Update OpenSSL-1.1.1-pre8-dev

CHANGES

@@ -8,6 +8,10 @@
  release branch.
 
  Changes between 1.1.0h and 1.1.1 [xx XXX xxxx]
+  *) Add blinding to an ECDSA signature to protect against side channel attacks
+     discovered by Keegan Ryan (NCC Group).
+     [Matt Caswell]
+
   *) Enforce checking in the pkeyutl command line app to ensure that the input
      length does not exceed the maximum supported digest length when performing
      a sign, verify or verifyrecover operation.

Configurations/10-main.conf

@@ -211,8 +211,11 @@ my %targets = (
         ex_libs          => add("-lsocket -lnsl -ldl"),
         dso_scheme       => "dlfcn",
         thread_scheme    => "pthreads",
-        shared_target    => "solaris-shared",
+        shared_target    => "self",
         shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
+        shared_ldflag    => "-Wl,-Bsymbolic",
+        shared_defflag   => "-Wl,-M,",
+        shared_sonameflag=> "-Wl,-h,",
     },
 #### Solaris x86 with GNU C setups
     "solaris-x86-gcc" => {
@@ -229,7 +232,7 @@ my %targets = (
         ex_libs          => add(threads("-pthread")),
         bn_ops           => "BN_LLONG",
         shared_cflag     => "-fPIC",
-        shared_ldflag    => "-shared -static-libgcc",
+        shared_ldflag    => add("-shared -static-libgcc"),
     },
     "solaris64-x86_64-gcc" => {
         # -shared -static-libgcc might appear controversial, but modules
@@ -251,7 +254,7 @@ my %targets = (
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         perlasm_scheme   => "elf",
         shared_cflag     => "-fPIC",
-        shared_ldflag    => "-shared -static-libgcc",
+        shared_ldflag    => add("-shared -static-libgcc"),
         multilib         => "/64",
     },
 
@@ -282,7 +285,7 @@ my %targets = (
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         perlasm_scheme   => "elf",
         shared_cflag     => "-KPIC",
-        shared_ldflag    => "-G -dy -z text",
+        shared_ldflag    => add("-G -dy -z text"),
         multilib         => "/64",
     },
 
@@ -298,7 +301,7 @@ my %targets = (
         ex_libs          => add(threads("-pthread")),
         bn_ops           => "BN_LLONG RC4_CHAR",
         shared_cflag     => "-fPIC",
-        shared_ldflag    => "-shared",
+        shared_ldflag    => add("-shared"),
     },
     "solaris-sparcv8-gcc" => {
         inherit_from     => [ "solaris-sparcv7-gcc", asm("sparcv8_asm") ],
@@ -333,7 +336,7 @@ my %targets = (
         ex_libs          => add(threads("-lpthread")),
         bn_ops           => "BN_LLONG RC4_CHAR",
         shared_cflag     => "-KPIC",
-        shared_ldflag    => "-G -dy -z text",
+        shared_ldflag    => add("-G -dy -z text"),
     },
 ####
     "solaris-sparcv8-cc" => {
@@ -1114,85 +1117,74 @@ my %targets = (
     # variable, then you should know that in OpenSSL case it's considered
     # only in ./config. Once configured, build procedure remains "deaf" to
     # current value of $OBJECT_MODE.
+    "aix-common" => {
+        inherit_from     => [ "BASE_unix" ],
+        template         => 1,
+        sys_id           => "AIX",
+        lib_cppflags     => "-DB_ENDIAN",
+        thread_scheme    => "pthreads",
+        dso_scheme       => "dlfcn",
+        shared_target    => "self",
+        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
+        bin_lflags       => shared("-Wl,-bsvr4"),
+        module_ldflags   => "-Wl,-G,-bsymbolic,-bexpall,-bnolibpath",
+        shared_ldflag    => "-Wl,-G,-bsymbolic,-bnolibpath",
+        shared_defflag   => "-Wl,-bE:",
+    },
     "aix-gcc" => {
-        inherit_from     => [ "BASE_unix", asm("ppc32_asm") ],
+        inherit_from     => [ "aix-common", asm("ppc32_asm") ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
         cflags           => add(threads("-pthread")),
-        lib_cppflags     => "-DB_ENDIAN",
+        ex_libs          => threads("-pthread"),
-        ex_libs          => add(threads("-pthread")),
-        sys_id           => "AIX",
         bn_ops           => "BN_LLONG RC4_CHAR",
-        thread_scheme    => "pthreads",
         perlasm_scheme   => "aix32",
-        dso_scheme       => "dlfcn",
+        shared_ldflag    => add("-shared -static-libgcc"),
-        shared_target    => "aix-shared",
-        shared_ldflag    => "-shared -static-libgcc -Wl,-G",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         AR               => add("-X32"),
         RANLIB           => add("-X32"),
     },
     "aix64-gcc" => {
-        inherit_from     => [ "BASE_unix", asm("ppc64_asm") ],
+        inherit_from     => [ "aix-common", asm("ppc64_asm") ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
         cflags           => combine("-maix64", threads("-pthread")),
-        lib_cppflags     => "-DB_ENDIAN",
+        ex_libs          => threads("-pthread"),
-        ex_libs          => add(threads("-pthread")),
-        sys_id           => "AIX",
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
-        thread_scheme    => "pthreads",
         perlasm_scheme   => "aix64",
-        dso_scheme       => "dlfcn",
+        shared_ldflag    => add("-shared -static-libgcc"),
-        shared_target    => "aix-shared",
-        shared_ldflag    => "-shared -static-libgcc -Wl,-G",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         AR               => add("-X64"),
         RANLIB           => add("-X64"),
     },
     "aix-cc" => {
-        inherit_from     => [ "BASE_unix", asm("ppc32_asm") ],
+        inherit_from     => [ "aix-common", asm("ppc32_asm") ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
         cflags           => combine("-q32 -qmaxmem=16384 -qro -qroconst",
                                     threads("-qthreaded")),
         cppflags         => threads("-D_THREAD_SAFE"),
-        lib_cppflags     => "-DB_ENDIAN",
-        sys_id           => "AIX",
-        bn_ops           => "BN_LLONG RC4_CHAR",
-        thread_scheme    => "pthreads",
         ex_libs          => threads("-lpthreads"),
+        bn_ops           => "BN_LLONG RC4_CHAR",
         perlasm_scheme   => "aix32",
-        dso_scheme       => "dlfcn",
-        shared_target    => "aix-shared",
         shared_cflag     => "-qpic",
-        shared_ldflag    => "-G",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         AR               => add("-X32"),
         RANLIB           => add("-X32"),
     },
     "aix64-cc" => {
-        inherit_from     => [ "BASE_unix", asm("ppc64_asm") ],
+        inherit_from     => [ "aix-common", asm("ppc64_asm") ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
         cflags           => combine("-q64 -qmaxmem=16384 -qro -qroconst",
                                     threads("-qthreaded")),
         cppflags         => threads("-D_THREAD_SAFE"),
-        lib_cppflags     => "-DB_ENDIAN",
-        sys_id           => "AIX",
-        bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
-        thread_scheme    => "pthreads",
         ex_libs          => threads("-lpthreads"),
+        bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
         perlasm_scheme   => "aix64",
         dso_scheme       => "dlfcn",
-        shared_target    => "aix-shared",
         shared_cflag     => "-qpic",
-        shared_ldflag    => "-G",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         AR               => add("-X64"),
         RANLIB           => add("-X64"),
     },
@@ -1573,46 +1565,6 @@ my %targets = (
         perlasm_scheme   => "macosx",
     },
 
-#### iPhoneOS/iOS
-#
-# It takes three prior-set environment variables to make it work:
-#
-# CROSS_COMPILE=/where/toolchain/is/usr/bin/ [note ending slash]
-# CROSS_TOP=/where/SDKs/are
-# CROSS_SDK=iPhoneOSx.y.sdk
-#
-# Exact paths vary with Xcode releases, but for couple of last ones
-# they would look like this:
-#
-# CROSS_COMPILE=`xcode-select --print-path`/Toolchains/XcodeDefault.xctoolchain/usr/bin/
-# CROSS_TOP=`xcode-select --print-path`/Platforms/iPhoneOS.platform/Developer
-# CROSS_SDK=iPhoneOS.sdk
-#
-    "iphoneos-cross" => {
-        inherit_from     => [ "darwin-common" ],
-        cflags           => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
-        sys_id           => "iOS",
-        disable          => [ "engine" ],
-    },
-    "ios-cross" => {
-        inherit_from     => [ "darwin-common", asm("armv4_asm") ],
-        # It should be possible to go below iOS 6 and even add -arch armv6,
-        # thus targeting iPhone pre-3GS, but it's assumed to be irrelevant
-        # at this point.
-        cflags           => add("-arch armv7 -mios-version-min=6.0.0 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
-        sys_id           => "iOS",
-        perlasm_scheme   => "ios32",
-        disable          => [ "engine" ],
-    },
-    "ios64-cross" => {
-        inherit_from     => [ "darwin-common", asm("aarch64_asm") ],
-        cflags           => add("-arch arm64 -mios-version-min=7.0.0 -isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
-        sys_id           => "iOS",
-        bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
-        perlasm_scheme   => "ios64",
-        disable          => [ "engine" ],
-    },
-
 ##### GNU Hurd
     "hurd-x86" => {
         inherit_from     => [ "BASE_unix" ],

Configurations/15-ios.conf

@@ -0,0 +1,64 @@
+#### iPhoneOS/iOS
+#
+# It takes recent enough XCode to use following two targets. It shouldn't
+# be a problem by now, but if they don't work, original targets below
+# that depend on manual definition of environment variables should still
+# work...
+#
+my %targets = (
+    "ios-xcrun" => {
+        inherit_from     => [ "darwin-common", asm("armv4_asm") ],
+        # It should be possible to go below iOS 6 and even add -arch armv6,
+        # thus targeting iPhone pre-3GS, but it's assumed to be irrelevant
+        # at this point.
+        CC               => "xcrun -sdk iphoneos cc",
+        cflags           => add("-arch armv7 -mios-version-min=6.0.0 -fno-common"),
+        sys_id           => "iOS",
+        perlasm_scheme   => "ios32",
+        disable          => [ "engine" ],
+    },
+    "ios64-xcrun" => {
+        inherit_from     => [ "darwin-common", asm("aarch64_asm") ],
+        CC               => "xcrun -sdk iphoneos cc",
+        cflags           => add("-arch arm64 -mios-version-min=7.0.0 -fno-common"),
+        sys_id           => "iOS",
+        bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        perlasm_scheme   => "ios64",
+        disable          => [ "engine" ],
+    },
+    "iossimulator-xcrun" => {
+        inherit_from     => [ "darwin-common" ],
+        CC               => "xcrun -sdk iphonesimulator cc",
+        sys_id           => "iOS",
+        disable          => [ "engine" ],
+    },
+# It takes three prior-set environment variables to make it work:
+#
+# CROSS_COMPILE=/where/toolchain/is/usr/bin/ [note ending slash]
+# CROSS_TOP=/where/SDKs/are
+# CROSS_SDK=iPhoneOSx.y.sdk
+#
+# Exact paths vary with Xcode releases, but for couple of last ones
+# they would look like this:
+#
+# CROSS_COMPILE=`xcode-select --print-path`/Toolchains/XcodeDefault.xctoolchain/usr/bin/
+# CROSS_TOP=`xcode-select --print-path`/Platforms/iPhoneOS.platform/Developer
+# CROSS_SDK=iPhoneOS.sdk
+#
+    "iphoneos-cross" => {
+        inherit_from     => [ "darwin-common" ],
+        cflags           => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
+        sys_id           => "iOS",
+        disable          => [ "engine" ],
+    },
+    "ios-cross" => {
+        inherit_from     => [ "ios-xcrun" ],
+        CC               => "cc",
+        cflags           => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK)"),
+    },
+    "ios64-cross" => {
+        inherit_from     => [ "ios64-xcrun" ],
+        CC               => "cc",
+        cflags           => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK)"),
+    },
+);

Configurations/shared-info.pl

@@ -65,10 +65,6 @@ my %shared_info;
             shared_ldflag     => '-shared -Wl,-Bsymbolic -set_version $(SHLIB_VERSION_NUMBER)',
         };
     },
-    'solaris-shared' => {
-        shared_ldflag     => '-Wl,-Bsymbolic',
-        shared_defflag    => '-Wl,-M,',
-    },
     'svr3-shared' => sub {
         return $shared_info{'gnu-shared'} if detect_gnu_ld();
         return {
@@ -95,8 +91,4 @@ my %shared_info;
         shared_ldflag     => '-Wl,-B,symbolic,+vnocompatwarnings,-z,+s,+cdp,../:,+cdp,./:',
         shared_sonameflag => '-Wl,+h,',
     },
-    'aix-shared' => {
-        bin_lflags            => '-Wl,-bsvr4',
-        shared_ldflag         => '-Wl,-bexpall,-bnolibpath,-bM:SRE',
-    },
 );

Configurations/unix-Makefile.tmpl

@@ -760,11 +760,13 @@ generate_fuzz_oids:
 # Set to -force to force a rebuild
 ERROR_REBUILD=
 errors:
-	( cd $(SRCDIR); $(PERL) util/ck_errf.pl -strict */*.c */*/*.c )
+	( b=`pwd`; set -e; cd $(SRCDIR); \
-	( b=`pwd`; cd $(SRCDIR); \
+          $(PERL) util/ck_errf.pl -strict -internal; \
           $(PERL) -I$$b util/mkerr.pl $(ERROR_REBUILD) -internal )
-	( b=`pwd`; cd $(SRCDIR)/engines; \
+	( b=`pwd`; set -e; cd $(SRCDIR)/engines; \
           for E in *.ec ; do \
+              $(PERL) ../util/ck_errf.pl -strict \
+                -conf $$E `basename $$E .ec`.c; \
               $(PERL) -I$$b ../util/mkerr.pl $(ERROR_REBUILD) -static \
                 -conf $$E `basename $$E .ec`.c ; \
           done )

Configure

@@ -2777,7 +2777,10 @@ sub threads {
     return sub { add($disabled{threads} ? () : @flags)->(); }
 }
 
