Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-04-25 19:56:17 +09:00
parent 2015c00c43
commit 80ef640063
5977 changed files with 13451 additions and 5979 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/internal/man3/OPENSSL_SA.pod
+1 -1
View File
@@ -120,7 +120,7 @@ This functionality was added to OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. Copyright
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. Copyright
(c) 2019, Oracle and/or its affiliates. All rights reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this
doc/internal/man3/evp_keymgmt_newdata.pod
+1 -1
View File
@@ -82,7 +82,7 @@ The functions described here were all added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/evp_keymgmt_util_export_to_provider.pod
+1 -1
View File
@@ -77,7 +77,7 @@ L<EVP_PKEY_ASN1_METHOD(3)>, L<EVP_PKEY_assign_RSA(3)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/evp_pkey_export_to_provider.pod
+16 -21
View File
@@ -2,7 +2,7 @@
=head1 NAME
evp_pkey_export_to_provider, evp_pkey_upgrade_to_provider
evp_pkey_export_to_provider, evp_pkey_downgrade
- internal EVP_PKEY support functions for providers
=head1 SYNOPSIS
@@ -13,9 +13,7 @@ evp_pkey_export_to_provider, evp_pkey_upgrade_to_provider
void *evp_pkey_export_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx,
EVP_KEYMGMT **keymgmt,
const char *propquery);
void *evp_pkey_upgrade_to_provider(EVP_PKEY *pk, OPENSSL_CTX *libctx,
EVP_KEYMGMT **keymgmt,
const char *propquery);
int evp_pkey_downgrade(EVP_PKEY *pk);
=head1 DESCRIPTION
@@ -31,29 +29,26 @@ default context), the name of the legacy type of I<pk>, and the I<propquery>
If I<keymgmt> isn't NULL but I<*keymgmt> is, and the "origin" was successfully
exported, then I<*keymgmt> is assigned the implicitly fetched B<EVP_KEYMGMT>.
evp_pkey_upgrade_to_provider() exports the legacy "origin" key contained in
I<pk> to it's provider side counterpart, then clears the legacy "origin" key
along with other legacy data, and resets all the caches. Otherwise, it works
like evp_pkey_export_to_provider().
I<evp_pkey_upgrade_to_provider() must be used with great care, only if there's
no other way.>
Most of the time, it's sufficient to use evp_pkey_export_to_provider(), but in
case the key needs modification with data coming from a provided key, the key
will need an upgrade.
evp_pkey_downgrade() converts an B<EVP_PKEY> with a provider side "origin" key
to one with a legacy "origin", if there's a corresponding legacy implementation.
This clears the operation cache, except for the provider side "origin" key.
This function is used in spots where provider side keys aren't yet supported,
in an attempt to keep operating with available implementations.
=head1 RETURN VALUES
evp_pkey_export_to_provider() and evp_pkey_upgrade_to_provider() both return
the provider key data that was exported if the "origin" was successfully
exported to its target. Otherwise, NULL is returned.
evp_pkey_export_to_provider() returns the provider key data if there was any
allocated. It also either sets I<*keymgmt> to the B<EVP_KEYMGMT> associated
with the returned key data, or NULL on error.
evp_pkey_downgrade() returns 1 on success or 0 on error.
=head1 NOTES
Some functions calling evp_pkey_export_to_provider() or
evp_pkey_upgrade_to_provider() may have received a const key, and may
therefore have to cast the key to non-const form to call this function. Since
B<EVP_PKEY> is always dynamically allocated, this is OK.
Some functions calling evp_pkey_export_to_provider() or evp_pkey_downgrade()
may have received a const key, and may therefore have to cast the key to
non-const form to call this function. Since B<EVP_PKEY> is always dynamically
allocated, this is OK.
=head1 SEE ALSO
doc/internal/man3/ossl_cmp_asn1_octet_string_set1.pod
+1 -1
View File
@@ -49,7 +49,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_certReq_new.pod
+1 -1
View File
@@ -183,7 +183,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_hdr_init.pod
+1 -1
View File
@@ -124,7 +124,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_msg_check_received.pod
+1 -1
View File
@@ -76,7 +76,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_msg_protect.pod
+1 -1
View File
@@ -43,7 +43,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_pkisi_get_status.pod
+1 -1
View File
@@ -82,7 +82,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_print_log.pod
+1 -1
View File
@@ -98,7 +98,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man3/ossl_cmp_sk_X509_add1_cert.pod
+1 -1
View File
@@ -50,7 +50,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/internal/man7/build.info.pod
+1 -1
View File
@@ -614,7 +614,7 @@ L<Text::Temlate|https://metacpan.org/pod/Text::Template>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this
file except in compliance with the License. You can obtain a copy in the file
doc/man1/CA.pl.pod
+1 -1
View File
@@ -189,7 +189,7 @@ L<config(5)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-asn1parse.pod.in
+1 -1
View File
@@ -210,7 +210,7 @@ L<ASN1_generate_nconf(3)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-ca.pod.in
+13 -1
View File
@@ -36,8 +36,10 @@ B<openssl> B<ca>
[B<-key> I<arg>]
[B<-passin> I<arg>]
[B<-cert> I<file>]
[B<-certform> B<DER>|<PEM>]
[B<-selfsign>]
[B<-in> I<file>]
[B<-inform> B<DER>|<PEM>]
[B<-out> I<file>]
[B<-notext>]
[B<-outdir> I<dir>]
@@ -104,6 +106,11 @@ B<default_ca> in the B<ca> section).
An input filename containing a single certificate request to be
signed by the CA.
=item B<-inform> B<DER>|B<PEM>
The format of the data in CSR input files.
The default is PEM.
=item B<-ss_cert> I<filename>
A single self-signed certificate to be signed by the CA.
@@ -135,6 +142,11 @@ F<.pem> appended.
The CA certificate file.
=item B<-certform> B<DER>|B<PEM>
The format of the data in certificate input files.
The default is PEM.
=item B<-keyfile> I<filename>
The private key to sign requests with.
@@ -788,7 +800,7 @@ L<x509v3_config(5)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-ciphers.pod.in
+1 -1
View File
@@ -803,7 +803,7 @@ The B<-convert> option was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-cmds.pod.in
+1 -1
View File
@@ -150,7 +150,7 @@ deprecated in OpenSSL 3.0 and will be removed in OpenSSL 4.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-cms.pod.in
+1 -1
View File
@@ -768,7 +768,7 @@ The -no_alt_chains option was added in OpenSSL 1.0.2b.
=head1 COPYRIGHT
Copyright 2008-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-crl.pod.in
+1 -1
View File
@@ -153,7 +153,7 @@ L<ossl_store-file(7)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-crl2pkcs7.pod.in
+1 -1
View File
@@ -98,7 +98,7 @@ L<openssl-pkcs7(1)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-dgst.pod.in
+1 -1
View File
@@ -249,7 +249,7 @@ The FIPS-related options were removed in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-dhparam.pod.in
+1 -1
View File
@@ -140,7 +140,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-dsa.pod.in
+1 -1
View File
@@ -168,7 +168,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-dsaparam.pod.in
+1 -1
View File
@@ -113,7 +113,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-enc.pod.in
+1 -1
View File
@@ -430,7 +430,7 @@ The B<-ciphers> option was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-engine.pod.in
+1 -1
View File
@@ -116,7 +116,7 @@ L<config(5)>
=head1 COPYRIGHT
Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-errstr.pod.in
+1 -1
View File
@@ -44,7 +44,7 @@ to produce the error message:
=head1 COPYRIGHT
Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-fipsinstall.pod.in
+7 -3
View File
@@ -18,6 +18,7 @@ B<openssl fipsinstall>
[B<-mac_name> I<macname>]
[B<-macopt> I<nm>:I<v>]
[B<-noout>]
[B<-quiet>]
[B<-corrupt_desc> I<selftest_description>]
[B<-corrupt_type> I<selftest_type>]
@@ -114,9 +115,12 @@ C<openssl list -digest-commands>.
