Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2019-09-21 00:43:47 +09:00
parent 2e57f602ae
commit 62515c7d8d
1131 changed files with 47556 additions and 24957 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/internal/man3/DEFINE_SPARSE_ARRAY_OF.pod
+1 -1
View File
@@ -108,7 +108,7 @@ ossl_sa_TYPE_free_leaves() do not return values.
=head1 HISTORY
This functionality was added to OpenSSL 3.0.0.
This functionality was added to OpenSSL 3.0.
=head1 COPYRIGHT
doc/internal/man3/OSSL_METHOD_STORE.pod
+19 -13
View File
@@ -19,9 +19,10 @@ ossl_method_store_cache_get, ossl_method_store_cache_set
void ossl_method_store_free(OSSL_METHOD_STORE *store);
int ossl_method_store_init(OPENSSL_CTX *ctx);
void ossl_method_store_cleanup(OPENSSL_CTX *ctx);
int ossl_method_store_add(OSSL_METHOD_STORE *store,
int nid, const char *properties,
void *method, void (*method_destruct)(void *));
int ossl_method_store_add(OSSL_METHOD_STORE *store, const OSSL_PROVIDER *prov,
int nid, const char *properties, void *method,
int (*method_up_ref)(void *),
void (*method_destruct)(void *));
int ossl_method_store_remove(OSSL_METHOD_STORE *store,
int nid, const void *method);
int ossl_method_store_fetch(OSSL_METHOD_STORE *store,
@@ -62,15 +63,20 @@ B<ctx> to allow access to the required underlying property data.
ossl_method_store_free() frees resources allocated to B<store>.
ossl_method_store_add() adds the B<method> to the B<store> as an instance of an
algorithm indicated by B<nid> and the property definition B<properties>.
The optional B<method_destruct> function is called when B<method> is being
released from B<store>.
ossl_method_store_add() adds the B<method> constructed from an implementation in
the provider B<prov> to the B<store> as an instance of an algorithm indicated by
B<nid> and the property definition B<properties>, unless the B<store> already
has a method from the same provider with the same B<nid> and B<properties>.
If the B<method_up_ref> function is given, it's called to increment the
reference count of the method.
If the B<method_destruct> function is given, it's called when this function
fails to add the method to the store, or later on when it is being released from
the B<store>.
ossl_method_store_remove() removes the B<method> identified by B<nid> from the
B<store>.
ossl_method_store_fetch() queries B<store> for an method identified by B<nid>
ossl_method_store_fetch() queries B<store> for a method identified by B<nid>
that matches the property query B<prop_query>.
The result, if any, is returned in B<method>.
@@ -82,28 +88,28 @@ and the ones passed to the ossl_method_store_free().
=head2 Cache Functions
ossl_method_store_cache_get() queries the cache associated with the B<store>
for an method identified by B<nid> that matches the property query
for a method identified by B<nid> that matches the property query
B<prop_query>.
The result, if any, is returned in B<method>.
ossl_method_store_cache_set() sets a cache entry identified by B<nid> with the
property query B<prop_query> in the B<store>.
Future cache gets will return the specified B<method>.
Future calls to ossl_method_store_cache_get() will return the specified B<method>.
=head1 RETURN VALUES
ossl_method_store_new() a new method store object or B<NULL> on failure.
ossl_method_store_new() returns a new method store object or B<NULL> on failure.
ossl_method_store_free(), ossl_method_store_add(),
ossl_method_store_remove(), ossl_method_store_fetch(),
ossl_method_store_set_global_properties(), ossl_method_store_cache_get()
and ossl_method_store_cache_set() return B<1> on success and B<0> on error.
ossl_method_store_free() and ossl_method_store_cleanup() do not return values.
ossl_method_store_free() and ossl_method_store_cleanup() do not return any value.
=head1 HISTORY
This functionality was added to OpenSSL 3.0.0.
This functionality was added to OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/CMS_add1_signing_cert.pod → doc/internal/man3/cms_add1_signing_cert.pod
+7 -6
View File
@@ -2,7 +2,7 @@
=head1 NAME
CMS_add1_signing_cert, CMS_add1_signing_cert_v2
cms_add1_signing_cert, cms_add1_signing_cert_v2
- add ESS signing-certificate signed attribute to a
CMS_SignerInfo data structure
@@ -10,15 +10,15 @@ CMS_SignerInfo data structure
#include <openssl/cms.h>
int CMS_add1_signing_cert(CMS_SignerInfo *si, ESS_SIGNING_CERT *sc);
int cms_add1_signing_cert(CMS_SignerInfo *si, ESS_SIGNING_CERT *sc);
int CMS_add1_signing_cert_v2(CMS_SignerInfo *si, ESS_SIGNING_CERT_V2 *sc2);
int cms_add1_signing_cert_v2(CMS_SignerInfo *si, ESS_SIGNING_CERT_V2 *sc2);
=head1 DESCRIPTION
CMS_add1_signing_cert() adds an ESS Signing Certificate B<sc> (version 1) signed
cms_add1_signing_cert() adds an ESS Signing Certificate B<sc> (version 1) signed
attribute to the CMS_SignerInfo B<si>.
CMS_add1_signing_cert_v2() adds an ESS Signing Certificate B<sc2> (version 2) signed
cms_add1_signing_cert_v2() adds an ESS Signing Certificate B<sc2> (version 2) signed
attribute to the CMS_SignerInfo B<si>.
The ESS Signing Certificate attributes version 1 and 2 are defined in RFC 5035
which updates Section 5.4 of RFC 2634.
@@ -31,7 +31,8 @@ For a fuller description see L<cms(1)>).
=head1 RETURN VALUES
CMS_add1_signing_cert() and CMS_add1_signing_cert_v2() return 1 if attribute is added or 0 if an error occurred.
cms_add1_signing_cert() and cms_add1_signing_cert_v2() return 1 if attribute
is added or 0 if an error occurred.
=head1 COPYRIGHT
doc/internal/man3/evp_generic_fetch.pod
+41 -11
View File
@@ -2,7 +2,8 @@
=head1 NAME
evp_generic_fetch - generic algorithm fetcher and method creator for EVP
evp_generic_fetch, evp_generic_fetch_by_number
- generic algorithm fetchers and method creators for EVP
=head1 SYNOPSIS
@@ -11,26 +12,50 @@ evp_generic_fetch - generic algorithm fetcher and method creator for EVP
void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id,
const char *name, const char *properties,
void *(*new_method)(const OSSL_DISPATCH *fns,
OSSL_PROVIDER *prov),
void *(*new_method)(int name_id,
const OSSL_DISPATCH *fns,
OSSL_PROVIDER *prov,
void *method_data),
void *method_data,
int (*up_ref_method)(void *),
void (*free_method)(void *));
void *evp_generic_fetch_by_number(OPENSSL_CTX *ctx, int operation_id,
int name_id, const char *properties,
void *(*new_method)(int name_id,
const OSSL_DISPATCH *fns,
OSSL_PROVIDER *prov,
void *method_data),
void *method_data,
int (*up_ref_method)(void *),
void (*free_method)(void *));
=head1 DESCRIPTION
evp_generic_fetch() calls ossl_method_construct() with the given
C<libctx>, C<operation_id>, C<name>, and C<properties> and uses
I<libctx>, I<operation_id>, I<name>, and I<properties> and uses
it to create an EVP method with the help of the functions
C<new_method>, C<up_ref_method>, and C<free_method>.
I<new_method>, I<up_ref_method>, and I<free_method>.
The three functions are supposed to:
evp_generic_fetch_by_number() does the same thing as evp_generic_fetch(),
but takes a I<name_id> instead of a number.
I<name_id> must always be non-zero; as a matter of fact, it being zero
is considered a programming error.
This is meant to be used when one method needs to fetch an associated
other method, and is typically called from inside the given function
I<new_method>.
The three functions I<new_method>, I<up_ref_method>, and
I<free_method> are supposed to:
=over 4
=item new_method()
creates an internal method from function pointers found in the
dispatch table C<fns>.
dispatch table I<fns>, with name identity I<name_id>.
The provider I<prov> and I<method_data> are also passed to be used as
new_method() sees fit.
=item up_ref_method()
@@ -50,10 +75,10 @@ evp_generic_fetch() returns a method on success, or B<NULL> on error.
=head1 EXAMPLES
This is a short example of the fictitious EVP API and operation called
C<EVP_FOO>.
B<EVP_FOO>.
To begin with, let's assume something like this in
C<include/openssl/core_numbers.h>:
F<include/openssl/core_numbers.h>:
#define OSSL_OP_FOO 100
@@ -75,6 +100,7 @@ And here's the implementation of the FOO method fetcher:
/* typedef struct evp_foo_st EVP_FOO */
struct evp_foo_st {
OSSL_PROVIDER *prov;
int name_id;
CRYPTO_REF_COUNT refcnt;
OSSL_OP_foo_newctx_fn *newctx;
OSSL_OP_foo_init_fn *init;
@@ -87,14 +113,18 @@ And here's the implementation of the FOO method fetcher:
* In this example, we have a public method creator and destructor.
* It's not absolutely necessary, but is in the spirit of OpenSSL.
*/
EVP_FOO *EVP_FOO_meth_from_dispatch(const OSSL_DISPATCH *fns,
OSSL_PROVIDER *prov)
EVP_FOO *EVP_FOO_meth_from_dispatch(int name_id,
const OSSL_DISPATCH *fns,
OSSL_PROVIDER *prov,
void *data)
{
EVP_FOO *foo = NULL;
if ((foo = OPENSSL_zalloc(sizeof(*foo))) == NULL)
return NULL;
foo->name_id = name_id;
for (; fns->function_id != 0; fns++) {
switch (fns->function_id) {
case OSSL_OP_FOO_NEWCTX_FUNC:
doc/internal/man3/evp_keymgmt_export_to_provider.pod
+56
View File
@@ -0,0 +1,56 @@
=pod
=head1 NAME
evp_keymgmt_export_to_provider,
evp_keymgmt_clear_pkey_cache
- key material provider export for EVP
=head1 SYNOPSIS
#include "internal/evp_int.h"
void *evp_keymgmt_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt);
void evp_keymgmt_clear_pkey_cache(EVP_PKEY *pk);
=head1 DESCRIPTION
evp_keymgmt_export_to_provider() exports the key material from the
given key I<pk> to a provider via a B<EVP_KEYMGMT> interface, if this
hasn't already been done.
It maintains a cache of provider key references in I<pk> to keep track
of all such exports.
If I<pk> has an assigned legacy key, a check is done to see if any of
its key material has changed since last export, i.e. the legacy key's
is_dirty() method returns 1.
If it has, the cache of already exported keys is cleared, and a new
export is made with the new key material.
evp_keymgmt_clear_pkey_cache() can be used to explicitly clear the
cache of provider key references.
=head1 RETURN VALUES
evp_keymgmt_export_to_provider() returns a pointer to the appropriate
provider side key (created or found again), or NULL on error.
=head1 NOTES
"Legacy key" is the term used for any key that has been assigned to an
B<EVP_PKEY> with EVP_PKEY_assign_RSA() and similar functions.
=head1 SEE ALSO
L<EVP_PKEY_ASN1_METHOD(3)>, L<EVP_PKEY_assign_RSA(3)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/internal/man3/evp_keymgmt_freekey.pod
+109
View File
@@ -0,0 +1,109 @@
=pod
=head1 NAME
evp_keymgmt_importdomparams, evp_keymgmt_gendomparams,
evp_keymgmt_freedomparams,
evp_keymgmt_exportdomparams,
evp_keymgmt_importdomparams_types, evp_keymgmt_exportdomparams_types,
evp_keymgmt_importkey, evp_keymgmt_genkey, evp_keymgmt_loadkey,
evp_keymgmt_freekey,
evp_keymgmt_exportkey,
evp_keymgmt_importkey_types, evp_keymgmt_exportkey_types
- internal KEYMGMT support functions
=head1 SYNOPSIS
#include "internal/evp_int.h"
void *evp_keymgmt_importdomparams(const EVP_KEYMGMT *keymgmt,
const OSSL_PARAM params[]);
void *evp_keymgmt_gendomparams(const EVP_KEYMGMT *keymgmt,
const OSSL_PARAM params[]);
void evp_keymgmt_freedomparams(const EVP_KEYMGMT *keymgmt, void *provdomparams);
int evp_keymgmt_exportdomparams(const EVP_KEYMGMT *keymgmt,
void *provdomparams, OSSL_PARAM params[]);
const OSSL_PARAM *evp_keymgmt_importdomparams_types(const EVP_KEYMGMT *keymgmt);
const OSSL_PARAM *evp_keymgmt_exportdomparams_types(const EVP_KEYMGMT *keymgmt);
void *evp_keymgmt_importkey(const EVP_KEYMGMT *keymgmt,
const OSSL_PARAM params[]);
void *evp_keymgmt_genkey(const EVP_KEYMGMT *keymgmt, void *domparams,
const OSSL_PARAM params[]);
void *evp_keymgmt_loadkey(const EVP_KEYMGMT *keymgmt,
void *id, size_t idlen);
void evp_keymgmt_freekey(const EVP_KEYMGMT *keymgmt, void *provkey);
int evp_keymgmt_exportkey(const EVP_KEYMGMT *keymgmt, void *provkey,
OSSL_PARAM params[]);
const OSSL_PARAM *evp_keymgmt_importkey_types(const EVP_KEYMGMT *keymgmt);
const OSSL_PARAM *evp_keymgmt_exportkey_types(const EVP_KEYMGMT *keymgmt);
=head1 DESCRIPTION
All these functions are helpers to call the provider's corresponding
function.
evp_keymgmt_importdomparams() calls the method's importdomparams() function.
evp_keymgmt_gendomparams() calls the method's gendomparams() function.
evp_keymgmt_freedomparams() calls the method's freedomparams() function.
evp_keymgmt_exportdomparams() calls the method's exportdomparams()
function.
evp_keymgmt_importdomparams_types() calls the method's
importdomparams_types() function.
evp_keymgmt_exportdomparams_types() calls the method's
exportdomparams_types() function.
evp_keymgmt_importkey() calls the method's importkey()
function.
evp_keymgmt_genkey() calls the method's genkey() function.
evp_keymgmt_loadkey() calls the method's loadkey() function.
evp_keymgmt_freekey() calls the method's freekey() function.
evp_keymgmt_exportkey() calls the method's exportkey()
function.
evp_keymgmt_importkey_types() calls the method's importkey_types() function.
evp_keymgmt_exportkey_types() calls the method's exportkey_types() function.
=head1 RETURN VALUES
evp_keymgmt_importdomparams(), evp_keymgmt_gendomparams() return a pointer
to a provider owned set of domparams parameters, or NULL on error.
evp_keymgmt_importkey(), evp_keymgmt_genkey(), evp_keymgmt_loadkey() return
a pointer to a provider owned key, or NULL on error.
evp_keymgmt_exportdomparams() and evp_keymgmt_exportkey() return 1 on success,
or 0 on error.
evp_keymgmt_importdomparams_types(), evp_keymgmt_exportdomparams_types()
return parameter descriptor for importing and exporting domparams
parameters, or NULL if there are no such descriptors.
evp_keymgmt_importkey_types() and evp_keymgmt_exportkey_types()
return parameter descriptor for importing and exporting keys, or NULL
if there are no such descriptors.
=head1 HISTORY
The functions described here were all added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/internal/man3/ossl_algorithm_do_all.pod
+63
View File
@@ -0,0 +1,63 @@
=pod
=head1 NAME
ossl_algorithm_do_all - generic algorithm implementation iterator
=head1 SYNOPSIS
void ossl_algorithm_do_all(OPENSSL_CTX *libctx, int operation_id,
OSSL_PROVIDER *provider,
void (*fn)(OSSL_PROVIDER *provider,
const OSSL_ALGORITHM *algo,
int no_store, void *data),
void *data)
=head1 DESCRIPTION
ossl_algorithm_do_all() looks up every algorithm it can find, given a
library context I<libctx>, an operation identity I<operation_id> and a
provider I<provider>.
I<libctx> may be NULL to signify that the default library context should
be used.
I<operation_id> may be zero to signify that all kinds of operations
will be looked up.
I<provider> may be NULL to signify that all loaded providers will be
queried.
For each implementation found, the function I<fn> is called with the
I<provider> for the implementation, the algorithm descriptor I<algo>,
the flag I<no_store> indicating whether the algorithm descriptor may
be remembered or not, and the caller I<data> that was passed to
ossl_algorithm_do_all().
=head1 RETURN VALUES
ossl_algorithm_do_all() doesn't return any value.
=head1 NOTES
The function described here are mainly useful for discovery, and
possibly display of what has been discovered, for example an
application that wants to display the loaded providers and what they
may offer, but also for constructors, such as
L<ossl_construct_method(3)>.
=head1 SEE ALSO
L<ossl_construct_method(3)>, L<EVP_MAC_do_all(3)>
=head1 HISTORY
This functionality was added to OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this
file except in compliance with the License. You can obtain a copy in the file
LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/internal/man3/ossl_method_construct.pod
+11 -15
View File
@@ -15,13 +15,11 @@ OSSL_METHOD_CONSTRUCT_METHOD, ossl_method_construct
/* Remove a store */
void (*dealloc_tmp_store)(void *store);
/* Get an already existing method from a store */
void *(*get)(OPENSSL_CTX *libctx, void *store,
int operation_id, const char *name, const char *propquery,
void *data);
void *(*get)(OPENSSL_CTX *libctx, void *store, void *data);
/* Store a method in a store */
int (*put)(OPENSSL_CTX *libctx, void *store, void *method,
int operation_id, const char *name, const char *propdef,
void *data);
const OSSL_PROVIDER *prov, int operation_id, const char *name,
const char *propdef, void *data);
/* Construct a new method */
void *(*construct)(const char *name, const OSSL_DISPATCH *fns,
OSSL_PROVIDER *prov, void *data);
@@ -31,7 +29,6 @@ OSSL_METHOD_CONSTRUCT_METHOD, ossl_method_construct
typedef struct ossl_method_construct_method OSSL_METHOD_CONSTRUCT_METHOD;
void *ossl_method_construct(OPENSSL_CTX *ctx, int operation_id,
const char *name, const char *properties,
int force_cache,
OSSL_METHOD_CONSTRUCT_METHOD *mcm, void *mcm_data);
@@ -58,11 +55,10 @@ It's important to keep in mind that a method is identified by three things:
=head2 Functions
ossl_method_construct() creates a method by asking all available
providers for a dispatch table given an I<operation_id>, an algorithm
I<name> and a set of I<properties>, and then calling the appropriate
functions given by the sub-system specific method creator through
I<mcm> and the data in I<mcm_data> (which is passed by
ossl_method_construct()).
providers for a dispatch table given an I<operation_id>, and then
calling the appropriate functions given by the sub-system specific
method creator through I<mcm> and the data in I<mcm_data> (which is
passed by ossl_method_construct()).
This function assumes that the sub-system method creator implements
reference counting and acts accordingly (i.e. it will call the
@@ -98,10 +94,10 @@ B<NULL> is a valid value and means that a sub-system default store
must be used.
This default store should be stored in the library context I<libctx>.
The method to be looked up should be identified with the given
I<operation_id>, I<name>, the provided property query I<propquery>
and data from I<data> (which is the I<mcm_data> that was passed to
ossl_construct_method()).
The method to be looked up should be identified with data found in I<data>
(which is the I<mcm_data> that was passed to ossl_construct_method()).
In other words, the ossl_method_construct() caller is entirely responsible
for ensuring the necesssary data is made available.