-
+sub shared {
+    my @flags = @_;
+    return sub { add($disabled{shared} ? () : @flags)->(); }
+}
 
 our $add_called = 0;
 # Helper function to implement adding values to already existing configuration

build.info

@@ -33,6 +33,14 @@ IF[{- defined $target{shared_defflag} -}]
 
     SHARED_SOURCE[libcrypto]=libcrypto.def
     SHARED_SOURCE[libssl]=libssl.def
+  ELSIF[{- $config{target} =~ /^aix/ -}]
+    GENERATE[libcrypto.map]=util/mkdef.pl crypto aix
+    DEPEND[libcrypto.map]=util/libcrypto.num
+    GENERATE[libssl.map]=util/mkdef.pl ssl aix
+    DEPEND[libssl.map]=util/libssl.num
+
+    SHARED_SOURCE[libcrypto]=libcrypto.map
+    SHARED_SOURCE[libssl]=libssl.map
   ELSE
     GENERATE[libcrypto.map]=util/mkdef.pl crypto linux
     DEPEND[libcrypto.map]=util/libcrypto.num

crypto/asn1/ameth_lib.c

@@ -417,3 +417,19 @@ void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
 {
     ameth->set_pub_key = set_pub_key;
 }
+
+void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
+                                    int (*get_priv_key) (const EVP_PKEY *pk,
+                                                         unsigned char *priv,
+                                                         size_t *len))
+{
+    ameth->get_priv_key = get_priv_key;
+}
+
+void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
+                                   int (*get_pub_key) (const EVP_PKEY *pk,
+                                                       unsigned char *pub,
+                                                       size_t *len))
+{
+    ameth->get_pub_key = get_pub_key;
+}

crypto/bn/asm/sparcv9-mont.pl

@@ -493,6 +493,9 @@ $code.=<<___;
 	mulx	$npj,$mul1,$acc1
 	add	$tpj,$car1,$car1
 	ld	[$np+$j],$npj			! np[j]
+	srlx	$car1,32,$tmp0
+	and	$car1,$mask,$car1
+	add	$tmp0,$sbit,$sbit
 	add	$acc0,$car1,$car1
 	ld	[$tp+8],$tpj			! tp[j]
 	add	$acc1,$car1,$car1

crypto/chacha/asm/chacha-ppc.pl

@@ -438,9 +438,9 @@ my ($a,$b,$c,$d)=@_;
 	"&vxor		('$b','$b','$c')",
 	"&vrlw		('$b','$b','$seven')",
 
-	"&vsldoi	('$c','$c','$c',8)",
+	"&vrldoi	('$c','$c',8)",
-	"&vsldoi	('$b','$b','$b',$odd?4:12)",
+	"&vrldoi	('$b','$b',$odd?4:12)",
-	"&vsldoi	('$d','$d','$d',$odd?12:4)"
+	"&vrldoi	('$d','$d',$odd?12:4)"
 	);
 }
 
@@ -1334,11 +1334,12 @@ foreach (split("\n",$code)) {
 	    s/\?lvsr/lvsl/	or
 	    s/\?lvsl/lvsr/	or
 	    s/\?(vperm\s+v[0-9]+,\s*)(v[0-9]+,\s*)(v[0-9]+,\s*)(v[0-9]+)/$1$3$2$4/ or
-	    s/(vsldoi\s+v[0-9]+,\s*)(v[0-9]+,)\s*(v[0-9]+,\s*)([0-9]+)/$1$3$2 16-$4/;
+	    s/vrldoi(\s+v[0-9]+,\s*)(v[0-9]+,)\s*([0-9]+)/vsldoi$1$2$2 16-$3/;
 	} else {			# little-endian
 	    s/le\?//		or
 	    s/be\?/#be#/	or
-	    s/\?([a-z]+)/$1/;
+	    s/\?([a-z]+)/$1/	or
+	    s/vrldoi(\s+v[0-9]+,\s*)(v[0-9]+,)\s*([0-9]+)/vsldoi$1$2$2 $3/;
 	}
 
 	print $_,"\n";

crypto/dh/dh_key.c

@@ -78,10 +78,15 @@ static int generate_key(DH *dh)
     int ok = 0;
     int generate_new_key = 0;
     unsigned l;
-    BN_CTX *ctx;
+    BN_CTX *ctx = NULL;
     BN_MONT_CTX *mont = NULL;
     BIGNUM *pub_key = NULL, *priv_key = NULL;
 
+    if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
+        DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
+        return 0;
+    }
+
     ctx = BN_CTX_new();
     if (ctx == NULL)
         goto err;

crypto/ec/ecdsa_ossl.c

@@ -196,7 +196,8 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
                                EC_KEY *eckey)
 {
     int ok = 0, i;
-    BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL;
+    BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL, *blind = NULL;
+    BIGNUM *blindm = NULL;
     const BIGNUM *order, *ckinv;
     BN_CTX *ctx = NULL;
     const EC_GROUP *group;
@@ -229,8 +230,18 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
     }
     s = ret->s;
 
-    if ((ctx = BN_CTX_new()) == NULL ||
+    ctx = BN_CTX_secure_new();
-        (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {
+    if (ctx == NULL) {
+        ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
+        goto err;
+    }
+
+    BN_CTX_start(ctx);
+    tmp = BN_CTX_get(ctx);
+    m = BN_CTX_get(ctx);
+    blind = BN_CTX_get(ctx);
+    blindm = BN_CTX_get(ctx);
+    if (blindm == NULL) {
         ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_MALLOC_FAILURE);
         goto err;
     }
@@ -270,18 +281,64 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
             }
         }
 
-        if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
+        /*
+         * The normal signature calculation is:
+         *
+         *   s := k^-1 * (m + r * priv_key) mod order
+         *
+         * We will blind this to protect against side channel attacks
+         *
+         *   s := k^-1 * blind^-1 * (blind * m + blind * r * priv_key) mod order
+         */
+
+        /* Generate a blinding value */
+        do {
+            if (!BN_priv_rand(blind, BN_num_bits(order) - 1,
+                              BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
+                goto err;
+        } while (BN_is_zero(blind));
+        BN_set_flags(blind, BN_FLG_CONSTTIME);
+        BN_set_flags(blindm, BN_FLG_CONSTTIME);
+        BN_set_flags(tmp, BN_FLG_CONSTTIME);
+
+        /* tmp := blind * priv_key * r mod order */
+        if (!BN_mod_mul(tmp, blind, priv_key, order, ctx)) {
             ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
             goto err;
         }
-        if (!BN_mod_add_quick(s, tmp, m, order)) {
+        if (!BN_mod_mul(tmp, tmp, ret->r, order, ctx)) {
             ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
             goto err;
         }
+
+        /* blindm := blind * m mod order */
+        if (!BN_mod_mul(blindm, blind, m, order, ctx)) {
+            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
+            goto err;
+        }
+
+        /* s : = (blind * priv_key * r) + (blind * m) mod order */
+        if (!BN_mod_add_quick(s, tmp, blindm, order)) {
+            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
+            goto err;
+        }
+
+        /* s:= s * blind^-1 mod order */
+        if (BN_mod_inverse(blind, blind, order, ctx) == NULL) {
+            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
+            goto err;
+        }
+        if (!BN_mod_mul(s, s, blind, order, ctx)) {
+            ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
+            goto err;
+        }
+
+        /* s := s * k^-1 mod order */
         if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
             ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
             goto err;
         }
+
         if (BN_is_zero(s)) {
             /*
              * if kinv and r have been supplied by the caller, don't
@@ -303,9 +360,8 @@ ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len,
         ECDSA_SIG_free(ret);
         ret = NULL;
     }
+    BN_CTX_end(ctx);
     BN_CTX_free(ctx);
-    BN_clear_free(m);
-    BN_clear_free(tmp);
     BN_clear_free(kinv);
     return ret;
 }

crypto/ec/ecx_meth.c

@@ -354,6 +354,47 @@ static int ecx_set_pub_key(EVP_PKEY *pkey, const unsigned char *pub, size_t len)
                       KEY_OP_PUBLIC);
 }
 
+static int ecx_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
+                            size_t *len)
+{
+    const ECX_KEY *key = pkey->pkey.ecx;
+
+    if (priv == NULL) {
+        *len = KEYLENID(pkey->ameth->pkey_id);
+        return 1;
+    }
+
+    if (key == NULL
+            || key->privkey == NULL
+            || *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
+        return 0;
+
+    *len = KEYLENID(pkey->ameth->pkey_id);
+    memcpy(priv, key->privkey, *len);
+
+    return 1;
+}
+
+static int ecx_get_pub_key(const EVP_PKEY *pkey, unsigned char *pub,
+                           size_t *len)
+{
+    const ECX_KEY *key = pkey->pkey.ecx;
+
+    if (pub == NULL) {
+        *len = KEYLENID(pkey->ameth->pkey_id);
+        return 1;
+    }
+
+    if (key == NULL
+            || *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
+        return 0;
+
+    *len = KEYLENID(pkey->ameth->pkey_id);
+    memcpy(pub, key->pubkey, *len);
+
+    return 1;
+}
+
 const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth = {
     EVP_PKEY_X25519,
     EVP_PKEY_X25519,
@@ -393,6 +434,8 @@ const EVP_PKEY_ASN1_METHOD ecx25519_asn1_meth = {
 
     ecx_set_priv_key,
     ecx_set_pub_key,
+    ecx_get_priv_key,
+    ecx_get_pub_key,
 };
 
 const EVP_PKEY_ASN1_METHOD ecx448_asn1_meth = {
@@ -434,6 +477,8 @@ const EVP_PKEY_ASN1_METHOD ecx448_asn1_meth = {
 
     ecx_set_priv_key,
     ecx_set_pub_key,
+    ecx_get_priv_key,
+    ecx_get_pub_key,
 };
 
 static int ecd_size25519(const EVP_PKEY *pkey)
@@ -547,6 +592,8 @@ const EVP_PKEY_ASN1_METHOD ed25519_asn1_meth = {
 
     ecx_set_priv_key,
     ecx_set_pub_key,
+    ecx_get_priv_key,
+    ecx_get_pub_key,
 };
 
 const EVP_PKEY_ASN1_METHOD ed448_asn1_meth = {
@@ -587,6 +634,8 @@ const EVP_PKEY_ASN1_METHOD ed448_asn1_meth = {
 
     ecx_set_priv_key,
     ecx_set_pub_key,
+    ecx_get_priv_key,
+    ecx_get_pub_key,
 };
 
 static int pkey_ecx_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)

crypto/err/openssl.txt

@@ -757,6 +757,8 @@ EVP_F_EVP_PKEY_GET0_HMAC:183:EVP_PKEY_get0_hmac
 EVP_F_EVP_PKEY_GET0_POLY1305:184:EVP_PKEY_get0_poly1305
 EVP_F_EVP_PKEY_GET0_RSA:121:EVP_PKEY_get0_RSA
 EVP_F_EVP_PKEY_GET0_SIPHASH:172:EVP_PKEY_get0_siphash
+EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY:202:EVP_PKEY_get_raw_private_key
+EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY:203:EVP_PKEY_get_raw_public_key
 EVP_F_EVP_PKEY_KEYGEN:146:EVP_PKEY_keygen
 EVP_F_EVP_PKEY_KEYGEN_INIT:147:EVP_PKEY_keygen_init
 EVP_F_EVP_PKEY_METH_ADD0:194:EVP_PKEY_meth_add0
@@ -2199,6 +2201,7 @@ EVP_R_EXPECTING_A_EC_KEY:142:expecting a ec key
 EVP_R_EXPECTING_A_POLY1305_KEY:164:expecting a poly1305 key
 EVP_R_EXPECTING_A_SIPHASH_KEY:175:expecting a siphash key
 EVP_R_FIPS_MODE_NOT_SUPPORTED:167:fips mode not supported
+EVP_R_GET_RAW_KEY_FAILED:182:get raw key failed
 EVP_R_ILLEGAL_SCRYPT_PARAMETERS:171:illegal scrypt parameters
 EVP_R_INITIALIZATION_ERROR:134:initialization error
 EVP_R_INPUT_NOT_INITIALIZED:111:input not initialized

crypto/evp/evp_err.c

@@ -93,6 +93,10 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET0_RSA, 0), "EVP_PKEY_get0_RSA"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET0_SIPHASH, 0),
      "EVP_PKEY_get0_siphash"},
+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, 0),
+     "EVP_PKEY_get_raw_private_key"},
+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY, 0),
+     "EVP_PKEY_get_raw_public_key"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_KEYGEN, 0), "EVP_PKEY_keygen"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_KEYGEN_INIT, 0),
      "EVP_PKEY_keygen_init"},
@@ -185,6 +189,7 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
     "expecting a siphash key"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_FIPS_MODE_NOT_SUPPORTED),
     "fips mode not supported"},
+    {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_GET_RAW_KEY_FAILED), "get raw key failed"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_ILLEGAL_SCRYPT_PARAMETERS),
     "illegal scrypt parameters"},
     {ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INITIALIZATION_ERROR),

crypto/evp/p_lib.c

@@ -280,6 +280,40 @@ EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
     return NULL;
 }
 
+int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
+                                 size_t *len)
+{
+     if (pkey->ameth->get_priv_key == NULL) {
+        EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY,
+               EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+        return 0;
+    }
+
+    if (!pkey->ameth->get_priv_key(pkey, priv, len)) {
+        EVPerr(EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY, EVP_R_GET_RAW_KEY_FAILED);
+        return 0;
+    }
+
+    return 1;
+}
+
+int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
+                                size_t *len)
+{
+     if (pkey->ameth->get_pub_key == NULL) {
+        EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY,
+               EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
+        return 0;
+    }
+
+    if (!pkey->ameth->get_pub_key(pkey, pub, len)) {
+        EVPerr(EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY, EVP_R_GET_RAW_KEY_FAILED);
+        return 0;
+    }
+
+    return 1;
+}
+
 EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
                                 size_t len, const EVP_CIPHER *cipher)
 {

crypto/hmac/hm_ameth.c

@@ -72,6 +72,25 @@ static int hmac_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
     return 1;
 }
 
