 CipherString and Curves Selection-ssl]
+[9-Ed25519 CipherString and Curves Selection-ssl]
-server = 9-Ed448 CipherString and Curves Selection-server
+server = 9-Ed25519 CipherString and Curves Selection-server
-client = 9-Ed448 CipherString and Curves Selection-client
+client = 9-Ed25519 CipherString and Curves Selection-client
 
-[9-Ed448 CipherString and Curves Selection-server]
+[9-Ed25519 CipherString and Curves Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -380,7 +376,42 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[9-Ed448 CipherString and Curves Selection-client]
+[9-Ed25519 CipherString and Curves Selection-client]
+CipherString = aECDSA
+Curves = X25519
+MaxProtocol = TLSv1.2
+SignatureAlgorithms = ECDSA+SHA256:ed25519
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-9]
+ExpectedResult = Success
+ExpectedServerCertType = Ed25519
+ExpectedServerSignType = Ed25519
+
+
+# ===========================================================
+
+[10-Ed448 CipherString and Curves Selection]
+ssl_conf = 10-Ed448 CipherString and Curves Selection-ssl
+
+[10-Ed448 CipherString and Curves Selection-ssl]
+server = 10-Ed448 CipherString and Curves Selection-server
+client = 10-Ed448 CipherString and Curves Selection-client
+
+[10-Ed448 CipherString and Curves Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[10-Ed448 CipherString and Curves Selection-client]
 CipherString = aECDSA
 Curves = X448
 MaxProtocol = TLSv1.2
@@ -388,7 +419,7 @@ SignatureAlgorithms = ECDSA+SHA256:ed448
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-9]
+[test-10]
 ExpectedResult = Success
 ExpectedServerCertType = Ed448
 ExpectedServerSignType = Ed448
@@ -396,39 +427,39 @@ ExpectedServerSignType = Ed448
 
 # ===========================================================
 
-[10-ECDSA CipherString Selection, no ECDSA certificate]
+[11-ECDSA CipherString Selection, no ECDSA certificate]
-ssl_conf = 10-ECDSA CipherString Selection, no ECDSA certificate-ssl
+ssl_conf = 11-ECDSA CipherString Selection, no ECDSA certificate-ssl
 
-[10-ECDSA CipherString Selection, no ECDSA certificate-ssl]
+[11-ECDSA CipherString Selection, no ECDSA certificate-ssl]
-server = 10-ECDSA CipherString Selection, no ECDSA certificate-server
+server = 11-ECDSA CipherString Selection, no ECDSA certificate-server
-client = 10-ECDSA CipherString Selection, no ECDSA certificate-client
+client = 11-ECDSA CipherString Selection, no ECDSA certificate-client
 
-[10-ECDSA CipherString Selection, no ECDSA certificate-server]
+[11-ECDSA CipherString Selection, no ECDSA certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[10-ECDSA CipherString Selection, no ECDSA certificate-client]
+[11-ECDSA CipherString Selection, no ECDSA certificate-client]
 CipherString = aECDSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-10]
+[test-11]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[11-ECDSA Signature Algorithm Selection]
+[12-ECDSA Signature Algorithm Selection]
-ssl_conf = 11-ECDSA Signature Algorithm Selection-ssl
+ssl_conf = 12-ECDSA Signature Algorithm Selection-ssl
 
-[11-ECDSA Signature Algorithm Selection-ssl]
+[12-ECDSA Signature Algorithm Selection-ssl]
-server = 11-ECDSA Signature Algorithm Selection-server
+server = 12-ECDSA Signature Algorithm Selection-server
-client = 11-ECDSA Signature Algorithm Selection-client
+client = 12-ECDSA Signature Algorithm Selection-client
 
-[11-ECDSA Signature Algorithm Selection-server]
+[12-ECDSA Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -440,13 +471,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[11-ECDSA Signature Algorithm Selection-client]
+[12-ECDSA Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-11]
+[test-12]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA256
@@ -455,14 +486,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[12-ECDSA Signature Algorithm Selection SHA384]
+[13-ECDSA Signature Algorithm Selection SHA384]
-ssl_conf = 12-ECDSA Signature Algorithm Selection SHA384-ssl
+ssl_conf = 13-ECDSA Signature Algorithm Selection SHA384-ssl
 
-[12-ECDSA Signature Algorithm Selection SHA384-ssl]
+[13-ECDSA Signature Algorithm Selection SHA384-ssl]
-server = 12-ECDSA Signature Algorithm Selection SHA384-server
+server = 13-ECDSA Signature Algorithm Selection SHA384-server
-client = 12-ECDSA Signature Algorithm Selection SHA384-client
+client = 13-ECDSA Signature Algorithm Selection SHA384-client
 
-[12-ECDSA Signature Algorithm Selection SHA384-server]
+[13-ECDSA Signature Algorithm Selection SHA384-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -474,13 +505,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[12-ECDSA Signature Algorithm Selection SHA384-client]
+[13-ECDSA Signature Algorithm Selection SHA384-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA384
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-12]
+[test-13]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA384
@@ -489,14 +520,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[13-ECDSA Signature Algorithm Selection SHA1]
+[14-ECDSA Signature Algorithm Selection SHA1]
-ssl_conf = 13-ECDSA Signature Algorithm Selection SHA1-ssl
+ssl_conf = 14-ECDSA Signature Algorithm Selection SHA1-ssl
 
-[13-ECDSA Signature Algorithm Selection SHA1-ssl]
+[14-ECDSA Signature Algorithm Selection SHA1-ssl]
-server = 13-ECDSA Signature Algorithm Selection SHA1-server
+server = 14-ECDSA Signature Algorithm Selection SHA1-server
-client = 13-ECDSA Signature Algorithm Selection SHA1-client
+client = 14-ECDSA Signature Algorithm Selection SHA1-client
 