This function is expected to increment the method's reference count.
doc/internal/man3/ossl_param_bld_init.pod
+188
View File
@@ -0,0 +1,188 @@
=pod
=head1 NAME
ossl_param_bld_init, ossl_param_bld_to_param, ossl_param_bld_to_param_ex,
ossl_param_bld_free, ossl_param_bld_push_int, ossl_param_bld_push_uint,
ossl_param_bld_push_long, ossl_param_bld_push_ulong,
ossl_param_bld_push_int32, ossl_param_bld_push_uint32,
ossl_param_bld_push_int64, ossl_param_bld_push_uint64,
ossl_param_bld_push_size_t, ossl_param_bld_push_double,
ossl_param_bld_push_BN, ossl_param_bld_push_utf8_string,
ossl_param_bld_push_utf8_ptr, ossl_param_bld_push_octet_string,
ossl_param_bld_push_octet_ptr
- functions to assist in the creation of OSSL_PARAM arrays
=head1 SYNOPSIS
=for comment generic
#include "internal/params_build.h"
#define OSSL_PARAM_BLD_MAX 10
typedef struct { ... } OSSL_PARAM_BLD;
void ossl_param_bld_init(OSSL_PARAM_BLD *bld);
OSSL_PARAM *ossl_param_bld_to_param(OSSL_PARAM_BLD *bld);
OSSL_PARAM *ossl_param_bld_to_param_ex(OSSL_PARAM_BLD *bld,
OSSL_PARAM *params, size_t param_n,
void *data, size_t data_n,
void *secure, size_t secure_n);
void ossl_param_bld_free(OSSL_PARAM *params);
int ossl_param_bld_push_TYPE(OSSL_PARAM_BLD *bld, const char *key, TYPE val);
int ossl_param_bld_push_BN(OSSL_PARAM_BLD *bld, const char *key,
const BIGNUM *bn);
int ossl_param_bld_push_utf8_string(OSSL_PARAM_BLD *bld, const char *key,
const char *buf, size_t bsize);
int ossl_param_bld_push_utf8_ptr(OSSL_PARAM_BLD *bld, const char *key,
char *buf, size_t bsize);
int ossl_param_bld_push_octet_string(OSSL_PARAM_BLD *bld, const char *key,
const void *buf, size_t bsize);
int ossl_param_bld_push_octet_ptr(OSSL_PARAM_BLD *bld, const char *key,
void *buf, size_t bsize);
=head1 DESCRIPTION
A collection of utility functions that simplify the creation of OSSL_PARAM
arrays. The B<TYPE> names are as per L<OSSL_PARAM_int(3)>.
ossl_param_bld_init() initialises the OSSL_PARAM_BLD structure so that values
can be added.
Any existing values are cleared.
ossl_param_bld_to_param() converts a built up OSSL_PARAM_BLD structure
B<bld> into an allocated OSSL_PARAM array.
The OSSL_PARAM array and all associated storage must be freed by calling
ossl_param_bld_free() with the functions return value.
ossl_param_bld_free() deallocates the memory allocated by
ossl_param_bld_to_param().
ossl_param_bld_to_param_ex() behaves like ossl_param_bld_to_param(), except that
no additional memory is allocated.
An OSSL_PARAM array of at least B<param_n> elements is passed in as B<params>.
The auxiliary storage for the parameters is a block of memory pointed to
by B<data> of at least B<data_n> bytes in size.
If required, secure memory for private BIGNUMs should be pointed to by
B<secure> of at least B<secure_n> bytes in size.
ossl_param_bld_push_TYPE() are a series of functions which will create
OSSL_PARAM objects of the specified size and correct type for the B<val>
argument.
B<val> is stored by value and an expression or auto variable can be used.
ossl_param_bld_push_BN() is a function that will create an OSSL_PARAM object
that holds the specified BIGNUM B<bn>.
If B<bn> is marked as being securely allocated, it's OSSL_PARAM representation
will also be securely allocated.
The B<bn> argument is stored by reference and the underlying BIGNUM object
must exist until after ossl_param_bld_to_param() has been called.
ossl_param_bld_push_utf8_string() is a function that will create an OSSL_PARAM
object that references the UTF8 string specified by B<buf>.
If the length of the string, B<bsize>, is zero then it will be calculated.
The string that B<buf> points to is stored by reference and must remain in
scope until after ossl_param_bld_to_param() has been called.
ossl_param_bld_push_octet_string() is a function that will create an OSSL_PARAM
object that references the octet string specified by B<buf> and <bsize>.
The memory that B<buf> points to is stored by reference and must remain in
scope until after ossl_param_bld_to_param() has been called.
ossl_param_bld_push_utf8_ptr() is a function that will create an OSSL_PARAM
object that references the UTF8 string specified by B<buf>.
If the length of the string, B<bsize>, is zero then it will be calculated.
The string B<buf> points to is stored by reference and must remain in
scope until the OSSL_PARAM array is freed.
ossl_param_bld_push_octet_ptr() is a function that will create an OSSL_PARAM
object that references the octet string specified by B<buf>.
The memory B<buf> points to is stored by reference and must remain in
scope until the OSSL_PARAM array is freed.
=head1 RETURN VALUES
ossl_param_bld_to_param() and ossl_param_bld_to_param_ex() return the
allocated OSSL_PARAM array, or NULL on error.
All of the ossl_param_bld_push_TYPE functions return 1 on success and 0
on error.
=head1 NOTES
The constant B<OSSL_PARAM_BLD_MAX> specifies the maximum number of parameters
that can be added.
Exceeding this will result in the push functions returning errors.
The structure B<OSSL_PARAM_BLD> should be considered opaque and subject to
change between versions.
=head1 EXAMPLES
Both examples creating an OSSL_PARAM array that contains an RSA key.
For both, the predefined key variables are:
BIGNUM *p, *q; /* both prime */
BIGNUM *n; /* = p * q */
unsigned int e; /* exponent, usually 65537 */
BIGNUM *d; /* e^-1 */
=head2 Example 1
This example shows how to create an OSSL_PARAM array that contains an RSA
private key.
OSSL_PARAM_BLD bld;
OSSL_PARAM *params;
ossl_param_bld_init(&bld, &secure);
if (!ossl_param_bld_push_BN(&bld, "p", p)
|| !ossl_param_bld_push_BN(&bld, "q", q)
|| !ossl_param_bld_push_uint(&bld, "e", e)
|| !ossl_param_bld_push_BN(&bld, "n", n)
|| !ossl_param_bld_push_BN(&bld, "d", d)
|| (params = ossl_param_bld_to_param(&bld)) == NULL)
goto err;
/* Use params */
...
ossl_param_bld_free(params);
=head2 Example 2
This example shows how to create an OSSL_PARAM array that contains an RSA
public key.
OSSL_PARAM_BLD bld;
OSSL_PARAM *params;
ossl_param_bld_init(&bld, &secure);
if (!ossl_param_bld_push_BN(&bld, "n", n)
|| !ossl_param_bld_push_BN(&bld, "d", d)
|| (params = ossl_param_bld_to_param(&bld)) == NULL)
goto err;
/* Use params */
...
ossl_param_bld_free(params);
=head1 SEE ALSO
L<OSSL_PARAM_int>, L<OSSL_PARAM>
=head1 HISTORY
The functions described here were all added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/internal/man3/ossl_provider_new.pod
+39 -11
View File
@@ -6,12 +6,13 @@ ossl_provider_find, ossl_provider_new, ossl_provider_up_ref,
ossl_provider_free,
ossl_provider_set_fallback, ossl_provider_set_module_path,
ossl_provider_add_parameter,
ossl_provider_activate,
ossl_provider_activate, ossl_provider_available,
ossl_provider_ctx,
ossl_provider_forall_loaded,
ossl_provider_name, ossl_provider_dso,
ossl_provider_module_name, ossl_provider_module_path,
ossl_provider_teardown, ossl_provider_get_param_types,
ossl_provider_library_context,
ossl_provider_teardown, ossl_provider_gettable_params,
ossl_provider_get_params, ossl_provider_query_operation
- internal provider routines
@@ -19,9 +20,11 @@ ossl_provider_get_params, ossl_provider_query_operation
#include "internal/provider.h"
OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name);
OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name,
int noconfig);
OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name,
ossl_provider_init_fn *init_function);
ossl_provider_init_fn *init_function
int noconfig);
int ossl_provider_up_ref(OSSL_PROVIDER *prov);
void ossl_provider_free(OSSL_PROVIDER *prov);
@@ -33,6 +36,8 @@ ossl_provider_get_params, ossl_provider_query_operation
/* Load and initialize the Provider */
int ossl_provider_activate(OSSL_PROVIDER *prov);
/* Check if provider is available */
int ossl_provider_available(OSSL_PROVIDER *prov);
/* Return pointer to the provider's context */
void *ossl_provider_ctx(const OSSL_PROVIDER *prov);
@@ -48,10 +53,11 @@ ossl_provider_get_params, ossl_provider_query_operation
const DSO *ossl_provider_dso(OSSL_PROVIDER *prov);
const char *ossl_provider_module_name(OSSL_PROVIDER *prov);
const char *ossl_provider_module_path(OSSL_PROVIDER *prov);
OPENSSL_CTX *ossl_provider_library_context(const OSSL_PROVIDER *prov);
/* Thin wrappers around calls to the provider */
void ossl_provider_teardown(const OSSL_PROVIDER *prov);
const OSSL_ITEM *ossl_provider_get_param_types(const OSSL_PROVIDER *prov);
const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov);
int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]);
const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov,
int operation_id,
@@ -79,7 +85,11 @@ times as ossl_provider_activate() has.
=head2 Functions
ossl_provider_find() finds an existing provider object in the provider
object store by I<name>.
object store by I<name>.
The config file will be automatically loaded unless I<noconfig> is set.
Typically I<noconfig> should be 0.
We set I<noconfig> to 1 only when calling these functions while processing a
config file in order to avoid recursively attempting to load the file.
The provider object it finds has its reference count incremented.
ossl_provider_new() creates a new provider object named I<name> and
@@ -87,6 +97,10 @@ stores it in the provider object store, unless there already is one
there with the same name.
If there already is one with the same name, it's returned with its
reference count incremented.
The config file will be automatically loaded unless I<noconfig> is set.
Typically I<noconfig> should be 0.
We set I<noconfig> to 1 only when calling these functions while processing a
config file in order to avoid recursively attempting to load the file.
The reference count of a newly created provider object will always
be 2; one for being added to the store, and one for the returned
reference.
@@ -120,6 +134,9 @@ This will be used in preference to automatically trying to figure out
the path from the provider name and the default module directory (more
on this in L</NOTES>).
ossl_provider_library_context() returns the library context the given
provider I<prov> is registered in.
ossl_provider_add_parameter() adds a global parameter for the provider
to retrieve as it sees fit.
The parameters are a combination of I<name> and I<value>, and the
@@ -148,6 +165,10 @@ be located in that module, and called.
=back
ossl_provider_available() activates all fallbacks if no provider is
activated yet, then checks if given provider object I<prov> is
activated.
ossl_provider_ctx() returns a context created by the provider.
Outside of the provider, it's completely opaque, but it needs to be
passed back to some of the provider functions.
@@ -172,9 +193,9 @@ for providers that come in the form of loadable modules.
ossl_provider_teardown() calls the provider's I<teardown> function, if
the provider has one.
ossl_provider_get_param_types() calls the provider's I<get_param_types>
ossl_provider_gettable_params() calls the provider's I<gettable_params>
function, if the provider has one.
It should return an array of I<OSSL_ITEM> to describe all the
It should return an array of I<OSSL_PARAM> to describe all the
parameters that the provider has for the provider object.
ossl_provider_get_params() calls the provider's parameter request
@@ -228,16 +249,23 @@ ossl_provider_free() doesn't return any value.
ossl_provider_set_module_path(), ossl_provider_set_fallback() and
ossl_provider_activate() return 1 on success, or 0 on error.
ossl_provider_available() return 1 if the provider is available,
otherwise 0.
ossl_provider_name(), ossl_provider_dso(),
ossl_provider_module_name(), and ossl_provider_module_path() return a
pointer to their respective data if it's available, otherwise NULL
is returned.
ossl_provider_library_context() return a pointer to the library context.
This may be NULL, and is perfectly valid, as it denotes the default
global library context.
ossl_provider_teardown() doesnt't return any value.
ossl_provider_get_param_types() returns a pointer to an I<OSSL_ITEM>
array if this function is available in the provider, otherwise
NULL.
ossl_provider_gettable_params() returns a pointer to a constant
I<OSSL_PARAM> array if this function is available in the provider,
otherwise NULL.
ossl_provider_get_params() returns 1 on success, or 0 on error.
If this function isn't available in the provider, 0 is returned.
doc/man1/CA.pl.pod
+5 -1
View File
@@ -199,7 +199,11 @@ behaviour of the certificate commands call the B<openssl> command directly.
=head1 SEE ALSO
L<x509(1)>, L<ca(1)>, L<req(1)>, L<pkcs12(1)>,
L<openssl(1)>,
L<openssl-x509(1)>,
L<openssl-ca(1)>,
L<openssl-req(1)>,
L<openssl-pkcs12(1)>,
L<config(5)>
=head1 COPYRIGHT
doc/man1/fipsinstall.pod
+147
View File
@@ -0,0 +1,147 @@
=pod
=head1 NAME
openssl-fipsinstall - perform FIPS configuration installation
=head1 SYNOPSIS
B<openssl fipsinstall>
[B<-help>]
[B<-in configfilename>]
[B<-out configfilename>]
[B<-module modulefilename>]
[B<-provider_name providername>]
[B<-section_name sectionname>]
[B<-verify>]
[B<-mac_name macname>]
[B<-macopt>]
B<openssl> I<fipsinstall> [B<...>]
=head1 DESCRIPTION
This utility is used to generate a FIPS module configuration file.
The generated configuration file consists of:
=over 4
=item - A mac of the FIPS module file.
=item - A status indicator that indicates if the known answer Self Tests (KAT's)
have successfully run.
=back
This configuration file can be used each time a FIPS module is loaded
in order to pass data to the FIPS modules self tests. The FIPS module always
verifies the modules MAC, but only needs to run the KATS once during install.
=head1 OPTIONS
=over 4
=item B<-help>
Print a usage message.
=item B<-module filename>
Filename of a fips module to perform an integrity check on.
=item B<-out configfilename>
Filename to output the configuration data to, or standard output by default.
=item B<-in configfilename>
Input filename to load configuration data from. Used with the '-verify' option.
Standard input is used if the filename is '-'.
=item B<-verify>
Verify that the input configuration file contains the correct information
=item B<-provider_name providername>
Name of the provider inside the configuration file.
=item B<-section_name sectionname>
Name of the section inside the configuration file.
=item B<-mac_name name>
Specifies the name of a supported MAC algorithm which will be used.
To see the list of supported MAC's use the command I<list -mac-algorithms>.
The default is "HMAC".
=item B<-macopt nm:v>
Passes options to the MAC algorithm.
A comprehensive list of controls can be found in the EVP_MAC implementation
documentation.
Common control strings used for fipsinstall are:
=over 4
=item B<key:string>
Specifies the MAC key as an alphanumeric string (use if the key contains
printable characters only).
The string length must conform to any restrictions of the MAC algorithm.
A key must be specified for every MAC algorithm.
=item B<hexkey:string>
Specifies the MAC key in hexadecimal form (two hex digits per byte).
The key length must conform to any restrictions of the MAC algorithm.
A key must be specified for every MAC algorithm.
=item B<digest:string>
Used by HMAC as an alphanumeric string (use if the key contains printable
characters only).
The string length must conform to any restrictions of the MAC algorithm.
To see the list of supported digests, use the command I<list -digest-commands>.
=back
=back
=head1 EXAMPLES
Calculate the mac of a FIPS module 'fips.so' and run a FIPS self test
for the module, and save the fips.conf configuration file:
openssl fipsinstall -module ./fips.so -out fips.conf -provider_name fips \
-section_name fipsinstall -mac_name HMAC -macopt digest:SHA256 \
-macopt hexkey:000102030405060708090A0B0C0D0E0F10111213
Verify that the configuration file 'fips.conf' contains the correct info:
openssl fipsinstall -module ./fips.so -in fips.conf -provider_name fips \
-section_name fips_install -mac_name HMAC -macopt digest:SHA256 \
-macopt hexkey:000102030405060708090A0B0C0D0E0F10111213 -verify
=head1 NOTES
The MAC mechanisms that are available will depend on the options
used when building OpenSSL.
The B<list -mac-algorithms> command can be used to list them.
=head1 SEE ALSO
L<fips_config(5)>,
L<EVP_MAC(3)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man1/asn1parse.pod → doc/man1/openssl-asn1parse.pod
+3 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-asn1parse,
asn1parse - ASN.1 parsing tool
openssl-asn1parse - ASN.1 parsing tool
=head1 SYNOPSIS
@@ -201,11 +200,12 @@ ASN.1 types is not well handled (if at all).
=head1 SEE ALSO
L<openssl(1)>,
L<ASN1_generate_nconf(3)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ca.pod → doc/man1/openssl-ca.pod
+8 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-ca,
ca - sample minimal CA application
openssl-ca - sample minimal CA application
=head1 SYNOPSIS
@@ -770,8 +769,13 @@ are in year 2050 or later.
=head1 SEE ALSO
L<req(1)>, L<spkac(1)>, L<x509(1)>, L<CA.pl(1)>,
L<config(5)>, L<x509v3_config(5)>
L<openssl(1)>,
L<openssl-req(1)>,
L<openssl-spkac(1)>,
L<openssl-x509(1)>,
L<CA.pl(1)>,
L<config(5)>,
L<x509v3_config(5)>
=head1 COPYRIGHT
doc/man1/ciphers.pod → doc/man1/openssl-ciphers.pod
+7 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-ciphers,
ciphers - SSL cipher display and cipher list tool
openssl-ciphers - SSL cipher display and cipher list tool
=head1 SYNOPSIS
@@ -524,7 +523,7 @@ Note: these ciphers can also be used in SSL v3.
TLS_DHE_DSS_WITH_RC4_128_SHA DHE-DSS-RC4-SHA
=head2 Elliptic curve cipher suites.
=head2 Elliptic curve cipher suites
TLS_ECDHE_RSA_WITH_NULL_SHA ECDHE-RSA-NULL-SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA ECDHE-RSA-RC4-SHA
@@ -768,7 +767,10 @@ Set security level to 2 and display all ciphers consistent with level 2:
=head1 SEE ALSO
L<s_client(1)>, L<s_server(1)>, L<ssl(7)>
L<openssl(1)>,
L<openssl-s_client(1)>,
L<openssl-s_server(1)>,
L<ssl(7)>
=head1 HISTORY
@@ -781,7 +783,7 @@ The B<-convert> option was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-cmds.pod
+153
View File
@@ -0,0 +1,153 @@
=pod
=head1 NAME
asn1parse,
ca,
ciphers,
cms,
crl,
crl2pkcs7,
dgst,
dhparam,
dsa,
dsaparam,
ec,
ecparam,
enc,
engine,
errstr,
gendsa,
genpkey,
genrsa,
info,
kdf,
mac,
nseq,
ocsp,
passwd,
pkcs12,
pkcs7,
pkcs8,
pkey,
pkeyparam,
pkeyutl,
prime,
rand,
rehash,
req,
rsa,
rsautl,
s_client,
s_server,
s_time,
sess_id,
smime,
speed,
spkac,
srp,
storeutl,
ts,
verify,
version,
x509
- OpenSSL application commands
=head1 SYNOPSIS
=for comment generic
B<openssl> B<cmd> [B<-help>] [B<...>]
=head1 DESCRIPTION
Every B<cmd> listed above is a (sub-)command of the L<openssl(1)> application.
It has its own detailed manual page at B<openssl-cmd(1)>. For example, to view
the manual page for the B<openssl dgst> command, type B<man openssl-dgst>.
=head1 OPTIONS
Among others, every subcommand has a help option.
=over 4
=item B<-help>
Print out a usage message for the subcommand.
=back
=head1 SEE ALSO
L<openssl(1)>,
L<openssl-asn1parse(1)>,
L<openssl-ca(1)>,
L<openssl-ciphers(1)>,
L<openssl-cms(1)>,
L<openssl-crl(1)>,
L<openssl-crl2pkcs7(1)>,
L<openssl-dgst(1)>,
L<openssl-dhparam(1)>,
L<openssl-dsa(1)>,
L<openssl-dsaparam(1)>,
L<openssl-ec(1)>,
L<openssl-ecparam(1)>,
L<openssl-enc(1)>,
L<openssl-engine(1)>,
L<openssl-errstr(1)>,
L<openssl-gendsa(1)>,
L<openssl-genpkey(1)>,
L<openssl-genrsa(1)>,
L<openssl-info(1)>,
L<openssl-kdf(1)>,
L<openssl-mac(1)>,
L<openssl-nseq(1)>,
L<openssl-ocsp(1)>,
L<openssl-passwd(1)>,
L<openssl-pkcs12(1)>,
L<openssl-pkcs7(1)>,
L<openssl-pkcs8(1)>,
L<openssl-pkey(1)>,
L<openssl-pkeyparam(1)>,
L<openssl-pkeyutl(1)>,
L<openssl-prime(1)>,
L<openssl-rand(1)>,
L<openssl-rehash(1)>,
L<openssl-req(1)>,
L<openssl-rsa(1)>,
L<openssl-rsautl(1)>,
L<openssl-s_client(1)>,
L<openssl-s_server(1)>,
L<openssl-s_time(1)>,
L<openssl-sess_id(1)>,
L<openssl-smime(1)>,
L<openssl-speed(1)>,
L<openssl-spkac(1)>,
L<openssl-srp(1)>,
L<openssl-storeutl(1)>,
L<openssl-ts(1)>,
L<openssl-verify(1)>,
L<openssl-version(1)>,
L<openssl-x509(1)>,
=head1 HISTORY
Initially, the manual page entry for the B<openssl cmd> command used
to be available at B<cmd(1)>. Later, the alias B<openssl-cmd(1)> was
introduced, which made it easier to group the openssl commands using
the L<apropos(1)> command or the shell's tab completion.