+static int hmac_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
+                             size_t *len)
+{
+    ASN1_OCTET_STRING *os = (ASN1_OCTET_STRING *)pkey->pkey.ptr;
+
+    if (priv == NULL) {
+        *len = ASN1_STRING_length(os);
+        return 1;
+    }
+
+    if (os == NULL || *len < (size_t)ASN1_STRING_length(os))
+        return 0;
+
+    *len = ASN1_STRING_length(os);
+    memcpy(priv, ASN1_STRING_get0_data(os), *len);
+
+    return 1;
+}
+
 const EVP_PKEY_ASN1_METHOD hmac_asn1_meth = {
     EVP_PKEY_HMAC,
     EVP_PKEY_HMAC,
@@ -103,4 +122,6 @@ const EVP_PKEY_ASN1_METHOD hmac_asn1_meth = {
 
     hmac_set_priv_key,
     NULL,
+    hmac_get_priv_key,
+    NULL,
 };

crypto/include/internal/asn1_int.h

@@ -61,6 +61,8 @@ struct evp_pkey_asn1_method_st {
     /* Get/set raw private/public key data */
     int (*set_priv_key) (EVP_PKEY *pk, const unsigned char *priv, size_t len);
     int (*set_pub_key) (EVP_PKEY *pk, const unsigned char *pub, size_t len);
+    int (*get_priv_key) (const EVP_PKEY *pk, unsigned char *priv, size_t *len);
+    int (*get_pub_key) (const EVP_PKEY *pk, unsigned char *pub, size_t *len);
 } /* EVP_PKEY_ASN1_METHOD */ ;
 
 DEFINE_STACK_OF_CONST(EVP_PKEY_ASN1_METHOD)

crypto/modes/modes_lcl.h

@@ -178,12 +178,13 @@ struct ocb128_context {
     OCB_BLOCK l_dollar;
     OCB_BLOCK *l;
     /* Must be reset for each session */
-    u64 blocks_hashed;
+    struct {
-    u64 blocks_processed;
+        u64 blocks_hashed;
-    OCB_BLOCK tag;
+        u64 blocks_processed;
-    OCB_BLOCK offset_aad;
+        OCB_BLOCK offset_aad;
-    OCB_BLOCK sum;
+        OCB_BLOCK sum;
-    OCB_BLOCK offset;
+        OCB_BLOCK offset;
-    OCB_BLOCK checksum;
+        OCB_BLOCK checksum;
+    } sess;
 };
 #endif                          /* OPENSSL_NO_OCB */

crypto/modes/ocb128.c

@@ -239,6 +239,9 @@ int CRYPTO_ocb128_setiv(OCB128_CONTEXT *ctx, const unsigned char *iv,
         return -1;
     }
 
+    /* Reset nonce-dependent variables */
+    memset(&ctx->sess, 0, sizeof(ctx->sess));
+
     /* Nonce = num2str(TAGLEN mod 128,7) || zeros(120-bitlen(N)) || 1 || N */
     nonce[0] = ((taglen * 8) % 128) << 1;
     memset(nonce + 1, 0, 15);
@@ -259,10 +262,10 @@ int CRYPTO_ocb128_setiv(OCB128_CONTEXT *ctx, const unsigned char *iv,
 
     /* Offset_0 = Stretch[1+bottom..128+bottom] */
     shift = bottom % 8;
-    ocb_block_lshift(stretch + (bottom / 8), shift, ctx->offset.c);
+    ocb_block_lshift(stretch + (bottom / 8), shift, ctx->sess.offset.c);
     mask = 0xff;
     mask <<= 8 - shift;
-    ctx->offset.c[15] |=
+    ctx->sess.offset.c[15] |=
         (*(stretch + (bottom / 8) + 16) & mask) >> (8 - shift);
 
     return 1;
@@ -281,25 +284,25 @@ int CRYPTO_ocb128_aad(OCB128_CONTEXT *ctx, const unsigned char *aad,
 
     /* Calculate the number of blocks of AAD provided now, and so far */
     num_blocks = len / 16;
-    all_num_blocks = num_blocks + ctx->blocks_hashed;
+    all_num_blocks = num_blocks + ctx->sess.blocks_hashed;
 
     /* Loop through all full blocks of AAD */
-    for (i = ctx->blocks_hashed + 1; i <= all_num_blocks; i++) {
+    for (i = ctx->sess.blocks_hashed + 1; i <= all_num_blocks; i++) {
         OCB_BLOCK *lookup;
 
         /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
         lookup = ocb_lookup_l(ctx, ocb_ntz(i));
         if (lookup == NULL)
             return 0;
-        ocb_block16_xor(&ctx->offset_aad, lookup, &ctx->offset_aad);
+        ocb_block16_xor(&ctx->sess.offset_aad, lookup, &ctx->sess.offset_aad);
 
         memcpy(tmp.c, aad, 16);
         aad += 16;
 
         /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i) */
-        ocb_block16_xor(&ctx->offset_aad, &tmp, &tmp);
+        ocb_block16_xor(&ctx->sess.offset_aad, &tmp, &tmp);
         ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
-        ocb_block16_xor(&tmp, &ctx->sum, &ctx->sum);
+        ocb_block16_xor(&tmp, &ctx->sess.sum, &ctx->sess.sum);
     }
 
     /*
@@ -310,20 +313,21 @@ int CRYPTO_ocb128_aad(OCB128_CONTEXT *ctx, const unsigned char *aad,
 
     if (last_len > 0) {
         /* Offset_* = Offset_m xor L_* */
-        ocb_block16_xor(&ctx->offset_aad, &ctx->l_star, &ctx->offset_aad);
+        ocb_block16_xor(&ctx->sess.offset_aad, &ctx->l_star,
+                        &ctx->sess.offset_aad);
 
         /* CipherInput = (A_* || 1 || zeros(127-bitlen(A_*))) xor Offset_* */
         memset(tmp.c, 0, 16);
         memcpy(tmp.c, aad, last_len);
         tmp.c[last_len] = 0x80;
-        ocb_block16_xor(&ctx->offset_aad, &tmp, &tmp);
+        ocb_block16_xor(&ctx->sess.offset_aad, &tmp, &tmp);
 
         /* Sum = Sum_m xor ENCIPHER(K, CipherInput) */
         ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
-        ocb_block16_xor(&tmp, &ctx->sum, &ctx->sum);
+        ocb_block16_xor(&tmp, &ctx->sess.sum, &ctx->sess.sum);
     }
 
-    ctx->blocks_hashed = all_num_blocks;
+    ctx->sess.blocks_hashed = all_num_blocks;
 
     return 1;
 }
@@ -344,7 +348,7 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
      * so far
      */
     num_blocks = len / 16;
-    all_num_blocks = num_blocks + ctx->blocks_processed;
+    all_num_blocks = num_blocks + ctx->sess.blocks_processed;
 
     if (num_blocks && all_num_blocks == (size_t)all_num_blocks
         && ctx->stream != NULL) {
@@ -360,11 +364,11 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
             return 0;
 
         ctx->stream(in, out, num_blocks, ctx->keyenc,
-                    (size_t)ctx->blocks_processed + 1, ctx->offset.c,
+                    (size_t)ctx->sess.blocks_processed + 1, ctx->sess.offset.c,
-                    (const unsigned char (*)[16])ctx->l, ctx->checksum.c);
+                    (const unsigned char (*)[16])ctx->l, ctx->sess.checksum.c);
     } else {
         /* Loop through all full blocks to be encrypted */
-        for (i = ctx->blocks_processed + 1; i <= all_num_blocks; i++) {
+        for (i = ctx->sess.blocks_processed + 1; i <= all_num_blocks; i++) {
             OCB_BLOCK *lookup;
             OCB_BLOCK tmp;
 
@@ -372,18 +376,18 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
             lookup = ocb_lookup_l(ctx, ocb_ntz(i));
             if (lookup == NULL)
                 return 0;
-            ocb_block16_xor(&ctx->offset, lookup, &ctx->offset);
+            ocb_block16_xor(&ctx->sess.offset, lookup, &ctx->sess.offset);
 
             memcpy(tmp.c, in, 16);
             in += 16;
 
             /* Checksum_i = Checksum_{i-1} xor P_i */
-            ocb_block16_xor(&tmp, &ctx->checksum, &ctx->checksum);
+            ocb_block16_xor(&tmp, &ctx->sess.checksum, &ctx->sess.checksum);
 
             /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i) */
-            ocb_block16_xor(&ctx->offset, &tmp, &tmp);
+            ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
             ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
-            ocb_block16_xor(&ctx->offset, &tmp, &tmp);
+            ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
 
             memcpy(out, tmp.c, 16);
             out += 16;
@@ -400,10 +404,10 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
         OCB_BLOCK pad;
 
         /* Offset_* = Offset_m xor L_* */
-        ocb_block16_xor(&ctx->offset, &ctx->l_star, &ctx->offset);
+        ocb_block16_xor(&ctx->sess.offset, &ctx->l_star, &ctx->sess.offset);
 
         /* Pad = ENCIPHER(K, Offset_*) */
-        ctx->encrypt(ctx->offset.c, pad.c, ctx->keyenc);
+        ctx->encrypt(ctx->sess.offset.c, pad.c, ctx->keyenc);
 
         /* C_* = P_* xor Pad[1..bitlen(P_*)] */
         ocb_block_xor(in, pad.c, last_len, out);
@@ -412,10 +416,10 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
         memset(pad.c, 0, 16);           /* borrow pad */
         memcpy(pad.c, in, last_len);
         pad.c[last_len] = 0x80;
-        ocb_block16_xor(&pad, &ctx->checksum, &ctx->checksum);
+        ocb_block16_xor(&pad, &ctx->sess.checksum, &ctx->sess.checksum);
     }
 
-    ctx->blocks_processed = all_num_blocks;
+    ctx->sess.blocks_processed = all_num_blocks;
 
     return 1;
 }
@@ -436,7 +440,7 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
      * so far
      */
     num_blocks = len / 16;
-    all_num_blocks = num_blocks + ctx->blocks_processed;
+    all_num_blocks = num_blocks + ctx->sess.blocks_processed;
 
     if (num_blocks && all_num_blocks == (size_t)all_num_blocks
         && ctx->stream != NULL) {
@@ -452,30 +456,30 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
             return 0;
 
         ctx->stream(in, out, num_blocks, ctx->keydec,
-                    (size_t)ctx->blocks_processed + 1, ctx->offset.c,
+                    (size_t)ctx->sess.blocks_processed + 1, ctx->sess.offset.c,
-                    (const unsigned char (*)[16])ctx->l, ctx->checksum.c);
+                    (const unsigned char (*)[16])ctx->l, ctx->sess.checksum.c);
     } else {
         OCB_BLOCK tmp;
 
         /* Loop through all full blocks to be decrypted */
-        for (i = ctx->blocks_processed + 1; i <= all_num_blocks; i++) {
+        for (i = ctx->sess.blocks_processed + 1; i <= all_num_blocks; i++) {
 
             /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
             OCB_BLOCK *lookup = ocb_lookup_l(ctx, ocb_ntz(i));
             if (lookup == NULL)
                 return 0;
-            ocb_block16_xor(&ctx->offset, lookup, &ctx->offset);
+            ocb_block16_xor(&ctx->sess.offset, lookup, &ctx->sess.offset);
 
             memcpy(tmp.c, in, 16);
             in += 16;
 
             /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i) */
-            ocb_block16_xor(&ctx->offset, &tmp, &tmp);
+            ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
             ctx->decrypt(tmp.c, tmp.c, ctx->keydec);
-            ocb_block16_xor(&ctx->offset, &tmp, &tmp);
+            ocb_block16_xor(&ctx->sess.offset, &tmp, &tmp);
 
             /* Checksum_i = Checksum_{i-1} xor P_i */
-            ocb_block16_xor(&tmp, &ctx->checksum, &ctx->checksum);
+            ocb_block16_xor(&tmp, &ctx->sess.checksum, &ctx->sess.checksum);
 
             memcpy(out, tmp.c, 16);
             out += 16;
@@ -492,10 +496,10 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
         OCB_BLOCK pad;
 
         /* Offset_* = Offset_m xor L_* */
-        ocb_block16_xor(&ctx->offset, &ctx->l_star, &ctx->offset);
+        ocb_block16_xor(&ctx->sess.offset, &ctx->l_star, &ctx->sess.offset);
 
         /* Pad = ENCIPHER(K, Offset_*) */
-        ctx->encrypt(ctx->offset.c, pad.c, ctx->keyenc);
+        ctx->encrypt(ctx->sess.offset.c, pad.c, ctx->keyenc);
 
         /* P_* = C_* xor Pad[1..bitlen(C_*)] */
         ocb_block_xor(in, pad.c, last_len, out);
@@ -504,39 +508,46 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
         memset(pad.c, 0, 16);           /* borrow pad */
         memcpy(pad.c, out, last_len);
         pad.c[last_len] = 0x80;
-        ocb_block16_xor(&pad, &ctx->checksum, &ctx->checksum);
+        ocb_block16_xor(&pad, &ctx->sess.checksum, &ctx->sess.checksum);
     }
 
-    ctx->blocks_processed = all_num_blocks;
+    ctx->sess.blocks_processed = all_num_blocks;
 
     return 1;
 }
 
+static int ocb_finish(OCB128_CONTEXT *ctx, unsigned char *tag, size_t len,
+                      int write)
+{
+    OCB_BLOCK tmp;
+
+    if (len > 16 || len < 1) {
+        return -1;
+    }
+
+    /*
+     * Tag = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) xor HASH(K,A)
+     */
+    ocb_block16_xor(&ctx->sess.checksum, &ctx->sess.offset, &tmp);
+    ocb_block16_xor(&ctx->l_dollar, &tmp, &tmp);
+    ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
+    ocb_block16_xor(&tmp, &ctx->sess.sum, &tmp);
+
+    if (write) {
+        memcpy(tag, &tmp, len);
+        return 1;
+    } else {
+        return CRYPTO_memcmp(&tmp, tag, len);
+    }
+}
+
 /*
  * Calculate the tag and verify it against the supplied tag
  */
 int CRYPTO_ocb128_finish(OCB128_CONTEXT *ctx, const unsigned char *tag,
                          size_t len)
 {
-    OCB_BLOCK tmp;
+    return ocb_finish(ctx, (unsigned char*)tag, len, 0);
-
-    /*
-     * Tag = ENCIPHER(K, Checksum_* xor Offset_* xor L_$) xor HASH(K,A)
-     */
-    ocb_block16_xor(&ctx->checksum, &ctx->offset, &tmp);
-    ocb_block16_xor(&ctx->l_dollar, &tmp, &tmp);
-    ctx->encrypt(tmp.c, tmp.c, ctx->keyenc);
-    ocb_block16_xor(&tmp, &ctx->sum, &ctx->tag);
-
-    if (len > 16 || len < 1) {
-        return -1;
-    }
-
-    /* Compare the tag if we've been given one */
-    if (tag)
-        return CRYPTO_memcmp(&ctx->tag, tag, len);
-    else
-        return -1;
 }
 