Disable logging of the self tests.
=item B<-corrupt_desc> I<selftest_description>
=item B<-quiet>
=item B<-corrupt_type> I<selftest_type>
Do not output pass/fail messages. Implies B<-noout>.
=item B<-corrupt_desc> I<selftest_description>,
B<-corrupt_type> I<selftest_type>
The corrupt options can be used to test failure of one or more self test(s) by
name.
@@ -162,7 +166,7 @@ L<EVP_MAC(3)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-gendsa.pod.in
+1 -1
View File
@@ -101,7 +101,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-genpkey.pod.in
+35 -4
View File
@@ -194,11 +194,15 @@ The number of bits in the generated prime. If not specified 2048 is used.
=item B<dsa_paramgen_q_bits>:I<numbits>
=item B<qbits>:I<numbits>
The number of bits in the q parameter. Must be one of 160, 224 or 256. If not
specified 224 is used.
=item B<dsa_paramgen_md>:I<digest>
=item B<digest>:I<digest>
The digest to use during parameter generation. Must be one of B<sha1>, B<sha224>
or B<sha256>. If set, then the number of bits in B<q> will match the output size
of the specified digest and the B<dsa_paramgen_q_bits> parameter will be
@@ -206,6 +210,31 @@ ignored. If not set, then a digest will be used that gives an output matching
the number of bits in B<q>, i.e. B<sha1> if q length is 160, B<sha224> if it 224
or B<sha256> if it is 256.
=item B<properties>:I<query>
The I<digest> property I<query> string to use when fetching a digest from a provider.
=item B<type>:I<type>
The type of generation to use. Set this to 1 to use legacy FIPS186-2 parameter
generation. The default of 0 uses FIPS186-4 parameter generation.
=item B<gindex>:I<index>
The index to use for canonical generation and verification of the generator g.
Set this to a positive value ranging from 0..255 to use this mode. Larger values
will only use the bottom byte.
This I<index> must then be reused during key validation to verify the value of g.
If this value is not set then g is not verifiable. The default value is -1.
=item B<hexseed>:I<seed>
The seed I<seed> data to use instead of generating a random seed internally.
This should be used for testing purposes only. This will either produced fixed
values for the generated parameters OR it will fail if the seed did not
generate valid primes.
=back
=head2 DH Parameter Generation Options
@@ -269,10 +298,12 @@ Generate a 2048 bit RSA key using 3 as the public exponent:
openssl genpkey -algorithm RSA -out key.pem \
-pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3
Generate 2048 bit DSA parameters:
Generate 2048 bit DSA parameters that can be validated: The output values for
gindex and seed are required for key validation purposes and are not saved to
the output pem file).
openssl genpkey -genparam -algorithm DSA -out dsap.pem \
-pkeyopt dsa_paramgen_bits:2048
openssl genpkey -genparam -algorithm DSA -out dsap.pem -pkeyopt pbits:2048 \
-pkeyopt qbits:224 -pkeyopt digest:SHA256 -pkeyopt gindex:1 -text
Generate DSA key from parameters:
@@ -330,7 +361,7 @@ The ability to generate X448, ED25519 and ED448 keys was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-genrsa.pod.in
+1 -1
View File
@@ -121,7 +121,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-info.pod.in
+1 -1
View File
@@ -81,7 +81,7 @@ This command was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-kdf.pod.in
+1 -1
View File
@@ -165,7 +165,7 @@ Added in OpenSSL 3.0
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-list.pod.in
+1 -1
View File
@@ -137,7 +137,7 @@ In both cases, C<bar> is the name of the provider.
=head1 COPYRIGHT
Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-mac.pod.in
+1 -1
View File
@@ -156,7 +156,7 @@ L<EVP_MAC-Poly1305(7)>
=head1 COPYRIGHT
Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-nseq.pod.in
+1 -1
View File
@@ -66,7 +66,7 @@ Create a Netscape certificate sequence
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-ocsp.pod.in
+1 -1
View File
@@ -478,7 +478,7 @@ The -no_alt_chains option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-passwd.pod.in
+1 -1
View File
@@ -121,7 +121,7 @@ When the B<-table> option is used, reverse the order of cleartext and hash.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-pkcs12.pod.in
+1 -1
View File
@@ -367,7 +367,7 @@ L<ossl_store-file(7)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-pkcs7.pod.in
+1 -1
View File
@@ -99,7 +99,7 @@ L<openssl-crl2pkcs7(1)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-pkcs8.pod.in
+1 -1
View File
@@ -275,7 +275,7 @@ The B<-iter> option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-pkey.pod.in
+1 -1
View File
@@ -193,7 +193,7 @@ L<openssl-gendsa(1)>
=head1 COPYRIGHT
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-pkeyparam.pod.in
+1 -1
View File
@@ -87,7 +87,7 @@ L<openssl-gendsa(1)>
=head1 COPYRIGHT
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-pkeyutl.pod.in
+1 -1
View File
@@ -405,7 +405,7 @@ L<EVP_PKEY_CTX_set_tls1_prf_md(3)>,
=head1 COPYRIGHT
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-prime.pod.in
+1 -1
View File
@@ -60,7 +60,7 @@ This parameter is ignored.
=head1 COPYRIGHT
Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-provider.pod.in
+1 -1
View File
@@ -53,7 +53,7 @@ L<config(5)>
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-rand.pod.in
+1 -1
View File
@@ -67,7 +67,7 @@ L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-rehash.pod.in
+1 -1
View File
@@ -147,7 +147,7 @@ L<openssl-x509(1)>
=head1 COPYRIGHT
Copyright 2015-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-req.pod.in
+1 -1
View File
@@ -693,7 +693,7 @@ The B<-section> option was added in OpenSSL 3.0.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-rsa.pod.in
+1 -1
View File
@@ -190,7 +190,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-rsautl.pod.in
+1 -1
View File
@@ -239,7 +239,7 @@ This command was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-s_client.pod.in
+50 -39
View File
@@ -30,22 +30,21 @@ B<openssl> B<s_client>
[B<-verifyCAstore> I<uri>]
[B<-cert> I<filename>]
[B<-certform> B<DER>|B<PEM>]
[B<-cert_chain> I<filename>]
[B<-build_chain>]
[B<-CRL> I<filename>]
[B<-CRLform> B<DER>|B<PEM>]
[B<-crl_download>]
[B<-key> I<filename>]
[B<-keyform> B<DER>|B<PEM>]
[B<-cert_chain> I<filename>]
[B<-build_chain>]
[B<-keyform> B<DER>|B<PEM>|B<ENGINE>]
[B<-pass> I<arg>]
[B<-chainCApath> I<directory>]
[B<-chainCAfile> I<filename>]
[B<-chainCApath> I<directory>]
[B<-chainCAstore> I<uri>]
[B<-requestCAfile> I<filename>]
[B<-dane_tlsa_domain> I<domain>]
[B<-dane_tlsa_rrdata> I<rrdata>]
[B<-dane_ee_no_namechecks>]
[B<-build_chain>]
[B<-reconnect>]
[B<-showcerts>]
[B<-prexit>]
@@ -236,12 +235,25 @@ ClientHello message. Cannot be used in conjunction with the B<-servername> or
=item B<-cert> I<certname>
The certificate to use, if one is requested by the server. The default is
not to use a certificate.