In order to reduce cluttering of the global manual page namespace,
the manual page entries without the 'openssl-' prefix have been
deprecated in OpenSSL 3.0 and will be removed in OpenSSL 4.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man1/cms.pod → doc/man1/openssl-cms.pod
+4 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-cms,
cms - CMS utility
openssl-cms - CMS utility
=head1 SYNOPSIS
@@ -560,7 +559,7 @@ The B<-debug_decrypt> option can be used to disable the MMA attack protection
and return an error if no recipient can be found: this option should be used
with caution. For a fuller description see L<CMS_decrypt(3)>).
=head1 CAdES Basic Electronic Signature (CAdES-BES)
=head1 CADES BASIC ELECTRONIC SIGNATURE (CADES-BES)
A CAdES Basic Electronic Signature (CAdES-BES), as defined in the European Standard ETSI EN 319 122-1 V1.1.1, contains:
@@ -626,7 +625,7 @@ the signers certificates.
=back
=head1 COMPATIBILITY WITH PKCS#7 format.
=head1 COMPATIBILITY WITH PKCS#7 FORMAT
The B<smime> utility can only process the older B<PKCS#7> format. The B<cms>
utility supports Cryptographic Message Syntax format. Use of some features
@@ -776,7 +775,7 @@ The -no_alt_chains option was added in OpenSSL 1.0.2b.
=head1 COPYRIGHT
Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/crl.pod → doc/man1/openssl-crl.pod
+6 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-crl,
crl - CRL utility
openssl-crl - CRL utility
=head1 SYNOPSIS
@@ -129,11 +128,14 @@ and files too.
=head1 SEE ALSO
L<crl2pkcs7(1)>, L<ca(1)>, L<x509(1)>
L<openssl(1)>,
L<openssl-crl2pkcs7(1)>,
L<openssl-ca(1)>,
L<openssl-x509(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/crl2pkcs7.pod → doc/man1/openssl-crl2pkcs7.pod
+4 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-crl2pkcs7,
crl2pkcs7 - Create a PKCS#7 structure from a CRL and certificates
openssl-crl2pkcs7 - Create a PKCS#7 structure from a CRL and certificates
=head1 SYNOPSIS
@@ -92,11 +91,12 @@ install user certificates and CAs in MSIE using the Xenroll control.
=head1 SEE ALSO
L<pkcs7(1)>
L<openssl(1)>,
L<openssl-pkcs7(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/dgst.pod → doc/man1/openssl-dgst.pod
+1 -2
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-dgst,
dgst - perform digest operations
openssl-dgst - perform digest operations
=head1 SYNOPSIS
doc/man1/dhparam.pod → doc/man1/openssl-dhparam.pod
+9 -7
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-dhparam,
dhparam - DH parameter manipulation and generation
openssl-dhparam - DH parameter manipulation and generation
=head1 SYNOPSIS
@@ -19,6 +18,7 @@ B<openssl dhparam>
[B<-text>]
[B<-C>]
[B<-2>]
[B<-3>]
[B<-5>]
[B<-rand file...>]
[B<-writerand file>]
@@ -77,9 +77,9 @@ avoid small-subgroup attacks that may be possible otherwise.
Performs numerous checks to see if the supplied parameters are valid and
displays a warning if not.
=item B<-2>, B<-5>
=item B<-2>, B<-3>, B<-5>
The generator to use, either 2 or 5. If present then the
The generator to use, either 2, 3 or 5. If present then the
input file is ignored and parameters are generated instead. If not
present but B<numbits> is present, parameters are generated with the
default generator 2.
@@ -102,8 +102,9 @@ This can be used with a subsequent B<-rand> flag.
This option specifies that a parameter set should be generated of size
I<numbits>. It must be the last option. If this option is present then
the input file is ignored and parameters are generated instead. If
this option is not present but a generator (B<-2> or B<-5>) is
this option is not present but a generator (B<-2>, B<-3> or B<-5>) is
present, parameters are generated with a default length of 2048 bits.
The minimim length is 512 bits. The maximum length is 10000 bits.
=item B<-noout>
@@ -152,11 +153,12 @@ There should be a way to generate and manipulate DH keys.
=head1 SEE ALSO
L<dsaparam(1)>
L<openssl(1)>,
L<openssl-dsaparam(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/dsa.pod → doc/man1/openssl-dsa.pod
+7 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-dsa,
dsa - DSA key processing
openssl-dsa - DSA key processing
=head1 SYNOPSIS
@@ -167,12 +166,15 @@ To just output the public part of a private key:
=head1 SEE ALSO
L<dsaparam(1)>, L<gendsa(1)>, L<rsa(1)>,
L<genrsa(1)>
L<openssl(1)>,
L<openssl-dsaparam(1)>,
L<openssl-gendsa(1)>,
L<openssl-rsa(1)>,
L<openssl-genrsa(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/dsaparam.pod → doc/man1/openssl-dsaparam.pod
+7 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-dsaparam,
dsaparam - DSA parameter manipulation and generation
openssl-dsaparam - DSA parameter manipulation and generation
=head1 SYNOPSIS
@@ -121,12 +120,15 @@ DSA parameters is often used to generate several distinct keys.
=head1 SEE ALSO
L<gendsa(1)>, L<dsa(1)>, L<genrsa(1)>,
L<rsa(1)>
L<openssl(1)>,
L<openssl-gendsa(1)>,
L<openssl-dsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-rsa(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ec.pod → doc/man1/openssl-ec.pod
+6 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-ec,
ec - EC key processing
openssl-ec - EC key processing
=head1 SYNOPSIS
@@ -189,11 +188,14 @@ To change the point conversion form to B<compressed>:
=head1 SEE ALSO
L<ecparam(1)>, L<dsa(1)>, L<rsa(1)>
L<openssl(1)>,
L<openssl-ecparam(1)>,
L<openssl-dsa(1)>,
L<openssl-rsa(1)>
=head1 COPYRIGHT
Copyright 2003-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2003-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ecparam.pod → doc/man1/openssl-ecparam.pod
+5 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-ecparam,
ecparam - EC parameter manipulation and generation
openssl-ecparam - EC parameter manipulation and generation
=head1 SYNOPSIS
@@ -184,11 +183,13 @@ To print out the EC parameters to standard output:
=head1 SEE ALSO
L<ec(1)>, L<dsaparam(1)>
L<openssl(1)>,
L<openssl-ec(1)>,
L<openssl-dsaparam(1)>
=head1 COPYRIGHT
Copyright 2003-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2003-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/enc.pod → doc/man1/openssl-enc.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-enc,
enc - symmetric cipher routines
openssl-enc - symmetric cipher routines
=head1 SYNOPSIS
@@ -421,7 +420,7 @@ The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/engine.pod → doc/man1/openssl-engine.pod
+4 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-engine,
engine - load and query engines
openssl-engine - load and query engines
=head1 SYNOPSIS
@@ -64,7 +63,7 @@ See the example below.
=back
=head1 EXAMPLE
=head1 EXAMPLES
To list all the commands available to a dynamic engine:
@@ -105,11 +104,12 @@ The path to the engines directory.
=head1 SEE ALSO
L<openssl(1)>,
L<config(5)>
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/errstr.pod → doc/man1/openssl-errstr.pod
+3 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-errstr,
errstr - lookup error codes
openssl-errstr - lookup error codes
=head1 SYNOPSIS
@@ -20,7 +19,7 @@ second colon.
None.
=head1 EXAMPLE
=head1 EXAMPLES
The error code:
@@ -36,7 +35,7 @@ to produce the error message:
=head1 COPYRIGHT
Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/gendsa.pod → doc/man1/openssl-gendsa.pod
+7 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-gendsa,
gendsa - generate a DSA private key from a set of parameters
openssl-gendsa - generate a DSA private key from a set of parameters
=head1 SYNOPSIS
@@ -91,12 +90,15 @@ much quicker that RSA key generation for example.
=head1 SEE ALSO
L<dsaparam(1)>, L<dsa(1)>, L<genrsa(1)>,
L<rsa(1)>
L<openssl(1)>,
L<openssl-dsaparam(1)>,
L<openssl-dsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-rsa(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/genpkey.pod → doc/man1/openssl-genpkey.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-genpkey,
genpkey - generate a private key
openssl-genpkey - generate a private key
=head1 SYNOPSIS
@@ -325,7 +324,7 @@ The ability to generate X448, ED25519 and ED448 keys was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/genrsa.pod → doc/man1/openssl-genrsa.pod
+4 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-genrsa,
genrsa - generate an RSA private key
openssl-genrsa - generate an RSA private key
=head1 SYNOPSIS
@@ -119,11 +118,12 @@ of a key.
=head1 SEE ALSO
L<gendsa(1)>
L<openssl(1)>,
L<openssl-gendsa(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/info.pod → doc/man1/openssl-info.pod
+11 -2
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-info,
info - print OpenSSL built-in information
openssl-info - print OpenSSL built-in information
=head1 SYNOPSIS
@@ -15,6 +14,8 @@ B<openssl info>
[B<-dsoext>]
[B<-dirfilesep>]
[B<-listsep]>
[B<-seeds]>
[B<-cpusettings]>
=head1 DESCRIPTION
@@ -63,6 +64,14 @@ Outputs the OpenSSL list separator character.
This is typically used to construct C<$PATH> (C<%PATH%> on Windows)
style lists.
=item B<-seeds>
Outputs the randomness seed sources.
=item B<-cpusettings>
Outputs the OpenSSL CPU settings info.
=back
=head1 HISTORY
doc/man1/kdf.pod → doc/man1/openssl-kdf.pod
+17 -14
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-kdf,
kdf - perform Key Derivation Function operations
openssl-kdf - perform Key Derivation Function operations
=head1 SYNOPSIS
@@ -43,9 +42,9 @@ Output the derived key in binary form. Uses hexadecimal text format if not speci
=item B<-kdfopt> I<nm:v>
Passes options to the KDF algorithm.
A comprehensive list of controls can be found in the EVP_KDF_CTX implementation
documentation.
Common control strings used by EVP_KDF_ctrl_str() are:
A comprehensive list of parameters can be found in the EVP_KDF_CTX
implementation documentation.
Common parameter names used by EVP_KDF_CTX_set_params() are:
=over 4
@@ -83,7 +82,8 @@ To see the list of supported digests, use the command I<list -digest-commands>.
=item I<kdf_name>
Specifies the name of a supported KDF algorithm which will be used.
The supported algorithms names are TLS1-PRF, HKDF, SSKDF, PBKDF2, SSHKDF and id-scrypt.
The supported algorithms names include TLS1-PRF, HKDF, SSKDF, PBKDF2,
SSHKDF, X942KDF, X963KDF and id-scrypt.
=back
@@ -143,14 +143,17 @@ used when building OpenSSL.
=head1 SEE ALSO
L<EVP_KDF_CTX(3)>,
L<EVP_KDF_SCRYPT(7)>
L<EVP_KDF_TLS1_PRF(7)>
L<EVP_KDF_PBKDF2(7)>
L<EVP_KDF_HKDF(7)>
L<EVP_KDF_SS(7)>
L<EVP_KDF_SSHKDF(7)>
L<pkeyutl(1)>
L<openssl(1)>,
L<openssl-pkeyutl(1)>,
L<EVP_KDF(3)>,
L<EVP_KDF-SCRYPT(7)>,
L<EVP_KDF-TLS1_PRF(7)>,
L<EVP_KDF-PBKDF2(7)>,
L<EVP_KDF-HKDF(7)>,
L<EVP_KDF-SS(7)>,
L<EVP_KDF-SSHKDF(7)>,
L<EVP_KDF-X942(7)>,
L<EVP_KDF-X963(7)>
=head1 HISTORY
doc/man1/list.pod → doc/man1/openssl-list.pod
+24 -7
View File
@@ -2,17 +2,18 @@
=head1 NAME
openssl-list,
list - list algorithms and features
openssl-list - list algorithms and features
=head1 SYNOPSIS
B<openssl list>
[B<-help>]
[B<-verbose>]
[B<-1>]
[B<-commands>]
[B<-digest-commands>]
[B<-digest-algorithms>]
[B<-kdf-algorithms>]
[B<-mac-algorithms>]
[B<-cipher-commands>]
[B<-cipher-algorithms>]
@@ -34,6 +35,11 @@ features.
Display a usage message.
=item B<-verbose>
Displays extra information.
The options below where verbosity applies say a bit more about what that means.
=item B<-1>
List the commands, digest-commands, or cipher-commands in a single column.
@@ -53,12 +59,19 @@ as input to the L<dgst(1)> or L<speed(1)> commands.
Display a list of message digest algorithms.
If a line is of the form C<foo =E<gt> bar> then B<foo> is an alias for the
official algorithm name, B<bar>.
If a line is of the form C<foo @ bar>, then B<foo> is provided by the provider
B<bar>.
In verbose mode, the algorithms provided by a provider will get additional
information on what parameters each implementation supports.
=item B<-kdf-algorithms>
Display a list of key derivation function algorithms.
=item B<-mac-algorithms>
Display a list of message authentication code algorithms.
If a line is of the form C<foo =E<gt> bar> then B<foo> is an alias for the
official algorithm name, B<bar>.
=item B<-cipher-commands>
@@ -70,6 +83,11 @@ to the L<dgst(1)> or L<speed(1)> commands.
Display a list of cipher algorithms.
If a line is of the form C<foo =E<gt> bar> then B<foo> is an alias for the
official algorithm name, B<bar>.
If a line is of the form C<foo @ bar>, then B<foo> is provided by the provider
B<bar>.
In verbose mode, the algorithms provided by a provider will get additional
information on what parameters each implementation supports.
=item B<-public-key-algorithms>
@@ -78,8 +96,7 @@ a block of multiple lines, all but the first are indented.
=item B<-public-key-methods>
Display a list of public key method OIDs: this also includes public key methods
without an associated ASN.1 method, for example, KDF algorithms.
Display a list of public key method OIDs.
=item B<-engines>
@@ -99,7 +116,7 @@ format described in L<config(5)/ASN1 Object Configuration Module>.
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/mac.pod → doc/man1/openssl-mac.pod
+10 -10
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-mac,
mac - perform Message Authentication Code operations
openssl-mac - perform Message Authentication Code operations
=head1 SYNOPSIS
@@ -50,7 +49,7 @@ Output the MAC in binary form. Uses hexadecimal text format if not specified.
Passes options to the MAC algorithm.
A comprehensive list of controls can be found in the EVP_MAC implementation
documentation.
Common control strings used by EVP_MAC_ctrl_str() are:
Common parameter names used by EVP_MAC_CTX_get_params() are:
=over 4
@@ -143,17 +142,18 @@ The B<list -mac-algorithms> command can be used to list them.
=head1 SEE ALSO
L<openssl(1)>,
L<EVP_MAC(3)>,
L<EVP_MAC_CMAC(7)>,
L<EVP_MAC_GMAC(7)>,
L<EVP_MAC_HMAC(7)>,
L<EVP_MAC_KMAC(7)>,
L<EVP_MAC_SIPHASH(7)>,
L<EVP_MAC_POLY1305(7)>
L<EVP_MAC-CMAC(7)>,
L<EVP_MAC-GMAC(7)>,
L<EVP_MAC-HMAC(7)>,
L<EVP_MAC-KMAC(7)>,
L<EVP_MAC-SIPHASH(7)>,
L<EVP_MAC-POLY1305(7)>
=head1 COPYRIGHT
Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/nseq.pod → doc/man1/openssl-nseq.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-nseq,
nseq - create or examine a Netscape certificate sequence
openssl-nseq - create or examine a Netscape certificate sequence
=head1 SYNOPSIS
@@ -75,7 +74,7 @@ output files and allowing multiple certificate files to be used.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ocsp.pod → doc/man1/openssl-ocsp.pod
+3 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-ocsp,
ocsp - Online Certificate Status Protocol utility
openssl-ocsp - Online Certificate Status Protocol utility
=head1 SYNOPSIS
@@ -393,7 +392,7 @@ immediately available.
=back
=head1 OCSP Response verification.
=head1 OCSP RESPONSE VERIFICATION
OCSP Response follows the rules specified in RFC2560.
@@ -497,7 +496,7 @@ The -no_alt_chains option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/passwd.pod → doc/man1/openssl-passwd.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-passwd,
passwd - compute password hashes
openssl-passwd - compute password hashes
=head1 SYNOPSIS
@@ -122,7 +121,7 @@ This can be used with a subsequent B<-rand> flag.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkcs12.pod → doc/man1/openssl-pkcs12.pod
+6 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-pkcs12,
pkcs12 - PKCS#12 file utility
openssl-pkcs12 - PKCS#12 file utility
=head1 SYNOPSIS
@@ -225,7 +224,8 @@ for this search. If the search fails it is considered a fatal error.
Encrypt the certificate using triple DES, this may render the PKCS#12
file unreadable by some "export grade" software. By default the private
key is encrypted using triple DES and the certificate using 40 bit RC2.
key is encrypted using triple DES and the certificate using 40 bit RC2
unless RC2 is disabled in which case triple DES is used.
=item B<-keypbe alg>, B<-certpbe alg>
@@ -378,11 +378,12 @@ Include some extra certificates:
=head1 SEE ALSO
L<pkcs8(1)>
L<openssl(1)>,
L<openssl-pkcs8(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkcs7.pod → doc/man1/openssl-pkcs7.pod
+4 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-pkcs7,
pkcs7 - PKCS#7 utility
openssl-pkcs7 - PKCS#7 utility
=head1 SYNOPSIS
@@ -106,11 +105,12 @@ cannot currently parse, for example, the new CMS as described in RFC2630.
=head1 SEE ALSO
L<crl2pkcs7(1)>
L<openssl(1)>,
L<openssl-crl2pkcs7(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkcs8.pod → doc/man1/openssl-pkcs8.pod
+8 -6
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-pkcs8,
pkcs8 - PKCS#8 format private key conversion tool
openssl-pkcs8 - PKCS#8 format private key conversion tool
=head1 SYNOPSIS
@@ -210,7 +209,7 @@ It is possible to write out DER encoded encrypted private keys in
PKCS#8 format because the encryption details are included at an ASN1
level whereas the traditional format includes them at a PEM level.
=head1 PKCS#5 v1.5 and PKCS#12 algorithms.
=head1 PKCS#5 V1.5 AND PKCS#12 ALGORITHMS
Various algorithms can be used with the B<-v1> command line option,
including PKCS#5 v1.5 and PKCS#12. These are described in more detail
@@ -300,8 +299,11 @@ in use and other details such as the iteration count.
=head1 SEE ALSO
L<dsa(1)>, L<rsa(1)>, L<genrsa(1)>,
L<gendsa(1)>
L<openssl(1)>,
L<openssl-dsa(1)>,
L<openssl-rsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-gendsa(1)>
=head1 HISTORY
@@ -309,7 +311,7 @@ The B<-iter> option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkey.pod → doc/man1/openssl-pkey.pod
+9 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-pkey,
pkey - public or private key processing tool
openssl-pkey - public or private key processing tool
=head1 SYNOPSIS
@@ -153,12 +152,17 @@ To just output the public part of a private key:
=head1 SEE ALSO
L<genpkey(1)>, L<rsa(1)>, L<pkcs8(1)>,
L<dsa(1)>, L<genrsa(1)>, L<gendsa(1)>
L<openssl(1)>,
L<openssl-genpkey(1)>,
L<openssl-rsa(1)>,
L<openssl-pkcs8(1)>,
L<openssl-dsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-gendsa(1)>
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkeyparam.pod → doc/man1/openssl-pkeyparam.pod
+10 -6
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-pkeyparam,
pkeyparam - public key algorithm parameter processing tool
openssl-pkeyparam - public key algorithm parameter processing tool
=head1 SYNOPSIS
@@ -60,7 +59,7 @@ This option checks the correctness of parameters.
=back
=head1 EXAMPLE
=head1 EXAMPLES
Print out text version of parameters:
@@ -73,12 +72,17 @@ PEM format is supported because the key type is determined by the PEM headers.
=head1 SEE ALSO
L<genpkey(1)>, L<rsa(1)>, L<pkcs8(1)>,
L<dsa(1)>, L<genrsa(1)>, L<gendsa(1)>
L<openssl(1)>,
L<openssl-genpkey(1)>,
L<openssl-rsa(1)>,
L<openssl-pkcs8(1)>,
L<openssl-dsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-gendsa(1)>
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkeyutl.pod → doc/man1/openssl-pkeyutl.pod
+22 -9
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-pkeyutl,
pkeyutl - public key algorithm utility
openssl-pkeyutl - public key algorithm utility
=head1 SYNOPSIS
@@ -310,12 +309,12 @@ The EC algorithm supports sign, verify and derive operations. The sign and
verify operations use ECDSA and derive uses ECDH. SHA1 is assumed by default for
the B<-pkeyopt> B<digest> option.