 /*
@@ -544,17 +555,7 @@ int CRYPTO_ocb128_finish(OCB128_CONTEXT *ctx, const unsigned char *tag,
  */
 int CRYPTO_ocb128_tag(OCB128_CONTEXT *ctx, unsigned char *tag, size_t len)
 {
-    if (len > 16 || len < 1) {
+    return ocb_finish(ctx, tag, len, 1);
-        return -1;
-    }
-
-    /* Calculate the tag */
-    CRYPTO_ocb128_finish(ctx, NULL, 0);
-
-    /* Copy the tag into the supplied buffer */
-    memcpy(tag, ctx->tag.c, len);
-
-    return 1;
 }
 
 /*

crypto/objects/obj_dat.h

@@ -10,7 +10,7 @@
  */
 
 /* Serialized OID's */
-static const unsigned char so[7626] = {
+static const unsigned char so[7746] = {
     0x2A,0x86,0x48,0x86,0xF7,0x0D,                 /* [    0] OBJ_rsadsi */
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,            /* [    6] OBJ_pkcs */
     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x02,0x02,       /* [   13] OBJ_md2 */
@@ -1060,9 +1060,23 @@ static const unsigned char so[7626] = {
     0x2B,0x6F,                                     /* [ 7610] OBJ_ieee */
     0x2B,0x6F,0x02,0x8C,0x53,                      /* [ 7612] OBJ_ieee_siswg */
     0x2A,0x81,0x1C,0xCF,0x55,0x01,0x82,0x2D,       /* [ 7617] OBJ_sm2 */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x01,       /* [ 7625] OBJ_id_tc26_cipher_gostr3412_2015_magma */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x01,0x01,  /* [ 7633] OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x01,0x02,  /* [ 7642] OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x02,       /* [ 7651] OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x02,0x01,  /* [ 7659] OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x05,0x02,0x02,  /* [ 7668] OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x07,            /* [ 7677] OBJ_id_tc26_wrap */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x01,       /* [ 7684] OBJ_id_tc26_wrap_gostr3412_2015_magma */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x01,0x01,  /* [ 7692] OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15 */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x02,       /* [ 7701] OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik */
+    0x2A,0x85,0x03,0x07,0x01,0x01,0x07,0x01,0x01,  /* [ 7709] OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 */
+    0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x02,  /* [ 7718] OBJ_id_tc26_gost_3410_2012_256_paramSetB */
+    0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x03,  /* [ 7727] OBJ_id_tc26_gost_3410_2012_256_paramSetC */
+    0x2A,0x85,0x03,0x07,0x01,0x02,0x01,0x01,0x04,  /* [ 7736] OBJ_id_tc26_gost_3410_2012_256_paramSetD */
 };
 
-#define NUM_NID 1173
+#define NUM_NID 1193
 static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"UNDEF", "undefined", NID_undef},
     {"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
@@ -2237,9 +2251,29 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
     {"ieee", "ieee", NID_ieee, 2, &so[7610]},
     {"ieee-siswg", "IEEE Security in Storage Working Group", NID_ieee_siswg, 5, &so[7612]},
     {"SM2", "sm2", NID_sm2, 8, &so[7617]},
+    {"id-tc26-cipher-gostr3412-2015-magma", "id-tc26-cipher-gostr3412-2015-magma", NID_id_tc26_cipher_gostr3412_2015_magma, 8, &so[7625]},
+    {"id-tc26-cipher-gostr3412-2015-magma-ctracpkm", "id-tc26-cipher-gostr3412-2015-magma-ctracpkm", NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm, 9, &so[7633]},
+    {"id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac", "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac", NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac, 9, &so[7642]},
+    {"id-tc26-cipher-gostr3412-2015-kuznyechik", "id-tc26-cipher-gostr3412-2015-kuznyechik", NID_id_tc26_cipher_gostr3412_2015_kuznyechik, 8, &so[7651]},
+    {"id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm", "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm", NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm, 9, &so[7659]},
+    {"id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac", "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac", NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac, 9, &so[7668]},
+    {"id-tc26-wrap", "id-tc26-wrap", NID_id_tc26_wrap, 7, &so[7677]},
+    {"id-tc26-wrap-gostr3412-2015-magma", "id-tc26-wrap-gostr3412-2015-magma", NID_id_tc26_wrap_gostr3412_2015_magma, 8, &so[7684]},
+    {"id-tc26-wrap-gostr3412-2015-magma-kexp15", "id-tc26-wrap-gostr3412-2015-magma-kexp15", NID_id_tc26_wrap_gostr3412_2015_magma_kexp15, 9, &so[7692]},
+    {"id-tc26-wrap-gostr3412-2015-kuznyechik", "id-tc26-wrap-gostr3412-2015-kuznyechik", NID_id_tc26_wrap_gostr3412_2015_kuznyechik, 8, &so[7701]},
+    {"id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15", "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15", NID_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15, 9, &so[7709]},
+    {"id-tc26-gost-3410-2012-256-paramSetB", "GOST R 34.10-2012 (256 bit) ParamSet B", NID_id_tc26_gost_3410_2012_256_paramSetB, 9, &so[7718]},
+    {"id-tc26-gost-3410-2012-256-paramSetC", "GOST R 34.10-2012 (256 bit) ParamSet C", NID_id_tc26_gost_3410_2012_256_paramSetC, 9, &so[7727]},
+    {"id-tc26-gost-3410-2012-256-paramSetD", "GOST R 34.10-2012 (256 bit) ParamSet D", NID_id_tc26_gost_3410_2012_256_paramSetD, 9, &so[7736]},
+    {"magma-ecb", "magma-ecb", NID_magma_ecb},
+    {"magma-ctr", "magma-ctr", NID_magma_ctr},
+    {"magma-ofb", "magma-ofb", NID_magma_ofb},
+    {"magma-cbc", "magma-cbc", NID_magma_cbc},
+    {"magma-cfb", "magma-cfb", NID_magma_cfb},
+    {"magma-mac", "magma-mac", NID_magma_mac},
 };
 
-#define NUM_SN 1164
+#define NUM_SN 1184
 static const unsigned int sn_objs[NUM_SN] = {
      364,    /* "AD_DVCS" */
      419,    /* "AES-128-CBC" */
@@ -2999,6 +3033,12 @@ static const unsigned int sn_objs[NUM_SN] = {
      977,    /* "id-tc26-algorithms" */
      990,    /* "id-tc26-cipher" */
     1001,    /* "id-tc26-cipher-constants" */
+    1176,    /* "id-tc26-cipher-gostr3412-2015-kuznyechik" */
+    1177,    /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm" */
+    1178,    /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac" */
+    1173,    /* "id-tc26-cipher-gostr3412-2015-magma" */
+    1174,    /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm" */
+    1175,    /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac" */
      994,    /* "id-tc26-constants" */
      981,    /* "id-tc26-digest" */
     1000,    /* "id-tc26-digest-constants" */
@@ -3006,6 +3046,9 @@ static const unsigned int sn_objs[NUM_SN] = {
     1003,    /* "id-tc26-gost-28147-param-Z" */
     1147,    /* "id-tc26-gost-3410-2012-256-constants" */
     1148,    /* "id-tc26-gost-3410-2012-256-paramSetA" */
+    1184,    /* "id-tc26-gost-3410-2012-256-paramSetB" */
+    1185,    /* "id-tc26-gost-3410-2012-256-paramSetC" */
+    1186,    /* "id-tc26-gost-3410-2012-256-paramSetD" */
      996,    /* "id-tc26-gost-3410-2012-512-constants" */
      998,    /* "id-tc26-gost-3410-2012-512-paramSetA" */
      999,    /* "id-tc26-gost-3410-2012-512-paramSetB" */
@@ -3019,6 +3062,11 @@ static const unsigned int sn_objs[NUM_SN] = {
      984,    /* "id-tc26-signwithdigest" */
      985,    /* "id-tc26-signwithdigest-gost3410-2012-256" */
      986,    /* "id-tc26-signwithdigest-gost3410-2012-512" */
+    1179,    /* "id-tc26-wrap" */
+    1182,    /* "id-tc26-wrap-gostr3412-2015-kuznyechik" */
+    1183,    /* "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15" */
+    1180,    /* "id-tc26-wrap-gostr3412-2015-magma" */
+    1181,    /* "id-tc26-wrap-gostr3412-2015-magma-kexp15" */
      676,    /* "identified-organization" */
     1170,    /* "ieee" */
     1171,    /* "ieee-siswg" */
@@ -3045,6 +3093,12 @@ static const unsigned int sn_objs[NUM_SN] = {
      476,    /* "lastModifiedTime" */
      157,    /* "localKeyID" */
      480,    /* "mXRecord" */
+    1190,    /* "magma-cbc" */
+    1191,    /* "magma-cfb" */
+    1188,    /* "magma-ctr" */
+    1187,    /* "magma-ecb" */
+    1192,    /* "magma-mac" */
+    1189,    /* "magma-ofb" */
      460,    /* "mail" */
      493,    /* "mailPreferenceOption" */
      467,    /* "manager" */
@@ -3407,7 +3461,7 @@ static const unsigned int sn_objs[NUM_SN] = {
     1093,    /* "x509ExtAdmission" */
 };
 
-#define NUM_LN 1164
+#define NUM_LN 1184
 static const unsigned int ln_objs[NUM_LN] = {
      363,    /* "AD Time Stamping" */
      405,    /* "ANSI X9.62" */
@@ -3464,6 +3518,9 @@ static const unsigned int ln_objs[NUM_LN] = {
      811,    /* "GOST R 34.10-2001" */
      817,    /* "GOST R 34.10-2001 DH" */
     1148,    /* "GOST R 34.10-2012 (256 bit) ParamSet A" */
+    1184,    /* "GOST R 34.10-2012 (256 bit) ParamSet B" */
+    1185,    /* "GOST R 34.10-2012 (256 bit) ParamSet C" */
+    1186,    /* "GOST R 34.10-2012 (256 bit) ParamSet D" */
      998,    /* "GOST R 34.10-2012 (512 bit) ParamSet A" */
      999,    /* "GOST R 34.10-2012 (512 bit) ParamSet B" */
     1149,    /* "GOST R 34.10-2012 (512 bit) ParamSet C" */
@@ -4154,6 +4211,12 @@ static const unsigned int ln_objs[NUM_LN] = {
      977,    /* "id-tc26-algorithms" */
      990,    /* "id-tc26-cipher" */
     1001,    /* "id-tc26-cipher-constants" */
+    1176,    /* "id-tc26-cipher-gostr3412-2015-kuznyechik" */
+    1177,    /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm" */
+    1178,    /* "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac" */
+    1173,    /* "id-tc26-cipher-gostr3412-2015-magma" */
+    1174,    /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm" */
+    1175,    /* "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac" */
      994,    /* "id-tc26-constants" */
      981,    /* "id-tc26-digest" */
     1000,    /* "id-tc26-digest-constants" */
@@ -4164,6 +4227,11 @@ static const unsigned int ln_objs[NUM_LN] = {
      978,    /* "id-tc26-sign" */
      995,    /* "id-tc26-sign-constants" */
      984,    /* "id-tc26-signwithdigest" */
+    1179,    /* "id-tc26-wrap" */
+    1182,    /* "id-tc26-wrap-gostr3412-2015-kuznyechik" */
+    1183,    /* "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15" */
+    1180,    /* "id-tc26-wrap-gostr3412-2015-magma" */
+    1181,    /* "id-tc26-wrap-gostr3412-2015-magma-kexp15" */
       34,    /* "idea-cbc" */
       35,    /* "idea-cfb" */
       36,    /* "idea-ecb" */
@@ -4201,6 +4269,12 @@ static const unsigned int ln_objs[NUM_LN] = {
      157,    /* "localKeyID" */
       15,    /* "localityName" */
      480,    /* "mXRecord" */
+    1190,    /* "magma-cbc" */
+    1191,    /* "magma-cfb" */
+    1188,    /* "magma-ctr" */
+    1187,    /* "magma-ecb" */
+    1192,    /* "magma-mac" */
+    1189,    /* "magma-ofb" */
      493,    /* "mailPreferenceOption" */
      467,    /* "manager" */
        3,    /* "md2" */
@@ -4575,7 +4649,7 @@ static const unsigned int ln_objs[NUM_LN] = {
      125,    /* "zlib compression" */
 };
 