The client certificate to use, if one is requested by the server.
The default is not to use a certificate.
=item B<-certform> I<format>
The chain for the client certificate may be specified using B<-cert_chain>.
The certificate format to use: DER or PEM. PEM is the default.
=item B<-certform> B<DER>|B<PEM>
The client certificate file format to use; the default is B<PEM>.
see L<openssl(1)/Format Options>.
=item B<-cert_chain>
A file containing untrusted certificates to use when attempting to build the
certificate chain related to the certificate specified via the B<-cert> option.
=item B<-build_chain>
Specify whether the application should build the client certificate chain to be
provided to the server.
=item B<-CRL> I<filename>
@@ -249,7 +261,7 @@ CRL file to use to check the server's certificate.
=item B<-CRLform> B<DER>|B<PEM>
The CRL format; the default is B<PEM>.
The CRL file format; the default is B<PEM>.
See L<openssl(1)/Format Options> for details.
=item B<-crl_download>
@@ -258,25 +270,14 @@ Download CRL from distribution points in the certificate.
=item B<-key> I<keyfile>
The private key to use. If not specified then the certificate file will
be used.
The client private key file to use.
If not specified then the certificate file will be used to read also the key.
=item B<-keyform> I<format>
=item B<-keyform> B<DER>|B<PEM>|B<ENGINE>
The key format; the default is B<PEM>.
See L<openssl(1)/Format Options> for details.
=item B<-cert_chain>
A file containing trusted certificates to use when attempting to build the
client/server certificate chain related to the certificate specified via the
B<-cert> option.
=item B<-build_chain>
Specify whether the application should build the certificate chain to be
provided to the server.
=item B<-pass> I<arg>
the private key password source. For more information about the format of I<arg>
@@ -301,32 +302,42 @@ Limit verify output to only errors.
=item B<-verifyCAfile> I<filename>
CA file for verifying the server's certificate, in PEM format.
A file in PEM format containing trusted certificates to use
for verifying the server's certificate.
=item B<-verifyCApath> I<dir>
Use the specified directory as a certificate store path to verify
the server's CA certificate.
A directory containing trusted certificates to use
for verifying the server's certificate.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
=item B<-verifyCAstore> I<uri>
Use the specified URI as a store URI to verify the server's certificate.
=item B<-chainCApath> I<directory>
The directory to use for building the chain provided to the server. This
directory must be in "hash format", see L<openssl-verify(1)> for more
information.
The URI of a store containing trusted certificates to use
for verifying the server's certificate.
=item B<-chainCAfile> I<file>
A file containing trusted certificates to use when attempting to build the
client certificate chain.
A file in PEM format containing trusted certificates to use
when attempting to build the client certificate chain.
=item B<-chainCApath> I<directory>
A directory containing trusted certificates to use
for building the client certificate chain provided to the server.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
=item B<-chainCAstore> I<uri>
The URI to use when attempting to build the client certificate chain.
The URI of a store containing trusted certificates to use
when attempting to build the client certificate chain.
The URI may indicate a single certificate, as well as a collection of them.
With URIs in the C<file:> scheme, this acts as B<-chainCAfile> or
B<-chainCApath>, depending on if the URI indicates a directory or a
single file.
See L<ossl_store-file(7)> for more information on the C<file:> scheme.
=item B<-requestCAfile> I<file>
@@ -885,7 +896,7 @@ The B<-name> option was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-s_server.pod.in
+77 -42
View File
@@ -19,16 +19,20 @@ B<openssl> B<s_server>
[B<-verify> I<int>]
[B<-Verify> I<int>]
[B<-cert> I<infile>]
[B<-naccept> I<+int>]
[B<-serverinfo> I<val>]
[B<-cert2> I<infile>]
[B<-certform> B<DER>|B<PEM>]
[B<-cert_chain> I<infile>]
[B<-build_chain>]
[B<-serverinfo> I<val>]
[B<-key> I<infile>]
[B<-keyform> B<DER>|B<PEM>]
[B<-key2> I<infile>]
[B<-keyform> B<DER>|B<PEM>|B<ENGINE>]
[B<-pass> I<val>]
[B<-dcert> I<infile>]
[B<-dcertform> B<DER>|B<PEM>]
[B<-dcert_chain> I<infile>]
[B<-dkey> I<infile>]
[B<-dkeyform> B<DER>|B<PEM>]
[B<-dkeyform> B<DER>|B<PEM>|B<ENGINE>]
[B<-dpass> I<val>]
[B<-nbio_test>]
[B<-crlf>]
@@ -44,29 +48,24 @@ B<openssl> B<s_server>
[B<-http_server_binmode>]
[B<-servername>]
[B<-servername_fatal>]
[B<-cert2> I<infile>]
[B<-key2> I<infile>]
[B<-tlsextdebug>]
[B<-HTTP>]
[B<-id_prefix> I<val>]
[B<-keymatexport> I<val>]
[B<-keymatexportlen> I<+int>]
[B<-CRLform> B<DER>|B<PEM>]
[B<-CRL> I<infile>]
[B<-CRLform> B<DER>|B<PEM>]
[B<-crl_download>]
[B<-cert_chain> I<infile>]
[B<-dcert_chain> I<infile>]
[B<-chainCAfile> I<infile>]
[B<-chainCApath> I<dir>]
[B<-verifyCApath> I<dir>]
[B<-chainCAstore> I<uri>]
[B<-verifyCAfile> I<infile>]
[B<-verifyCApath> I<dir>]
[B<-verifyCAstore> I<uri>]
[B<-no_cache>]
[B<-ext_cache>]
[B<-verify_return_error>]
[B<-verify_quiet>]
[B<-build_chain>]
[B<-chainCAfile> I<infile>]
[B<-verifyCAfile> I<infile>]
[B<-ign_eof>]
[B<-no_ign_eof>]
[B<-status>]
@@ -84,6 +83,7 @@ B<openssl> B<s_server>
[B<-max_send_frag> I<+int>]
[B<-split_send_frag> I<+int>]
[B<-max_pipelines> I<+int>]
[B<-naccept> I<+int>]
[B<-read_buf> I<+int>]
[B<-bugs>]
[B<-no_comp>]
@@ -219,22 +219,21 @@ certificate and some require a certificate with a certain public key type:
for example the DSS cipher suites require a certificate containing a DSS
(DSA) key. If not specified then the filename F<server.pem> will be used.
=item B<-certform> B<DER>|B<PEM>
The server certificate file format; the default is B<PEM>.
See L<openssl(1)/Format Options> for details.
=item B<-cert_chain>
A file containing trusted certificates to use when attempting to build the
client/server certificate chain related to the certificate specified via the
B<-cert> option.
A file containing untrusted certificates to use when attempting to build the
certificate chain related to the certificate specified via the B<-cert> option.