-[13-ECDSA Signature Algorithm Selection SHA1-server]
+[14-ECDSA Signature Algorithm Selection SHA1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -508,13 +539,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[13-ECDSA Signature Algorithm Selection SHA1-client]
+[14-ECDSA Signature Algorithm Selection SHA1-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA1
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-13]
+[test-14]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA1
@@ -523,14 +554,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[14-ECDSA Signature Algorithm Selection compressed point]
+[15-ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 14-ECDSA Signature Algorithm Selection compressed point-ssl
+ssl_conf = 15-ECDSA Signature Algorithm Selection compressed point-ssl
 
-[14-ECDSA Signature Algorithm Selection compressed point-ssl]
+[15-ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 14-ECDSA Signature Algorithm Selection compressed point-server
+server = 15-ECDSA Signature Algorithm Selection compressed point-server
-client = 14-ECDSA Signature Algorithm Selection compressed point-client
+client = 15-ECDSA Signature Algorithm Selection compressed point-client
 
-[14-ECDSA Signature Algorithm Selection compressed point-server]
+[15-ECDSA Signature Algorithm Selection compressed point-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
@@ -538,13 +569,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[14-ECDSA Signature Algorithm Selection compressed point-client]
+[15-ECDSA Signature Algorithm Selection compressed point-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-14]
+[test-15]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA256
@@ -553,39 +584,39 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate]
-ssl_conf = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
+ssl_conf = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
-server = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
+server = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
-client = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
+client = 16-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
+[16-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-15]
+[test-16]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[16-RSA Signature Algorithm Selection]
+[17-RSA Signature Algorithm Selection]
-ssl_conf = 16-RSA Signature Algorithm Selection-ssl
+ssl_conf = 17-RSA Signature Algorithm Selection-ssl
 
-[16-RSA Signature Algorithm Selection-ssl]
+[17-RSA Signature Algorithm Selection-ssl]
-server = 16-RSA Signature Algorithm Selection-server
+server = 17-RSA Signature Algorithm Selection-server
-client = 16-RSA Signature Algorithm Selection-client
+client = 17-RSA Signature Algorithm Selection-client
 
-[16-RSA Signature Algorithm Selection-server]
+[17-RSA Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -597,13 +628,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[16-RSA Signature Algorithm Selection-client]
+[17-RSA Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-16]
+[test-17]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA256
@@ -612,14 +643,14 @@ ExpectedServerSignType = RSA
 
 # ===========================================================
 
-[17-RSA-PSS Signature Algorithm Selection]
+[18-RSA-PSS Signature Algorithm Selection]
-ssl_conf = 17-RSA-PSS Signature Algorithm Selection-ssl
+ssl_conf = 18-RSA-PSS Signature Algorithm Selection-ssl
 
-[17-RSA-PSS Signature Algorithm Selection-ssl]
+[18-RSA-PSS Signature Algorithm Selection-ssl]
-server = 17-RSA-PSS Signature Algorithm Selection-server
+server = 18-RSA-PSS Signature Algorithm Selection-server
-client = 17-RSA-PSS Signature Algorithm Selection-client
+client = 18-RSA-PSS Signature Algorithm Selection-client
 
-[17-RSA-PSS Signature Algorithm Selection-server]
+[18-RSA-PSS Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -631,43 +662,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[17-RSA-PSS Signature Algorithm Selection-client]
+[18-RSA-PSS Signature Algorithm Selection-client]
-CipherString = DEFAULT
-SignatureAlgorithms = RSA-PSS+SHA256
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-17]
-ExpectedResult = Success
-ExpectedServerCertType = RSA
-ExpectedServerSignHash = SHA256
-ExpectedServerSignType = RSA-PSS
-
-
-# ===========================================================
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection]
-ssl_conf = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
-server = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
-client = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.2
-PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
-PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
@@ -682,14 +677,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection]
-ssl_conf = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
+ssl_conf = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
-server = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-server
+server = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
-client = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-client
+client = 19-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -703,35 +698,45 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[19-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
+[19-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
 CipherString = DEFAULT
-SignatureAlgorithms = rsa_pss_pss_sha256
+SignatureAlgorithms = RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-19]
 ExpectedResult = Success
-ExpectedServerCertType = RSA-PSS
+ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA256
 ExpectedServerSignType = RSA-PSS
 
 
 # ===========================================================
 
-[20-Only RSA-PSS Certificate]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection]
-ssl_conf = 20-Only RSA-PSS Certificate-ssl
+ssl_conf = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
 
-[20-Only RSA-PSS Certificate-ssl]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
-server = 20-Only RSA-PSS Certificate-server
+server = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-server
-client = 20-Only RSA-PSS Certificate-client
+client = 20-RSA-PSS Certificate Unified Signature Algorithm Selection-client
 
-[20-Only RSA-PSS Certificate-server]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.2
+PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[20-Only RSA-PSS Certificate-client]
+[20-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
 CipherString = DEFAULT
+SignatureAlgorithms = rsa_pss_pss_sha256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
@@ -744,89 +749,115 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[21-RSA-PSS Certificate, no PSS signature algorithms]
+[21-Only RSA-PSS Certificate]
-ssl_conf = 21-RSA-PSS Certificate, no PSS signature algorithms-ssl
+ssl_conf = 21-Only RSA-PSS Certificate-ssl
 
-[21-RSA-PSS Certificate, no PSS signature algorithms-ssl]
+[21-Only RSA-PSS Certificate-ssl]
-server = 21-RSA-PSS Certificate, no PSS signature algorithms-server
+server = 21-Only RSA-PSS Certificate-server
-client = 21-RSA-PSS Certificate, no PSS signature algorithms-client
+client = 21-Only RSA-PSS Certificate-client
 