-#define NUM_OBJ 1055
+#define NUM_OBJ 1069
 static const unsigned int obj_objs[NUM_OBJ] = {
        0,    /* OBJ_undef                        0 */
      181,    /* OBJ_iso                          1 */
@@ -4975,6 +5049,7 @@ static const unsigned int obj_objs[NUM_OBJ] = {
      987,    /* OBJ_id_tc26_mac                  1 2 643 7 1 1 4 */
      990,    /* OBJ_id_tc26_cipher               1 2 643 7 1 1 5 */
      991,    /* OBJ_id_tc26_agreement            1 2 643 7 1 1 6 */
+    1179,    /* OBJ_id_tc26_wrap                 1 2 643 7 1 1 7 */
      995,    /* OBJ_id_tc26_sign_constants       1 2 643 7 1 2 1 */
     1000,    /* OBJ_id_tc26_digest_constants     1 2 643 7 1 2 2 */
     1001,    /* OBJ_id_tc26_cipher_constants     1 2 643 7 1 2 5 */
@@ -5063,8 +5138,12 @@ static const unsigned int obj_objs[NUM_OBJ] = {
      986,    /* OBJ_id_tc26_signwithdigest_gost3410_2012_512 1 2 643 7 1 1 3 3 */
      988,    /* OBJ_id_tc26_hmac_gost_3411_2012_256 1 2 643 7 1 1 4 1 */
      989,    /* OBJ_id_tc26_hmac_gost_3411_2012_512 1 2 643 7 1 1 4 2 */
+    1173,    /* OBJ_id_tc26_cipher_gostr3412_2015_magma 1 2 643 7 1 1 5 1 */
+    1176,    /* OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik 1 2 643 7 1 1 5 2 */
      992,    /* OBJ_id_tc26_agreement_gost_3410_2012_256 1 2 643 7 1 1 6 1 */
      993,    /* OBJ_id_tc26_agreement_gost_3410_2012_512 1 2 643 7 1 1 6 2 */
+    1180,    /* OBJ_id_tc26_wrap_gostr3412_2015_magma 1 2 643 7 1 1 7 1 */
+    1182,    /* OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik 1 2 643 7 1 1 7 2 */
     1147,    /* OBJ_id_tc26_gost_3410_2012_256_constants 1 2 643 7 1 2 1 1 */
      996,    /* OBJ_id_tc26_gost_3410_2012_512_constants 1 2 643 7 1 2 1 2 */
     1002,    /* OBJ_id_tc26_gost_28147_constants 1 2 643 7 1 2 5 1 */
@@ -5270,7 +5349,16 @@ static const unsigned int obj_objs[NUM_OBJ] = {
     1120,    /* OBJ_aria_128_ccm                 1 2 410 200046 1 1 37 */
     1121,    /* OBJ_aria_192_ccm                 1 2 410 200046 1 1 38 */
     1122,    /* OBJ_aria_256_ccm                 1 2 410 200046 1 1 39 */
+    1174,    /* OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm 1 2 643 7 1 1 5 1 1 */
+    1175,    /* OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac 1 2 643 7 1 1 5 1 2 */
+    1177,    /* OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm 1 2 643 7 1 1 5 2 1 */
+    1178,    /* OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac 1 2 643 7 1 1 5 2 2 */
+    1181,    /* OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15 1 2 643 7 1 1 7 1 1 */
+    1183,    /* OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15 1 2 643 7 1 1 7 1 1 */
     1148,    /* OBJ_id_tc26_gost_3410_2012_256_paramSetA 1 2 643 7 1 2 1 1 1 */
+    1184,    /* OBJ_id_tc26_gost_3410_2012_256_paramSetB 1 2 643 7 1 2 1 1 2 */
+    1185,    /* OBJ_id_tc26_gost_3410_2012_256_paramSetC 1 2 643 7 1 2 1 1 3 */
+    1186,    /* OBJ_id_tc26_gost_3410_2012_256_paramSetD 1 2 643 7 1 2 1 1 4 */
      997,    /* OBJ_id_tc26_gost_3410_2012_512_paramSetTest 1 2 643 7 1 2 1 2 0 */
      998,    /* OBJ_id_tc26_gost_3410_2012_512_paramSetA 1 2 643 7 1 2 1 2 1 */
      999,    /* OBJ_id_tc26_gost_3410_2012_512_paramSetB 1 2 643 7 1 2 1 2 2 */

crypto/objects/obj_mac.num

@@ -1170,3 +1170,23 @@ uacurve9		1169
 ieee		1170
 ieee_siswg		1171
 sm2		1172
+id_tc26_cipher_gostr3412_2015_magma		1173
+id_tc26_cipher_gostr3412_2015_magma_ctracpkm		1174
+id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac		1175
+id_tc26_cipher_gostr3412_2015_kuznyechik		1176
+id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm		1177
+id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac		1178
+id_tc26_wrap		1179
+id_tc26_wrap_gostr3412_2015_magma		1180
+id_tc26_wrap_gostr3412_2015_magma_kexp15		1181
+id_tc26_wrap_gostr3412_2015_kuznyechik		1182
+id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15		1183
+id_tc26_gost_3410_2012_256_paramSetB		1184
+id_tc26_gost_3410_2012_256_paramSetC		1185
+id_tc26_gost_3410_2012_256_paramSetD		1186
+magma_ecb		1187
+magma_ctr		1188
+magma_ofb		1189
+magma_cbc		1190
+magma_cfb		1191
+magma_mac		1192

crypto/objects/objects.txt

@@ -1339,16 +1339,31 @@ id-tc26-mac 1		: id-tc26-hmac-gost-3411-2012-256 : HMAC GOST 34.11-2012 256 bit
 id-tc26-mac 2		: id-tc26-hmac-gost-3411-2012-512 : HMAC GOST 34.11-2012 512 bit
 
 id-tc26-algorithms 5	: id-tc26-cipher
+id-tc26-cipher 1	:  id-tc26-cipher-gostr3412-2015-magma
+id-tc26-cipher-gostr3412-2015-magma 1	: id-tc26-cipher-gostr3412-2015-magma-ctracpkm
+id-tc26-cipher-gostr3412-2015-magma 2	: id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac
+id-tc26-cipher 2	:  id-tc26-cipher-gostr3412-2015-kuznyechik
+id-tc26-cipher-gostr3412-2015-kuznyechik 1	: id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm
+id-tc26-cipher-gostr3412-2015-kuznyechik 2	: id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac
 
 id-tc26-algorithms 6	: id-tc26-agreement
 id-tc26-agreement 1	: id-tc26-agreement-gost-3410-2012-256
 id-tc26-agreement 2	: id-tc26-agreement-gost-3410-2012-512
 
+id-tc26-algorithms 7	:	id-tc26-wrap
+id-tc26-wrap 1	: id-tc26-wrap-gostr3412-2015-magma
+id-tc26-wrap-gostr3412-2015-magma 1	: id-tc26-wrap-gostr3412-2015-magma-kexp15
+id-tc26-wrap 2	: id-tc26-wrap-gostr3412-2015-kuznyechik
+id-tc26-wrap-gostr3412-2015-magma 1	: id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15
+
 id-tc26 2 		: id-tc26-constants
 
 id-tc26-constants 1	: id-tc26-sign-constants
 id-tc26-sign-constants 1: id-tc26-gost-3410-2012-256-constants
 id-tc26-gost-3410-2012-256-constants 1	: id-tc26-gost-3410-2012-256-paramSetA: GOST R 34.10-2012 (256 bit) ParamSet A
+id-tc26-gost-3410-2012-256-constants 2	: id-tc26-gost-3410-2012-256-paramSetB: GOST R 34.10-2012 (256 bit) ParamSet B
+id-tc26-gost-3410-2012-256-constants 3	: id-tc26-gost-3410-2012-256-paramSetC: GOST R 34.10-2012 (256 bit) ParamSet C
+id-tc26-gost-3410-2012-256-constants 4	: id-tc26-gost-3410-2012-256-paramSetD: GOST R 34.10-2012 (256 bit) ParamSet D
 id-tc26-sign-constants 2: id-tc26-gost-3410-2012-512-constants
 id-tc26-gost-3410-2012-512-constants 0	: id-tc26-gost-3410-2012-512-paramSetTest: GOST R 34.10-2012 (512 bit) testing parameter set
 id-tc26-gost-3410-2012-512-constants 1	: id-tc26-gost-3410-2012-512-paramSetA: GOST R 34.10-2012 (512 bit) ParamSet A
@@ -1374,6 +1389,14 @@ member-body 643 100 112	: issuerSignTool	: Signing Tool of Issuer
 			: grasshopper-cfb
 			: grasshopper-mac
 
+#GOST R34.13-2015 Magma
+			: magma-ecb
+			: magma-ctr
+			: magma-ofb
+			: magma-cbc
+			: magma-cfb
+			: magma-mac
+
 # Definitions for Camellia cipher - CBC MODE
 
 1 2 392 200011 61 1 1 1 2 : CAMELLIA-128-CBC		: camellia-128-cbc

crypto/poly1305/poly1305_ameth.c

@@ -67,6 +67,25 @@ static int poly1305_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
     return 1;
 }
 
+static int poly1305_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
+                                 size_t *len)
+{
+    ASN1_OCTET_STRING *os = (ASN1_OCTET_STRING *)pkey->pkey.ptr;
+
+    if (priv == NULL) {
+        *len = POLY1305_KEY_SIZE;
+        return 1;
+    }
+
+    if (os == NULL || *len < POLY1305_KEY_SIZE)
+        return 0;
+
+    memcpy(priv, ASN1_STRING_get0_data(os), ASN1_STRING_length(os));
+    *len = POLY1305_KEY_SIZE;
+
+    return 1;
+}
+
 const EVP_PKEY_ASN1_METHOD poly1305_asn1_meth = {
     EVP_PKEY_POLY1305,
     EVP_PKEY_POLY1305,
@@ -98,4 +117,6 @@ const EVP_PKEY_ASN1_METHOD poly1305_asn1_meth = {
 
     poly1305_set_priv_key,
     NULL,
+    poly1305_get_priv_key,
+    NULL,
 };

crypto/rand/rand_unix.c

@@ -229,17 +229,9 @@ static size_t sysctl_random(char *buf, size_t buflen)
  */
 int syscall_random(void *buf, size_t buflen)
 {
-    union {
-        void *p;
-        int (*f)(void *buffer, size_t length);
-    } p_getentropy;
-
     /*
      * Do runtime detection to find getentropy().
      *
-     * We could cache the result of the lookup, but we normally don't
-     * call this function often.
-     *
      * Known OSs that should support this:
      * - Darwin since 16 (OSX 10.12, IOS 10.0).
      * - Solaris since 11.3
@@ -247,9 +239,27 @@ int syscall_random(void *buf, size_t buflen)
      * - Linux since 3.17 with glibc 2.25
      * - FreeBSD since 12.0 (1200061)
      */
+#  if defined(__GNUC__) && __GNUC__>=2 && defined(__ELF__)
+    extern int getentropy(void *bufer, size_t length) __attribute__((weak));
+
+    if (getentropy != NULL)
+        return getentropy(buf, buflen) == 0 ? buflen : 0;
+#  else
+    union {
+        void *p;
+        int (*f)(void *buffer, size_t length);
+    } p_getentropy;
+
+    /*
+     * We could cache the result of the lookup, but we normally don't
+     * call this function often.
+     */
+    ERR_set_mark();
     p_getentropy.p = DSO_global_lookup("getentropy");
+    ERR_pop_to_mark();
     if (p_getentropy.p != NULL)
         return p_getentropy.f(buf, buflen) == 0 ? buflen : 0;
+#  endif
 
     /* Linux supports this since version 3.17 */
 #  if defined(__linux) && defined(SYS_getrandom)

crypto/siphash/siphash_ameth.c

@@ -68,6 +68,25 @@ static int siphash_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
     return 1;
 }
 
+static int siphash_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
+                                size_t *len)
+{
+    ASN1_OCTET_STRING *os = (ASN1_OCTET_STRING *)pkey->pkey.ptr;
+
+    if (priv == NULL) {
+        *len = SIPHASH_KEY_SIZE;
+        return 1;
+    }
+
+    if (os == NULL || *len < SIPHASH_KEY_SIZE)
+        return 0;
+
+    memcpy(priv, ASN1_STRING_get0_data(os), ASN1_STRING_length(os));
+    *len = SIPHASH_KEY_SIZE;
+
+    return 1;
+}
+
 const EVP_PKEY_ASN1_METHOD siphash_asn1_meth = {
     EVP_PKEY_SIPHASH,
     EVP_PKEY_SIPHASH,
@@ -99,4 +118,6 @@ const EVP_PKEY_ASN1_METHOD siphash_asn1_meth = {
 
     siphash_set_priv_key,
     NULL,
+    siphash_get_priv_key,
+    NULL,
 };

crypto/srp/srp_vfy.c

@@ -189,7 +189,7 @@ static SRP_user_pwd *SRP_user_pwd_new(void)
     SRP_user_pwd *ret;
     
     if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) {
-        /* SRPerr(SRP_F_SRP_USER_PWD_NEW, ERR_R_MALLOC_FAILURE); */
+        /* SRPerr(SRP_F_SRP_USER_PWD_NEW, ERR_R_MALLOC_FAILURE); */ /*ckerr_ignore*/
         return NULL;
     }
     ret->N = NULL;

crypto/x509/x509type.c

@@ -35,6 +35,9 @@ int X509_certificate_type(const X509 *x, const EVP_PKEY *pkey)
 /*              if (!sign only extension) */
         ret |= EVP_PKT_ENC;
         break;
+    case EVP_PKEY_RSA_PSS:
+        ret = EVP_PK_RSA | EVP_PKT_SIGN;
+        break;
     case EVP_PKEY_DSA:
         ret = EVP_PK_DSA | EVP_PKT_SIGN;
         break;

doc/man1/s_client.pod

@@ -23,9 +23,19 @@ B<openssl> B<s_client>
 [B<-certform DER|PEM>]
 [B<-key filename>]
 [B<-keyform DER|PEM>]
+[B<-cert_chain filename>]
+[B<-build_chain>]
+[B<-xkey>]
+[B<-xcert>]
+[B<-xchain>]
+[B<-xchain_build>]
+[B<-xcertform PEM|DER>]
+[B<-xkeyform PEM|DER>]
 [B<-pass arg>]
 [B<-CApath directory>]
 [B<-CAfile filename>]
+[B<-chainCApath directory>]
+[B<-chainCAfile filename>]
 [B<-no-CAfile>]
 [B<-no-CApath>]
 [B<-requestCAfile filename>]
@@ -60,6 +70,7 @@ B<openssl> B<s_client>
 [B<-verify_hostname hostname>]
 [B<-verify_ip ip>]
 [B<-verify_name name>]
+[B<-build_chain>]
 [B<-x509_strict>]
 [B<-reconnect>]
 [B<-showcerts>]
@@ -212,6 +223,34 @@ be used.
 
 The private format to use: DER or PEM. PEM is the default.
 