=item B<-build_chain>
Specify whether the application should build the certificate chain to be
Specify whether the application should build the server certificate chain to be
provided to the client.
=item B<-naccept> I<+int>
The server will exit after receiving the specified number of connections,
default unlimited.
=item B<-serverinfo> I<val>
A file containing one or more blocks of PEM data. Each PEM block
@@ -243,17 +242,12 @@ followed by "length" bytes of extension data). If the client sends
an empty TLS ClientHello extension matching the type, the corresponding
ServerHello extension will be returned.
=item B<-certform> B<DER>|B<PEM>, B<-CRLForm> B<DER>|B<PEM>
The certificate and CRL format; the default is PEM.
See L<openssl(1)/Format Options> for details.
=item B<-key> I<infile>
The private key to use. If not specified then the certificate file will
be used.
=item B<-keyform> B<DER>|B<PEM>
=item B<-keyform> B<DER>|B<PEM>|B<ENGINE>
The key format; the default is B<PEM>.
See L<openssl(1)/Format Options> for details.
@@ -277,14 +271,19 @@ by using an appropriate certificate.
=item B<-dcert_chain>
A file containing trusted certificates to use when attempting to build the
A file containing untrusted certificates to use when attempting to build the
server certificate chain when a certificate specified via the B<-dcert> option
is in use.
=item B<-dcertform> B<DER>|B<PEM>, B<-dkeyform> B<DER>|B<PEM>
=item B<-dcertform> B<DER>|B<PEM>
The format of the certificate and private key; the default is B<PEM>
see L<openssl(1)/Format Options>.
The format of the additional certificate file; the default is B<PEM>.
See L<openssl(1)/Format Options>.
=item B<-dkeyform> B<DER>|B<PEM>|B<ENGINE>
The format of the additional private key; the default is B<PEM>.
See L<openssl(1)/Format Options>.
=item B<-dpass> I<val>
@@ -316,22 +315,53 @@ File to send output of B<-msg> or B<-trace> to, default standard output.
Prints the SSL session states.
=item B<-chainCApath> I<dir>
=item B<-CRL> I<infile>
The directory to use for building the chain provided to the client. This
directory must be in "hash format", see L<openssl-verify(1)> for more
information.
The CRL file to use.
=item B<-CRLform> B<DER>|B<PEM>
The CRL file format; the default is B<PEM>.
See L<openssl(1)/Format Options> for details.
=item B<-crl_download>
Download CRLs from distribution points given in CDP extensions of certificates
=item B<-verifyCAfile> I<filename>
A file in PEM format CA containing trusted certificates to use
for verifying client certificates.
=item B<-verifyCApath> I<dir>
A directory containing trusted certificates to use
for verifying client certificates.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
=item B<-verifyCAstore> I<uri>
The URI of a store containing trusted certificates to use
for verifying client certificates.
=item B<-chainCAfile> I<file>
A file containing trusted certificates to use when attempting to build the
server certificate chain.
A file in PEM format containing trusted certificates to use
when attempting to build the server certificate chain.
=item B<-chainCApath> I<dir>
A directory containing trusted certificates to use
for building the server certificate chain provided to the client.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
=item B<-chainCAstore> I<uri>
The URI to a store to use for building the chain provided to the client.
The URI may indicate a single certificate, as well as a collection of
them.
The URI of a store containing trusted certificates to use
for building the server certificate chain provided to the client.
The URI may indicate a single certificate, as well as a collection of them.
With URIs in the C<file:> scheme, this acts as B<-chainCAfile> or
B<-chainCApath>, depending on if the URI indicates a directory or a
single file.
@@ -462,6 +492,11 @@ an effect if an engine has been loaded that supports pipelining (e.g. the dasync
engine) and a suitable cipher suite has been negotiated. The default value is 1.
See L<SSL_CTX_set_max_pipelines(3)> for further information.
=item B<-naccept> I<+int>
The server will exit after receiving the specified number of connections,
default unlimited.
=item B<-read_buf> I<+int>
The default read buffer size to be used for connections. This will only have an
@@ -782,7 +817,7 @@ The
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-s_time.pod.in
+1 -1
View File
@@ -190,7 +190,7 @@ L<ossl_store-file(7)>
=head1 COPYRIGHT
Copyright 2004-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-sess_id.pod.in
+1 -1
View File
@@ -152,7 +152,7 @@ L<openssl-s_server(1)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-smime.pod.in
+1 -1
View File
@@ -481,7 +481,7 @@ The -no_alt_chains option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-speed.pod.in
+1 -1
View File
@@ -115,7 +115,7 @@ pre-compiled grand selection is tested.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-spkac.pod.in
+1 -1
View File
@@ -150,7 +150,7 @@ L<openssl-ca(1)>
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-srp.pod.in
+1 -1
View File
@@ -83,7 +83,7 @@ see L<openssl(1)/Pass Phrase Options>.
=head1 COPYRIGHT
Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-storeutl.pod.in
+1 -1
View File
@@ -125,7 +125,7 @@ This command was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-ts.pod.in
+2 -2
View File
@@ -37,7 +37,6 @@ B<-reply>
[B<-chain> I<certs_file.pem>]
[B<-tspolicy> I<object_id>]
[B<-in> I<response.tsr>]
[B<-untrusted> I<file>]
[B<-token_in>]
[B<-out> I<response.tsr>]
[B<-token_out>]
@@ -52,6 +51,7 @@ B<-verify>
[B<-queryfile> I<request.tsq>]
[B<-in> I<response.tsr>]
[B<-token_in>]
[B<-untrusted> I<file>]
[B<-CAfile> I<file>]
[B<-CApath> I<dir>]
[B<-CAstore> I<uri>]
@@ -639,7 +639,7 @@ L<ossl_store-file(7)>
=head1 COPYRIGHT
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-verify.pod.in
+9 -8
View File
@@ -38,10 +38,6 @@ This command verifies certificate chains.
Print out a usage message.
=item B<-CAfile> I<file>, B<-no-CAfile>, B<-CApath> I<dir>, B<-no-CApath>
See L<openssl(1)/Trusted Certificate Options> for more information.
=item B<-CRLfile> I<file>
The I<file> should contain one or more CRLs in PEM format.
@@ -50,7 +46,7 @@ I<file>s.
=item B<-crl_download>
Attempt to download CRL information for this certificate.
Attempt to download CRL information for certificates via their CDP entries.
=item B<-show_chain>
@@ -64,11 +60,16 @@ Print extra information about the operations being performed.
=item B<-trusted> I<file>
A file of trusted certificates.
A file of trusted certificates in PEM format.
This option can be specified more than once to load certificates from multiple
I<file>s.
=item B<-untrusted> I<file>
A file of untrusted certificates.
A file of untrusted certificates in PEM format to use for chain building.
This option can be specified more than once to load certificates from multiple
I<file>s.
=item B<-vfyopt> I<nm>:I<v>
@@ -155,7 +156,7 @@ The B<-show_chain> option was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-version.pod.in
+1 -1
View File
@@ -86,7 +86,7 @@ in a bug report.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl-x509.pod.in
+1 -1
View File
@@ -823,7 +823,7 @@ form must have their links rebuilt using L<openssl-rehash(1)> or similar.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl.pod
+3 -3
View File
@@ -977,8 +977,8 @@ effect.