=head1 X25519 and X448 ALGORITHMS
=head1 X25519 AND X448 ALGORITHMS
The X25519 and X448 algorithms support key derivation only. Currently there are
no additional options.
=head1 Ed25519 and Ed448 ALGORITHMS
=head1 ED25519 AND ED448 ALGORITHMS
These algorithms only support signing and verifying. OpenSSL only implements the
"pure" variants of these algorithms so raw data can be passed directly to them
@@ -341,6 +340,13 @@ This sets the ID string used in SM2 sign or verify operations. While verifying
an SM2 signature, the ID string must be the same one used when signing the data.
Otherwise the verification will fail.
=item B<sm2_hex_id:hex_string>
This sets the ID string used in SM2 sign or verify operations. While verifying
an SM2 signature, the ID string must be the same one used when signing the data.
Otherwise the verification will fail. The ID string provided with this option
should be a valid hexadecimal value.
=back
=head1 EXAMPLES
@@ -393,14 +399,21 @@ Verify some data using an L<SM2(7)> certificate and a specific ID:
=head1 SEE ALSO
L<genpkey(1)>, L<pkey(1)>, L<rsautl(1)>
L<dgst(1)>, L<rsa(1)>, L<genrsa(1)>,
L<EVP_PKEY_CTX_set_hkdf_md(3)>, L<EVP_PKEY_CTX_set_tls1_prf_md(3)>,
L<kdf(1)>
L<openssl(1)>,
L<openssl-genpkey(1)>,
L<openssl-pkey(1)>,
L<openssl-rsautl(1)>
L<openssl-dgst(1)>,
L<openssl-rsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-kdf(1)>
L<EVP_PKEY_CTX_set_hkdf_md(3)>,
L<EVP_PKEY_CTX_set_tls1_prf_md(3)>,
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/prime.pod → doc/man1/openssl-prime.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-prime,
prime - compute prime numbers
openssl-prime - compute prime numbers
=head1 SYNOPSIS
@@ -58,7 +57,7 @@ is prime. The default is 20.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/rand.pod → doc/man1/openssl-rand.pod
+3 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-rand,
rand - generate pseudo-random bytes
openssl-rand - generate pseudo-random bytes
=head1 SYNOPSIS
@@ -62,11 +61,12 @@ Show the output as a hex string.
=head1 SEE ALSO
L<openssl(1)>,
L<RAND_bytes(3)>
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/rehash.pod → doc/man1/openssl-rehash.pod
+4 -5
View File
@@ -5,8 +5,7 @@ Original text by James Westby, contributed under the OpenSSL license.
=head1 NAME
openssl-c_rehash, openssl-rehash,
c_rehash, rehash - Create symbolic links to files named by the hash values
openssl-c_rehash - Create symbolic links to files named by the hash values
=head1 SYNOPSIS
@@ -131,12 +130,12 @@ Ignored if directories are listed on the command line.
=head1 SEE ALSO
L<openssl(1)>,
L<crl(1)>.
L<x509(1)>.
L<openssl-crl(1)>,
L<openssl-x509(1)>
=head1 COPYRIGHT
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/req.pod → doc/man1/openssl-req.pod
+7 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-req,
req - PKCS#10 certificate request and certificate generating utility
openssl-req - PKCS#10 certificate request and certificate generating utility
=head1 SYNOPSIS
@@ -710,8 +709,12 @@ address in subjectAltName should be input by the user.
=head1 SEE ALSO
L<x509(1)>, L<ca(1)>, L<genrsa(1)>,
L<gendsa(1)>, L<config(5)>,
L<openssl(1)>,
L<openssl-x509(1)>,
L<openssl-ca(1)>,
L<openssl-genrsa(1)>,
L<openssl-gendsa(1)>,
L<config(5)>,
L<x509v3_config(5)>
=head1 COPYRIGHT
doc/man1/rsa.pod → doc/man1/openssl-rsa.pod
+7 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-rsa,
rsa - RSA key processing tool
openssl-rsa - RSA key processing tool
=head1 SYNOPSIS
@@ -190,12 +189,15 @@ without having to manually edit them.
=head1 SEE ALSO
L<pkcs8(1)>, L<dsa(1)>, L<genrsa(1)>,
L<gendsa(1)>
L<openssl(1)>,
L<openssl-pkcs8(1)>,
L<openssl-dsa(1)>,
L<openssl-genrsa(1)>,
L<openssl-gendsa(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/rsautl.pod → doc/man1/openssl-rsautl.pod
+6 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-rsautl,
rsautl - RSA utility
openssl-rsautl - RSA utility
=head1 SYNOPSIS
@@ -206,11 +205,14 @@ which it can be seen agrees with the recovered value above.
=head1 SEE ALSO
L<dgst(1)>, L<rsa(1)>, L<genrsa(1)>
L<openssl(1)>,
L<openssl-dgst(1)>,
L<openssl-rsa(1)>,
L<openssl-genrsa(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/s_client.pod → doc/man1/openssl-s_client.pod
+10 -6
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-s_client,
s_client - SSL/TLS client program
openssl-s_client - SSL/TLS client program
=head1 SYNOPSIS
@@ -149,7 +148,7 @@ SSL servers.
=head1 OPTIONS
In addition to the options below the B<s_client> utility also supports the
common and client only options documented in the
common and client only options documented
in the "Supported Command Line Commands" section of the L<SSL_CONF_cmd(3)>
manual page.
@@ -830,8 +829,13 @@ information whenever a session is renegotiated.
=head1 SEE ALSO
L<SSL_CONF_cmd(3)>, L<sess_id(1)>, L<s_server(1)>, L<ciphers(1)>,
L<SSL_CTX_set_max_send_fragment(3)>, L<SSL_CTX_set_split_send_fragment(3)>,
L<openssl(1)>,
L<openssl-sess_id(1)>,
L<openssl-s_server(1)>,
L<openssl-ciphers(1)>,
L<SSL_CONF_cmd(3)>,
L<SSL_CTX_set_max_send_fragment(3)>,
L<SSL_CTX_set_split_send_fragment(3)>,
L<SSL_CTX_set_max_pipelines(3)>
=head1 HISTORY
@@ -841,7 +845,7 @@ The B<-name> option was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/s_server.pod → doc/man1/openssl-s_server.pod
+8 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-s_server,
s_server - SSL/TLS server program
openssl-s_server - SSL/TLS server program
=head1 SYNOPSIS
@@ -194,7 +193,7 @@ for connections on a given port using SSL/TLS.
=head1 OPTIONS
In addition to the options below the B<s_server> utility also supports the
common and server only options documented in the
common and server only options documented
in the "Supported Command Line Commands" section of the L<SSL_CONF_cmd(3)>
manual page.
@@ -833,7 +832,11 @@ unknown cipher suites a client says it supports.
=head1 SEE ALSO
L<SSL_CONF_cmd(3)>, L<sess_id(1)>, L<s_client(1)>, L<ciphers(1)>
L<openssl(1)>,
L<openssl-sess_id(1)>,
L<openssl-s_client(1)>,
L<openssl-ciphers(1)>,
L<SSL_CONF_cmd(3)>,
L<SSL_CTX_set_max_send_fragment(3)>,
L<SSL_CTX_set_split_send_fragment(3)>,
L<SSL_CTX_set_max_pipelines(3)>
@@ -847,7 +850,7 @@ The
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/s_time.pod → doc/man1/openssl-s_time.pod
+6 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-s_time,
s_time - SSL/TLS performance timing program
openssl-s_time - SSL/TLS performance timing program
=head1 SYNOPSIS
@@ -198,11 +197,14 @@ fails.
=head1 SEE ALSO
L<s_client(1)>, L<s_server(1)>, L<ciphers(1)>
L<openssl(1)>,
L<openssl-s_client(1)>,
L<openssl-s_server(1)>,
L<openssl-ciphers(1)>
=head1 COPYRIGHT
Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/sess_id.pod → doc/man1/openssl-sess_id.pod
+5 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-sess_id,
sess_id - SSL/TLS session handling utility
openssl-sess_id - SSL/TLS session handling utility
=head1 SYNOPSIS
@@ -152,11 +151,13 @@ The cipher and start time should be printed out in human readable form.
=head1 SEE ALSO
L<ciphers(1)>, L<s_server(1)>
L<openssl(1)>,
L<openssl-ciphers(1)>,
L<openssl-s_server(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/smime.pod → doc/man1/openssl-smime.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-smime,
smime - S/MIME utility
openssl-smime - S/MIME utility
=head1 SYNOPSIS
@@ -514,7 +513,7 @@ The -no_alt_chains option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/speed.pod → doc/man1/openssl-speed.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-speed,
speed - test library performance
openssl-speed - test library performance
=head1 SYNOPSIS
@@ -104,7 +103,7 @@ pre-compiled grand selection is tested.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/spkac.pod → doc/man1/openssl-spkac.pod
+4 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-spkac,
spkac - SPKAC printing and generating utility
openssl-spkac - SPKAC printing and generating utility
=head1 SYNOPSIS
@@ -141,11 +140,12 @@ to be used in a "replay attack".
=head1 SEE ALSO
L<ca(1)>
L<openssl(1)>,
L<openssl-ca(1)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/srp.pod → doc/man1/openssl-srp.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-srp,
srp - maintain SRP password file
openssl-srp - maintain SRP password file
=head1 SYNOPSIS
@@ -63,7 +62,7 @@ Generate verbose output while processing.
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/storeutl.pod → doc/man1/openssl-storeutl.pod
+2 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-storeutl,
storeutl - STORE utility
openssl-storeutl - STORE utility
=head1 SYNOPSIS
@@ -123,7 +122,7 @@ The B<openssl> B<storeutl> app was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ts.pod → doc/man1/openssl-ts.pod
+8 -5
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-ts,
ts - Time Stamping Authority tool (client/server)
openssl-ts - Time Stamping Authority tool (client/server)
=head1 SYNOPSIS
@@ -660,13 +659,17 @@ test/testtsa).
=head1 SEE ALSO
L<tsget(1)>, L<openssl(1)>, L<req(1)>,
L<x509(1)>, L<ca(1)>, L<genrsa(1)>,
L<openssl(1)>,
L<openssl-tsget(1)>,
L<openssl-req(1)>,
L<openssl-x509(1)>,
L<openssl-ca(1)>,
L<openssl-genrsa(1)>,
L<config(5)>
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/tsget.pod → doc/man1/openssl-tsget.pod
+4 -3
View File
@@ -2,7 +2,6 @@
=head1 NAME
openssl-tsget,
tsget - Time Stamping HTTP/HTTPS client
=head1 SYNOPSIS
@@ -187,12 +186,14 @@ example:
=for comment foreign manuals: curl(1)
L<openssl(1)>, L<ts(1)>, L<curl(1)>,
L<openssl(1)>,
L<openssl-ts(1)>,
L<openssl-curl(1)>,
B<RFC 3161>
=head1 COPYRIGHT
Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/verify.pod → doc/man1/openssl-verify.pod
+4 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-verify,
verify - Utility to verify certificates
openssl-verify - Utility to verify certificates
=head1 SYNOPSIS
@@ -770,7 +769,8 @@ B<X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY> error codes.
=head1 SEE ALSO
L<x509(1)>
L<openssl(1)>,
L<openssl-x509(1)>
=head1 HISTORY
@@ -779,7 +779,7 @@ The B<-show_chain> option was added in OpenSSL 1.1.0.
The B<-issuer_checks> option is deprecated as of OpenSSL 1.1.0 and
is silently ignored.
The B<-sm2-id> and B<-sm2-hex-id> options were added in OpenSSL 3.0.0.
The B<-sm2-id> and B<-sm2-hex-id> options were added in OpenSSL 3.0.
=head1 COPYRIGHT
doc/man1/version.pod → doc/man1/openssl-version.pod
+17 -3
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-version,
version - print OpenSSL version information
openssl-version - print OpenSSL version information
=head1 SYNOPSIS
@@ -17,6 +16,9 @@ B<openssl version>
[B<-p>]
[B<-d>]
[B<-e>]
[B<-m>]
[B<-r>]
[B<-c>]
=head1 DESCRIPTION
@@ -62,6 +64,18 @@ OPENSSLDIR setting.
ENGINESDIR settings.
=item B<-m>
MODULESDIR settings.
=item B<-r>
The random number generator source settings.
=item B<-c>
The OpenSSL CPU settings info.
=back
=head1 NOTES
@@ -71,7 +85,7 @@ in a bug report.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/x509.pod → doc/man1/openssl-x509.pod
+7 -4
View File
@@ -2,8 +2,7 @@
=head1 NAME
openssl-x509,
x509 - Certificate display and signing utility
openssl-x509 - Certificate display and signing utility
=head1 SYNOPSIS
@@ -940,8 +939,12 @@ dates rather than an offset from the current time.
=head1 SEE ALSO
L<req(1)>, L<ca(1)>, L<genrsa(1)>,
L<gendsa(1)>, L<verify(1)>,
L<openssl(1)>,
L<openssl-req(1)>,
L<openssl-ca(1)>,
L<openssl-genrsa(1)>,
L<openssl-gendsa(1)>,
L<openssl-verify(1)>,
L<x509v3_config(5)>
=head1 HISTORY
doc/man1/openssl.pod
+53 -16
View File
@@ -615,22 +615,59 @@ BIGNUM context.
=head1 SEE ALSO
L<asn1parse(1)>, L<ca(1)>, L<ciphers(1)>, L<cms(1)>, L<config(5)>,
L<crl(1)>, L<crl2pkcs7(1)>, L<dgst(1)>,
L<dhparam(1)>, L<dsa(1)>, L<dsaparam(1)>,
L<ec(1)>, L<ecparam(1)>,
L<enc(1)>, L<engine(1)>, L<errstr(1)>, L<gendsa(1)>, L<genpkey(1)>,
L<genrsa(1)>, L<kdf(1)>, L<mac(1)>, L<nseq(1)>, L<ocsp(1)>,
L<passwd(1)>,
L<pkcs12(1)>, L<pkcs7(1)>, L<pkcs8(1)>,
L<pkey(1)>, L<pkeyparam(1)>, L<pkeyutl(1)>, L<prime(1)>,
L<rand(1)>, L<rehash(1)>, L<req(1)>, L<rsa(1)>,
L<rsautl(1)>, L<s_client(1)>,
L<s_server(1)>, L<s_time(1)>, L<sess_id(1)>,
L<smime(1)>, L<speed(1)>, L<spkac(1)>, L<srp(1)>, L<storeutl(1)>,
L<ts(1)>,
L<verify(1)>, L<version(1)>, L<x509(1)>,
L<crypto(7)>, L<ssl(7)>, L<x509v3_config(5)>
L<openssl-asn1parse(1)>,
L<openssl-ca(1)>,
L<openssl-ciphers(1)>,
L<openssl-cms(1)>,
L<openssl-crl(1)>,
L<openssl-crl2pkcs7(1)>,
L<openssl-dgst(1)>,
L<openssl-dhparam(1)>,
L<openssl-dsa(1)>,
L<openssl-dsaparam(1)>,
L<openssl-ec(1)>,
L<openssl-ecparam(1)>,
L<openssl-enc(1)>,
L<openssl-engine(1)>,
L<openssl-errstr(1)>,
L<openssl-gendsa(1)>,
L<openssl-genpkey(1)>,
L<openssl-genrsa(1)>,
L<openssl-kdf(1)>,
L<openssl-mac(1)>,
L<openssl-nseq(1)>,
L<openssl-ocsp(1)>,
L<openssl-passwd(1)>,
L<openssl-pkcs12(1)>,
L<openssl-pkcs7(1)>,
L<openssl-pkcs8(1)>,
L<openssl-pkey(1)>,
L<openssl-pkeyparam(1)>,
L<openssl-pkeyutl(1)>,
L<openssl-prime(1)>,
L<openssl-rand(1)>,
L<openssl-rehash(1)>,
L<openssl-req(1)>,
L<openssl-rsa(1)>,
L<openssl-rsautl(1)>,
L<openssl-s_client(1)>,
L<openssl-s_server(1)>,
L<openssl-s_time(1)>,
L<openssl-sess_id(1)>,
L<openssl-smime(1)>,
L<openssl-speed(1)>,
L<openssl-spkac(1)>,
L<openssl-srp(1)>,
L<openssl-storeutl(1)>,
L<openssl-ts(1)>,
L<openssl-verify(1)>,
L<openssl-version(1)>,
L<openssl-x509(1)>,
L<config(5)>,
L<crypto(7)>,
L<ssl(7)>,
L<x509v3_config(5)>
=head1 HISTORY
doc/man1/provider.pod
+57
View File
@@ -0,0 +1,57 @@
=pod
=head1 NAME
openssl-provider - load and query providers
=head1 SYNOPSIS
B<openssl provider>
[B<-v>]
[B<-vv>]
[B<-vvv>]
[ I<provider...> ]
=head1 DESCRIPTION
The B<provider> command is used to query the capabilities of the specified
I<provider>'s.
=head1 OPTIONS
=over 4
=item B<-v> B<-vv> B<-vvv>
Provides information about each specified provider.
The first flag lists the names of all algorithms each provider
implements; the second lists them by category; the third adds
information on what parameters each of them can handle.
=back
=head1 ENVIRONMENT
=over 4
=item B<OPENSSL_MODULES>
The path to the modules directory, where one can expect provider
modules to be located.
=back
=head1 SEE ALSO
L<config(5)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/ASYNC_WAIT_CTX_new.pod
+1 -1
View File
@@ -195,7 +195,7 @@ were added in OpenSSL 1.1.0.
ASYNC_WAIT_CTX_set_callback(), ASYNC_WAIT_CTX_get_callback(),
ASYNC_WAIT_CTX_set_status(), and ASYNC_WAIT_CTX_get_status()
were added in OpenSSL 3.0.0.
were added in OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/ASYNC_start_job.pod
+1 -1
View File
@@ -174,7 +174,7 @@ is included, commonly as one of the first included headers. Therefore
it is defined as an application developer's responsibility to include
windows.h prior to async.h.
=head1 EXAMPLE
=head1 EXAMPLES
The following example demonstrates how to use most of the core async APIs:
doc/man3/BIO_ctrl.pod
+1 -1
View File
@@ -141,7 +141,7 @@ the case of BIO_seek() on a file BIO for a successful operation.
=head1 HISTORY
The BIO_get_ktls_send() and BIO_get_ktls_recv() functions were added in
OpenSSL 3.0.0.
OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/BIO_f_ssl.pod
+18 -18
View File
@@ -129,9 +129,25 @@ BIO_set_ssl(), BIO_get_ssl(), BIO_set_ssl_mode(),
BIO_set_ssl_renegotiate_bytes(), BIO_set_ssl_renegotiate_timeout(),
BIO_get_num_renegotiates(), and BIO_do_handshake() are implemented as macros.
=head1 EXAMPLE
=head1 RETURN VALUES
This SSL/TLS client example, attempts to retrieve a page from an
BIO_f_ssl() returns the SSL B<BIO_METHOD> structure.
BIO_set_ssl(), BIO_get_ssl(), BIO_set_ssl_mode(), BIO_set_ssl_renegotiate_bytes(),
BIO_set_ssl_renegotiate_timeout() and BIO_get_num_renegotiates() return 1 on
success or a value which is less than or equal to 0 if an error occurred.
BIO_new_ssl(), BIO_new_ssl_connect() and BIO_new_buffer_ssl_connect() return
a valid B<BIO> structure on success or B<NULL> if an error occurred.
BIO_ssl_copy_session_id() returns 1 on success or 0 on error.
BIO_do_handshake() returns 1 if the connection was established successfully.
A zero or negative value is returned if the connection could not be established.
=head1 EXAMPLES
This SSL/TLS client example attempts to retrieve a page from an
SSL/TLS web server. The I/O routines are identical to those of the
unencrypted example in L<BIO_s_connect(3)>.
@@ -271,22 +287,6 @@ a client and also echoes the request to standard output.
BIO_flush(sbio);
BIO_free_all(sbio);
=head1 RETURN VALUES
BIO_f_ssl() returns the SSL B<BIO_METHOD> structure.
BIO_set_ssl(), BIO_get_ssl(), BIO_set_ssl_mode(), BIO_set_ssl_renegotiate_bytes(),
BIO_set_ssl_renegotiate_timeout() and BIO_get_num_renegotiates() return 1 on
success or a value which is less than or equal to 0 if an error occurred.