-[21-RSA-PSS Certificate, no PSS signature algorithms-server]
+[21-Only RSA-PSS Certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 
-[21-RSA-PSS Certificate, no PSS signature algorithms-client]
+[21-Only RSA-PSS Certificate-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-21]
+ExpectedResult = Success
+ExpectedServerCertType = RSA-PSS
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = RSA-PSS
+
+
+# ===========================================================
+
+[22-RSA-PSS Certificate, no PSS signature algorithms]
+ssl_conf = 22-RSA-PSS Certificate, no PSS signature algorithms-ssl
+
+[22-RSA-PSS Certificate, no PSS signature algorithms-ssl]
+server = 22-RSA-PSS Certificate, no PSS signature algorithms-server
+client = 22-RSA-PSS Certificate, no PSS signature algorithms-client
+
+[22-RSA-PSS Certificate, no PSS signature algorithms-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+
+[22-RSA-PSS Certificate, no PSS signature algorithms-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-21]
+[test-22]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[22-RSA key exchange with all RSA certificate types]
+[23-RSA key exchange with all RSA certificate types]
-ssl_conf = 22-RSA key exchange with all RSA certificate types-ssl
+ssl_conf = 23-RSA key exchange with all RSA certificate types-ssl
 
-[22-RSA key exchange with all RSA certificate types-ssl]
+[23-RSA key exchange with all RSA certificate types-ssl]
-server = 22-RSA key exchange with all RSA certificate types-server
+server = 23-RSA key exchange with all RSA certificate types-server
-client = 22-RSA key exchange with all RSA certificate types-client
+client = 23-RSA key exchange with all RSA certificate types-client
 
-[22-RSA key exchange with all RSA certificate types-server]
+[23-RSA key exchange with all RSA certificate types-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[22-RSA key exchange with all RSA certificate types-client]
+[23-RSA key exchange with all RSA certificate types-client]
-CipherString = kRSA
-MaxProtocol = TLSv1.2
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-22]
-ExpectedResult = Success
-ExpectedServerCertType = RSA
-
-
-# ===========================================================
-
-[23-RSA key exchange with only RSA-PSS certificate]
-ssl_conf = 23-RSA key exchange with only RSA-PSS certificate-ssl
-
-[23-RSA key exchange with only RSA-PSS certificate-ssl]
-server = 23-RSA key exchange with only RSA-PSS certificate-server
-client = 23-RSA key exchange with only RSA-PSS certificate-client
-
-[23-RSA key exchange with only RSA-PSS certificate-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
-CipherString = DEFAULT
-PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
-
-[23-RSA key exchange with only RSA-PSS certificate-client]
 CipherString = kRSA
 MaxProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-23]
+ExpectedResult = Success
+ExpectedServerCertType = RSA
+
+
+# ===========================================================
+
+[24-RSA key exchange with only RSA-PSS certificate]
+ssl_conf = 24-RSA key exchange with only RSA-PSS certificate-ssl
+
+[24-RSA key exchange with only RSA-PSS certificate-ssl]
+server = 24-RSA key exchange with only RSA-PSS certificate-server
+client = 24-RSA key exchange with only RSA-PSS certificate-client
+
+[24-RSA key exchange with only RSA-PSS certificate-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
+
+[24-RSA key exchange with only RSA-PSS certificate-client]
+CipherString = kRSA
+MaxProtocol = TLSv1.2
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-24]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[24-Suite B P-256 Hash Algorithm Selection]
+[25-Suite B P-256 Hash Algorithm Selection]
-ssl_conf = 24-Suite B P-256 Hash Algorithm Selection-ssl
+ssl_conf = 25-Suite B P-256 Hash Algorithm Selection-ssl
 
-[24-Suite B P-256 Hash Algorithm Selection-ssl]
+[25-Suite B P-256 Hash Algorithm Selection-ssl]
-server = 24-Suite B P-256 Hash Algorithm Selection-server
+server = 25-Suite B P-256 Hash Algorithm Selection-server
-client = 24-Suite B P-256 Hash Algorithm Selection-client
+client = 25-Suite B P-256 Hash Algorithm Selection-client
 
-[24-Suite B P-256 Hash Algorithm Selection-server]
+[25-Suite B P-256 Hash Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = SUITEB128
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem
@@ -834,13 +865,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[24-Suite B P-256 Hash Algorithm Selection-client]
+[25-Suite B P-256 Hash Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
 VerifyMode = Peer
 
-[test-24]
+[test-25]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
 ExpectedServerSignHash = SHA256
@@ -849,14 +880,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[25-Suite B P-384 Hash Algorithm Selection]
+[26-Suite B P-384 Hash Algorithm Selection]
-ssl_conf = 25-Suite B P-384 Hash Algorithm Selection-ssl
+ssl_conf = 26-Suite B P-384 Hash Algorithm Selection-ssl
 
-[25-Suite B P-384 Hash Algorithm Selection-ssl]
+[26-Suite B P-384 Hash Algorithm Selection-ssl]
-server = 25-Suite B P-384 Hash Algorithm Selection-server
+server = 26-Suite B P-384 Hash Algorithm Selection-server
-client = 25-Suite B P-384 Hash Algorithm Selection-client
+client = 26-Suite B P-384 Hash Algorithm Selection-client
 
-[25-Suite B P-384 Hash Algorithm Selection-server]
+[26-Suite B P-384 Hash Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = SUITEB128
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
@@ -864,13 +895,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
 MaxProtocol = TLSv1.2
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[25-Suite B P-384 Hash Algorithm Selection-client]
+[26-Suite B P-384 Hash Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
 VerifyMode = Peer
 
-[test-25]
+[test-26]
 ExpectedResult = Success
 ExpectedServerCertType = P-384
 ExpectedServerSignHash = SHA384
@@ -879,21 +910,21 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[26-TLS 1.2 Ed25519 Client Auth]
+[27-TLS 1.2 Ed25519 Client Auth]
-ssl_conf = 26-TLS 1.2 Ed25519 Client Auth-ssl
+ssl_conf = 27-TLS 1.2 Ed25519 Client Auth-ssl
 
-[26-TLS 1.2 Ed25519 Client Auth-ssl]
+[27-TLS 1.2 Ed25519 Client Auth-ssl]
-server = 26-TLS 1.2 Ed25519 Client Auth-server
+server = 27-TLS 1.2 Ed25519 Client Auth-server
-client = 26-TLS 1.2 Ed25519 Client Auth-client
+client = 27-TLS 1.2 Ed25519 Client Auth-client
 