Parse I<file> as a set of one or more certificates in PEM format.
All certificates must be self-signed, unless the
B<-partial_chain> option is specified.
This option implies the B<-no-CAfile> and B<-no-CApath> options and it
cannot be used with either the B<-CAfile> or B<-CApath> options, so
This option implies the B<-no-CAfile>, B<-no-CApath>, and B<-no-CAstore> options
and it cannot be used with the B<-CAfile>, B<-CApath> or B<-CAstore> options, so
only certificates in the file are trust anchors.
This option may be used multiple times.
@@ -1405,7 +1405,7 @@ is silently ignored.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/tsget.pod
+1 -1
View File
@@ -192,7 +192,7 @@ L<https://www.rfc-editor.org/rfc/rfc3161.html>
=head1 COPYRIGHT
Copyright 2006-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ASN1_TIME_set.pod
+1 -1
View File
@@ -264,7 +264,7 @@ The ASN1_TIME_compare() function was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ASN1_TYPE_get.pod
+1 -1
View File
@@ -91,7 +91,7 @@ NULL on failure.
=head1 COPYRIGHT
Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BF_encrypt.pod
+1 -1
View File
@@ -121,7 +121,7 @@ All of these functions were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_f_buffer.pod
+1 -1
View File
@@ -92,7 +92,7 @@ L<BIO_ctrl(3)>.
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_get_ex_new_index.pod
+1 -1
View File
@@ -87,7 +87,7 @@ L<CRYPTO_get_ex_new_index(3)>.
=head1 COPYRIGHT
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_set_callback.pod
+1 -1
View File
@@ -230,7 +230,7 @@ in crypto/bio/bio_cb.c
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/CONF_modules_free.pod
+1 -1
View File
@@ -48,7 +48,7 @@ For more information see L<OPENSSL_init_crypto(3)>.
=head1 COPYRIGHT
Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/CRYPTO_get_ex_new_index.pod
+1 -1
View File
@@ -168,7 +168,7 @@ CRYPTO_alloc_ex_data() was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/CTLOG_STORE_new.pod
+1 -1
View File
@@ -79,7 +79,7 @@ added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/CTLOG_new.pod
+1 -1
View File
@@ -80,7 +80,7 @@ were added in OpenSSL 3.0. All other functions were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/CT_POLICY_EVAL_CTX_new.pod
+1 -1
View File
@@ -130,7 +130,7 @@ functions were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DEFINE_STACK_OF.pod
+18 -14
View File
@@ -64,27 +64,31 @@ functions that wrap around the utility B<OPENSSL_sk_> API.
In the description here, B<I<TYPE>> is used
as a placeholder for any of the OpenSSL datatypes, such as B<X509>.
STACK_OF() returns the name for a stack of the specified B<I<TYPE>>.
DEFINE_STACK_OF() creates set of functions for a stack of B<I<TYPE>>. This
will mean that type B<I<TYPE>> is stored in each stack, the type is referenced by
The STACK_OF() macro returns the name for a stack of the specified B<I<TYPE>>.
This is an opaque pointer to a structure declaration.
This can be used in every header file that references the stack.
There are several B<DEFINE...> macros that create static inline functions
for all of the functions described on this page.
This should normally be used in one source file, and the stack manipulation
is wrapped with application-specific functions.
DEFINE_STACK_OF() creates set of functions for a stack of B<I<TYPE>> elements.
The type is referenced by
B<STACK_OF>(B<I<TYPE>>) and each function name begins with B<sk_I<TYPE>_>.
For example:
TYPE *sk_TYPE_value(STACK_OF(TYPE) *sk, int idx);
DEFINE_STACK_OF_CONST() is identical to DEFINE_STACK_OF() except
each element is constant. For example:
each element is constant.
/* DEFINE_STACK_OF(TYPE) */
TYPE *sk_TYPE_value(STACK_OF(TYPE) *sk, int idx);
/* DEFINE_STACK_OF_CONST(TYPE) */
const TYPE *sk_TYPE_value(STACK_OF(TYPE) *sk, int idx);
DEFINE_SPECIAL_STACK_OF() defines a stack of B<I<TYPE>> but
each function uses B<FUNCNAME> in the function name. For example:
DEFINE_SPECIAL_STACK_OF() and DEFINE_SPECIAL_STACK_OF_CONST() are similar
except B<FUNCNAME> is used in the function names:
/* DEFINE_SPECIAL_STACK_OF(TYPE, FUNCNAME) */
TYPE *sk_FUNCNAME_value(STACK_OF(TYPE) *sk, int idx);
DEFINE_SPECIAL_STACK_OF_CONST() is similar except that each element is
constant:
/* DEFINE_SPECIAL_STACK_OF(TYPE, FUNCNAME) */
const TYPE *sk_FUNCNAME_value(STACK_OF(TYPE) *sk, int idx);
B<sk_I<TYPE>_num>() returns the number of elements in I<sk> or -1 if I<sk> is
doc/man3/DH_generate_key.pod
+1 -1
View File
@@ -57,7 +57,7 @@ Both of these functions were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_generate_parameters.pod
+1 -1
View File
@@ -160,7 +160,7 @@ DH_generate_parameters_ex() instead.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_get0_pqg.pod
+11 -11
View File
@@ -27,13 +27,14 @@ DH_get_length, DH_set_length - Routines for getting and setting data in a DH obj
int DH_test_flags(const DH *dh, int flags);
void DH_set_flags(DH *dh, int flags);
long DH_get_length(const DH *dh);
int DH_set_length(DH *dh, long length);
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
B<OPENSSL_API_COMPAT> with a suitable version value, see
L<openssl_user_macros(7)>:
ENGINE *DH_get0_engine(DH *d);
long DH_get_length(const DH *dh);
int DH_set_length(DH *dh, long length);
=head1 DESCRIPTION
@@ -56,11 +57,9 @@ and therefore the values that have been passed in should not be freed directly
after this function has been called. The I<q> parameter may be NULL.
DH_set0_pqg() also checks if the parameters associated with I<p> and I<g> and
optionally I<q> are associated with known safe prime groups. If it is a safe
prime group then the value of I<q> will be set to q = (p - 1) / 2 if I<q> is NULL.
For safe prime groups the optional length parameter I<length> is set to twice
the value of the maximum_target_security_strength(BN_num_bits(I<p>)) as listed in
SP800-56Ar3 Table(s) 25 & 26. If it is not a safe prime group then the optional
length parameter will be set if I<q> is not NULL to BN_num_bits(I<q>).
prime group then the value of I<q> will be set to q = (p - 1) / 2 if I<q> is
NULL. The optional length parameter will be set to BN_num_bits(I<q>) if I<q>
is not NULL.
To get the public and private key values use the DH_get0_key() function. A
pointer to the public key will be stored in I<*pub_key>, and a pointer to the
@@ -96,7 +95,9 @@ The DH_get_length() and DH_set_length() functions get and set the optional
length parameter associated with this DH object. If the length is nonzero then
it is used, otherwise it is ignored. The I<length> parameter indicates the
length of the secret exponent (private key) in bits. These functions are
deprecated.
deprecated. For safe prime groups the optional length parameter I<length> can be
set to a value greater or equal to 2 * maximum_target_security_strength(BN_num_bits(I<p>))
as listed in SP800-56Ar3 Table(s) 25 & 26.
