Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update pre10

Browse Source
This commit is contained in:
Hakase
2018-08-23 00:44:44 +09:00
parent ef69dcb649
commit 6ed909873d
55 changed files with 818 additions and 394 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man1/ca.pod
+5 -4
View File
@@ -184,9 +184,9 @@ The number of days to certify the certificate for.
=item B<-md alg>
The message digest to use.
Any digest supported by the OpenSSL B<dgst> command can be used. If the signing
key is using Ed25519 or Ed448 then you should specify "null" for the digest.
This option also applies to CRLs.
Any digest supported by the OpenSSL B<dgst> command can be used. For signing
algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message
digest that is set is ignored. This option also applies to CRLs.
=item B<-policy arg>
@@ -453,7 +453,8 @@ least one of these must be present to generate a CRL.
=item B<default_md>
The same as the B<-md> option. Mandatory.
The same as the B<-md> option. Mandatory except where the signing algorithm does
not require a digest (i.e. Ed25519 and Ed448).
=item B<database>
doc/man1/req.pod
+5 -5
View File
@@ -209,7 +209,7 @@ the configuration file.
Some public key algorithms may override this choice. For instance, DSA
signatures always use SHA1, GOST R 34.10 signatures always use
GOST R 34.11-94 (B<-md_gost94>).
GOST R 34.11-94 (B<-md_gost94>), Ed25519 and Ed448 never use any digest.
=item B<-config filename>
@@ -394,10 +394,10 @@ option. For compatibility B<encrypt_rsa_key> is an equivalent option.
=item B<default_md>
This option specifies the digest algorithm to use.
Any digest supported by the OpenSSL B<dgst> command can be used.
If not present then MD5 is used.
This option can be overridden on the command line.
This option specifies the digest algorithm to use. Any digest supported by the
OpenSSL B<dgst> command can be used. This option can be overridden on the
command line. Certain signing algorithms (i.e. Ed25519 and Ed448) will ignore
any digest that has been set.
=item B<string_mask>
doc/man1/s_client.pod
+4 -4
View File
@@ -134,7 +134,7 @@ B<openssl> B<s_client>
[B<-ctlogfile>]
[B<-keylogfile file>]
[B<-early_data file>]
[B<-force_pha>]
[B<-enable_pha>]
[B<target>]
=head1 DESCRIPTION
@@ -700,10 +700,10 @@ Reads the contents of the specified file and attempts to send it as early data
to the server. This will only work with resumed sessions that support early
data and when the server accepts the early data.
=item B<-force_pha>
=item B<-enable_pha>
For TLSv1.3 only, always send the Post-Handshake Authentication extension,
whether or not a certificate has been provided via B<-cert>.
For TLSv1.3 only, send the Post-Handshake Authentication extension. This will
happen whether or not a certificate has been provided via B<-cert>.
=item B<[target]>
doc/man3/BIO_s_file.pod
+1 -1
View File
@@ -54,7 +54,7 @@ BIO_CLOSE, BIO_NOCLOSE (the close flag) BIO_FP_TEXT (sets the underlying
stream to text mode, default is binary: this only has any effect under
Win32).
BIO_set_fp() set the fp of a file BIO to B<fp>. B<flags> has the same
BIO_set_fp() sets the fp of a file BIO to B<fp>. B<flags> has the same
meaning as in BIO_new_fp(), it is a macro.
BIO_get_fp() retrieves the fp of a file BIO, it is a macro.
doc/man3/BN_generate_prime.pod
+1 -1
View File
@@ -143,7 +143,7 @@ A callback is invoked through a call to B<BN_GENCB_call>. This will check
the type of the callback and will invoke B<callback(a, b, gencb)> for new
style callbacks or B<callback(a, b, cb_arg)> for old style.
It is possible to obtained the argument associated with a BN_GENCB structure
It is possible to obtain the argument associated with a BN_GENCB structure
(set via a call to BN_GENCB_set or BN_GENCB_set_old) using BN_GENCB_get_arg.
BN_generate_prime() (deprecated) works in the same way as
doc/man3/CRYPTO_THREAD_run_once.pod
+2 -15
View File
@@ -4,8 +4,8 @@
CRYPTO_THREAD_run_once,
CRYPTO_THREAD_lock_new, CRYPTO_THREAD_read_lock, CRYPTO_THREAD_write_lock,
CRYPTO_THREAD_unlock, CRYPTO_THREAD_lock_free, CRYPTO_atomic_add,
CRYPTO_atomic_read, CRYPTO_atomic_write - OpenSSL thread support
CRYPTO_THREAD_unlock, CRYPTO_THREAD_lock_free,
CRYPTO_atomic_add - OpenSSL thread support
=head1 SYNOPSIS
@@ -21,8 +21,6 @@ CRYPTO_atomic_read, CRYPTO_atomic_write - OpenSSL thread support
void CRYPTO_THREAD_lock_free(CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_read(int *val, int *ret, CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_write(int *val, int n, CRYPTO_RWLOCK *lock);
=head1 DESCRIPTION
@@ -77,17 +75,6 @@ operations are supported on the specific platform. Because of this, if a
variable is modified by CRYPTO_atomic_add() then CRYPTO_atomic_add() must
be the only way that the variable is modified.