BIO_new_ssl(), BIO_new_ssl_connect() and BIO_new_buffer_ssl_connect() return
a valid B<BIO> structure on success or B<NULL> if an error occurred.
BIO_ssl_copy_session_id() returns 1 on success or 0 on error.
BIO_do_handshake() returns 1 if the connection was established successfully.
A zero or negative value is returned if the connection could not be established.
=head1 HISTORY
In OpenSSL before 1.0.0 the BIO_pop() call was handled incorrectly,
doc/man3/BIO_find_type.pod
+1 -1
View File
@@ -40,7 +40,7 @@ BIO_next() returns the next BIO in a chain.
BIO_method_type() returns the type of the BIO B<b>.
=head1 EXAMPLE
=head1 EXAMPLES
Traverse a chain looking for digest BIOs:
doc/man3/BIO_new.pod
+1 -1
View File
@@ -53,7 +53,7 @@ on it other than the discarded return value.
BIO_set() was removed in OpenSSL 1.1.0 as BIO type is now opaque.
=head1 EXAMPLE
=head1 EXAMPLES
Create a memory BIO:
doc/man3/BIO_s_accept.pod
+1 -1
View File
@@ -174,7 +174,7 @@ BIO_get_bind_mode() returns the set of B<BIO_BIND> flags, or -1 on failure.
BIO_new_accept() returns a BIO or NULL on error.
=head1 EXAMPLE
=head1 EXAMPLES
This example accepts two connections on port 4444, sends messages
down each and finally closes both down.
doc/man3/BIO_s_bio.pod
+2 -2
View File
@@ -133,7 +133,7 @@ locations for B<bio1> and B<bio2>. Check the error stack for more information.
[XXXXX: More return values need to be added here]
=head1 EXAMPLE
=head1 EXAMPLES
The BIO pair can be used to have full control over the network access of an
application. The application can call select() on the socket as required
@@ -176,7 +176,7 @@ and must be transferred to the network. Use BIO_ctrl_get_read_request() to
find out, how many bytes must be written into the buffer before the
SSL_operation() can successfully be continued.
=head1 WARNING
=head1 WARNINGS
As the data is buffered, SSL_operation() may return with an ERROR_SSL_WANT_READ
condition, but there is still data in the write buffer. An application must
doc/man3/BIO_s_connect.pod
+1 -1
View File
@@ -163,7 +163,7 @@ BIO_set_nbio() always returns 1.
BIO_do_connect() returns 1 if the connection was successfully
established and 0 or -1 if the connection failed.
=head1 EXAMPLE
=head1 EXAMPLES
This is example connects to a webserver on the local host and attempts
to retrieve a page and copy the result to standard output.
doc/man3/BIO_s_fd.pod
+1 -1
View File
@@ -68,7 +68,7 @@ been initialized.
BIO_new_fd() returns the newly allocated BIO or NULL is an error
occurred.
=head1 EXAMPLE
=head1 EXAMPLES
This is a file descriptor BIO version of "Hello World":
doc/man3/BIO_s_mem.pod
+13 -9
View File
@@ -118,7 +118,19 @@ BIO_FLAGS_NONCLEAR_RST set has the same effect as a write operation.
There should be an option to set the maximum size of a memory BIO.
=head1 EXAMPLE
=head1 RETURN VALUES
BIO_s_mem() and BIO_s_secmem() return a valid memory B<BIO_METHOD> structure.
BIO_set_mem_eof_return(), BIO_set_mem_buf() and BIO_get_mem_ptr()
return 1 on success or a value which is less than or equal to 0 if an error occurred.
BIO_get_mem_data() returns the total number of bytes available on success,
0 if b is NULL, or a negative value in case of other errors.
BIO_new_mem_buf() returns a valid B<BIO> structure on success or NULL on error.
=head1 EXAMPLES
Create a memory BIO and write some data to it:
@@ -139,14 +151,6 @@ Extract the BUF_MEM structure from a memory BIO and then free up the BIO:
BIO_set_close(mem, BIO_NOCLOSE); /* So BIO_free() leaves BUF_MEM alone */
BIO_free(mem);
=head1 RETURN VALUES
BIO_s_mem() and BIO_s_secmem() return a valid memory B<BIO_METHOD> structure.
BIO_set_mem_eof_return(), BIO_get_mem_data(), BIO_set_mem_buf() and BIO_get_mem_ptr()
return 1 on success or a value which is less than or equal to 0 if an error occurred.
BIO_new_mem_buf() returns a valid B<BIO> structure on success or NULL on error.
=head1 COPYRIGHT
doc/man3/BIO_set_callback.pod
+5 -5
View File
@@ -211,11 +211,6 @@ the actual call parameter, see B<BIO_callback_ctrl>.
=back
=head1 EXAMPLE
The BIO_debug_callback() function is a good example, its source is
in crypto/bio/bio_cb.c
=head1 RETURN VALUES
BIO_get_callback_ex() and BIO_get_callback() return the callback function
@@ -228,6 +223,11 @@ via a call to BIO_set_callback_arg().
BIO_debug_callback() returns 1 or B<ret> if it's called after specific BIO
operations.
=head1 EXAMPLES
The BIO_debug_callback() function is a good example, its source is
in crypto/bio/bio_cb.c
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/BN_generate_prime.pod
+25 -9
View File
@@ -2,15 +2,19 @@
=head1 NAME
BN_generate_prime_ex, BN_is_prime_ex, BN_is_prime_fasttest_ex, BN_GENCB_call,
BN_GENCB_new, BN_GENCB_free, BN_GENCB_set_old, BN_GENCB_set, BN_GENCB_get_arg,
BN_generate_prime, BN_is_prime, BN_is_prime_fasttest - generate primes and test
for primality
BN_generate_prime_ex2, BN_generate_prime_ex, BN_is_prime_ex,
BN_is_prime_fasttest_ex, BN_GENCB_call, BN_GENCB_new, BN_GENCB_free,
BN_GENCB_set_old, BN_GENCB_set, BN_GENCB_get_arg, BN_generate_prime,
BN_is_prime, BN_is_prime_fasttest - generate primes and test for primality
=head1 SYNOPSIS
#include <openssl/bn.h>
int BN_generate_prime_ex2(BIGNUM *ret, int bits, int safe,
const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb,
BN_CTX *ctx);
int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe, const BIGNUM *add,
const BIGNUM *rem, BN_GENCB *cb);
@@ -50,9 +54,12 @@ L<openssl_user_macros(7)>:
=head1 DESCRIPTION
BN_generate_prime_ex() generates a pseudo-random prime number of
at least bit length B<bits>. The returned number is probably prime
with a negligible error.
BN_generate_prime_ex2() generates a pseudo-random prime number of
at least bit length B<bits> using the BN_CTX provided in B<ctx>. The value of
B<ctx> must not be NULL.
The returned number is probably prime with a negligible error.
If B<add> is B<NULL> the returned prime number will have exact bit
length B<bits> with the top most two bits set.
If B<ret> is not B<NULL>, it will be used to store the number.
@@ -89,11 +96,20 @@ If B<add> is not B<NULL>, the prime will fulfill the condition p % B<add>
generator.
If B<safe> is true, it will be a safe prime (i.e. a prime p so
that (p-1)/2 is also prime).
that (p-1)/2 is also prime). If B<safe> is true, and B<rem> == B<NULL>
the condition will be p % B<add> == 3.
It is recommended that B<add> is a multiple of 4.
The random generator must be seeded prior to calling BN_generate_prime_ex().
If the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to
external circumstances (see L<RAND(7)>), the operation will fail.
The random number generator configured for the OPENSSL_CTX associated with
B<ctx> will be used.
BN_generate_prime_ex() is the same as BN_generate_prime_ex2() except that no
B<ctx> parameter is passed.
In this case the random number generator associated with the default OPENSSL_CTX
will be used.
BN_is_prime_ex() and BN_is_prime_fasttest_ex() test if the number B<p> is
prime. The following tests are performed until one of them shows that
@@ -206,7 +222,7 @@ and BN_GENCB_get_arg() functions were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BN_mod_mul_montgomery.pod
+1 -1
View File
@@ -64,7 +64,7 @@ BN_MONT_CTX_free() has no return value.
For the other functions, 1 is returned for success, 0 on error.
The error codes can be obtained by L<ERR_get_error(3)>.
=head1 WARNING
=head1 WARNINGS
The inputs must be reduced modulo B<m>, otherwise the result will be
outside the expected range.
doc/man3/BN_new.pod
+2 -2
View File
@@ -22,7 +22,7 @@ BN_new, BN_secure_new, BN_clear, BN_free, BN_clear_free - allocate and free BIGN
BN_new() allocates and initializes a B<BIGNUM> structure.
BN_secure_new() does the same except that the secure heap
OPENSSL_secure_malloc(3) is used to store the value.
L<OPENSSL_secure_malloc(3)> is used to store the value.
BN_clear() is used to destroy sensitive data such as keys when they
are no longer needed. It erases the memory used by B<a> and sets it
@@ -46,7 +46,7 @@ BN_clear(), BN_free() and BN_clear_free() have no return values.
=head1 SEE ALSO
L<ERR_get_error(3)>
L<ERR_get_error(3)>, L<OPENSSL_secure_malloc(3)>
=head1 HISTORY
doc/man3/CMS_compress.pod
-4
View File
@@ -17,8 +17,6 @@ is the compression algorithm to use or B<NID_undef> to use the default
algorithm (zlib compression). B<in> is the content to be compressed.
B<flags> is an optional set of flags.
=head1 NOTES
The only currently supported compression algorithm is zlib using the NID
NID_zlib_compression.
@@ -41,8 +39,6 @@ The compressed data is included in the CMS_ContentInfo structure, unless
B<CMS_DETACHED> is set in which case it is omitted. This is rarely used in
practice and is not supported by SMIME_write_CMS().
=head1 NOTES
If the flag B<CMS_STREAM> is set the returned B<CMS_ContentInfo> structure is
B<not> complete and outputting its contents via a function that does not
properly finalize the B<CMS_ContentInfo> structure will give unpredictable
doc/man3/CMS_encrypt.pod
-4
View File
@@ -17,8 +17,6 @@ CMS_encrypt() creates and returns a CMS EnvelopedData structure. B<certs>
is a list of recipient certificates. B<in> is the content to be encrypted.
B<cipher> is the symmetric cipher to use. B<flags> is an optional set of flags.
=head1 NOTES
Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this
function.
@@ -60,8 +58,6 @@ The data being encrypted is included in the CMS_ContentInfo structure, unless
B<CMS_DETACHED> is set in which case it is omitted. This is rarely used in
practice and is not supported by SMIME_write_CMS().
=head1 NOTES
If the flag B<CMS_STREAM> is set the returned B<CMS_ContentInfo> structure is
B<not> complete and outputting its contents via a function that does not
properly finalize the B<CMS_ContentInfo> structure will give unpredictable
doc/man3/CRYPTO_THREAD_run_once.pod
+10 -12
View File
@@ -97,7 +97,16 @@ one of the first included headers. Therefore it is defined as an
application developer's responsibility to include windows.h prior to
crypto.h where use of CRYPTO_THREAD_* types and functions is required.
=head1 EXAMPLE
=head1 EXAMPLES
You can find out if OpenSSL was configured with thread support:
#include <openssl/opensslconf.h>
#if defined(OPENSSL_THREADS)
/* thread support enabled */
#else
/* no thread support */
#endif
This example safely initializes and uses a lock.
@@ -144,17 +153,6 @@ no longer in use and is unloaded.
The simplest solution is to just "leak" the lock in applications and not
repeatedly load/unload shared libraries that allocate locks.
=head1 NOTES
You can find out if OpenSSL was configured with thread support:
#include <openssl/opensslconf.h>
#if defined(OPENSSL_THREADS)
/* thread support enabled */
#else
/* no thread support */
#endif
=head1 SEE ALSO
L<crypto(7)>
doc/man3/CRYPTO_get_ex_new_index.pod
+1 -1
View File
@@ -162,7 +162,7 @@ dup_func() should return 0 for failure and 1 for success.
=head1 HISTORY
CRYPTO_alloc_ex_data() was added in OpenSSL 3.0.0.
CRYPTO_alloc_ex_data() was added in OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/DH_generate_parameters.pod
+9 -1
View File
@@ -73,6 +73,14 @@ The generator B<g> is not suitable.
Note that the lack of this bit doesn't guarantee that B<g> is
suitable, unless B<p> is known to be a strong prime.
=item DH_MODULUS_TOO_SMALL
The modulus is too small.
=item DH_MODULUS_TOO_LARGE
The modulus is too large.
=back
DH_check() confirms that the Diffie-Hellman parameters B<dh> are valid. The
@@ -141,7 +149,7 @@ DH_generate_parameters_ex() instead.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ECDSA_SIG_new.pod
+9 -16
View File
@@ -3,10 +3,10 @@
=head1 NAME
ECDSA_SIG_get0, ECDSA_SIG_get0_r, ECDSA_SIG_get0_s, ECDSA_SIG_set0,
ECDSA_SIG_new, ECDSA_SIG_free, i2d_ECDSA_SIG, d2i_ECDSA_SIG, ECDSA_size,
ECDSA_sign, ECDSA_do_sign, ECDSA_verify, ECDSA_do_verify, ECDSA_sign_setup,
ECDSA_sign_ex, ECDSA_do_sign_ex - low level elliptic curve digital signature
algorithm (ECDSA) functions
ECDSA_SIG_new, ECDSA_SIG_free, ECDSA_size, ECDSA_sign, ECDSA_do_sign,
ECDSA_verify, ECDSA_do_verify, ECDSA_sign_setup, ECDSA_sign_ex,
ECDSA_do_sign_ex - low level elliptic curve digital signature algorithm (ECDSA)
functions
=head1 SYNOPSIS
@@ -18,8 +18,6 @@ algorithm (ECDSA) functions
const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig);
const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig);
int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s);
int i2d_ECDSA_SIG(const ECDSA_SIG *sig, unsigned char **pp);
ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **sig, const unsigned char **pp, long len);
int ECDSA_size(const EC_KEY *eckey);
int ECDSA_sign(int type, const unsigned char *dgst, int dgstlen,
@@ -68,15 +66,8 @@ function transfers the memory management of the values to the ECDSA_SIG object,
and therefore the values that have been passed in should not be freed directly
after this function has been called.
i2d_ECDSA_SIG() creates the DER encoding of the ECDSA signature B<sig> and
writes the encoded signature to B<*pp> (note: if B<pp> is NULL i2d_ECDSA_SIG()
returns the expected length in bytes of the DER encoded signature).
i2d_ECDSA_SIG() returns the length of the DER encoded signature (or 0 on
error).
d2i_ECDSA_SIG() decodes a DER encoded ECDSA signature and returns the decoded
signature in a newly allocated B<ECDSA_SIG> structure. B<*sig> points to the
buffer containing the DER encoded signature of size B<len>.
See L<i2d_ECDSA_SIG(3)> and L<d2i_ECDSA_SIG(3)> for information about encoding
and decoding ECDSA signatures to/from DER.
ECDSA_size() returns the maximum length of a DER encoded ECDSA signature
created with the private EC key B<eckey>.
@@ -202,7 +193,9 @@ ANSI X9.62, US Federal Information Processing Standard FIPS 186-2
L<EC_KEY_new(3)>,
L<EVP_DigestSignInit(3)>,
L<EVP_DigestVerifyInit(3)>
L<EVP_DigestVerifyInit(3)>,
L<i2d_ECDSA_SIG(3)>,
L<d2i_ECDSA_SIG(3)>
=head1 COPYRIGHT
doc/man3/EC_GROUP_copy.pod
+4 -1
View File
@@ -51,7 +51,8 @@ EC_GROUP_get_pentanomial_basis, EC_GROUP_get0_field
int EC_GROUP_get_degree(const EC_GROUP *group);
int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx);
int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only);
int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only,
BN_CTX *ctx);
int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx);
@@ -152,6 +153,8 @@ then this method can be used to lookup the name of the curve that matches the gr
aliases, so that multiple NID's can map to the same domain parameters. For such curves it is unspecified which of the aliases will be
returned if the curve name of the given group is NID_undef.
If B<nist_only> is 1 it will only look for NIST approved curves, otherwise it searches all built-in curves.
This function may be passed a BN_CTX object in the B<ctx> parameter.
The B<ctx> parameter may be NULL.
EC_GROUP_cmp compares B<a> and B<b> to determine whether they represent the same curve or not.
doc/man3/EC_GROUP_new.pod
+24 -5
View File
@@ -4,6 +4,7 @@
EC_GROUP_get_ecparameters,
EC_GROUP_get_ecpkparameters,
EC_GROUP_new_ex,
EC_GROUP_new,
EC_GROUP_new_from_ecparameters,
EC_GROUP_new_from_ecpkparameters,
@@ -11,6 +12,7 @@ EC_GROUP_free,
EC_GROUP_clear_free,
EC_GROUP_new_curve_GFp,
EC_GROUP_new_curve_GF2m,
EC_GROUP_new_by_curve_name_ex,
EC_GROUP_new_by_curve_name,
EC_GROUP_set_curve,
EC_GROUP_get_curve,
@@ -25,6 +27,7 @@ objects
#include <openssl/ec.h>
EC_GROUP *EC_GROUP_new_ex(OPENSSL_CTX *libctx, const EC_METHOD *meth);
EC_GROUP *EC_GROUP_new(const EC_METHOD *meth);
EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params)
EC_GROUP *EC_GROUP_new_from_ecpkparameters(const ECPKPARAMETERS *params)
@@ -35,6 +38,7 @@ objects
const BIGNUM *b, BN_CTX *ctx);
EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a,
const BIGNUM *b, BN_CTX *ctx);
EC_GROUP *EC_GROUP_new_by_curve_name_ex(OPENSSL_CTX *libctx, int nid);
EC_GROUP *EC_GROUP_new_by_curve_name(int nid);
int EC_GROUP_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
@@ -71,12 +75,18 @@ y^2 + xy = x^3 + ax^2 + b (where b != 0)
Operations in a binary field are performed relative to an B<irreducible polynomial>. All such curves with OpenSSL
use a trinomial or a pentanomial for this parameter.
A new curve can be constructed by calling EC_GROUP_new, using the implementation provided by B<meth> (see
L<EC_GFp_simple_method(3)>). It is then necessary to call EC_GROUP_set_curve() to set the curve parameters.
A new curve can be constructed by calling EC_GROUP_new_ex, using the implementation provided by B<meth> (see
L<EC_GFp_simple_method(3)>) and associated with the library context B<ctx>
(see L<OPENSSL_CTX(3)>).
The B<ctx> parameter may be NULL in which case the default library context is used.
It is then necessary to call EC_GROUP_set_curve() to set the curve parameters.
EC_GROUP_new_from_ecparameters() will create a group from the
specified B<params> and
EC_GROUP_new_from_ecpkparameters() will create a group from the specific PK B<params>.
EC_GROUP_new is the same as EC_GROUP_new_ex() except that the library context
used is always the default library context.
EC_GROUP_set_curve() sets the curve parameters B<p>, B<a> and B<b>. For a curve over Fp B<b>
is the prime for the field. For a curve over F2^m B<p> represents the irreducible polynomial - each bit
represents a term in the polynomial. Therefore there will either be three or five bits set dependent on whether
@@ -109,8 +119,12 @@ The EC_builtin_curve structure is defined as follows:
Each EC_builtin_curve item has a unique integer id (B<nid>), and a human readable comment string describing the curve.
In order to construct a builtin curve use the function EC_GROUP_new_by_curve_name and provide the B<nid> of the curve to
be constructed.
In order to construct a builtin curve use the function EC_GROUP_new_by_curve_name_ex and provide the B<nid> of the curve to
be constructed and the associated library context to be used in B<ctx> (see L<OPENSSL_CTX(3)>).
The B<ctx> value may be NULL in which case the default library context is used.
EC_GROUP_new_by_curve_name is the same as EC_GROUP_new_by_curve_name_ex except
that the default library context is always used.
EC_GROUP_free frees the memory associated with the EC_GROUP.
If B<group> is NULL nothing is done.