+=item B<-cert_chain>
+
+A file containing trusted certificates to use when attempting to build the
+client/server certificate chain related to the certificate specified via the
+B<-cert> option.
+
+=item B<-build_chain>
+
+Specify whether the application should build the certificate chain to be
+provided to the server.
+
+=item B<-xkey infile>, B<-xcert infile>, B<-xchain>
+
+Specify an extra certificate, private key and certificate chain. These behave
+in the same manner as the B<-cert>, B<-key> and B<-cert_chain> options.  When
+specified, the callback returning the first valid chain will be in use by the
+client.
+
+=item B<-xchain_build>
+
+Specify whether the application should build the certificate chain to be
+provided to the server for the extra certificates provided via B<-xkey infile>,
+B<-xcert infile>, B<-xchain> options.
+
+=item B<-xcertform PEM|DER>, B<-xkeyform PEM|DER>
+
+Extra certificate and private key format respectively.
+
 =item B<-pass arg>
 
 the private key password source. For more information about the format of B<arg>
@@ -240,7 +279,7 @@ set multiple options. See the L<x509(1)> manual page for details.
 =item B<-CApath directory>
 
 The directory to use for server certificate verification. This directory
-must be in "hash format", see B<verify> for more information. These are
+must be in "hash format", see L<verify(1)> for more information. These are
 also used when building the client certificate chain.
 
 =item B<-CAfile file>
@@ -248,6 +287,16 @@ also used when building the client certificate chain.
 A file containing trusted certificates to use during server authentication
 and to use when attempting to build the client certificate chain.
 
+=item B<-chainCApath directory>
+
+The directory to use for building the chain provided to the server. This
+directory must be in "hash format", see L<verify(1)> for more information.
+
+=item B<-chainCAfile file>
+
+A file containing trusted certificates to use when attempting to build the
+client certificate chain.
+
 =item B<-no-CAfile>
 
 Do not load the trusted CA certificates from the default file location

doc/man1/s_server.pod

@@ -246,6 +246,17 @@ certificate and some require a certificate with a certain public key type:
 for example the DSS cipher suites require a certificate containing a DSS
 (DSA) key. If not specified then the filename "server.pem" will be used.
 
+=item B<-cert_chain>
+
+A file containing trusted certificates to use when attempting to build the
+client/server certificate chain related to the certificate specified via the
+B<-cert> option.
+
+=item B<-build_chain>
+
+Specify whether the application should build the certificate chain to be
+provided to the client.
+
 =item B<-nameopt val>
 
 Option which determines how the subject or issuer names are displayed. The
@@ -295,10 +306,33 @@ and some a DSS (DSA) key. By using RSA and DSS certificates and keys
 a server can support clients which only support RSA or DSS cipher suites
 by using an appropriate certificate.
 
+=item B<-dcert_chain>
+
+A file containing trusted certificates to use when attempting to build the
+server certificate chain when a certificate specified via the B<-dcert> option
+is in use.
+
 =item B<-dcertform PEM|DER>, B<-dkeyform PEM|DER>, B<-dpass val>
 
 Additional certificate and private key format and passphrase respectively.
 
+=item B<-xkey infile>, B<-xcert infile>, B<-xchain>
+
+Specify an extra certificate, private key and certificate chain. These behave
+in the same manner as the B<-cert>, B<-key> and B<-cert_chain> options.  When
+specified, the callback returning the first valid chain will be in use by
+the server.
+
+=item B<-xchain_build>
+
+Specify whether the application should build the certificate chain to be
+provided to the client for the extra certificates provided via B<-xkey infile>,
+B<-xcert infile>, B<-xchain> options.
+
+=item B<-xcertform PEM|DER>, B<-xkeyform PEM|DER>
+
+Extra certificate and private key format respectively.
+
 =item B<-nbio_test>
 
 Tests non blocking I/O.
@@ -333,9 +367,19 @@ a certificate is requested.
 =item B<-CApath dir>
 
 The directory to use for client certificate verification. This directory
-must be in "hash format", see B<verify> for more information. These are
+must be in "hash format", see L<verify(1)> for more information. These are
 also used when building the server certificate chain.
 
+=item B<-chainCApath dir>
+
+The directory to use for building the chain provided to the client. This
+directory must be in "hash format", see L<verify(1)> for more information.
+
+=item B<-chainCAfile file>
+
+A file containing trusted certificates to use when attempting to build the
+server certificate chain.
+
 =item B<-no-CAfile>
 
 Do not load the trusted CA certificates from the default file location.

doc/man3/BUF_MEM_new.pod

@@ -6,8 +6,6 @@ BUF_MEM_new, BUF_MEM_new_ex, BUF_MEM_free, BUF_MEM_grow,
 BUF_MEM_grow_clean, BUF_reverse
 - simple character array structure
 
-standard C library equivalents
-
 =head1 SYNOPSIS
 
  #include <openssl/buffer.h>

doc/man3/DSA_sign.pod

@@ -23,13 +23,12 @@ digest B<dgst> using the private key B<dsa> and places its ASN.1 DER
 encoding at B<sigret>. The length of the signature is places in
 *B<siglen>. B<sigret> must point to DSA_size(B<dsa>) bytes of memory.
 
-DSA_sign_setup() may be used to precompute part of the signing
+DSA_sign_setup() is defined only for backward binary compatibility and
-operation in case signature generation is time-critical. It expects
+should not be used.
-B<dsa> to contain DSA parameters. It places the precomputed values
+Since OpenSSL 1.1.0 the DSA type is opaque and the output of
-in newly allocated B<BIGNUM>s at *B<kinvp> and *B<rp>, after freeing
+DSA_sign_setup() cannot be used anyway: calling this function will only
-the old ones unless *B<kinvp> and *B<rp> are NULL. These values may
+cause overhead, and does not affect the actual signature
-be passed to DSA_sign() in B<dsa-E<gt>kinv> and B<dsa-E<gt>r>.
+(pre-)computation.
-B<ctx> is a pre-allocated B<BN_CTX> or NULL.
 
 DSA_verify() verifies that the signature B<sigbuf> of size B<siglen>
 matches a given message digest B<dgst> of size B<len>.

doc/man3/EVP_PKEY_ASN1_METHOD.pod

@@ -21,6 +21,8 @@ EVP_PKEY_asn1_set_param_check,
 EVP_PKEY_asn1_set_security_bits,
 EVP_PKEY_asn1_set_set_priv_key,
 EVP_PKEY_asn1_set_set_pub_key,
+EVP_PKEY_asn1_set_get_priv_key,
+EVP_PKEY_asn1_set_get_pub_key,
 EVP_PKEY_get0_asn1
 - manipulating and registering EVP_PKEY_ASN1_METHOD structure
 
@@ -125,6 +127,16 @@ EVP_PKEY_get0_asn1
                                                         const unsigned char *pub,
                                                         size_t len));
 
+ void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
+                                     int (*get_priv_key) (const EVP_PKEY *pk,
+                                                          unsigned char *priv,
+                                                          size_t *len));
+
+ void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
+                                    int (*get_pub_key) (const EVP_PKEY *pk,
+                                                        unsigned char *pub,
+                                                        size_t *len));
+
  const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
 
 =head1 DESCRIPTION
@@ -390,8 +402,9 @@ EVP_PKEY_asn1_set_param(), EVP_PKEY_asn1_set_free(),
 EVP_PKEY_asn1_set_ctrl(), EVP_PKEY_asn1_set_item(),
 EVP_PKEY_asn1_set_siginf(), EVP_PKEY_asn1_set_check(),
 EVP_PKEY_asn1_set_public_check(), EVP_PKEY_asn1_set_param_check(),
-EVP_PKEY_asn1_set_security_bits(), EVP_PKEY_asn1_set_set_priv_key() and
+EVP_PKEY_asn1_set_security_bits(), EVP_PKEY_asn1_set_set_priv_key(),
-EVP_PKEY_asn1_set_set_pub_key() set the diverse methods of the given
+EVP_PKEY_asn1_set_set_pub_key(), EVP_PKEY_asn1_set_get_priv_key() and
+EVP_PKEY_asn1_set_get_pub_key() set the diverse methods of the given
 B<EVP_PKEY_ASN1_METHOD> object.
 
 EVP_PKEY_get0_asn1() finds the B<EVP_PKEY_ASN1_METHOD> associated

doc/man3/EVP_PKEY_new.pod

@@ -8,8 +8,10 @@ EVP_PKEY_free,
 EVP_PKEY_new_raw_private_key,
 EVP_PKEY_new_raw_public_key,
 EVP_PKEY_new_CMAC_key,
-EVP_PKEY_new_mac_key
+EVP_PKEY_new_mac_key,
-- public/private key allocation functions
+EVP_PKEY_get_raw_private_key,
+EVP_PKEY_get_raw_public_key
+- public/private key allocation and raw key handling functions
 
 =head1 SYNOPSIS
 
@@ -28,10 +30,16 @@ EVP_PKEY_new_mac_key
  EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, const unsigned char *key,
                                 int keylen);
 
+ int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
+                                  size_t *len);
+ int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
+                                 size_t *len);
+
 =head1 DESCRIPTION
 
 The EVP_PKEY_new() function allocates an empty B<EVP_PKEY> structure which is
-used by OpenSSL to store private keys. The reference count is set to B<1>.
+used by OpenSSL to store public and private keys. The reference count is set to
+B<1>.
 
 EVP_PKEY_up_ref() increments the reference count of B<key>.
 
@@ -63,14 +71,32 @@ creation of a CMAC in the B<cipher> argument.
 EVP_PKEY_new_mac_key() works in the same way as EVP_PKEY_new_raw_private_key().
 New applications should use EVP_PKEY_new_raw_private_key() instead.
 
+EVP_PKEY_get_raw_private_key() fills the buffer provided by B<priv> with raw
+private key data. The number of bytes written is populated in B<*len>. If the
+buffer B<priv> is NULL then B<*len> is populated with the number of bytes
+required to hold the key. The calling application is responsible for ensuring
+that the buffer is large enough to receive the private key data. This function
+only works for algorithms that support raw private keys. Currently this is:
+B<EVP_PKEY_HMAC>, B<EVP_PKEY_POLY1305>, B<EVP_PKEY_SIPHASH>, B<EVP_PKEY_X25519>,
+B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>.
+
+EVP_PKEY_get_raw_public_key() fills the buffer provided by B<pub> with raw
+public key data. The number of bytes written is populated in B<*len>. If the
+buffer B<pub> is NULL then B<*len> is populated with the number of bytes
+required to hold the key. The calling application is responsible for ensuring
+that the buffer is large enough to receive the public key data. This function
+only works for algorithms that support raw public  keys. Currently this is:
+B<EVP_PKEY_X25519>, B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>.
+
 =head1 NOTES
 
 The B<EVP_PKEY> structure is used by various OpenSSL functions which require a
 general private key without reference to any particular algorithm.
 
-The structure returned by EVP_PKEY_new() is empty. To add a private key to this
+The structure returned by EVP_PKEY_new() is empty. To add a private or public
-empty structure the functions described in L<EVP_PKEY_set1_RSA(3)> should be
+key to this empty structure use the appropriate functions described in
-used.
+L<EVP_PKEY_set1_RSA(3)>, L<EVP_PKEY_set1_DSA>, L<EVP_PKEY_set1_DH> or
+L<EVP_PKEY_set1_EC_KEY>.
 
 =head1 RETURN VALUES
 
@@ -78,19 +104,22 @@ EVP_PKEY_new(), EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key(),
 EVP_PKEY_new_CMAC_key() and EVP_PKEY_new_mac_key() return either the newly
 allocated B<EVP_PKEY> structure or B<NULL> if an error occurred.
 
-EVP_PKEY_up_ref() returns 1 for success and 0 for failure.
+EVP_PKEY_up_ref(), EVP_PKEY_get_raw_private_key() and
+EVP_PKEY_get_raw_public_key() return 1 for success and 0 for failure.
 
 =head1 SEE ALSO
 
-L<EVP_PKEY_set1_RSA(3)>
+L<EVP_PKEY_set1_RSA(3)>, L<EVP_PKEY_set1_DSA>, L<EVP_PKEY_set1_DH> or
+L<EVP_PKEY_set1_EC_KEY>
 
 =head1 HISTORY
 
 EVP_PKEY_new() and EVP_PKEY_free() exist in all versions of OpenSSL.
 
 EVP_PKEY_up_ref() was first added to OpenSSL 1.1.0.
-EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key() and
+EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key(),
-EVP_PKEY_new_CMAC_key() were first added to OpenSSL 1.1.1.
+EVP_PKEY_new_CMAC_key(), EVP_PKEY_new_raw_private_key() and
+EVP_PKEY_get_raw_public_key() were first added to OpenSSL 1.1.1.
 
 =head1 COPYRIGHT
 

doc/man3/SSL_get_current_cipher.pod

@@ -15,7 +15,7 @@ SSL_get_pending_cipher - get SSL_CIPHER of a connection
 
  const char *SSL_get_cipher_name(const SSL *s);
  const char *SSL_get_cipher(const SSL *s);
- int SSL_get_cipher_bits(const SSL *s, int *np) \
+ int SSL_get_cipher_bits(const SSL *s, int *np);
  const char *SSL_get_cipher_version(const SSL *s);
 
 =head1 DESCRIPTION

doc/man3/X509v3_get_ext_by_NID.pod

@@ -115,8 +115,8 @@ initial extension will not be checked.
 
 X509v3_get_ext_count() returns the extension count.
 
-X509v3_get_ext() and X509v3_delete_ext() return an B<X509_EXTENSION> pointer
+X509v3_get_ext(), X509v3_delete_ext() and X509_delete_ext() return an
-or B<NULL> if an error occurs.
+B<X509_EXTENSION> pointer or B<NULL> if an error occurs.
 
 X509v3_get_ext_by_NID() X509v3_get_ext_by_OBJ() and
 X509v3_get_ext_by_critical() return the an extension index or B<-1> if an
@@ -124,6 +124,8 @@ error occurs.
 
 X509v3_add_ext() returns a stack of extensions or B<NULL> on error.
 