=item *
CRYPTO_atomic_read() atomically reads B<val> and returns the result of
the operation in B<ret>. B<lock> will be locked, unless atomic operations
are supported on the specific platform.
=item *
CRYPTO_atomic_write() atomically writes B<n> to B<val>. B<lock> will be
locked, unless atomic operations are supported on the specific platform.
=back
=head1 RETURN VALUES
doc/man3/EVP_PKEY_get_default_digest_nid.pod
+2 -1
View File
@@ -13,7 +13,8 @@ EVP_PKEY_get_default_digest_nid - get default signature digest
The EVP_PKEY_get_default_digest_nid() function sets B<pnid> to the default
message digest NID for the public key signature operations associated with key
B<pkey>.
B<pkey>. Note that some signature algorithms (i.e. Ed25519 and Ed448) do not use
a digest during signing. In this case B<pnid> will be set to NID_undef.
=head1 NOTES
doc/man3/RSA_generate_key.pod
+1 -1
View File
@@ -93,7 +93,7 @@ L<ERR_get_error(3)>, L<RAND_bytes(3)>, L<BN_generate_prime(3)>
=head1 HISTORY
RSA_generate_key() was deprecated in OpenSSL 0.9.8; use
RSA_generate_key_ex() intsead.
RSA_generate_key_ex() instead.
=head1 COPYRIGHT
doc/man3/SSL_CTX_set_verify.pod
+10 -7
View File
@@ -7,7 +7,8 @@ SSL_CTX_set_verify, SSL_set_verify,
SSL_CTX_set_verify_depth, SSL_set_verify_depth,
SSL_verify_cb,
SSL_verify_client_post_handshake,
SSL_force_post_handshake_auth
SSL_set_post_handshake_auth,
SSL_CTX_set_post_handshake_auth
- set peer certificate verification parameters
=head1 SYNOPSIS
@@ -24,7 +25,8 @@ SSL_force_post_handshake_auth
void SSL_set_verify_depth(SSL *ssl, int depth);
int SSL_verify_client_post_handshake(SSL *ssl);
void SSL_force_post_handshake_auth(SSL *ssl);
void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val);
void SSL_set_post_handshake_auth(SSL *ssl, int val);
=head1 DESCRIPTION
@@ -48,10 +50,11 @@ verification that shall be allowed for B<ctx>.
SSL_set_verify_depth() sets the maximum B<depth> for the certificate chain
verification that shall be allowed for B<ssl>.
SSL_force_post_handshake_auth() forces the Post-Handshake Authentication
extension to be added to the ClientHello regardless of certificate configuration
at the time of the initial handshake, such that post-handshake authentication
can be requested by the server. A certificate callback will need to be set via
SSL_CTX_set_post_handshake_auth() and SSL_set_post_handshake_auth() enable the
Post-Handshake Authentication extension to be added to the ClientHello such that
post-handshake authentication can be requested by the server. If B<val> is 0
then the extension is not sent, otherwise it is. By default the extension is not
sent. A certificate callback will need to be set via
SSL_CTX_set_client_cert_cb() if no certificate is provided at initialization.
SSL_verify_client_post_handshake() causes a CertificateRequest message to be
@@ -341,7 +344,7 @@ L<CRYPTO_get_ex_new_index(3)>
=head1 HISTORY
The SSL_VERIFY_POST_HANDSHAKE option, and the SSL_verify_client_post_handshake()
and SSL_force_post_handshake_auth() functions were added in OpenSSL 1.1.1.
and SSL_set_post_handshake_auth() functions were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
doc/man7/Ed25519.pod
+5 -5
View File
@@ -13,18 +13,18 @@ one-shot digest sign and digest verify using PureEdDSA and B<Ed25519> or B<Ed448
(see RFC8032). It has associated private and public key formats compatible with
draft-ietf-curdle-pkix-04.
No additional parameters can be set during key generation one-shot signing or
verification. In particular, because PureEdDSA is used, when signing or
verifying a digest must B<NOT> be specified.
No additional parameters can be set during key generation, one-shot signing or
verification. In particular, because PureEdDSA is used, a digest must B<NOT> be
specified when signing or verifying.
=head1 NOTES
The PureEdDSA algorithm does not support the streaming mechanism
of other signature algorithms using, for example, EVP_DigestUpdate().
The message to sign or verify must be passed using the one-shot
EVP_DigestSign() asn EVP_DigestVerify() functions.
EVP_DigestSign() and EVP_DigestVerify() functions.
When calling EVP_DigestSignInit() or EVP_DigestSignUpdate() the
When calling EVP_DigestSignInit() or EVP_DigestVerifyInit(), the
digest parameter B<MUST> be set to B<NULL>.
Applications wishing to sign certificates (or other structures such as