-[26-TLS 1.2 Ed25519 Client Auth-server]
+[27-TLS 1.2 Ed25519 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[26-TLS 1.2 Ed25519 Client Auth-client]
+[27-TLS 1.2 Ed25519 Client Auth-client]
 CipherString = DEFAULT
 Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
 Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -902,7 +933,7 @@ MinProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-26]
+[test-27]
 ExpectedClientCertType = Ed25519
 ExpectedClientSignType = Ed25519
 ExpectedResult = Success
@@ -910,21 +941,21 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[27-TLS 1.2 Ed448 Client Auth]
+[28-TLS 1.2 Ed448 Client Auth]
-ssl_conf = 27-TLS 1.2 Ed448 Client Auth-ssl
+ssl_conf = 28-TLS 1.2 Ed448 Client Auth-ssl
 
-[27-TLS 1.2 Ed448 Client Auth-ssl]
+[28-TLS 1.2 Ed448 Client Auth-ssl]
-server = 27-TLS 1.2 Ed448 Client Auth-server
+server = 28-TLS 1.2 Ed448 Client Auth-server
-client = 27-TLS 1.2 Ed448 Client Auth-client
+client = 28-TLS 1.2 Ed448 Client Auth-client
 
-[27-TLS 1.2 Ed448 Client Auth-server]
+[28-TLS 1.2 Ed448 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[27-TLS 1.2 Ed448 Client Auth-client]
+[28-TLS 1.2 Ed448 Client Auth-client]
 CipherString = DEFAULT
 Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
 Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -933,7 +964,7 @@ MinProtocol = TLSv1.2
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-27]
+[test-28]
 ExpectedClientCertType = Ed448
 ExpectedClientSignType = Ed448
 ExpectedResult = Success
@@ -941,38 +972,38 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[28-Only RSA-PSS Certificate, TLS v1.1]
+[29-Only RSA-PSS Certificate, TLS v1.1]
-ssl_conf = 28-Only RSA-PSS Certificate, TLS v1.1-ssl
+ssl_conf = 29-Only RSA-PSS Certificate, TLS v1.1-ssl
 
-[28-Only RSA-PSS Certificate, TLS v1.1-ssl]
+[29-Only RSA-PSS Certificate, TLS v1.1-ssl]
-server = 28-Only RSA-PSS Certificate, TLS v1.1-server
+server = 29-Only RSA-PSS Certificate, TLS v1.1-server
-client = 28-Only RSA-PSS Certificate, TLS v1.1-client
+client = 29-Only RSA-PSS Certificate, TLS v1.1-client
 
-[28-Only RSA-PSS Certificate, TLS v1.1-server]
+[29-Only RSA-PSS Certificate, TLS v1.1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
 
-[28-Only RSA-PSS Certificate, TLS v1.1-client]
+[29-Only RSA-PSS Certificate, TLS v1.1-client]
 CipherString = DEFAULT
 MaxProtocol = TLSv1.1
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-28]
+[test-29]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection]
-ssl_conf = 29-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
+ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
-server = 29-TLS 1.3 ECDSA Signature Algorithm Selection-server
+server = 30-TLS 1.3 ECDSA Signature Algorithm Selection-server
-client = 29-TLS 1.3 ECDSA Signature Algorithm Selection-client
+client = 30-TLS 1.3 ECDSA Signature Algorithm Selection-client
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-server]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -985,39 +1016,7 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[29-TLS 1.3 ECDSA Signature Algorithm Selection-client]
+[30-TLS 1.3 ECDSA Signature Algorithm Selection-client]
-CipherString = DEFAULT
-SignatureAlgorithms = ECDSA+SHA256
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-29]
-ExpectedResult = Success
-ExpectedServerCANames = empty
-ExpectedServerCertType = P-256
-ExpectedServerSignHash = SHA256
-ExpectedServerSignType = EC
-
-
-# ===========================================================
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
-client = 30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
-MaxProtocol = TLSv1.3
-MinProtocol = TLSv1.3
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[30-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
@@ -1033,14 +1032,46 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
-ssl_conf = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
+ssl_conf = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
-server = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
+server = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
-client = 31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
+client = 31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[31-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
+CipherString = DEFAULT
+SignatureAlgorithms = ECDSA+SHA256
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-31]
+ExpectedResult = Success
+ExpectedServerCANames = empty
+ExpectedServerCertType = P-256
+ExpectedServerSignHash = SHA256
+ExpectedServerSignType = EC
+
+
+# ===========================================================
+
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
+ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
+
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
+server = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
+client = 32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
+
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1053,26 +1084,26 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[31-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
+[32-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA1
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-31]
+[test-32]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
-ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
+ssl_conf = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
-server = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
+server = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
-client = 32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
+client = 33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1085,14 +1116,14 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[32-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
+[33-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
 CipherString = DEFAULT
 RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-32]
+[test-33]
 ExpectedResult = Success
 ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 ExpectedServerCertType = P-256
@@ -1102,14 +1133,14 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
-ssl_conf = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
+ssl_conf = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
-server = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
+server = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
-client = 33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
+client = 34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1122,13 +1153,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[33-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
+[34-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-33]
+[test-34]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA384
@@ -1137,72 +1168,40 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
-ssl_conf = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
+ssl_conf = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
-server = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
+server = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
-client = 34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
+client = 35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[34-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
+[35-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-34]
-ExpectedResult = ServerFail
-
-
-# ===========================================================
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
-ssl_conf = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
-server = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
-client = 35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.3
-MinProtocol = TLSv1.3
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[35-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
-CipherString = DEFAULT
-SignatureAlgorithms = RSA+SHA256
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
 [test-35]
 ExpectedResult = ServerFail
 