+X509_add_ext() returns 1 on success and 0 on error.
+
 =head1 SEE ALSO
 
 L<X509V3_get_d2i(3)>

doc/man7/ossl_store-file.pod

@@ -47,17 +47,14 @@ only).
 
 When needed, the 'file' scheme loader will require a pass phrase by
 using the C<UI_METHOD> that was passed via OSSL_STORE_open().
-This pass phrase is used as it is, which may present some challenge
+This pass phrase is expected to be UTF-8 encoded, anything else will
-when the file that's loaded contains a PKCS#12 object.
+give an undefined result.
+The files made accessible through this loader are expected to be
+standard compliant with regards to pass phrase encoding.
+Files that aren't should be re-generated with a correctly encoded pass
+phrase.
 See L<passphrase-encoding(7)> for more information.
 
-=begin comment
-
-The treatment of pass phrases is currently being worked on and may
-change.
-
-=end comment
-
 =head1 SEE ALSO
 
 L<ossl_store(7)>, L<passphrase-encoding(7)>

doc/man7/ossl_store.pod

@@ -33,6 +33,13 @@ dynamically from the calling application or from a loadable engine.
 Support for the 'file' scheme is built into C<libcrypto>.
 See L<ossl_store-file(7)> for more information.
 
+=head2 UI_METHOD and pass phrases
+
+The B<OSS_STORE> API does nothing to enforce any specific format or
+encoding on the pass phrase that the B<UI_METHOD> provides.  However,
+the pass phrase is expected to be UTF-8 encoded.  The result of any
+other encoding is undefined.
+
 =head1 EXAMPLES
 
 =head2 A generic call

doc/man7/passphrase-encoding.pod

@@ -4,7 +4,7 @@
 
 =head1 NAME
 
-password encoding
+passphrase-encoding
 - How diverse parts of OpenSSL treat pass phrases character encoding
 
 =head1 DESCRIPTION
@@ -61,11 +61,11 @@ OpenSSL still does this, to be able to read files produced with older versions.
 
 It should be noted that this approach isn't entirely fault free.
 
-A passphrase encoded in ISO-8859-2 could very well have a sequence such as
+A pass phrase encoded in ISO-8859-2 could very well have a sequence such as
 0xC3 0xAF (which is the two characters "LATIN CAPITAL LETTER A WITH BREVE"
 and "LATIN CAPITAL LETTER Z WITH DOT ABOVE" in ISO-8859-2 encoding), but would
 be misinterpreted as the perfectly valid UTF-8 encoded code point U+00EF (LATIN
-SMALL LETTER I WITH DIARESIS) I<if the passphrase doesn't contain anything that
+SMALL LETTER I WITH DIARESIS) I<if the pass phrase doesn't contain anything that
 would be invalid UTF-8>.
 A pass phrase that contains this kind of byte sequence will give a different
 outcome in OpenSSL 1.1.0 and newer than in OpenSSL older than 1.1.0.
@@ -80,13 +80,11 @@ than 1.1.0 was misinterpreted as ISO-8859-1 sequences.
 
 L<ossl_store(7)> acts as a general interface to access all kinds of objects,
 potentially protected with a pass phrase, a PIN or something else.
-This API currently doesn't stipulate any specific encoding of pass phrases, but
+This API stipulates that pass phrases should be UTF-8 encoded, and that any
-uses the underlying routines with their behaviours.
+other pass phrase encoding may give undefined results.
-This means that when using the built-in C<file:> scheme loader, the pass phrase
+This API relies on the application to ensure UTF-8 encoding, and doesn't check
-to unlock a PKCS#12 file will be treated as described for PKCS#12 above, and
+that this is the case, so what it gets, it will also pass to the underlying
-the pass phrase for a PEM files will be treated as the general case described
+loader.
-above, since that loader uses the same underlying routines.
-I<Note that other loaders will have their own behaviours>.
 
 =head1 RECOMMENDATIONS
 
@@ -135,7 +133,7 @@ following:
 
 =item 1.
 
-Try the password that you have as it is in the character encoding of your
+Try the pass phrase that you have as it is in the character encoding of your
 environment.
 It's possible that its byte sequence is exactly right.
 

fuzz/oids.txt

@@ -1047,3 +1047,17 @@ OBJ_uacurve9="\x2A\x86\x24\x02\x01\x01\x01\x01\x03\x01\x01\x02\x09"
 OBJ_ieee="\x2B\x6F"
 OBJ_ieee_siswg="\x2B\x6F\x02\x8C\x53"
 OBJ_sm2="\x2A\x81\x1C\xCF\x55\x01\x82\x2D"
+OBJ_id_tc26_cipher_gostr3412_2015_magma="\x2A\x85\x03\x07\x01\x01\x05\x01"
+OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm="\x2A\x85\x03\x07\x01\x01\x05\x01\x01"
+OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac="\x2A\x85\x03\x07\x01\x01\x05\x01\x02"
+OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik="\x2A\x85\x03\x07\x01\x01\x05\x02"
+OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm="\x2A\x85\x03\x07\x01\x01\x05\x02\x01"
+OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac="\x2A\x85\x03\x07\x01\x01\x05\x02\x02"
+OBJ_id_tc26_wrap="\x2A\x85\x03\x07\x01\x01\x07"
+OBJ_id_tc26_wrap_gostr3412_2015_magma="\x2A\x85\x03\x07\x01\x01\x07\x01"
+OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15="\x2A\x85\x03\x07\x01\x01\x07\x01\x01"
+OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik="\x2A\x85\x03\x07\x01\x01\x07\x02"
+OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15="\x2A\x85\x03\x07\x01\x01\x07\x01\x01"
+OBJ_id_tc26_gost_3410_2012_256_paramSetB="\x2A\x85\x03\x07\x01\x02\x01\x01\x02"
+OBJ_id_tc26_gost_3410_2012_256_paramSetC="\x2A\x85\x03\x07\x01\x02\x01\x01\x03"
+OBJ_id_tc26_gost_3410_2012_256_paramSetD="\x2A\x85\x03\x07\x01\x02\x01\x01\x04"

include/openssl/evp.h

@@ -1238,6 +1238,14 @@ void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*set_pub_key) (EVP_PKEY *pk,
                                                        const unsigned char *pub,
                                                        size_t len));
+void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
+                                    int (*get_priv_key) (const EVP_PKEY *pk,
+                                                         unsigned char *priv,
+                                                         size_t *len));
+void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
+                                   int (*get_pub_key) (const EVP_PKEY *pk,
+                                                       unsigned char *pub,
+                                                       size_t *len));
 
 void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
                                      int (*pkey_security_bits) (const EVP_PKEY
@@ -1352,6 +1360,11 @@ EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
 EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
                                       const unsigned char *pub,
                                       size_t len);
+int EVP_PKEY_get_raw_private_key(const EVP_PKEY *pkey, unsigned char *priv,
+                                 size_t *len);
+int EVP_PKEY_get_raw_public_key(const EVP_PKEY *pkey, unsigned char *pub,
+                                size_t *len);
+
 EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
                                 size_t len, const EVP_CIPHER *cipher);
 

include/openssl/evperr.h

@@ -79,6 +79,8 @@ int ERR_load_EVP_strings(void);
 # define EVP_F_EVP_PKEY_GET0_POLY1305                     184
 # define EVP_F_EVP_PKEY_GET0_RSA                          121
 # define EVP_F_EVP_PKEY_GET0_SIPHASH                      172
+# define EVP_F_EVP_PKEY_GET_RAW_PRIVATE_KEY               202
+# define EVP_F_EVP_PKEY_GET_RAW_PUBLIC_KEY                203
 # define EVP_F_EVP_PKEY_KEYGEN                            146
 # define EVP_F_EVP_PKEY_KEYGEN_INIT                       147
 # define EVP_F_EVP_PKEY_METH_ADD0                         194
@@ -139,6 +141,7 @@ int ERR_load_EVP_strings(void);
 # define EVP_R_EXPECTING_A_POLY1305_KEY                   164
 # define EVP_R_EXPECTING_A_SIPHASH_KEY                    175
 # define EVP_R_FIPS_MODE_NOT_SUPPORTED                    167
+# define EVP_R_GET_RAW_KEY_FAILED                         182
 # define EVP_R_ILLEGAL_SCRYPT_PARAMETERS                  171
 # define EVP_R_INITIALIZATION_ERROR                       134
 # define EVP_R_INPUT_NOT_INITIALIZED                      111

include/openssl/obj_mac.h

@@ -4218,6 +4218,30 @@
 #define NID_id_tc26_cipher              990
 #define OBJ_id_tc26_cipher              OBJ_id_tc26_algorithms,5L
 
+#define SN_id_tc26_cipher_gostr3412_2015_magma          "id-tc26-cipher-gostr3412-2015-magma"
+#define NID_id_tc26_cipher_gostr3412_2015_magma         1173
+#define OBJ_id_tc26_cipher_gostr3412_2015_magma         OBJ_id_tc26_cipher,1L
+
+#define SN_id_tc26_cipher_gostr3412_2015_magma_ctracpkm         "id-tc26-cipher-gostr3412-2015-magma-ctracpkm"
+#define NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm                1174
+#define OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm                OBJ_id_tc26_cipher_gostr3412_2015_magma,1L
+
+#define SN_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac            "id-tc26-cipher-gostr3412-2015-magma-ctracpkm-omac"
+#define NID_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac           1175
+#define OBJ_id_tc26_cipher_gostr3412_2015_magma_ctracpkm_omac           OBJ_id_tc26_cipher_gostr3412_2015_magma,2L
+
+#define SN_id_tc26_cipher_gostr3412_2015_kuznyechik             "id-tc26-cipher-gostr3412-2015-kuznyechik"
+#define NID_id_tc26_cipher_gostr3412_2015_kuznyechik            1176
+#define OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik            OBJ_id_tc26_cipher,2L
+
+#define SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm            "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm"
+#define NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm           1177
+#define OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm           OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik,1L
+
+#define SN_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac               "id-tc26-cipher-gostr3412-2015-kuznyechik-ctracpkm-omac"
+#define NID_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac              1178
+#define OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik_ctracpkm_omac              OBJ_id_tc26_cipher_gostr3412_2015_kuznyechik,2L
+
 #define SN_id_tc26_agreement            "id-tc26-agreement"
 #define NID_id_tc26_agreement           991
 #define OBJ_id_tc26_agreement           OBJ_id_tc26_algorithms,6L
@@ -4230,6 +4254,26 @@
 #define NID_id_tc26_agreement_gost_3410_2012_512                993
 #define OBJ_id_tc26_agreement_gost_3410_2012_512                OBJ_id_tc26_agreement,2L
 
+#define SN_id_tc26_wrap         "id-tc26-wrap"
+#define NID_id_tc26_wrap                1179
+#define OBJ_id_tc26_wrap                OBJ_id_tc26_algorithms,7L
+
+#define SN_id_tc26_wrap_gostr3412_2015_magma            "id-tc26-wrap-gostr3412-2015-magma"
+#define NID_id_tc26_wrap_gostr3412_2015_magma           1180
+#define OBJ_id_tc26_wrap_gostr3412_2015_magma           OBJ_id_tc26_wrap,1L
+
+#define SN_id_tc26_wrap_gostr3412_2015_magma_kexp15             "id-tc26-wrap-gostr3412-2015-magma-kexp15"
+#define NID_id_tc26_wrap_gostr3412_2015_magma_kexp15            1181
+#define OBJ_id_tc26_wrap_gostr3412_2015_magma_kexp15            OBJ_id_tc26_wrap_gostr3412_2015_magma,1L
+
+#define SN_id_tc26_wrap_gostr3412_2015_kuznyechik               "id-tc26-wrap-gostr3412-2015-kuznyechik"
+#define NID_id_tc26_wrap_gostr3412_2015_kuznyechik              1182
+#define OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik              OBJ_id_tc26_wrap,2L
+
+#define SN_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15                "id-tc26-wrap-gostr3412-2015-kuznyechik-kexp15"
+#define NID_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15               1183
+#define OBJ_id_tc26_wrap_gostr3412_2015_kuznyechik_kexp15               OBJ_id_tc26_wrap_gostr3412_2015_magma,1L
+
 #define SN_id_tc26_constants            "id-tc26-constants"
 #define NID_id_tc26_constants           994
 #define OBJ_id_tc26_constants           OBJ_id_tc26,2L
@@ -4247,6 +4291,21 @@
 #define NID_id_tc26_gost_3410_2012_256_paramSetA                1148
 #define OBJ_id_tc26_gost_3410_2012_256_paramSetA                OBJ_id_tc26_gost_3410_2012_256_constants,1L
 
+#define SN_id_tc26_gost_3410_2012_256_paramSetB         "id-tc26-gost-3410-2012-256-paramSetB"
+#define LN_id_tc26_gost_3410_2012_256_paramSetB         "GOST R 34.10-2012 (256 bit) ParamSet B"
+#define NID_id_tc26_gost_3410_2012_256_paramSetB                1184
+#define OBJ_id_tc26_gost_3410_2012_256_paramSetB                OBJ_id_tc26_gost_3410_2012_256_constants,2L
+
+#define SN_id_tc26_gost_3410_2012_256_paramSetC         "id-tc26-gost-3410-2012-256-paramSetC"
+#define LN_id_tc26_gost_3410_2012_256_paramSetC         "GOST R 34.10-2012 (256 bit) ParamSet C"
+#define NID_id_tc26_gost_3410_2012_256_paramSetC                1185
+#define OBJ_id_tc26_gost_3410_2012_256_paramSetC                OBJ_id_tc26_gost_3410_2012_256_constants,3L
+
+#define SN_id_tc26_gost_3410_2012_256_paramSetD         "id-tc26-gost-3410-2012-256-paramSetD"
+#define LN_id_tc26_gost_3410_2012_256_paramSetD         "GOST R 34.10-2012 (256 bit) ParamSet D"
+#define NID_id_tc26_gost_3410_2012_256_paramSetD                1186
+#define OBJ_id_tc26_gost_3410_2012_256_paramSetD                OBJ_id_tc26_gost_3410_2012_256_constants,4L
+
 #define SN_id_tc26_gost_3410_2012_512_constants         "id-tc26-gost-3410-2012-512-constants"
 #define NID_id_tc26_gost_3410_2012_512_constants                996
 #define OBJ_id_tc26_gost_3410_2012_512_constants                OBJ_id_tc26_sign_constants,2L
@@ -4331,6 +4390,24 @@
 #define SN_grasshopper_mac              "grasshopper-mac"
 #define NID_grasshopper_mac             1017
 