@@ -130,7 +144,12 @@ EC_GROUP_set_curve_GFp, EC_GROUP_get_curve_GFp, EC_GROUP_set_curve_GF2m, EC_GROU
L<crypto(7)>, L<EC_GROUP_copy(3)>,
L<EC_POINT_new(3)>, L<EC_POINT_add(3)>, L<EC_KEY_new(3)>,
L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)>
L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)>,
L<OPENSSL_CTX(3)>
=head1 HISTORY
EC_GROUP_new_ex and EC_GROUP_new_by_curve_name_ex were added in OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/EC_KEY_new.pod
+31 -12
View File
@@ -2,10 +2,10 @@
=head1 NAME
EC_KEY_get_method, EC_KEY_set_method,
EC_KEY_get_method, EC_KEY_set_method, EC_KEY_new_ex,
EC_KEY_new, EC_KEY_get_flags, EC_KEY_set_flags, EC_KEY_clear_flags,
EC_KEY_new_by_curve_name, EC_KEY_free, EC_KEY_copy, EC_KEY_dup, EC_KEY_up_ref,
EC_KEY_get0_engine,
EC_KEY_new_by_curve_name_ex, EC_KEY_new_by_curve_name, EC_KEY_free, EC_KEY_copy,
EC_KEY_dup, EC_KEY_up_ref, EC_KEY_get0_engine,
EC_KEY_get0_group, EC_KEY_set_group, EC_KEY_get0_private_key,
EC_KEY_set_private_key, EC_KEY_get0_public_key, EC_KEY_set_public_key,
EC_KEY_get_conv_form,
@@ -19,10 +19,12 @@ EC_KEY objects
#include <openssl/ec.h>
EC_KEY *EC_KEY_new_ex(OPENSSL_CTX *ctx);
EC_KEY *EC_KEY_new(void);
int EC_KEY_get_flags(const EC_KEY *key);
void EC_KEY_set_flags(EC_KEY *key, int flags);
void EC_KEY_clear_flags(EC_KEY *key, int flags);
EC_KEY *EC_KEY_new_by_curve_name_ex(OPENSSL_CTX *ctx, int nid);
EC_KEY *EC_KEY_new_by_curve_name(int nid);
void EC_KEY_free(EC_KEY *key);
EC_KEY *EC_KEY_copy(EC_KEY *dst, const EC_KEY *src);
@@ -57,15 +59,31 @@ EC_KEY objects
=head1 DESCRIPTION
An EC_KEY represents a public key and, optionally, the associated private
key. A new EC_KEY with no associated curve can be constructed by calling
EC_KEY_new(). The reference count for the newly created EC_KEY is initially
set to 1. A curve can be associated with the EC_KEY by calling
key.
A new EC_KEY with no associated curve can be constructed by calling
EC_KEY_new_ex() and specifying the associated library context in B<ctx>
(see L<OPENSSL_CTX(3)>).
The B<ctx> parameter may be NULL in which case the default library context is
used.
The reference count for the newly created EC_KEY is initially
set to 1.
A curve can be associated with the EC_KEY by calling
EC_KEY_set_group().
EC_KEY_new() is the same as EC_KEY_new_ex() except that the default library
context is always used.
Alternatively a new EC_KEY can be constructed by calling
EC_KEY_new_by_curve_name() and supplying the nid of the associated curve. See
L<EC_GROUP_new(3)> for a description of curve names. This function simply
wraps calls to EC_KEY_new() and EC_GROUP_new_by_curve_name().
EC_KEY_new_by_curve_name_ex() and supplying the nid of the associated curve and
the library context to be used B<ctx> (see L<OPENSSL_CTX(3)>).
The B<ctx> parameter may be NULL in which case the default library context is
used.
See L<EC_GROUP_new(3)> for a description of curve names.
This function simply wraps calls to EC_KEY_new_ex() and
EC_GROUP_new_by_curve_name_ex().
EC_KEY_new_by_curve_name() is the same as EC_KEY_new_by_curve_name_ex() except
that the default library context is always used.
Calling EC_KEY_free() decrements the reference count for the EC_KEY object,
and if it has dropped to zero then frees the memory associated with it. If
@@ -144,8 +162,8 @@ EC_KEY_priv2buf() converts an EC_KEY private key into an allocated buffer.
=head1 RETURN VALUES
EC_KEY_new(), EC_KEY_new_by_curve_name() and EC_KEY_dup() return a pointer to
the newly created EC_KEY object, or NULL on error.
EC_KEY_new_ex(), EC_KEY_new(), EC_KEY_new_by_curve_name() and EC_KEY_dup()
return a pointer to the newly created EC_KEY object, or NULL on error.
EC_KEY_get_flags() returns the flags associated with the EC_KEY object as an
integer.
@@ -174,7 +192,8 @@ L<crypto(7)>, L<EC_GROUP_new(3)>,
L<EC_GROUP_copy(3)>, L<EC_POINT_new(3)>,
L<EC_POINT_add(3)>,
L<EC_GFp_simple_method(3)>,
L<d2i_ECPKParameters(3)>
L<d2i_ECPKParameters(3)>,
L<OPENSSL_CTX(3)>
=head1 COPYRIGHT
doc/man3/ERR_GET_LIB.pod
+2 -1
View File
@@ -38,12 +38,13 @@ unique. However, when checking for sub-library specific reason codes,
be sure to also compare the library number.
ERR_GET_LIB(), ERR_GET_FUNC(), ERR_GET_REASON(), and ERR_FATAL_ERROR()
are macros.
are macros.
=head1 RETURN VALUES
The library number, function code, reason code, and whether the error
is fatal, respectively.
Starting with OpenSSL 3.0.0, the function code is always set to zero.
=head1 SEE ALSO
doc/man3/ERR_error_string.pod
+16 -9
View File
@@ -14,9 +14,12 @@ error message
void ERR_error_string_n(unsigned long e, char *buf, size_t len);
const char *ERR_lib_error_string(unsigned long e);
const char *ERR_func_error_string(unsigned long e);
const char *ERR_reason_error_string(unsigned long e);
Deprecated in OpenSSL 3.0:
const char *ERR_func_error_string(unsigned long e);
=head1 DESCRIPTION
ERR_error_string() generates a human-readable string representing the
@@ -33,13 +36,12 @@ For ERR_error_string_n(), I<buf> may not be B<NULL>.
The string will have the following format:
error:[error code]:[library name]:[function name]:[reason string]
error:[error code]:[library name]::[reason string]
I<error code> is an 8 digit hexadecimal number, I<library name>,
I<function name> and I<reason string> are ASCII text.
I<error code> is an 8 digit hexadecimal number, I<library name> and
I<reason string> are ASCII text.
ERR_lib_error_string(), ERR_func_error_string() and
ERR_reason_error_string() return the library name, function
ERR_lib_error_string() and ERR_reason_error_string() return the library
name and reason string respectively.
If there is no text string registered for the given error code,
@@ -53,15 +55,20 @@ all error codes currently in the queue.
ERR_error_string() returns a pointer to a static buffer containing the
string if I<buf> B<== NULL>, I<buf> otherwise.
ERR_lib_error_string(), ERR_func_error_string() and
ERR_reason_error_string() return the strings, and B<NULL> if
none is registered for the error code.
ERR_lib_error_string() and ERR_reason_error_string() return the strings,
and B<NULL> if none is registered for the error code.
ERR_func_error_string() returns NULL.
=head1 SEE ALSO
L<ERR_get_error(3)>,
L<ERR_print_errors(3)>
=head1 HISTORY
ERR_func_error_string() became deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/ERR_get_error.pod
+57 -7
View File
@@ -4,8 +4,11 @@
ERR_get_error, ERR_peek_error, ERR_peek_last_error,
ERR_get_error_line, ERR_peek_error_line, ERR_peek_last_error_line,
ERR_get_error_line_data, ERR_peek_error_line_data,
ERR_peek_last_error_line_data - obtain error code and data
ERR_get_error_func, ERR_peek_error_func, ERR_peek_last_error_func,
ERR_get_error_data, ERR_peek_error_data, ERR_peek_last_error_data,
ERR_get_error_all, ERR_peek_error_all, ERR_peek_last_error_all,
ERR_get_error_line_data, ERR_peek_error_line_data, ERR_peek_last_error_line_data
- obtain error code and data
=head1 SYNOPSIS
@@ -19,6 +22,26 @@ ERR_peek_last_error_line_data - obtain error code and data
unsigned long ERR_peek_error_line(const char **file, int *line);
unsigned long ERR_peek_last_error_line(const char **file, int *line);
unsigned long ERR_get_error_func(const char **func);
unsigned long ERR_peek_error_func(const char **func);
unsigned long ERR_peek_last_error_func(const char **func);
unsigned long ERR_get_error_data(const char **data, int *flags);
unsigned long ERR_peek_error_data(const char **data, int *flags);
unsigned long ERR_peek_last_error_data(const char **data, int *flags);
unsigned long ERR_get_error_all(const char **file, int *line,
const char *func,
const char **data, int *flags);
unsigned long ERR_peek_error_all(const char **file, int *line,
const char *func,
const char **data, int *flags);
unsigned long ERR_peek_last_error_all(const char **file, int *line,
const char *func,
const char **data, int *flags);
Deprecated since OpenSSL 3.0:
unsigned long ERR_get_error_line_data(const char **file, int *line,
const char **data, int *flags);
unsigned long ERR_peek_error_line_data(const char **file, int *line,
@@ -44,15 +67,31 @@ L<ERR_error_string(3)> for human-readable error
messages.
ERR_get_error_line(), ERR_peek_error_line() and
ERR_peek_last_error_line() are the same as the above, but they
ERR_peek_last_error_line() are the same as ERR_get_error(),
ERR_peek_error() and ERR_peek_last_error(), but they
additionally store the file name and line number where
the error occurred in *B<file> and *B<line>, unless these are B<NULL>.
ERR_get_error_func(), ERR_peek_error_func() and
ERR_peek_last_error_func() are the same as ERR_get_error(),
ERR_peek_error() and ERR_peek_last_error(), but they
additionally store the name of the function where the error in *B<func>,
unless it is B<NULL>.
ERR_get_error_data(), ERR_peek_error_data() and
ERR_peek_last_error_data() are the same as ERR_get_error(),
ERR_peek_error() and ERR_peek_last_error(), but they
additionally store additional data and flags associated with the error
code in *B<data> and *B<flags>, unless these are B<NULL>.
*B<data> contains a string if *B<flags>&B<ERR_TXT_STRING> is true.
ERR_get_error_all(), ERR_peek_error_all() and
ERR_peek_last_error_all() are combinations of all of the above.
ERR_get_error_line_data(), ERR_peek_error_line_data() and
ERR_peek_last_error_line_data() store additional data and flags
associated with the error code in *B<data>
and *B<flags>, unless these are B<NULL>. *B<data> contains a string
if *B<flags>&B<ERR_TXT_STRING> is true.
ERR_peek_last_error_line_data() are older variants of ERR_get_error_all(),
ERR_peek_error_all() and ERR_peek_last_error_all(), and should no longer
be used.
An application B<MUST NOT> free the *B<data> pointer (or any other pointers
returned by these functions) with OPENSSL_free() as freeing is handled
@@ -67,6 +106,17 @@ The error code, or 0 if there is no error in the queue.
L<ERR_error_string(3)>,
L<ERR_GET_LIB(3)>
=head1 HISTORY
ERR_get_error_func(), ERR_peek_error_func(), ERR_peek_last_error_func(),
ERR_get_error_data(), ERR_peek_error_data(), ERR_peek_last_error_data(),
ERR_get_error_all(), ERR_peek_error_all() and ERR_peek_last_error_all()
were added in OpenSSL 3.0.
ERR_get_error_line_data(), ERR_peek_error_line_data() and
ERR_peek_last_error_line_data() became deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/ERR_new.pod
+78
View File
@@ -0,0 +1,78 @@
=pod
=head1 NAME
ERR_new, ERR_set_debug, ERR_set_error, ERR_vset_error
- Error recording building blocks
=head1 SYNOPSIS
#include <openssl/err.h>
void ERR_new(void);
void ERR_set_debug(const char *file, int line, const char *func);
void ERR_set_error(int lib, int reason, const char *fmt, ...);
void ERR_vset_error(int lib, int reason, const char *fmt, va_list args);
=head1 DESCRIPTION
The functions described here are generally not used directly, but
rather through macros such as L<ERR_raise(3)>.
They can still be useful for anyone that wants to make their own
macros.
ERR_new() allocates a new slot in the thread's error queue.
ERR_set_debug() sets the debug information related to the current
error in the thread's error queue.
The values that can be given are the file name I<file>, line in the
file I<line> and the name of the function I<func> where the error
occured.
The names must be constant, this function will only save away the
pointers, not copy the strings.
ERR_set_error() sets the error information, which are the library
number I<lib> and the reason code I<reason>, and additional data as a
format string I<fmt> and an arbitrary number of arguments.
The additional data is processed with L<BIO_snprintf(3)> to form the
additional data string, which is allocated and store in the error
record.
ERR_vset_error() works like ERR_set_error(), but takes a B<va_list>
argument instead of a variable number of arguments.
=head1 RETURN VALUES
ERR_new, ERR_set_debug, ERR_set_error and ERR_vset_error
do not return any values.
=head1 NOTES
The library number is unique to each unit that records errors.
OpenSSL has a number of pre-allocated ones for its own uses, but
others may allocate their own library number dynamically with
L<ERR_get_next_error_library(3)>.
Reason codes are unique within each library, and may have an
associated set of strings as a short description of the reason.
For dynamically allocated library numbers, reason strings are recorded
with L<ERR_load_strings(3)>.
Provider authors are supplied with core versions of these functions,
see L<provider-base(7)>.
=head1 SEE ALSO
L<ERR_raise(3)>, L<ERR_get_next_error_library(3)>,
L<ERR_load_strings(3)>, L<BIO_snprintf(3)>, L<provider-base(7)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/ERR_put_error.pod
+28 -5
View File
@@ -2,19 +2,36 @@
=head1 NAME
ERR_put_error, ERR_add_error_data, ERR_add_error_vdata - record an error
ERR_raise, ERR_raise_data,
ERR_put_error, ERR_add_error_data, ERR_add_error_vdata
- record an error
=head1 SYNOPSIS
#include <openssl/err.h>
void ERR_put_error(int lib, int func, int reason, const char *file, int line);
void ERR_raise(int lib, int reason);
void ERR_raise_data(int lib, int reason, const char *fmt, ...);
void ERR_add_error_data(int num, ...);
void ERR_add_error_vdata(int num, va_list arg);
Deprecated since OpenSSL 3.0:
void ERR_put_error(int lib, int func, int reason, const char *file, int line);
=head1 DESCRIPTION
ERR_raise() adds a new error to the thread's error queue. The
error occured in the library B<lib> for the reason given by the
B<reason> code. Furthermore, the name of the file, the line, and name
of the function where the error occured is saved with the error
record.
ERR_raise_data() does the same thing as ERR_raise(), but also lets the
caller specify additional information as a format string B<fmt> and an
arbitrary number of values, which are processed with L<BIO_snprintf(3)>.
ERR_put_error() adds an error code to the thread's error queue. It
signals that the error of reason code B<reason> occurred in function
B<func> of library B<lib>, in line number B<line> of B<file>.
@@ -31,6 +48,8 @@ error messages for the error code.
=head2 Reporting errors
=for comment TODO(3.0) should this be internal documentation?
Each sub-library has a specific macro XXXerr() that is used to report
errors. Its first argument is a function code B<XXX_F_...>, the second
argument is a reason code B<XXX_R_...>. Function codes are derived
@@ -57,8 +76,12 @@ the ASN1err() macro.
=head1 RETURN VALUES
ERR_put_error() and ERR_add_error_data() return
no values.
ERR_raise(), ERR_put_error(), ERR_add_error_data() and
ERR_add_error_vdata() return no values.
=head1 NOTES
ERR_raise() and ERR_put_error() are implemented as macros.
=head1 SEE ALSO
@@ -66,7 +89,7 @@ L<ERR_load_strings(3)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_CIPHER_meth_new.pod
+3 -7
View File
@@ -10,7 +10,7 @@ EVP_CIPHER_meth_set_set_asn1_params, EVP_CIPHER_meth_set_get_asn1_params,
EVP_CIPHER_meth_set_ctrl, EVP_CIPHER_meth_get_init,
EVP_CIPHER_meth_get_do_cipher, EVP_CIPHER_meth_get_cleanup,
EVP_CIPHER_meth_get_set_asn1_params, EVP_CIPHER_meth_get_get_asn1_params,
EVP_CIPHER_meth_get_ctrl, EVP_CIPHER_up_ref
EVP_CIPHER_meth_get_ctrl
- Routines to build up EVP_CIPHER methods
=head1 SYNOPSIS
@@ -63,8 +63,6 @@ EVP_CIPHER_meth_get_ctrl, EVP_CIPHER_up_ref
int type, int arg,
void *ptr);
int EVP_CIPHER_up_ref(EVP_CIPHER *cipher);
=head1 DESCRIPTION
The B<EVP_CIPHER> type is a structure for symmetric cipher method
@@ -226,8 +224,6 @@ EVP_CIPHER_meth_get_get_asn1_params() and EVP_CIPHER_meth_get_ctrl()
are all used to retrieve the method data given with the
EVP_CIPHER_meth_set_*() functions above.
EVP_CIPHER_up_ref() increments the reference count for an EVP_CIPHER structure.
=head1 RETURN VALUES
EVP_CIPHER_meth_new() and EVP_CIPHER_meth_dup() return a pointer to a
@@ -236,8 +232,6 @@ All EVP_CIPHER_meth_set_*() functions return 1.
All EVP_CIPHER_meth_get_*() functions return pointers to their
respective B<cipher> function.
EVP_CIPHER_up_ref() returns 1 for success or 0 otherwise.
=head1 SEE ALSO
L<EVP_EncryptInit>
@@ -245,6 +239,8 @@ L<EVP_EncryptInit>
=head1 HISTORY
The functions described here were added in OpenSSL 1.1.0.
The B<EVP_CIPHER> structure created with these functions became reference
counted in OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/EVP_DigestInit.pod
+115 -22
View File
@@ -2,28 +2,44 @@
=head1 NAME
EVP_MD_fetch, EVP_MD_up_ref, EVP_MD_free,
EVP_MD_get_params, EVP_MD_gettable_params,
EVP_MD_CTX_new, EVP_MD_CTX_reset, EVP_MD_CTX_free, EVP_MD_CTX_copy,
EVP_MD_CTX_copy_ex, EVP_MD_CTX_ctrl, EVP_MD_CTX_set_params, EVP_MD_CTX_get_params,
EVP_MD_CTX_copy_ex, EVP_MD_CTX_ctrl,
EVP_MD_CTX_set_params, EVP_MD_CTX_get_params,
EVP_MD_CTX_settable_params, EVP_MD_CTX_gettable_params,
EVP_MD_CTX_set_flags, EVP_MD_CTX_clear_flags, EVP_MD_CTX_test_flags,
EVP_Digest, EVP_DigestInit_ex, EVP_DigestInit, EVP_DigestUpdate,
EVP_DigestFinal_ex, EVP_DigestFinalXOF, EVP_DigestFinal,
EVP_MD_name, EVP_MD_provider,
EVP_MD_type, EVP_MD_pkey_type, EVP_MD_size, EVP_MD_block_size, EVP_MD_flags,
EVP_MD_CTX_name,
EVP_MD_CTX_md, EVP_MD_CTX_type, EVP_MD_CTX_size, EVP_MD_CTX_block_size,
EVP_MD_CTX_md_data, EVP_MD_CTX_update_fn, EVP_MD_CTX_set_update_fn,
EVP_md_null,
EVP_get_digestbyname, EVP_get_digestbynid, EVP_get_digestbyobj,
EVP_MD_CTX_pkey_ctx, EVP_MD_CTX_set_pkey_ctx - EVP digest routines
EVP_MD_CTX_pkey_ctx, EVP_MD_CTX_set_pkey_ctx,
EVP_MD_do_all_ex
- EVP digest routines
=head1 SYNOPSIS
#include <openssl/evp.h>
EVP_MD *EVP_MD_fetch(OPENSSL_CTX *ctx, const char *algorithm,
const char *properties);
int EVP_MD_up_ref(EVP_MD *md);
void EVP_MD_free(EVP_MD *md);
int EVP_MD_get_params(const EVP_MD *digest, OSSL_PARAM params[]);
const OSSL_PARAM *EVP_MD_gettable_params(const EVP_MD *digest);
EVP_MD_CTX *EVP_MD_CTX_new(void);
int EVP_MD_CTX_reset(EVP_MD_CTX *ctx);
void EVP_MD_CTX_free(EVP_MD_CTX *ctx);
void EVP_MD_CTX_ctrl(EVP_MD_CTX *ctx, int cmd, int p1, void* p2);
int EVP_MD_CTX_get_params(EVP_MD_CTX *ctx, OSSL_PARAM params[]);
int EVP_MD_CTX_set_params(EVP_MD_CTX *ctx, const OSSL_PARAM params[]);
const OSSL_PARAM *EVP_MD_CTX_settable_params(const EVP_MD *digest);
const OSSL_PARAM *EVP_MD_CTX_gettable_params(const EVP_MD *digest);
void EVP_MD_CTX_set_flags(EVP_MD_CTX *ctx, int flags);
void EVP_MD_CTX_clear_flags(EVP_MD_CTX *ctx, int flags);
int EVP_MD_CTX_test_flags(const EVP_MD_CTX *ctx, int flags);
@@ -42,6 +58,8 @@ EVP_MD_CTX_pkey_ctx, EVP_MD_CTX_set_pkey_ctx - EVP digest routines
int EVP_MD_CTX_copy(EVP_MD_CTX *out, EVP_MD_CTX *in);
const char *EVP_MD_name(const EVP_MD *md);
const OSSL_PROVIDER *EVP_MD_provider(const EVP_MD *md);
int EVP_MD_type(const EVP_MD *md);
int EVP_MD_pkey_type(const EVP_MD *md);
int EVP_MD_size(const EVP_MD *md);
@@ -49,6 +67,7 @@ EVP_MD_CTX_pkey_ctx, EVP_MD_CTX_set_pkey_ctx - EVP digest routines
unsigned long EVP_MD_flags(const EVP_MD *md);
const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
const char *EVP_MD_CTX_name(const EVP_MD_CTX *ctx);
int EVP_MD_CTX_size(const EVP_MD *ctx);
int EVP_MD_CTX_block_size(const EVP_MD *ctx);
int EVP_MD_CTX_type(const EVP_MD *ctx);
@@ -68,13 +87,38 @@ EVP_MD_CTX_pkey_ctx, EVP_MD_CTX_set_pkey_ctx - EVP digest routines
EVP_PKEY_CTX *EVP_MD_CTX_pkey_ctx(const EVP_MD_CTX *ctx);
void EVP_MD_CTX_set_pkey_ctx(EVP_MD_CTX *ctx, EVP_PKEY_CTX *pctx);
void EVP_MD_do_all_ex(OPENSSL_CTX *libctx,
void (*fn)(EVP_MD *mac, void *arg),
void *arg);
=head1 DESCRIPTION
The EVP digest routines are a high level interface to message digests,
and should be used instead of the cipher-specific functions.
and should be used instead of the digest-specific functions.