 
 # ===========================================================
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
-ssl_conf = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
+ssl_conf = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
-server = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
+server = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
-client = 36-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
+client = 36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1215,13 +1214,45 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[36-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
+[36-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
+CipherString = DEFAULT
+SignatureAlgorithms = RSA+SHA256
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-36]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection]
+ssl_conf = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
+server = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
+client = 37-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[37-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = RSA-PSS+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-36]
+[test-37]
 ExpectedResult = Success
 ExpectedServerCertType = RSA
 ExpectedServerSignHash = SHA256
@@ -1230,14 +1261,14 @@ ExpectedServerSignType = RSA-PSS
 
 # ===========================================================
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection]
-ssl_conf = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
+ssl_conf = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
-server = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-server
+server = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-server
-client = 37-TLS 1.3 Ed25519 Signature Algorithm Selection-client
+client = 38-TLS 1.3 Ed25519 Signature Algorithm Selection-client
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1250,13 +1281,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[37-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
+[38-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ed25519
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-37]
+[test-38]
 ExpectedResult = Success
 ExpectedServerCertType = Ed25519
 ExpectedServerSignType = Ed25519
@@ -1264,14 +1295,14 @@ ExpectedServerSignType = Ed25519
 
 # ===========================================================
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection]
-ssl_conf = 38-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
+ssl_conf = 39-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
-server = 38-TLS 1.3 Ed448 Signature Algorithm Selection-server
+server = 39-TLS 1.3 Ed448 Signature Algorithm Selection-server
-client = 38-TLS 1.3 Ed448 Signature Algorithm Selection-client
+client = 39-TLS 1.3 Ed448 Signature Algorithm Selection-client
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-server]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1284,13 +1315,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[38-TLS 1.3 Ed448 Signature Algorithm Selection-client]
+[39-TLS 1.3 Ed448 Signature Algorithm Selection-client]
 CipherString = DEFAULT
 SignatureAlgorithms = ed448
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-38]
+[test-39]
 ExpectedResult = Success
 ExpectedServerCertType = Ed448
 ExpectedServerSignType = Ed448
@@ -1298,14 +1329,14 @@ ExpectedServerSignType = Ed448
 
 # ===========================================================
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection]
-ssl_conf = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
+ssl_conf = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
-server = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-server
+server = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-server
-client = 39-TLS 1.3 Ed25519 CipherString and Groups Selection-client
+client = 40-TLS 1.3 Ed25519 CipherString and Groups Selection-client
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1318,48 +1349,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[39-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
+[40-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
 CipherString = DEFAULT
 Groups = X25519
 SignatureAlgorithms = ECDSA+SHA256:ed25519
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-39]
-ExpectedResult = Success
-ExpectedServerCertType = P-256
-ExpectedServerSignType = EC
-
-
-# ===========================================================
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection]
-ssl_conf = 40-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
-server = 40-TLS 1.3 Ed448 CipherString and Groups Selection-server
-client = 40-TLS 1.3 Ed448 CipherString and Groups Selection-client
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.3
-MinProtocol = TLSv1.3
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[40-TLS 1.3 Ed448 CipherString and Groups Selection-client]
-CipherString = DEFAULT
-Groups = X448
-SignatureAlgorithms = ECDSA+SHA256:ed448
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
 [test-40]
 ExpectedResult = Success
 ExpectedServerCertType = P-256
@@ -1368,59 +1364,57 @@ ExpectedServerSignType = EC
 
 # ===========================================================
 
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
+[41-TLS 1.3 Ed448 CipherString and Groups Selection]
-ssl_conf = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
+ssl_conf = 41-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
 
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
-server = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
+server = 41-TLS 1.3 Ed448 CipherString and Groups Selection-server
-client = 41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
+client = 41-TLS 1.3 Ed448 CipherString and Groups Selection-client
 
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-ClientSignatureAlgorithms = PSS+SHA256
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-VerifyMode = Require
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-[41-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
 MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
-RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
+
+[41-TLS 1.3 Ed448 CipherString and Groups Selection-client]
+CipherString = DEFAULT
+Groups = X448
+SignatureAlgorithms = ECDSA+SHA256:ed448
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-41]
-ExpectedClientCANames = empty
-ExpectedClientCertType = RSA
-ExpectedClientSignHash = SHA256
-ExpectedClientSignType = RSA-PSS
 ExpectedResult = Success
+ExpectedServerCertType = P-256
+ExpectedServerSignType = EC
 
 
 # ===========================================================
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
-ssl_conf = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
+ssl_conf = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
-server = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
+server = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
-client = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
+client = 42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 ClientSignatureAlgorithms = PSS+SHA256
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
+[42-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
 ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1432,7 +1426,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-42]
-ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+ExpectedClientCANames = empty
 ExpectedClientCertType = RSA
 ExpectedClientSignHash = SHA256
 ExpectedClientSignType = RSA-PSS
@@ -1441,22 +1435,23 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
-ssl_conf = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
+ssl_conf = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
-server = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
+server = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
-client = 43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
+client = 43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-ClientSignatureAlgorithms = ECDSA+SHA256
+ClientSignatureAlgorithms = PSS+SHA256
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[43-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
+[43-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
 CipherString = DEFAULT
 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
 ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1468,6 +1463,42 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-43]
+ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+ExpectedClientCertType = RSA
+ExpectedClientSignHash = SHA256
+ExpectedClientSignType = RSA-PSS
+ExpectedResult = Success
+
+
+# ===========================================================
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
+ssl_conf = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
+server = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
+client = 44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ClientSignatureAlgorithms = ECDSA+SHA256
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyMode = Require
+
+[44-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
+RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-44]
 ExpectedClientCertType = P-256
 ExpectedClientSignHash = SHA256
 ExpectedClientSignType = EC
@@ -1476,21 +1507,21 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[44-TLS 1.3 Ed25519 Client Auth]
+[45-TLS 1.3 Ed25519 Client Auth]
-ssl_conf = 44-TLS 1.3 Ed25519 Client Auth-ssl
+ssl_conf = 45-TLS 1.3 Ed25519 Client Auth-ssl
 