=head1 NOTES
@@ -127,14 +128,13 @@ L<DH_set_method(3)>, L<DH_size(3)>, L<DH_meth_new(3)>
=head1 HISTORY
The DH_get0_engine(), DH_get_length() and DH_set_length() functions were
deprecated in OpenSSL 3.0.
The DH_get0_engine() function was deprecated in OpenSSL 3.0.
The functions described here were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_meth_new.pod
+1 -1
View File
@@ -166,7 +166,7 @@ The functions described here were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_new_by_nid.pod
+2 -8
View File
@@ -2,7 +2,7 @@
=head1 NAME
DH_new_by_nid, DH_get_nid - get or find DH named parameters
DH_new_by_nid, DH_get_nid - create or get DH named parameters
=head1 SYNOPSIS
@@ -13,7 +13,7 @@ Deprecated since OpenSSL 3.0, can be hidden entirely by defining
B<OPENSSL_API_COMPAT> with a suitable version value, see
L<openssl_user_macros(7)>:
int *DH_get_nid(DH *dh);
int DH_get_nid(const DH *dh);
=head1 DESCRIPTION
@@ -26,12 +26,6 @@ B<NID_modp_4096>, B<NID_modp_6144> or B<NID_modp_8192>.
DH_get_nid() determines if the parameters contained in B<dh> match
any named safe prime group. It returns the NID corresponding to the matching
parameters or B<NID_undef> if there is no match.
Internally it caches the nid, so that any subsequent calls can fetch the
cached value.
If a matching p and g are not found and the value of parameter q is not set,
then it is set to q = (p - 1) / 2.
If parameter q is already set then it must also match the expected q otherwise
no match will be found.
This function is deprecated.
=head1 RETURN VALUES
doc/man3/DH_set_method.pod
+1 -1
View File
@@ -89,7 +89,7 @@ All of these functions were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_size.pod
+1 -1
View File
@@ -58,7 +58,7 @@ The DH_bits() function was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DSA_dup_DH.pod
+1 -1
View File
@@ -43,7 +43,7 @@ This function was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DSA_size.pod
+1 -1
View File
@@ -53,7 +53,7 @@ All of these functions were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ECDSA_SIG_new.pod
+1 -1
View File
@@ -212,7 +212,7 @@ functions were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_POINT_new.pod
+47 -28
View File
@@ -40,14 +40,6 @@ EC_POINT_hex2point
EC_POINT *EC_POINT_dup(const EC_POINT *src, const EC_GROUP *group);
const EC_METHOD *EC_POINT_method_of(const EC_POINT *point);
int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point);
int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
EC_POINT *p,
const BIGNUM *x, const BIGNUM *y,
const BIGNUM *z, BN_CTX *ctx);
int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
const EC_POINT *p,
BIGNUM *x, BIGNUM *y, BIGNUM *z,
BN_CTX *ctx);
int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *p,
const BIGNUM *x, const BIGNUM *y,
BN_CTX *ctx);
@@ -56,6 +48,34 @@ EC_POINT_hex2point
int EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *p,
const BIGNUM *x, int y_bit,
BN_CTX *ctx);
size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *p,
point_conversion_form_t form,
unsigned char *buf, size_t len, BN_CTX *ctx);
size_t EC_POINT_point2buf(const EC_GROUP *group, const EC_POINT *point,
point_conversion_form_t form,
unsigned char **pbuf, BN_CTX *ctx);
int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *p,
const unsigned char *buf, size_t len, BN_CTX *ctx);
BIGNUM *EC_POINT_point2bn(const EC_GROUP *group, const EC_POINT *p,
point_conversion_form_t form, BIGNUM *bn,
BN_CTX *ctx);
EC_POINT *EC_POINT_bn2point(const EC_GROUP *group, const BIGNUM *bn,
EC_POINT *p, BN_CTX *ctx);
char *EC_POINT_point2hex(const EC_GROUP *group, const EC_POINT *p,
point_conversion_form_t form, BN_CTX *ctx);
EC_POINT *EC_POINT_hex2point(const EC_GROUP *group, const char *hex,
EC_POINT *p, BN_CTX *ctx);
Deprecated since OpenSSL 3.0:
int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
EC_POINT *p,
const BIGNUM *x, const BIGNUM *y,
const BIGNUM *z, BN_CTX *ctx);
int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
const EC_POINT *p,
BIGNUM *x, BIGNUM *y, BIGNUM *z,
BN_CTX *ctx);
int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *p,
const BIGNUM *x, const BIGNUM *y,
BN_CTX *ctx);
@@ -76,24 +96,6 @@ EC_POINT_hex2point
EC_POINT *p,
const BIGNUM *x, int y_bit,
BN_CTX *ctx);
size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *p,
point_conversion_form_t form,
unsigned char *buf, size_t len, BN_CTX *ctx);
size_t EC_POINT_point2buf(const EC_GROUP *group, const EC_POINT *point,
point_conversion_form_t form,
unsigned char **pbuf, BN_CTX *ctx);
int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *p,
const unsigned char *buf, size_t len, BN_CTX *ctx);
BIGNUM *EC_POINT_point2bn(const EC_GROUP *group, const EC_POINT *p,
point_conversion_form_t form, BIGNUM *bn,
BN_CTX *ctx);
EC_POINT *EC_POINT_bn2point(const EC_GROUP *group, const BIGNUM *bn,
EC_POINT *p, BN_CTX *ctx);
char *EC_POINT_point2hex(const EC_GROUP *group, const EC_POINT *p,
point_conversion_form_t form, BN_CTX *ctx);
EC_POINT *EC_POINT_hex2point(const EC_GROUP *group, const char *hex,
EC_POINT *p, BN_CTX *ctx);
=head1 DESCRIPTION
@@ -142,9 +144,13 @@ operations. A mapping exists between Jacobian projective co-ordinates and
affine co-ordinates. A Jacobian projective co-ordinate (x, y, z) can be written
as an affine co-ordinate as (x/(z^2), y/(z^3)). Conversion to Jacobian
projective from affine co-ordinates is simple. The co-ordinate (x, y) is mapped
to (x, y, 1). To set or get the projective co-ordinates use
to (x, y, 1). Although deprecated in OpenSSL 3.0 and should no longer be used,
to set or get the projective co-ordinates in older versions use
EC_POINT_set_Jprojective_coordinates_GFp() and
EC_POINT_get_Jprojective_coordinates_GFp() respectively.
Modern versions should instead use EC_POINT_set_affine_coordinates() and
EC_POINT_get_affine_coordinates(), performing the conversion manually using the
above maps in such rare circumstances.
Points can also be described in terms of their compressed co-ordinates. For a
point (x, y), for any given value for x such that the point is on the curve
@@ -241,9 +247,22 @@ L<crypto(7)>, L<EC_GROUP_new(3)>, L<EC_GROUP_copy(3)>,
L<EC_POINT_add(3)>, L<EC_KEY_new(3)>,
L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)>
=head1 HISTORY
EC_POINT_set_Jprojective_coordinates_GFp(),
EC_POINT_get_Jprojective_coordinates_GFp(),
EC_POINT_set_affine_coordinates_GFp(), EC_POINT_get_affine_coordinates_GFp(),
EC_POINT_set_compressed_coordinates_GFp(),
EC_POINT_set_affine_coordinates_GF2m(), EC_POINT_get_affine_coordinates_GF2m(),
EC_POINT_set_compressed_coordinates_GF2m() were deprecated in OpenSSL 3.0.