The B<EVP_MD> type is a structure for digest method implementation.
=over 4
=item EVP_MD_fetch()
Fetches the digest implementation for the given B<algorithm> from any
provider offering it, within the criteria given by the B<properties>.
See L<provider(7)/Fetching algorithms> for further information.
The returned value must eventually be freed with EVP_MD_free().
Fetched B<EVP_MD> structures are reference counted.
=item EVP_MD_up_ref()
Increments the reference count for an B<EVP_MD> structure.
=item EVP_MD_free()
Decrements the reference count for the fetched B<EVP_MD> structure.
If the reference count drops to 0 then the structure is freed.
=item EVP_MD_CTX_new()
Allocates and returns a digest context.
@@ -99,15 +143,28 @@ EVP_MD_CTX_ctrl() must be called after EVP_DigestInit_ex(). Other restrictions
may apply depending on the control type and digest implementation.
See L</CONTROLS> below for more information.
=item EVP_MD_CTX_get_params
=item EVP_MD_get_params()
Retrieves the requested list of B<params> from a MD B<md>.
See L</PARAMETERS> below for more information.
=item EVP_MD_CTX_get_params()
Retrieves the requested list of B<params> from a MD context B<ctx>.
See L</PARAMS> below for more information.
See L</PARAMETERS> below for more information.
=item EVP_MD_CTX_set_params
=item EVP_MD_CTX_set_params()
Sets the list of <params> into a MD context B<ctx>.
See L</PARAMS> below for more information.
Sets the list of B<params> into a MD context B<ctx>.
See L</PARAMETERS> below for more information.
=item EVP_MD_gettable_params(), EVP_MD_CTX_gettable_params(),
EVP_MD_CTX_settable_params()
Get a B<OSSL_PARAM> array that describes the retrievable and settable
parameters, i.e. parameters that can be used with EVP_MD_get_params(),
EVP_MD_CTX_get_params() and EVP_MD_CTX_set_params(), respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
=item EVP_MD_CTX_set_flags(), EVP_MD_CTX_clear_flags(), EVP_MD_CTX_test_flags()
@@ -123,9 +180,12 @@ If B<impl> is NULL the default implementation of digest B<type> is used.
=item EVP_DigestInit_ex()
Sets up digest context B<ctx> to use a digest B<type> from ENGINE B<impl>.
B<type> will typically be supplied by a function such as EVP_sha1(). If
B<impl> is NULL then the default implementation of digest B<type> is used.
Sets up digest context B<ctx> to use a digest B<type>.
B<type> is typically supplied by a function such as EVP_sha1(), or a
value explicitly fetched with EVP_MD_fetch().
If B<impl> is non-NULL, its implementation of the digest B<type> is used if
there is one, and if not, the default implementation is used.
=item EVP_DigestUpdate()
@@ -170,6 +230,16 @@ automatically cleaned up.
Similar to EVP_MD_CTX_copy_ex() except the destination B<out> does not have to
be initialized.
=item EVP_MD_name(),
EVP_MD_CTX_name()
Return the name of the given message digest.
=item EVP_MD_provider()
Returns an B<OSSL_PROVIDER> pointer to the provider that implements the given
B<EVP_MD>.
=item EVP_MD_size(),
EVP_MD_CTX_size()
@@ -252,9 +322,16 @@ by the caller. A NULL B<pctx> pointer is also allowed to clear the B<EVP_PKEY_CT
assigned to B<ctx>. In such case, freeing the cleared B<EVP_PKEY_CTX> or not
depends on how the B<EVP_PKEY_CTX> is created.
=item EVP_MD_do_all_ex()
Traverses all messages digests implemented by all activated providers
in the given library context I<libctx>, and for each of the implementations,
calls the given function I<fn> with the implementation method and the given
I<arg> as argument.
=back
=head1 PARAMS
=head1 PARAMETERS
See L<OSSL_PARAM(3)> for information about passing parameters.
@@ -262,12 +339,13 @@ EVP_MD_CTX_set_params() can be used with the following OSSL_PARAM keys:
=over 4
=item OSSL_PARAM_DIGEST_KEY_XOFLEN <size_t>
=item OSSL_PARAM_DIGEST_KEY_XOFLEN <unsigned integer>
Sets the digest length for extendable output functions.
It is used by the SHAKE algorithm.
It is used by the SHAKE algorithm and should not exceed what can be given
using a B<size_t>.
=item OSSL_PARAM_DIGEST_KEY_PAD_TYPE <int>
=item OSSL_PARAM_DIGEST_KEY_PAD_TYPE <integer>
Sets the pad type.
It is used by the MDC2 algorithm.
@@ -278,7 +356,7 @@ EVP_MD_CTX_get_params() can be used with the following OSSL_PARAM keys:
=over 4
=item OSSL_PARAM_DIGEST_KEY_MICALG <utf8string>.
=item OSSL_PARAM_DIGEST_KEY_MICALG <UTF8 string>.
Gets the digest Message Integrity Check algorithm string. This is used when
creating S/MIME multipart/signed messages, as specified in RFC 3851.
@@ -343,6 +421,14 @@ disabled with this flag.
=over 4
=item EVP_MD_fetch()
Returns a pointer to a B<EVP_MD> for success or NULL for failure.
=item EVP_MD_up_ref()
Returns 1 for success or 0 for failure.
=item EVP_DigestInit_ex(),
EVP_DigestUpdate(),
EVP_DigestFinal_ex()
@@ -359,6 +445,12 @@ EVP_MD_CTX_get_params()
Returns 1 if successful or 0 for failure.
=item EVP_MD_CTX_settable_params(),
EVP_MD_CTX_gettable_params()
Return an array of constant B<OSSL_PARAM>s, or NULL if there is none
to get.
=item EVP_MD_CTX_copy_ex()
Returns 1 if successful or 0 for failure.
@@ -415,14 +507,14 @@ implementations of digests to be specified.
If digest contexts are not cleaned up after use,
memory leaks will occur.
EVP_MD_CTX_size(), EVP_MD_CTX_block_size(), EVP_MD_CTX_type(),
EVP_get_digestbynid() and EVP_get_digestbyobj() are defined as
macros.
EVP_MD_CTX_name(), EVP_MD_CTX_size(), EVP_MD_CTX_block_size(),
EVP_MD_CTX_type(), EVP_get_digestbynid() and EVP_get_digestbyobj() are defined
as macros.
EVP_MD_CTX_ctrl() sends commands to message digests for additional configuration
or control.
=head1 EXAMPLE
=head1 EXAMPLES
This example digests the data "Test Message\n" and "Hello World\n", using the
digest name passed on the command line.
@@ -487,6 +579,7 @@ L<EVP_sha224(3)>,
L<EVP_sha3_224(3)>,
L<EVP_sm3(3)>,
L<EVP_whirlpool(3)>
L<provider(7)/Fetching algorithms>
=head1 HISTORY
@@ -500,8 +593,8 @@ The EVP_dss1() function was removed in OpenSSL 1.1.0.
The EVP_MD_CTX_set_pkey_ctx() function was added in 1.1.1.
The EVP_MD_CTX_set_params() and EVP_MD_CTX_get_params() functions were
added in 3.0.
The EVP_MD_fetch(), EVP_MD_free(), EVP_MD_up_ref(), EVP_MD_CTX_set_params()
and EVP_MD_CTX_get_params() functions were added in 3.0.
=head1 COPYRIGHT
doc/man3/EVP_EncryptInit.pod
+112 -9
View File
@@ -2,6 +2,9 @@
=head1 NAME
EVP_CIPHER_fetch,
EVP_CIPHER_up_ref,
EVP_CIPHER_free,
EVP_CIPHER_CTX_new,
EVP_CIPHER_CTX_reset,
EVP_CIPHER_CTX_free,
@@ -25,7 +28,12 @@ EVP_CipherFinal,
EVP_get_cipherbyname,
EVP_get_cipherbynid,
EVP_get_cipherbyobj,
EVP_CIPHER_is_a,
EVP_CIPHER_name,
EVP_CIPHER_provider,
EVP_CIPHER_nid,
EVP_CIPHER_get_params,
EVP_CIPHER_gettable_params,
EVP_CIPHER_block_size,
EVP_CIPHER_key_length,
EVP_CIPHER_iv_length,
@@ -33,10 +41,16 @@ EVP_CIPHER_flags,
EVP_CIPHER_mode,
EVP_CIPHER_type,
EVP_CIPHER_CTX_cipher,
EVP_CIPHER_CTX_name,
EVP_CIPHER_CTX_nid,
EVP_CIPHER_CTX_get_params,
EVP_CIPHER_CTX_gettable_params,
EVP_CIPHER_CTX_set_params,
EVP_CIPHER_CTX_settable_params,
EVP_CIPHER_CTX_block_size,
EVP_CIPHER_CTX_key_length,
EVP_CIPHER_CTX_iv_length,
EVP_CIPHER_CTX_tag_length,
EVP_CIPHER_CTX_get_app_data,
EVP_CIPHER_CTX_set_app_data,
EVP_CIPHER_CTX_type,
@@ -45,7 +59,8 @@ EVP_CIPHER_CTX_mode,
EVP_CIPHER_param_to_asn1,
EVP_CIPHER_asn1_to_param,
EVP_CIPHER_CTX_set_padding,
EVP_enc_null
EVP_enc_null,
EVP_CIPHER_do_all_ex
- EVP cipher routines
=head1 SYNOPSIS
@@ -54,6 +69,10 @@ EVP_enc_null
#include <openssl/evp.h>
EVP_CIPHER *EVP_CIPHER_fetch(OPENSSL_CTX *ctx, const char *algorithm,
const char *properties);
int EVP_CIPHER_up_ref(EVP_CIPHER *cipher);
void EVP_CIPHER_free(EVP_CIPHER *cipher);
EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void);
int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *ctx);
void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx);
@@ -98,6 +117,9 @@ EVP_enc_null
const EVP_CIPHER *EVP_get_cipherbyobj(const ASN1_OBJECT *a);
int EVP_CIPHER_nid(const EVP_CIPHER *e);
int EVP_CIPHER_is_a(const EVP_CIPHER *cipher, const char *name);
const char *EVP_CIPHER_name(const EVP_CIPHER *cipher);
const OSSL_PROVIDER *EVP_CIPHER_provider(const EVP_CIPHER *cipher);
int EVP_CIPHER_block_size(const EVP_CIPHER *e);
int EVP_CIPHER_key_length(const EVP_CIPHER *e);
int EVP_CIPHER_iv_length(const EVP_CIPHER *e);
@@ -107,9 +129,18 @@ EVP_enc_null
const EVP_CIPHER *EVP_CIPHER_CTX_cipher(const EVP_CIPHER_CTX *ctx);
int EVP_CIPHER_CTX_nid(const EVP_CIPHER_CTX *ctx);
const char *EVP_CIPHER_CTX_name(const EVP_CIPHER_CTX *ctx);
int EVP_CIPHER_get_params(EVP_CIPHER *cipher, OSSL_PARAM params[]);
int EVP_CIPHER_CTX_set_params(EVP_CIPHER_CTX *ctx, const OSSL_PARAM params[]);
int EVP_CIPHER_CTX_get_params(EVP_CIPHER_CTX *ctx, OSSL_PARAM params[]);
const OSSL_PARAM *EVP_CIPHER_gettable_params(const EVP_CIPHER *cipher);
const OSSL_PARAM *EVP_CIPHER_CTX_settable_params(const EVP_CIPHER *cipher);
const OSSL_PARAM *EVP_CIPHER_CTX_gettable_params(const EVP_CIPHER *cipher);
int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx);
int EVP_CIPHER_CTX_key_length(const EVP_CIPHER_CTX *ctx);
int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx);
int EVP_CIPHER_CTX_tag_length(const EVP_CIPHER_CTX *ctx);
void *EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx);
void EVP_CIPHER_CTX_set_app_data(const EVP_CIPHER_CTX *ctx, void *data);
int EVP_CIPHER_CTX_type(const EVP_CIPHER_CTX *ctx);
@@ -118,11 +149,31 @@ EVP_enc_null
int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type);
void EVP_CIPHER_do_all_ex(OPENSSL_CTX *libctx,
void (*fn)(EVP_CIPHER *cipher, void *arg),
void *arg);
=head1 DESCRIPTION
The EVP cipher routines are a high level interface to certain
symmetric ciphers.
The B<EVP_CIPHER> type is a structure for cipher method implementation.
EVP_CIPHER_fetch() fetches the cipher implementation for the given
B<algorithm> from any provider offering it, within the criteria given
by the B<properties>.
See L<provider(7)/Fetching algorithms> for further information.
The returned value must eventually be freed with EVP_CIPHER_free().
EVP_CIPHER_up_ref() increments the reference count for an B<EVP_CIPHER>
structure.
EVP_CIPHER_free() decrements the reference count for the B<EVP_CIPHER>
structure.
If the reference count drops to 0 then the structure is freed.
EVP_CIPHER_CTX_new() creates a cipher context.
EVP_CIPHER_CTX_free() clears all information from a cipher context
@@ -132,16 +183,19 @@ cipher are complete so sensitive information does not remain in
memory.
EVP_EncryptInit_ex() sets up cipher context B<ctx> for encryption
with cipher B<type> from ENGINE B<impl>. B<ctx> must be created
before calling this function. B<type> is normally supplied
by a function such as EVP_aes_256_cbc(). If B<impl> is NULL then the
default implementation is used. B<key> is the symmetric key to use
with cipher B<type>. B<type> is typically supplied by a function such
as EVP_aes_256_cbc(), or a value explicitly fetched with
EVP_CIPHER_fetch(). If B<impl> is non-NULL, its implementation of the
cipher B<type> is used if there is one, and if not, the default
implementation is used. B<key> is the symmetric key to use
and B<iv> is the IV to use (if necessary), the actual number of bytes
used for the key and IV depends on the cipher. It is possible to set
all parameters to NULL except B<type> in an initial call and supply
the remaining parameters in subsequent calls, all of which have B<type>
set to NULL. This is done when the default cipher parameters are not
appropriate.
For EVP_CIPH_GCM_MODE the IV will be generated internally if it is not
specified.
EVP_EncryptUpdate() encrypts B<inl> bytes from the buffer B<in> and
writes the encrypted version to B<out>. This function can be called
@@ -215,6 +269,22 @@ decrypting. If the B<pad> parameter is zero then no padding is
performed, the total amount of data encrypted or decrypted must then
be a multiple of the block size or an error will occur.
EVP_CIPHER_get_params() retrieves the requested list of algorithm
B<params> from a B<cipher>.
EVP_CIPHER_CTX_set_params() Sets the list of operation B<params> into a CIPHER
context B<ctx>.
EVP_CIPHER_CTX_get_params() retrieves the requested list of operation
B<params> from CIPHER context B<ctx>.
EVP_CIPHER_gettable_params(), EVP_CIPHER_CTX_gettable_params(), and
EVP_CIPHER_CTX_settable_params() get a constant B<OSSL_PARAM> array
that decribes the retrievable and settable parameters, i.e. parameters
that can be used with EVP_CIPHER_get_params(), EVP_CIPHER_CTX_get_params()
and EVP_CIPHER_CTX_set_params(), respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key
length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>
structure. The constant B<EVP_MAX_KEY_LENGTH> is the maximum key length
@@ -231,6 +301,10 @@ length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>.
It will return zero if the cipher does not use an IV. The constant
B<EVP_MAX_IV_LENGTH> is the maximum IV length for all ciphers.
EVP_CIPHER_CTX_tag_length() returns the tag length of a AEAD cipher when passed
a B<EVP_CIPHER_CTX>. It will return zero if the cipher does not support a tag.
It returns a default value if the tag length has not been set.
EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block
size of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>
structure. The constant B<EVP_MAX_BLOCK_LENGTH> is also the maximum block
@@ -243,14 +317,26 @@ IDENTIFIER as such it ignores the cipher parameters and 40 bit RC2 and
identifier or does not have ASN1 support this function will return
B<NID_undef>.
EVP_CIPHER_is_a() returns 1 if the given I<cipher> is an implementation of an
algorithm that's identifiable with I<name>, otherwise 0.
EVP_CIPHER_name() and EVP_CIPHER_CTX_name() return the name of the passed
cipher or context.
EVP_CIPHER_provider() returns an B<OSSL_PROVIDER> pointer to the provider
that implements the given B<EVP_CIPHER>.
EVP_CIPHER_CTX_cipher() returns the B<EVP_CIPHER> structure when passed
an B<EVP_CIPHER_CTX> structure.
EVP_CIPHER_mode() and EVP_CIPHER_CTX_mode() return the block cipher mode:
EVP_CIPH_ECB_MODE, EVP_CIPH_CBC_MODE, EVP_CIPH_CFB_MODE, EVP_CIPH_OFB_MODE,
EVP_CIPH_CTR_MODE, EVP_CIPH_GCM_MODE, EVP_CIPH_CCM_MODE, EVP_CIPH_XTS_MODE,
EVP_CIPH_WRAP_MODE or EVP_CIPH_OCB_MODE. If the cipher is a stream cipher then
EVP_CIPH_STREAM_CIPHER is returned.
EVP_CIPH_WRAP_MODE, EVP_CIPH_OCB_MODE or EVP_CIPH_SIV_MODE. If the cipher is a
stream cipher then EVP_CIPH_STREAM_CIPHER is returned.
EVP_CIPHER_flags() returns any flags associated with the cipher. See
EVP_CIPHER_meth_set_flags() for a list of currently defined flags.
EVP_CIPHER_param_to_asn1() sets the AlgorithmIdentifier "parameter" based
on the passed cipher. This will typically include any parameters and an
@@ -278,8 +364,18 @@ based on the cipher context. The EVP_CIPHER can provide its own random key
generation routine to support keys of a specific form. B<Key> must point to a
buffer at least as big as the value returned by EVP_CIPHER_CTX_key_length().
EVP_CIPHER_do_all_ex() traverses all ciphers implemented by all activated
providers in the given library context I<libctx>, and for each of the
implementations, calls the given function I<fn> with the implementation method
and the given I<arg> as argument.
=head1 RETURN VALUES
EVP_CIPHER_fetch() returns a pointer to a B<EVP_CIPHER> for success
and B<NULL> for failure.
EVP_CIPHER_up_ref() returns 1 for success or 0 otherwise.
EVP_CIPHER_CTX_new() returns a pointer to a newly created
B<EVP_CIPHER_CTX> for success and B<NULL> for failure.
@@ -310,6 +406,9 @@ EVP_CIPHER_CTX_set_padding() always returns 1.
EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV
length or zero if the cipher does not use an IV.
EVP_CIPHER_CTX_tag_length() return the tag length or zero if the cipher does not
use a tag.
EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the NID of the cipher's
OBJECT IDENTIFIER or NID_undef if it has no defined OBJECT IDENTIFIER.
@@ -335,7 +434,7 @@ Null cipher: does nothing.
=back
=head1 AEAD Interface
=head1 AEAD INTERFACE
The EVP interface for Authenticated Encryption with Associated Data (AEAD)
modes are subtly altered and several additional I<ctrl> operations are supported
@@ -414,7 +513,7 @@ the length of the tag (with the C<tag> parameter set to NULL) when encrypting.
The tag length is often referred to as B<M>. If not set a default value is
used (12 for AES). When decrypting, the tag needs to be set before passing
in data to be decrypted, but as in GCM and OCB mode, it can be set after
passing additional authenticated data (see L<AEAD Interface>).
passing additional authenticated data (see L</AEAD INTERFACE>).
=item EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_L, ivlen, NULL)
@@ -686,6 +785,10 @@ EVP_CIPHER_CTX_reset() appeared and EVP_CIPHER_CTX_cleanup()
disappeared. EVP_CIPHER_CTX_init() remains as an alias for
EVP_CIPHER_CTX_reset().
The EVP_CIPHER_fetch(), EVP_CIPHER_free(), EVP_CIPHER_up_ref(),
EVP_CIPHER_CTX_set_params() and EVP_CIPHER_CTX_get_params() functions
were added in 3.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/EVP_KDF.pod
+265
View File
@@ -0,0 +1,265 @@
=pod
=head1 NAME
EVP_KDF, EVP_KDF_fetch, EVP_KDF_free, EVP_KDF_provider, EVP_KDF_up_ref,
EVP_KDF_name,
EVP_KDF_CTX, EVP_KDF_CTX_new, EVP_KDF_CTX_free, EVP_KDF_CTX_kdf,
EVP_KDF_reset, EVP_KDF_size, EVP_KDF_derive, EVP_KDF_CTX_dup,
EVP_KDF_CTX_get_params, EVP_KDF_CTX_set_params, EVP_KDF_do_all_ex,
EVP_KDF_get_params, EVP_KDF_CTX_gettable_params, EVP_KDF_CTX_settable_params,
EVP_KDF_gettable_params - EVP KDF routines
=head1 SYNOPSIS
#include <openssl/kdf.h>
typedef struct evp_kdf_st EVP_KDF;
typedef struct evp_kdf_ctx_st EVP_KDF_CTX;
EVP_KDF_CTX *EVP_KDF_CTX_new(const EVP_KDF *kdf);
const EVP_KDF *EVP_KDF_CTX_kdf(EVP_KDF_CTX *ctx);
void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx);
EVP_KDF_CTX *EVP_KDF_CTX_dup(const EVP_KDF_CTX *src);
void EVP_KDF_reset(EVP_KDF_CTX *ctx);
size_t EVP_KDF_size(EVP_KDF_CTX *ctx);
int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen);
const char *EVP_KDF_name(const EVP_KDF *kdf);
int EVP_KDF_up_ref(EVP_KDF *kdf);
void EVP_KDF_free(EVP_KDF *kdf);
EVP_KDF *EVP_KDF_fetch(OPENSSL_CTX *libctx, const char *algorithm,
const char *properties);
void EVP_KDF_do_all_ex(OPENSSL_CTX *libctx,
void (*fn)(EVP_KDF *kdf, void *arg),
void *arg);
int EVP_KDF_get_params(EVP_KDF *kdf, OSSL_PARAM params[]);
int EVP_KDF_CTX_get_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[]);
int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]);
const OSSL_PARAM *EVP_KDF_gettable_params(const EVP_KDF *kdf);
const OSSL_PARAM *EVP_KDF_CTX_gettable_params(const EVP_KDF *kdf);
const OSSL_PARAM *EVP_KDF_CTX_settable_params(const EVP_KDF *kdf);
const OSSL_PROVIDER *EVP_KDF_provider(const EVP_KDF *kdf);
=head1 DESCRIPTION
The EVP KDF routines are a high level interface to Key Derivation Function
algorithms and should be used instead of algorithm-specific functions.
After creating a B<EVP_KDF_CTX> for the required algorithm using
EVP_KDF_CTX_new(), inputs to the algorithm are supplied
using calls to EVP_KDF_CTX_set_params() before
calling EVP_KDF_derive() to derive the key.
=head2 Types
B<EVP_KDF> is a type that holds the implementation of a KDF.
B<EVP_KDF_CTX> is a context type that holds the algorithm inputs.
=head2 Algorithm implementation fetching
EVP_KDF_fetch() fetches an implementation of a KDF I<algorithm>, given
a library context I<libctx> and a set of I<properties>.
See L<provider(7)/Fetching algorithms> for further information.
The returned value must eventually be freed with
L<EVP_KDF_free(3)>.
EVP_KDF_up_ref() increments the reference count of an already fetched
KDF.
EVP_KDF_free() frees a fetched algorithm.
NULL is a valid parameter, for which this function is a no-op.
=head2 Context manipulation functions
EVP_KDF_CTX_new() creates a new context for the KDF implementation I<kdf>.
EVP_KDF_CTX_free() frees up the context C<ctx>. If I<ctx> is NULL, nothing
is done.
EVP_KDF_CTX_kdf() returns the B<EVP_KDF> associated with the context
I<ctx>.
=head2 Computing functions
EVP_KDF_reset() resets the context to the default state as if the context
had just been created.
EVP_KDF_derive() derives C<keylen> bytes of key material and places it in the
I<key> buffer. If the algorithm produces a fixed amount of output then an
error will occur unless the C<keylen> parameter is equal to that output size,
as returned by EVP_KDF_size().
EVP_KDF_get_params() retrieves details about the implementation
I<kdf>.
The set of parameters given with I<params> determine exactly what
parameters should be retrieved.
Note that a parameter that is unknown in the underlying context is
simply ignored.
EVP_KDF_CTX_get_params() retrieves chosen parameters, given the
context I<ctx> and its underlying context.
The set of parameters given with I<params> determine exactly what
parameters should be retrieved.
Note that a parameter that is unknown in the underlying context is
simply ignored.
EVP_KDF_CTX_set_params() passes chosen parameters to the underlying
context, given a context I<ctx>.
The set of parameters given with I<params> determine exactly what
parameters are passed down.
Note that a parameter that is unknown in the underlying context is
simply ignored.
Also, what happens when a needed parameter isn't passed down is
defined by the implementation.
EVP_KDF_gettable_params(), EVP_KDF_CTX_gettable_params() and
EVP_KDF_CTX_settable_params() get a constant B<OSSL_PARAM> array that
decribes the retrievable and settable parameters, i.e. parameters that
can be used with EVP_KDF_get_params(), EVP_KDF_CTX_get_params()
and EVP_KDF_CTX_set_params(), respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
=head2 Information functions
EVP_KDF_size() returns the output size if the algorithm produces a fixed amount
of output and B<SIZE_MAX> otherwise. If an error occurs then 0 is returned.
For some algorithms an error may result if input parameters necessary to
calculate a fixed output size have not yet been supplied.
EVP_KDF_name() returns the name of the given KDF implementation.
EVP_KDF_provider() returns the provider that holds the implementation
of the given I<kdf>.
EVP_KDF_do_all_ex() traverses all KDF implemented by all activated
providers in the given library context I<libctx>, and for each of the
implementations, calls the given function I<fn> with the implementation method
and the given I<arg> as argument.
=head1 PARAMETERS
The standard parameter names are:
=over 4
=item B<OSSL_KDF_PARAM_PASSWORD> ("pass") <octet string>
Some KDF implementations require a password.
For those KDF implementations that support it, this parameter sets the password.
=item B<OSSL_KDF_PARAM_SALT> ("salt") <octet string>
Some KDF implementations can take a salt.
For those KDF implementations that support it, this parameter sets the salt.
The default value, if any, is implementation dependent.
=item B<OSSL_KDF_PARAM_ITER> ("iter") <unsigned integer>
Some KDF implementations require an iteration count.
For those KDF implementations that support it, this parameter sets the
iteration count.
The default value, if any, is implementation dependent.
=item B<OSSL_KDF_PARAM_PROPERTIES> ("properties") <UTF8 string>
=item B<OSSL_KDF_PARAM_MAC> ("mac") <UTF8 string>
=item B<OSSL_KDF_PARAM_DIGEST> ("digest") <UTF8 string>
=item B<OSSL_MAC_PARAM_ENGINE> ("engine") <UTF8 string>
For KDF implementations that use an underlying computation MAC or
digest, these parameters set what the algorithm should be, and the
engine that implements the algorithm or the properties to fetch it
by if needed.
The value is always the name of the intended engine, algorithm,
or the properties.
Note that not all algorithms may support all possible underlying
implementations.
=item B<OSSL_KDF_PARAM_KEY> ("key") <octet string>
Some KDF implementations require a key.
For those KDF implementations that support it, this octet string parameter
sets the key.
=item B<OSSL_KDF_PARAM_MAC_SIZE> ("maclen") <unsigned integer>
Used by implementations that use a MAC with a variable output size (KMAC).
For those KDF implementations that support it, this parameter
sets the MAC output size.
The default value, if any, is implementation dependent.
The length must never exceed what can be given with a B<size_t>.
=item B<OSSL_KDF_PARAM_SCRYPT_MAXMEM> ("macmaxmem_byteslen") <unsigned integer>
Memory-hard password-based KDF algorithms, such as scrypt, use an amount of
memory that depends on the load factors provided as input.
For those KDF implementations that support it, this uint64_t parameter sets
an upper limit on the amount of memory that may be consumed while performing
a key derivation.
If this memory usage limit is exceeded because the load factors are chosen
too high, the key derivation will fail.
The default value is implementation dependent.
The memory size must never exceed what can be given with a B<size_t>.
=back
=head1 RETURN VALUES
EVP_MAC_fetch() returns a pointer to a newly fetched B<EVP_KDF>, or
NULL if allocation failed.
EVP_KDF_name() returns the name for the given I<kdf>, if it has been
added to the object database.
EVP_KDF_provider() returns a pointer to the provider for the KDF, or
NULL on error.
EVP_MAC_up_ref() returns 1 on success, 0 on error.
EVP_KDF_CTX_new() returns either the newly allocated
C<EVP_KDF_CTX> structure or C<NULL> if an error occurred.
EVP_KDF_CTX_free() and EVP_KDF_reset() do not return a value.
EVP_KDF_size() returns the output size. C<SIZE_MAX> is returned to indicate
that the algorithm produces a variable amount of output; 0 to indicate failure.
The remaining functions return 1 for success and 0 or a negative value for
failure. In particular, a return value of -2 indicates the operation is not
supported by the KDF algorithm.
=head1 SEE ALSO
L<EVP_KDF-SCRYPT(7)>
L<EVP_KDF-TLS1_PRF(7)>
L<EVP_KDF-PBKDF2(7)>
L<EVP_KDF-HKDF(7)>
L<EVP_KDF-SS(7)>
L<EVP_KDF-SSHKDF(7)>
L<EVP_KDF-X963(7)>
L<EVP_KDF-X942(7)>
=head1 HISTORY
This functionality was added to OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/EVP_KDF_CTX.pod
-296
View File
@@ -1,296 +0,0 @@
=pod
=head1 NAME
EVP_KDF, EVP_KDF_CTX, EVP_KDF_CTX_new, EVP_KDF_CTX_new_id, EVP_KDF_CTX_free,
EVP_KDF_CTX_kdf, EVP_KDF_reset, EVP_KDF_ctrl, EVP_KDF_vctrl, EVP_KDF_ctrl_str,
EVP_KDF_size, EVP_KDF_derive, EVP_KDF_nid, EVP_KDF_name,
EVP_get_kdfbyname, EVP_get_kdfbynid, EVP_get_kdfbyobj - EVP KDF routines
=head1 SYNOPSIS
#include <openssl/kdf.h>
typedef struct evp_kdf_st EVP_KDF;
typedef struct evp_kdf_ctx_st EVP_KDF_CTX;
EVP_KDF_CTX *EVP_KDF_CTX_new(const EVP_KDF *kdf);
EVP_KDF_CTX *EVP_KDF_CTX_new_id(int nid);
const EVP_KDF *EVP_KDF_CTX_kdf(EVP_KDF_CTX *ctx);
void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx);
void EVP_KDF_reset(EVP_KDF_CTX *ctx);
int EVP_KDF_ctrl(EVP_KDF_CTX *ctx, int cmd, ...);
int EVP_KDF_vctrl(EVP_KDF_CTX *ctx, int cmd, va_list args);
int EVP_KDF_ctrl_str(EVP_KDF_CTX *ctx, const char *type, const char *value);
size_t EVP_KDF_size(EVP_KDF_CTX *ctx);
int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen);
int EVP_KDF_nid(const EVP_KDF *kdf);
const char *EVP_KDF_name(const EVP_KDF *kdf);
const EVP_KDF *EVP_get_kdfbyname(const char *name);
const EVP_KDF *EVP_get_kdfbynid(int nid);
const EVP_KDF *EVP_get_kdfbyobj(const ASN1_OBJECT *o);
=head1 DESCRIPTION
The EVP KDF routines are a high level interface to Key Derivation Function
algorithms and should be used instead of algorithm-specific functions.
After creating a C<EVP_KDF_CTX> for the required algorithm using either
EVP_KDF_CTX_new() or EVP_KDF_CTX_new_id(), inputs to the algorithm are supplied
using calls to EVP_KDF_ctrl(), EVP_KDF_vctrl() or EVP_KDF_ctrl_str() before
calling EVP_KDF_derive() to derive the key.
=head2 Types
B<EVP_KDF> is a type that holds the implementation of a KDF.
B<EVP_KDF_CTX> is a context type that holds the algorithm inputs.
=head2 Context manipulation functions
EVP_KDF_CTX_new() creates a new context for the KDF type C<kdf>.
EVP_KDF_CTX_new_id() creates a new context for the numerical KDF identity C<nid>.
EVP_KDF_CTX_free() frees up the context C<ctx>. If C<ctx> is C<NULL>, nothing
is done.
EVP_KDF_CTX_kdf() returns the B<EVP_KDF> associated with the context
C<ctx>.
=head2 Computing functions
EVP_KDF_reset() resets the context to the default state as if the context
had just been created.
EVP_KDF_ctrl() is used to provide inputs to the KDF algorithm prior to
EVP_KDF_derive() being called. The inputs that may be provided will vary
depending on the KDF algorithm or its implementation. This functions takes
variable arguments, the exact expected arguments depend on C<cmd>.
See L</CONTROLS> below for a description of standard controls.
EVP_KDF_vctrl() is the variant of EVP_KDF_ctrl() that takes a C<va_list>
argument instead of variadic arguments.
EVP_KDF_ctrl_str() allows an application to send an algorithm specific control
operation to a context C<ctx> in string form. This is intended to be used for
options specified on the command line or in text files.
EVP_KDF_derive() derives C<keylen> bytes of key material and places it in the
C<key> buffer. If the algorithm produces a fixed amount of output then an
error will occur unless the C<keylen> parameter is equal to that output size,
as returned by EVP_KDF_size().
=head2 Information functions
EVP_KDF_size() returns the output size if the algorithm produces a fixed amount
of output and C<SIZE_MAX> otherwise. If an error occurs then 0 is returned.
For some algorithms an error may result if input parameters necessary to
calculate a fixed output size have not yet been supplied.
EVP_KDF_nid() returns the numeric identity of the given KDF implementation.
EVP_KDF_name() returns the name of the given KDF implementation.
=head2 Object database functions
EVP_get_kdfbyname() fetches a KDF implementation from the object
database by name.
EVP_get_kdfbynid() fetches a KDF implementation from the object
database by numeric identity.
EVP_get_kdfbyobj() fetches a KDF implementation from the object
database by ASN.1 OBJECT (i.e. an encoded OID).
=head1 CONTROLS
The standard controls are:
=over 4
=item B<EVP_KDF_CTRL_SET_PASS>
This control expects two arguments: C<unsigned char *pass>, C<size_t passlen>
Some KDF implementations require a password. For those KDF implementations
that support it, this control sets the password.
EVP_KDF_ctrl_str() takes two type strings for this control:
=over 4
=item "pass"
The value string is used as is.
=item "hexpass"
The value string is expected to be a hexadecimal number, which will be
decoded before being passed on as the control value.
=back
=item B<EVP_KDF_CTRL_SET_SALT>
This control expects two arguments: C<unsigned char *salt>, C<size_t saltlen>
Some KDF implementations can take a salt. For those KDF implementations that
support it, this control sets the salt.
The default value, if any, is implementation dependent.
EVP_KDF_ctrl_str() takes two type strings for this control:
=over 4
=item "salt"
The value string is used as is.
=item "hexsalt"
The value string is expected to be a hexadecimal number, which will be
decoded before being passed on as the control value.
=back
=item B<EVP_KDF_CTRL_SET_ITER>
This control expects one argument: C<int iter>
Some KDF implementations require an iteration count. For those KDF implementations that support it, this control sets the iteration count.
The default value, if any, is implementation dependent.
EVP_KDF_ctrl_str() type string: "iter"
The value string is expected to be a decimal number.
=item B<EVP_KDF_CTRL_SET_MAC>
This control expects one argument: C<EVP_MAC *mac>
Some KDF implementations use a MAC as an underlying computation
algorithm, this control sets what the MAC algorithm should be.
EVP_KDF_ctrl_str() type string: "mac"
The value string is expected to be the name of a MAC.
=item B<EVP_KDF_CTRL_SET_MD>
This control expects one argument: C<EVP_MD *md>
For MAC implementations that use a message digest as an underlying computation
algorithm, this control sets what the digest algorithm should be.
EVP_KDF_ctrl_str() type string: "digest"
The value string is expected to be the name of a digest.
=item B<EVP_KDF_CTRL_SET_KEY>
This control expects two arguments: C<unsigned char *key>, C<size_t keylen>
Some KDF implementations require a key. For those KDF implementations that
support it, this control sets the key.
EVP_KDF_ctrl_str() takes two type strings for this control:
=over 4
=item "key"
The value string is used as is.
=item "hexkey"
The value string is expected to be a hexadecimal number, which will be
decoded before being passed on as the control value.
=back
=item B<EVP_KDF_CTRL_SET_MAC_SIZE>
This control expects one argument: C<size_t size>
Used by implementations that use a MAC with a variable output size (KMAC). For
those KDF implementations that support it, this control sets the MAC output size.
The default value, if any, is implementation dependent.
EVP_KDF_ctrl_str() type string: "outlen"
The value string is expected to be a decimal number.
=item B<EVP_KDF_CTRL_SET_MAXMEM_BYTES>
This control expects one argument: C<uint64_t maxmem_bytes>
Memory-hard password-based KDF algorithms, such as scrypt, use an amount of
memory that depends on the load factors provided as input. For those KDF
implementations that support it, this control sets an upper limit on the amount
of memory that may be consumed while performing a key derivation. If this
memory usage limit is exceeded because the load factors are chosen too high,
the key derivation will fail.
The default value is implementation dependent.
EVP_KDF_ctrl_str() type string: "maxmem_bytes"
The value string is expected to be a decimal number.
=back
=head1 RETURN VALUES
EVP_KDF_CTX_new() and EVP_KDF_CTX_new_id() return either the newly allocated
C<EVP_KDF_CTX> structure or C<NULL> if an error occurred.
EVP_KDF_CTX_free() and EVP_KDF_reset() do not return a value.
EVP_KDF_size() returns the output size. C<SIZE_MAX> is returned to indicate
that the algorithm produces a variable amount of output; 0 to indicate failure.
EVP_KDF_nid() returns the numeric identity for the given C<kdf>.
EVP_KDF_name() returns the name for the given C<kdf>, if it has been
added to the object database.
EVP_add_kdf() returns 1 if the given C<kdf> was successfully added to
the object database, otherwise 0.
EVP_get_kdfbyname(), EVP_get_kdfbynid() and EVP_get_kdfbyobj() return
the requested KDF implementation, if it exists in the object database,
otherwise B<NULL>.
The remaining functions return 1 for success and 0 or a negative value for
failure. In particular, a return value of -2 indicates the operation is not
supported by the KDF algorithm.
=head1 SEE ALSO
L<EVP_KDF_SCRYPT(7)>
L<EVP_KDF_TLS1_PRF(7)>
L<EVP_KDF_PBKDF2(7)>
L<EVP_KDF_HKDF(7)>
L<EVP_KDF_SS(7)>
L<EVP_KDF_SSHKDF(7)>
L<EVP_KDF_X963(7)>
L<EVP_KDF_X942KDF(7)>
=head1 HISTORY
This functionality was added to OpenSSL 3.0.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut

Some files were not shown because too many files have changed in this diff Show More