-[44-TLS 1.3 Ed25519 Client Auth-ssl]
+[45-TLS 1.3 Ed25519 Client Auth-ssl]
-server = 44-TLS 1.3 Ed25519 Client Auth-server
+server = 45-TLS 1.3 Ed25519 Client Auth-server
-client = 44-TLS 1.3 Ed25519 Client Auth-client
+client = 45-TLS 1.3 Ed25519 Client Auth-client
 
-[44-TLS 1.3 Ed25519 Client Auth-server]
+[45-TLS 1.3 Ed25519 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[44-TLS 1.3 Ed25519 Client Auth-client]
+[45-TLS 1.3 Ed25519 Client Auth-client]
 CipherString = DEFAULT
 EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
 EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -1499,7 +1530,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-44]
+[test-45]
 ExpectedClientCertType = Ed25519
 ExpectedClientSignType = Ed25519
 ExpectedResult = Success
@@ -1507,21 +1538,21 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[45-TLS 1.3 Ed448 Client Auth]
+[46-TLS 1.3 Ed448 Client Auth]
-ssl_conf = 45-TLS 1.3 Ed448 Client Auth-ssl
+ssl_conf = 46-TLS 1.3 Ed448 Client Auth-ssl
 
-[45-TLS 1.3 Ed448 Client Auth-ssl]
+[46-TLS 1.3 Ed448 Client Auth-ssl]
-server = 45-TLS 1.3 Ed448 Client Auth-server
+server = 46-TLS 1.3 Ed448 Client Auth-server
-client = 45-TLS 1.3 Ed448 Client Auth-client
+client = 46-TLS 1.3 Ed448 Client Auth-client
 
-[45-TLS 1.3 Ed448 Client Auth-server]
+[46-TLS 1.3 Ed448 Client Auth-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyMode = Require
 
-[45-TLS 1.3 Ed448 Client Auth-client]
+[46-TLS 1.3 Ed448 Client Auth-client]
 CipherString = DEFAULT
 EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
 EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -1530,7 +1561,7 @@ MinProtocol = TLSv1.3
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-45]
+[test-46]
 ExpectedClientCertType = Ed448
 ExpectedClientSignType = Ed448
 ExpectedResult = Success
@@ -1538,52 +1569,25 @@ ExpectedResult = Success
 
 # ===========================================================
 
-[46-TLS 1.2 DSA Certificate Test]
+[47-TLS 1.3 ECDSA with brainpool]
-ssl_conf = 46-TLS 1.2 DSA Certificate Test-ssl
+ssl_conf = 47-TLS 1.3 ECDSA with brainpool-ssl
 
-[46-TLS 1.2 DSA Certificate Test-ssl]
+[47-TLS 1.3 ECDSA with brainpool-ssl]
-server = 46-TLS 1.2 DSA Certificate Test-server
+server = 47-TLS 1.3 ECDSA with brainpool-server
-client = 46-TLS 1.2 DSA Certificate Test-client
+client = 47-TLS 1.3 ECDSA with brainpool-client
 
-[46-TLS 1.2 DSA Certificate Test-server]
+[47-TLS 1.3 ECDSA with brainpool-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
-CipherString = ALL
-DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
-DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
-DSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-dsa-key.pem
-MaxProtocol = TLSv1.2
-MinProtocol = TLSv1.2
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[46-TLS 1.2 DSA Certificate Test-client]
-CipherString = ALL
-SignatureAlgorithms = DSA+SHA256:DSA+SHA1
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-46]
-ExpectedResult = Success
-
-
-# ===========================================================
-
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
-ssl_conf = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
-
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
-server = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
-client = 47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
-
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
-ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
+Groups = brainpoolP256r1
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
-VerifyMode = Request
 
-[47-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
+[47-TLS 1.3 ECDSA with brainpool-client]
 CipherString = DEFAULT
+Groups = brainpoolP256r1
+MaxProtocol = TLSv1.3
+MinProtocol = TLSv1.3
+RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
@@ -1593,14 +1597,69 @@ ExpectedResult = ServerFail
 
 # ===========================================================
 
-[48-TLS 1.3 DSA Certificate Test]
+[48-TLS 1.2 DSA Certificate Test]
-ssl_conf = 48-TLS 1.3 DSA Certificate Test-ssl
+ssl_conf = 48-TLS 1.2 DSA Certificate Test-ssl
 
-[48-TLS 1.3 DSA Certificate Test-ssl]
+[48-TLS 1.2 DSA Certificate Test-ssl]
-server = 48-TLS 1.3 DSA Certificate Test-server
+server = 48-TLS 1.2 DSA Certificate Test-server
-client = 48-TLS 1.3 DSA Certificate Test-client
+client = 48-TLS 1.2 DSA Certificate Test-client
 
-[48-TLS 1.3 DSA Certificate Test-server]
+[48-TLS 1.2 DSA Certificate Test-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = ALL
+DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
+DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
+DSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-dsa-key.pem
+MaxProtocol = TLSv1.2
+MinProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[48-TLS 1.2 DSA Certificate Test-client]
+CipherString = ALL
+SignatureAlgorithms = DSA+SHA256:DSA+SHA1
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-48]
+ExpectedResult = Success
+
+
+# ===========================================================
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
+ssl_conf = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
+server = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
+client = 49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
+VerifyMode = Request
+
+[49-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-49]
+ExpectedResult = ServerFail
+
+
+# ===========================================================
+
+[50-TLS 1.3 DSA Certificate Test]
+ssl_conf = 50-TLS 1.3 DSA Certificate Test-ssl
+
+[50-TLS 1.3 DSA Certificate Test-ssl]
+server = 50-TLS 1.3 DSA Certificate Test-server
+client = 50-TLS 1.3 DSA Certificate Test-client
+
+[50-TLS 1.3 DSA Certificate Test-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = ALL
 DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
@@ -1609,13 +1668,13 @@ MaxProtocol = TLSv1.3
 MinProtocol = TLSv1.3
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[48-TLS 1.3 DSA Certificate Test-client]
+[50-TLS 1.3 DSA Certificate Test-client]
 CipherString = ALL
 SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
-[test-48]
+[test-50]
 ExpectedResult = ServerFail
 