B<EC_POINT_set_affine_coordinates>, B<EC_POINT_get_affine_coordinates>,
and B<EC_POINT_set_compressed_coordinates> were
added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2013-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ERR_put_error.pod
+1 -1
View File
@@ -112,7 +112,7 @@ B<ERR_add_error_txt> and B<ERR_add_error_mem_bio> were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_DigestInit.pod
+1 -1
View File
@@ -647,7 +647,7 @@ and EVP_MD_CTX_get_params() functions were added in 3.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_DigestSignInit.pod
+1 -1
View File
@@ -188,7 +188,7 @@ EVP_DigestSignUpdate() was converted from a macro to a function in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_DigestVerifyInit.pod
+1 -1
View File
@@ -177,7 +177,7 @@ EVP_DigestVerifyUpdate() was converted from a macro to a function in OpenSSL
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_EncryptInit.pod
+1 -1
View File
@@ -837,7 +837,7 @@ were added in 3.0.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_MAC.pod
+1 -1
View File
@@ -384,7 +384,7 @@ These functions were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2018-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_CTX_ctrl.pod
+76 -15
View File
@@ -33,10 +33,16 @@ EVP_PKEY_CTX_get0_rsa_oaep_label,
EVP_PKEY_CTX_set_dsa_paramgen_bits,
EVP_PKEY_CTX_set_dsa_paramgen_q_bits,
EVP_PKEY_CTX_set_dsa_paramgen_md,
EVP_PKEY_CTX_set_dsa_paramgen_md_props,
EVP_PKEY_CTX_set_dsa_paramgen_gindex,
EVP_PKEY_CTX_set_dsa_paramgen_type,
EVP_PKEY_CTX_set_dsa_paramgen_seed,
EVP_PKEY_CTX_set_dh_paramgen_prime_len,
EVP_PKEY_CTX_set_dh_paramgen_subprime_len,
EVP_PKEY_CTX_set_dh_paramgen_generator,
EVP_PKEY_CTX_set_dh_paramgen_type,
EVP_PKEY_CTX_set_dh_paramgen_gindex,
EVP_PKEY_CTX_set_dh_paramgen_seed,
EVP_PKEY_CTX_set_dh_rfc5114,
EVP_PKEY_CTX_set_dhx_rfc5114,
EVP_PKEY_CTX_set_dh_pad,
@@ -121,6 +127,14 @@ EVP_PKEY_CTX_set1_id, EVP_PKEY_CTX_get1_id, EVP_PKEY_CTX_get1_id_len
int EVP_PKEY_CTX_set_dsa_paramgen_bits(EVP_PKEY_CTX *ctx, int nbits);
int EVP_PKEY_CTX_set_dsa_paramgen_q_bits(EVP_PKEY_CTX *ctx, int qbits);
int EVP_PKEY_CTX_set_dsa_paramgen_md(EVP_PKEY_CTX *ctx, const EVP_MD *md);
int EVP_PKEY_CTX_set_dsa_paramgen_md_props(EVP_PKEY_CTX *ctx,
const char *md_name,
const char *md_properties);
int EVP_PKEY_CTX_set_dsa_paramgen_type(EVP_PKEY_CTX *ctx, const char *name);
int EVP_PKEY_CTX_set_dsa_paramgen_gindex(EVP_PKEY_CTX *ctx, int gindex);
int EVP_PKEY_CTX_set_dsa_paramgen_seed(EVP_PKEY_CTX *ctx,
const unsigned char *seed,
size_t seedlen);
#include <openssl/dh.h>
@@ -132,6 +146,10 @@ EVP_PKEY_CTX_set1_id, EVP_PKEY_CTX_get1_id, EVP_PKEY_CTX_get1_id_len
int EVP_PKEY_CTX_set_dh_nid(EVP_PKEY_CTX *ctx, int nid);
int EVP_PKEY_CTX_set_dh_rfc5114(EVP_PKEY_CTX *ctx, int rfc5114);
int EVP_PKEY_CTX_set_dhx_rfc5114(EVP_PKEY_CTX *ctx, int rfc5114);
int EVP_PKEY_CTX_set_dh_paramgen_gindex(EVP_PKEY_CTX *ctx, int gindex);
int EVP_PKEY_CTX_set_dh_paramgen_seed(EVP_PKEY_CTX *ctx,
const unsigned char *seed,
size_t seedlen);
int EVP_PKEY_CTX_set_dh_kdf_type(EVP_PKEY_CTX *ctx, int kdf);
int EVP_PKEY_CTX_get_dh_kdf_type(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_set0_dh_kdf_oid(EVP_PKEY_CTX *ctx, ASN1_OBJECT *oid);
@@ -395,19 +413,42 @@ negotiated protocol version. Otherwise it should be left unset.
=head2 DSA parameters
The EVP_PKEY_CTX_set_dsa_paramgen_bits() macro sets the number of bits used
The EVP_PKEY_CTX_set_dsa_paramgen_bits() method sets the number of bits used
for DSA parameter generation to I<nbits>. If not specified, 2048 is used.
The EVP_PKEY_CTX_set_dsa_paramgen_q_bits() macro sets the number of bits in the
The EVP_PKEY_CTX_set_dsa_paramgen_q_bits() method sets the number of bits in the
subprime parameter I<q> for DSA parameter generation to I<qbits>. If not
specified, 224 is used. If a digest function is specified below, this parameter
is ignored and instead, the number of bits in I<q> matches the size of the
digest.
The EVP_PKEY_CTX_set_dsa_paramgen_md() macro sets the digest function used for
The EVP_PKEY_CTX_set_dsa_paramgen_md() method sets the digest function used for
DSA parameter generation to I<md>. If not specified, one of SHA-1, SHA-224, or
SHA-256 is selected to match the bit length of I<q> above.
The EVP_PKEY_CTX_set_dsa_paramgen_md_props() method sets the digest function
used for DSA parameter generation using I<md_name> and I<md_properties> to
retrieve the digest from a provider.
If not specified, I<md_name> will be set to one of SHA-1, SHA-224, or
SHA-256 depending on the bit length of I<q> above. I<md_properties> is a
property query string that has a default value of '' if not specified.
The EVP_PKEY_CTX_set_dsa_paramgen_gindex() method sets the I<gindex> used by
the generator G. The default value is -1 which uses unverifiable g, otherwise
a positive value uses verifiable g. This value must be saved if key validation
of g is required, since it is not part of a persisted key.
The EVP_PKEY_CTX_set_dsa_paramgen_seed() method sets the I<seed> to use for
generation rather than using a randomly generated value for the seed. This is
useful for testing purposes only and can fail if the seed does not produce
primes for both p & q on its first iteration. This value must be saved if
key validation of p, q, and verifiable g are required, since it is not part of
a persisted key.
The EVP_PKEY_CTX_set_dsa_paramgen_type() method sets the generation type to
use FIPS186-4 generation if I<name> is "fips186_4", or FIPS186-2 generation if
I<name> is "fips186_2". The default value is "fips186_4".
=head2 DH parameters
The EVP_PKEY_CTX_set_dh_paramgen_prime_len() macro sets the length of the DH
@@ -417,8 +458,7 @@ then 2048 is used. Only accepts lengths greater than or equal to 256.