 

test/ssl-tests/20-cert-select.conf.in

@@ -138,6 +138,28 @@ our @tests = (
             "ExpectedResult" => "Success"
         },
     },
+    {
+        name => "ECDSA with brainpool",
+        server =>  {
+            "Certificate" => test_pem("server-ecdsa-brainpoolP256r1-cert.pem"),
+            "PrivateKey" => test_pem("server-ecdsa-brainpoolP256r1-key.pem"),
+            "Groups" => "brainpoolP256r1",
+        },
+        client => {
+            #We don't restrict this to TLSv1.2, although use of brainpool
+            #should force this anyway so that this should succeed
+            "CipherString" => "aECDSA",
+            "RequestCAFile" => test_pem("root-cert.pem"),
+            "Groups" => "brainpoolP256r1",
+        },
+        test   => {
+            "ExpectedServerCertType" =>, "brainpoolP256r1",
+            "ExpectedServerSignType" =>, "EC",
+            # Note: certificate_authorities not sent for TLS < 1.3
+            "ExpectedServerCANames" =>, "empty",
+            "ExpectedResult" => "Success"
+        },
+    },
     {
         name => "RSA CipherString Selection",
         server => $server,
@@ -762,6 +784,23 @@ my @tests_tls_1_3 = (
             "ExpectedResult" => "Success"
         },
     },
+    {
+        name => "TLS 1.3 ECDSA with brainpool",
+        server =>  {
+            "Certificate" => test_pem("server-ecdsa-brainpoolP256r1-cert.pem"),
+            "PrivateKey" => test_pem("server-ecdsa-brainpoolP256r1-key.pem"),
+            "Groups" => "brainpoolP256r1",
+        },
+        client => {
+            "RequestCAFile" => test_pem("root-cert.pem"),
+            "Groups" => "brainpoolP256r1",
+            "MinProtocol" => "TLSv1.3",
+            "MaxProtocol" => "TLSv1.3"
+        },
+        test   => {
+            "ExpectedResult" => "ServerFail"
+        },
+    },
 );
 
 push @tests, @tests_tls_1_3 unless disabled("tls1_3");

test/sslapitest.c

@@ -5669,6 +5669,7 @@ static int test_client_cert_cb(int tst)
     SSL_CTX_set_verify(sctx,
                        SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
                        verify_cb);
+
     if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
                                       NULL, NULL))
             || !TEST_true(create_ssl_connection(serverssl, clientssl,
@@ -5686,6 +5687,140 @@ static int test_client_cert_cb(int tst)
     return testresult;
 }
 
+#if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
+/*
+ * Test setting certificate authorities on both client and server.
+ *
+ * Test 0: SSL_CTX_set0_CA_list() only
+ * Test 1: Both SSL_CTX_set0_CA_list() and SSL_CTX_set_client_CA_list()
+ * Test 2: Only SSL_CTX_set_client_CA_list()
+ */
+static int test_ca_names_int(int prot, int tst)
+{
+    SSL_CTX *cctx = NULL, *sctx = NULL;
+    SSL *clientssl = NULL, *serverssl = NULL;
+    int testresult = 0;
+    size_t i;
+    X509_NAME *name[] = { NULL, NULL, NULL, NULL };
+    char *strnames[] = { "Jack", "Jill", "John", "Joanne" };
+    STACK_OF(X509_NAME) *sk1 = NULL, *sk2 = NULL;
+    const STACK_OF(X509_NAME) *sktmp = NULL;
+
+    for (i = 0; i < OSSL_NELEM(name); i++) {
+        name[i] = X509_NAME_new();
+        if (!TEST_ptr(name[i])
+                || !TEST_true(X509_NAME_add_entry_by_txt(name[i], "CN",
+                                                         MBSTRING_ASC,
+                                                         (unsigned char *)
+                                                         strnames[i],
+                                                         -1, -1, 0)))
+            goto end;
+    }
+
+    if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
+                                       TLS_client_method(),
+                                       TLS1_VERSION,
+                                       prot,
+                                       &sctx, &cctx, cert, privkey)))
+        goto end;
+
+    SSL_CTX_set_verify(sctx, SSL_VERIFY_PEER, NULL);
+
+    if (tst == 0 || tst == 1) {
+        if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[0])))
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[1])))
+                || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[0])))
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[1]))))
+            goto end;
+
+        SSL_CTX_set0_CA_list(sctx, sk1);
+        SSL_CTX_set0_CA_list(cctx, sk2);
+        sk1 = sk2 = NULL;
+    }
+    if (tst == 1 || tst == 2) {
+        if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[2])))
+                || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[3])))
+                || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[2])))
+                || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[3]))))
+            goto end;
+
+        SSL_CTX_set_client_CA_list(sctx, sk1);
+        SSL_CTX_set_client_CA_list(cctx, sk2);
+        sk1 = sk2 = NULL;
+    }
+
+    if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
+                                      NULL, NULL))
+            || !TEST_true(create_ssl_connection(serverssl, clientssl,
+                                                SSL_ERROR_NONE)))
+        goto end;
+
+    /*
+     * We only expect certificate authorities to have been sent to the server
+     * if we are using TLSv1.3 and SSL_set0_CA_list() was used
+     */
+    sktmp = SSL_get0_peer_CA_list(serverssl);
+    if (prot == TLS1_3_VERSION
+            && (tst == 0 || tst == 1)) {
+        if (!TEST_ptr(sktmp)
+                || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
+                || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
+                                              name[0]), 0)
+                || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
+                                              name[1]), 0))
+            goto end;
+    } else if (!TEST_ptr_null(sktmp)) {
+        goto end;
+    }
+
+    /*
+     * In all tests we expect certificate authorities to have been sent to the
+     * client. However, SSL_set_client_CA_list() should override
+     * SSL_set0_CA_list()
+     */
+    sktmp = SSL_get0_peer_CA_list(clientssl);
+    if (!TEST_ptr(sktmp)
+            || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
+            || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
+                                          name[tst == 0 ? 0 : 2]), 0)
+            || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
+                                          name[tst == 0 ? 1 : 3]), 0))
+        goto end;
+
+    testresult = 1;
+
+ end:
+    SSL_free(serverssl);
+    SSL_free(clientssl);
+    SSL_CTX_free(sctx);
+    SSL_CTX_free(cctx);
+    for (i = 0; i < OSSL_NELEM(name); i++)
+        X509_NAME_free(name[i]);
+    sk_X509_NAME_pop_free(sk1, X509_NAME_free);
+    sk_X509_NAME_pop_free(sk2, X509_NAME_free);
+
+    return testresult;
+}
+#endif
+
+static int test_ca_names(int tst)
+{
+    int testresult = 1;
+
+#ifndef OPENSSL_NO_TLS1_2
+    testresult &= test_ca_names_int(TLS1_2_VERSION, tst);
+#endif
+#ifndef OPENSSL_NO_TLS1_3
+    testresult &= test_ca_names_int(TLS1_3_VERSION, tst);
+#endif
+
+    return testresult;
+}
+
 int setup_tests(void)
 {
     if (!TEST_ptr(cert = test_get_argument(0))
@@ -5790,6 +5925,7 @@ int setup_tests(void)
     ADD_ALL_TESTS(test_shutdown, 7);
     ADD_ALL_TESTS(test_cert_cb, 3);
     ADD_ALL_TESTS(test_client_cert_cb, 2);
+    ADD_ALL_TESTS(test_ca_names, 3);
     return 1;
 }
 

test/ssltest_old.c

@@ -779,7 +779,7 @@ static void print_details(SSL *c_ssl, const char *prefix)
         }
         X509_free(cert);
     }
-    if (SSL_get_server_tmp_key(c_ssl, &pkey)) {
+    if (SSL_get_peer_tmp_key(c_ssl, &pkey)) {
         BIO_puts(bio_stdout, ", temp key: ");
         print_key_details(bio_stdout, pkey);
         EVP_PKEY_free(pkey);

util/libssl.num

@@ -497,3 +497,4 @@ SSL_get_recv_max_early_data             497	1_1_1	EXIST::FUNCTION:
 SSL_CTX_get_recv_max_early_data         498	1_1_1	EXIST::FUNCTION:
 SSL_CTX_set_recv_max_early_data         499	1_1_1	EXIST::FUNCTION:
 SSL_CTX_set_post_handshake_auth         500	1_1_1	EXIST::FUNCTION:
+SSL_get_signature_type_nid              501	1_1_1a	EXIST::FUNCTION:

util/perl/OpenSSL/Test.pm

@@ -814,7 +814,7 @@ Returns a list of two numbers, the first representing the build version,
 the second representing the library version.  See opensslv.h for more
 information on those numbers.
 
-= back
+=back
 
 =cut
 

util/private.num

@@ -400,14 +400,17 @@ SSL_get_max_proto_version               define
 SSL_get_min_proto_version               define
 SSL_get_mode                            define
 SSL_get_peer_signature_nid              define
+SSL_get_peer_tmp_key                    define
 SSL_get_secure_renegotiation_support    define
 SSL_get_server_tmp_key                  define
 SSL_get_shared_curve                    define
 SSL_get_shared_group                    define
+SSL_get_signature_nid                   define
 SSL_get_time                            define
 SSL_get_timeout                         define
 SSL_get_tlsext_status_ocsp_resp         define
 SSL_get_tlsext_status_type              define
+SSL_get_tmp_key                         define
 SSL_in_accept_init                      define
 SSL_in_connect_init                     define
 SSL_library_init                        define

util/shlib_wrap.sh.in

@@ -1,5 +1,22 @@
 #!/bin/sh
+{-
+    use lib '.';
+    use configdata;
 
+    sub shlib {
+        my $lib = shift;
+        return "" if $disabled{shared};
+        $lib = $unified_info{rename}->{$lib}
+            if defined $unified_info{rename}->{$lib};
+        $lib = $unified_info{sharednames}->{$lib}
+            . ($target{shlib_variant} || "")
+            . ($target{shared_extension} || ".so");
+        $lib =~ s|\.\$\(SHLIB_VERSION_NUMBER\)
+                 |.$config{shlib_version_number}|x;
+        return $lib;
+    }
+    "";     # Make sure no left over string sneaks its way into the script
+-}
 # To test this OpenSSL version's applications against another version's
 # shared libraries, simply set
 #
@@ -25,15 +42,8 @@ fi
 THERE="`echo $0 | sed -e 's|[^/]*$||' 2>/dev/null`.."
 [ -d "${THERE}" ] || exec "$@"	# should never happen...
 
-# Alternative to this is to parse ${THERE}/Makefile...
+LIBCRYPTOSO="${THERE}/{- shlib('libcrypto') -}"
-LIBCRYPTOSO="${THERE}/libcrypto.so"
+LIBSSLSO="${THERE}/{- shlib('libssl') -}"
-if [ -f "$LIBCRYPTOSO" ]; then
-    while [ -h "$LIBCRYPTOSO" ]; do
-	LIBCRYPTOSO="${THERE}/`ls -l "$LIBCRYPTOSO" | sed -e 's|.*\-> ||'`"
-    done
-    SOSUFFIX=`echo ${LIBCRYPTOSO} | sed -e 's|.*\.so||' 2>/dev/null`
-    LIBSSLSO="${THERE}/libssl.so${SOSUFFIX}"
-fi
 
 SYSNAME=`(uname -s) 2>/dev/null`;
 case "$SYSNAME" in