The EVP_PKEY_CTX_set_dh_paramgen_subprime_len() macro sets the length of the DH
optional subprime parameter I<q> for DH parameter generation. The default is
256 if the prime is at least 2048 bits long or 160 otherwise. The DH
paramgen type must have been set to B<DH_PARAMGEN_TYPE_FIPS_186_2> or
B<DH_PARAMGEN_TYPE_FIPS_186_4>.
paramgen type must have been set to "fips186_4".
The EVP_PKEY_CTX_set_dh_paramgen_generator() macro sets DH generator to I<gen>
for DH parameter generation. If not specified 2 is used.
@@ -428,22 +468,39 @@ parameter generation. The supported parameters are:
=over 4
=item B<DH_PARAMGEN_TYPE_GENERATOR>
=item B<DH_PARAMGEN_TYPE_GROUP>
Uses a generator g (PKCS#3 format).
=item B<DH_PARAMGEN_TYPE_FIPS_186_2>
FIPS186-2 FFC parameter generator (X9.42 DH).
Use a named group. If only the safe prime parameter I<p> is set this can be
used to select a ffdhe safe prime group of the correct size.
=item B<DH_PARAMGEN_TYPE_FIPS_186_4>
FIPS186-4 FFC parameter generator.
=item B<DH_PARAMGEN_TYPE_FIPS_186_2>
FIPS186-2 FFC parameter generator (X9.42 DH).
=item B<DH_PARAMGEN_TYPE_GENERATOR>
Uses a safe prime generator g (PKCS#3 format).
=back
The default is B<DH_PARAMGEN_TYPE_GENERATOR>.
The EVP_PKEY_CTX_set_dh_paramgen_gindex() method sets the I<gindex> used by
the generator G. The default value is -1 which uses unverifiable g, otherwise
a positive value uses verifiable g. This value must be saved if key validation
of g is required, since it is not part of a persisted key.
The EVP_PKEY_CTX_set_dh_paramgen_seed() method sets the I<seed> to use for
generation rather than using a randomly generated value for the seed. This is
useful for testing purposes only and can fail if the seed does not produce
primes for both p & q on its first iteration. This value must be saved if
key validation of p, q, and verifiable g are required, since it is not part of
a persisted key.
The EVP_PKEY_CTX_set_dh_pad() function sets the DH padding mode.
If I<pad> is 1 the shared secret is padded with zeros up to the size of the DH
prime I<p>.
@@ -633,12 +690,16 @@ EVP_PKEY_CTX_get_rsa_padding(), EVP_PKEY_CTX_get_rsa_mgf1_md(),
EVP_PKEY_CTX_set_rsa_mgf1_md(), EVP_PKEY_CTX_set_rsa_oaep_md(),
EVP_PKEY_CTX_get_rsa_oaep_md(), EVP_PKEY_CTX_set0_rsa_oaep_label(),
EVP_PKEY_CTX_get0_rsa_oaep_label(), EVP_PKEY_CTX_set_rsa_pss_saltlen(),
EVP_PKEY_CTX_get_rsa_pss_saltlen(), were macros in OpenSSL 1.1.1 and below.
EVP_PKEY_CTX_get_rsa_pss_saltlen(), EVP_PKEY_CTX_set_dsa_paramgen_bits(),
EVP_PKEY_CTX_set_dsa_paramgen_q_bits() and EVP_PKEY_CTX_set_dsa_paramgen_md()
were macros in OpenSSL 1.1.1 and below.
From OpenSSL 3.0 they are functions.
EVP_PKEY_CTX_get_rsa_oaep_md_name(), EVP_PKEY_CTX_get_rsa_mgf1_md_name(),
EVP_PKEY_CTX_set_rsa_mgf1_md_name() and EVP_PKEY_CTX_set_rsa_oaep_md_name() were
added in OpenSSL 3.0.
EVP_PKEY_CTX_set_rsa_mgf1_md_name(), EVP_PKEY_CTX_set_rsa_oaep_md_name(),
EVP_PKEY_CTX_set_dsa_paramgen_md_props(), EVP_PKEY_CTX_set_dsa_paramgen_gindex(),
EVP_PKEY_CTX_set_dsa_paramgen_type() and EVP_PKEY_CTX_set_dsa_paramgen_seed()
were added in OpenSSL 3.0.
The EVP_PKEY_CTX_set1_id(), EVP_PKEY_CTX_get1_id() and
EVP_PKEY_CTX_get1_id_len() macros were added in 1.1.1, other functions were
@@ -646,7 +707,7 @@ added in OpenSSL 1.0.0.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_CTX_new.pod
+28 -6
View File
@@ -32,7 +32,8 @@ The EVP_PKEY_CTX_new_from_name() function allocates a public key algorithm
context using the library context I<libctx> (see L<OPENSSL_CTX(3)>), the
key type specified by I<name> and the property query I<propquery>. None
of the arguments are duplicated, so they must remain unchanged for the
lifetime of the returned B<EVP_PKEY_CTX> or of any of its duplicates.
lifetime of the returned B<EVP_PKEY_CTX> or of any of its duplicates. Read
further about the possible names in L</NOTES> below.
The EVP_PKEY_CTX_new_from_pkey() function allocates a public key algorithm
context using the library context I<libctx> (see L<OPENSSL_CTX(3)>) and the
@@ -52,16 +53,14 @@ If I<ctx> is NULL, nothing is done.
=head1 NOTES
=over 4
=item 1.
=head2 On B<EVP_PKEY_CTX>
The B<EVP_PKEY_CTX> structure is an opaque public key algorithm context used
by the OpenSSL high level public key API. Contexts B<MUST NOT> be shared between
threads: that is it is not permissible to use the same context simultaneously
in two threads.
=item 2.
=head2 On Key Types
We mention "key type" in this manual, which is the same
as "algorithm" in most cases, allowing either term to be used
@@ -69,6 +68,29 @@ interchangeably. There are algorithms where the I<key type> and the
I<algorithm> of the operations that use the keys are not the same,
such as EC keys being used for ECDSA and ECDH operations.
Key types are given in two different manners:
=over 4
=item Legacy NID or EVP_PKEY type
This is the I<id> used with EVP_PKEY_CTX_new_id().
These are B<EVP_PKEY_RSA>, B<EVP_PKEY_RSA_PSS>, B<EVP_PKEY_DSA>,
B<EVP_PKEY_DH>, B<EVP_PKEY_EC>, B<EVP_PKEY_SM2>, B<EVP_PKEY_X25519>,
B<EVP_PKEY_X448>, and are used by legacy methods.
=item Name strings
This is the I<name> used with EVP_PKEY_CTX_new_from_name().
These are names like "RSA", "DSA", and what's available depends on what
providers are currently accessible.
The OpenSSL providers offer a set of key types available this way, please
see L<OSSL_PROVIDER-FIPS(7)> and L<OSSL_PROVIDER-default(7)> and related
documentation for more information.
=back
=head1 RETURN VALUES
@@ -92,7 +114,7 @@ added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_CTX_set_scrypt_N.pod
+1 -1
View File
@@ -79,7 +79,7 @@ L<EVP_PKEY_derive(3)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_derive.pod
+1 -1
View File
@@ -99,7 +99,7 @@ These functions were added in OpenSSL 1.0.0.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy

Some files were not shown because too many files have changed in this diff Show More