+#define SN_magma_ecb            "magma-ecb"
+#define NID_magma_ecb           1187
+
+#define SN_magma_ctr            "magma-ctr"
+#define NID_magma_ctr           1188
+
+#define SN_magma_ofb            "magma-ofb"
+#define NID_magma_ofb           1189
+
+#define SN_magma_cbc            "magma-cbc"
+#define NID_magma_cbc           1190
+
+#define SN_magma_cfb            "magma-cfb"
+#define NID_magma_cfb           1191
+
+#define SN_magma_mac            "magma-mac"
+#define NID_magma_mac           1192
+
 #define SN_camellia_128_cbc             "CAMELLIA-128-CBC"
 #define LN_camellia_128_cbc             "camellia-128-cbc"
 #define NID_camellia_128_cbc            751

ssl/record/rec_layer_s3.c

@@ -1209,6 +1209,7 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
     SSL3_RECORD *rr;
     SSL3_BUFFER *rbuf;
     void (*cb) (const SSL *ssl, int type2, int val) = NULL;
+    int is_tls13 = SSL_IS_TLS13(s);
 
     rbuf = &s->rlayer.rbuf;
 
@@ -1340,7 +1341,7 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
     if (type == SSL3_RECORD_get_type(rr)
         || (SSL3_RECORD_get_type(rr) == SSL3_RT_CHANGE_CIPHER_SPEC
             && type == SSL3_RT_HANDSHAKE && recvd_type != NULL
-            && !SSL_IS_TLS13(s))) {
+            && !is_tls13)) {
         /*
          * SSL3_RT_APPLICATION_DATA or
          * SSL3_RT_HANDSHAKE or
@@ -1524,7 +1525,8 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
             cb(s, SSL_CB_READ_ALERT, j);
         }
 
-        if (alert_level == SSL3_AL_WARNING) {
+        if (alert_level == SSL3_AL_WARNING
+                || (is_tls13 && alert_descr == SSL_AD_USER_CANCELLED)) {
             s->s3->warn_alert = alert_descr;
             SSL3_RECORD_set_read(rr);
 
@@ -1534,34 +1536,19 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
                          SSL_R_TOO_MANY_WARN_ALERTS);
                 return -1;
             }
+        }
 
-            if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
+        /*
-                s->shutdown |= SSL_RECEIVED_SHUTDOWN;
+         * Apart from close_notify the only other warning alert in TLSv1.3
-                return 0;
+         * is user_cancelled - which we just ignore.
-            }
+         */
-            /*
+        if (is_tls13 && alert_descr == SSL_AD_USER_CANCELLED) {
-             * Apart from close_notify the only other warning alert in TLSv1.3
+            goto start;
-             * is user_cancelled - which we just ignore.
+        } else if (alert_descr == SSL_AD_CLOSE_NOTIFY
-             */
+                && (is_tls13 || alert_level == SSL3_AL_WARNING)) {
-            if (SSL_IS_TLS13(s) && alert_descr != SSL_AD_USER_CANCELLED) {
+            s->shutdown |= SSL_RECEIVED_SHUTDOWN;
-                SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL3_READ_BYTES,
+            return 0;
-                         SSL_R_UNKNOWN_ALERT_TYPE);
+        } else if (alert_level == SSL3_AL_FATAL || is_tls13) {
-                return -1;
-            }
-            /*
-             * This is a warning but we receive it if we requested
-             * renegotiation and the peer denied it. Terminate with a fatal
-             * alert because if application tried to renegotiate it
-             * presumably had a good reason and expects it to succeed. In
-             * future we might have a renegotiation where we don't care if
-             * the peer refused it where we carry on.
-             */
-            if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
-                SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_READ_BYTES,
-                         SSL_R_NO_RENEGOTIATION);
-                return -1;
-            }
-        } else if (alert_level == SSL3_AL_FATAL) {
             char tmp[16];
 
             s->rwstate = SSL_NOTHING;
@@ -1574,13 +1561,23 @@ int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
             SSL3_RECORD_set_read(rr);
             SSL_CTX_remove_session(s->session_ctx, s->session);
             return 0;
-        } else {
+        } else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
-            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL3_READ_BYTES,
+            /*
-                     SSL_R_UNKNOWN_ALERT_TYPE);
+             * This is a warning but we receive it if we requested
+             * renegotiation and the peer denied it. Terminate with a fatal
+             * alert because if application tried to renegotiate it
+             * presumably had a good reason and expects it to succeed. In
+             * future we might have a renegotiation where we don't care if
+             * the peer refused it where we carry on.
+             */
+            SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL3_READ_BYTES,
+                     SSL_R_NO_RENEGOTIATION);
             return -1;
         }
 
-        goto start;
+        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL3_READ_BYTES,
+                 SSL_R_UNKNOWN_ALERT_TYPE);
+        return -1;
     }
 
     if (s->shutdown & SSL_SENT_SHUTDOWN) { /* but we have not received a

ssl/ssl_sess.c

@@ -769,11 +769,11 @@ static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
         if (lck)
             CRYPTO_THREAD_unlock(ctx->lock);
 
-        if (ret)
-            SSL_SESSION_free(r);
-
         if (ctx->remove_session_cb != NULL)
             ctx->remove_session_cb(ctx, c);
+
+        if (ret)
+            SSL_SESSION_free(r);
     } else
         ret = 0;
     return ret;

ssl/statem/extensions.c

@@ -984,7 +984,9 @@ static int final_server_name(SSL *s, unsigned int context, int sent)
         return 0;
 
     case SSL_TLSEXT_ERR_ALERT_WARNING:
-        ssl3_send_alert(s, SSL3_AL_WARNING, altmp);
+        /* TLSv1.3 doesn't have warning alerts so we suppress this */
+        if (!SSL_IS_TLS13(s))
+            ssl3_send_alert(s, SSL3_AL_WARNING, altmp);
         return 1;
 
     case SSL_TLSEXT_ERR_NOACK:

test/evp_extra_test.c

@@ -9,6 +9,7 @@
 
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <openssl/bio.h>
 #include <openssl/crypto.h>
 #include <openssl/err.h>
@@ -476,6 +477,88 @@ static int test_EVP_PKCS82PKEY(void)
 }
 #endif
 
+static struct keys_st {
+    int type;
+    char *priv;
+    char *pub;
+} keys[] = {
+    {
+        EVP_PKEY_HMAC, "0123456789", NULL
+    }, {
+        EVP_PKEY_POLY1305, "01234567890123456789012345678901", NULL
+    }, {
+        EVP_PKEY_SIPHASH, "0123456789012345", NULL
+    },
+#ifndef OPENSSL_NO_EC
+    {
+        EVP_PKEY_X25519, "01234567890123456789012345678901",
+        "abcdefghijklmnopqrstuvwxyzabcdef"
+    }, {
+        EVP_PKEY_ED25519, "01234567890123456789012345678901",
+        "abcdefghijklmnopqrstuvwxyzabcdef"
+    }, {
+        EVP_PKEY_X448,
+        "01234567890123456789012345678901234567890123456789012345",
+        "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd"
+    }, {
+        EVP_PKEY_ED448,
+        "012345678901234567890123456789012345678901234567890123456",
+        "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde"
+    }
+#endif
+};
+
+static int test_set_get_raw_keys_int(int tst, int pub)
+{
+    int ret = 0;
+    unsigned char buf[80];
+    unsigned char *in;
+    size_t inlen, len = 0;
+    EVP_PKEY *pkey;
+
+    /* Check if this algorithm supports public keys */
+    if (keys[tst].pub == NULL)
+        return 1;
+
+    memset(buf, 0, sizeof(buf));
+
+    if (pub) {
+        inlen = strlen(keys[tst].pub);
+        in = (unsigned char *)keys[tst].pub;
+        pkey = EVP_PKEY_new_raw_public_key(keys[tst].type,
+                                           NULL,
+                                           in,
+                                           inlen);
+    } else {
+        inlen = strlen(keys[tst].priv);
+        in = (unsigned char *)keys[tst].priv;
+        pkey = EVP_PKEY_new_raw_private_key(keys[tst].type,
+                                            NULL,
+                                            in,
+                                            inlen);
+    }
+
+    if (!TEST_ptr(pkey)
+            || (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, NULL, &len)))
+            || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, NULL, &len)))
+            || !TEST_true(len == inlen)
+            || (!pub && !TEST_true(EVP_PKEY_get_raw_private_key(pkey, buf, &len)))
+            || (pub && !TEST_true(EVP_PKEY_get_raw_public_key(pkey, buf, &len)))
+            || !TEST_mem_eq(in, inlen, buf, len))
+        goto done;
+
+    ret = 1;
+ done:
+    EVP_PKEY_free(pkey);
+    return ret;
+}
+
+static int test_set_get_raw_keys(int tst)
+{
+    return test_set_get_raw_keys_int(tst, 0)
+           && test_set_get_raw_keys_int(tst, 1);
+}
+
 static int pkey_custom_check(EVP_PKEY *pkey)
 {
     return 0xbeef;
@@ -581,6 +664,7 @@ int setup_tests(void)
 #ifndef OPENSSL_NO_EC
     ADD_TEST(test_EVP_PKCS82PKEY);
 #endif
+    ADD_ALL_TESTS(test_set_get_raw_keys, OSSL_NELEM(keys));
     custom_pmeth = EVP_PKEY_meth_new(0xdefaced, 0);
     if (!TEST_ptr(custom_pmeth))
         return 0;

util/ck_errf.pl

@@ -16,14 +16,85 @@
 use strict;
 use warnings;
 
+my $config;
 my $err_strict = 0;
-my $bad        = 0;
+my $debug      = 0;
+my $internal   = 0;
 
-foreach my $file (@ARGV) {
+sub help
-    if ( $file eq "-strict" ) {
+{
+    print STDERR <<"EOF";
+mkerr.pl [options] [files...]
+
+Options:
+
+    -conf FILE  Use the named config file FILE instead of the default.
+
+    -debug      Verbose output debugging on stderr.
+
+    -internal   Generate code that is to be built as part of OpenSSL itself.
+                Also scans internal list of files.
+
+    -strict     If any error was found, fail with exit code 1, otherwise 0.
+
+    -help       Show this help text.
+
+    ...         Additional arguments are added to the file list to scan,
+                if '-internal' was NOT specified on the command line.
+
+EOF
+}
+
+while ( @ARGV ) {
+    my $arg = $ARGV[0];
+    last unless $arg =~ /-.*/;
+    $arg = $1 if $arg =~ /-(-.*)/;
+    if ( $arg eq "-conf" ) {
+        $config = $ARGV[1];
+        shift @ARGV;
+    } elsif ( $arg eq "-debug" ) {
+        $debug = 1;
+    } elsif ( $arg eq "-internal" ) {
+        $internal = 1;
+    } elsif ( $arg eq "-strict" ) {
         $err_strict = 1;
-        next;
+    } elsif ( $arg =~ /-*h(elp)?/ ) {
+        &help();
+        exit;
+    } elsif ( $arg =~ /-.*/ ) {
+        die "Unknown option $arg; use -h for help.\n";
     }
+    shift @ARGV;
+}
+
+my @source;
+if ( $internal ) {
+    die "Extra parameters given.\n" if @ARGV;
+    $config = "crypto/err/openssl.ec" unless defined $config;
+    @source = ( glob('crypto/*.c'), glob('crypto/*/*.c'),
+                glob('ssl/*.c'), glob('ssl/*/*.c') );
+} else {
+    die "Configuration file not given.\nSee '$0 -help' for information\n"
+        unless defined $config;
+    @source = @ARGV;
+}
+
+# To detect if there is any error generation for a libcrypto/libssl libs
+# we don't know, we need to find out what libs we do know.  That list is
+# readily available in crypto/err/openssl.ec, in form of lines starting
+# with "L ".  Note that we always rely on the modules SYS and ERR to be
+# generally available.
+my %libs       = ( SYS => 1, ERR => 1 );
+open my $cfh, $config or die "Trying to read $config: $!\n";
+while (<$cfh>) {
+    s|\R$||;                    # Better chomp
+    next unless m|^L ([0-9A-Z_]+)\s|;
+    next if $1 eq "NONE";
+    $libs{$1} = 1;
+}
+
+my $bad = 0;
+foreach my $file (@source) {
     open( IN, "<$file" ) || die "Can't open $file, $!";
     my $func = "";
     while (<IN>) {
@@ -33,17 +104,23 @@ foreach my $file (@ARGV) {
             $func = $1;
             $func =~ tr/A-Z/a-z/;
         }
-        if ( /([A-Z0-9]+)err\(([^,]+)/ && !/ckerr_ignore/ ) {
+        if ( /([A-Z0-9_]+[A-Z0-9])err\(([^,]+)/ && !/ckerr_ignore/ ) {
             my $errlib = $1;
             my $n      = $2;
 
+            unless ( $libs{$errlib} ) {
+                print "$file:$.:$errlib not listed in $config\n";
+                $libs{$errlib} = 1; # To not display it again
+                $bad = 1;
+            }
+
             if ( $func eq "" ) {
                 print "$file:$.:???:$n\n";
                 $bad = 1;
                 next;
             }
 
-            if ( $n !~ /([^_]+)_F_(.+)$/ ) {
+            if ( $n !~ /^(.+)_F_(.+)$/ ) {
                 #print "check -$file:$.:$func:$n\n";
                 next;
             }

util/libcrypto.num

@@ -4563,3 +4563,7 @@ X509_OBJECT_set1_X509                   4514	1_1_0i	EXIST::FUNCTION:
 X509_LOOKUP_meth_get_get_by_issuer_serial 4515	1_1_0i	EXIST::FUNCTION:
 X509_LOOKUP_meth_set_init               4516	1_1_0i	EXIST::FUNCTION:
 X509_OBJECT_set1_X509_CRL               4517	1_1_0i	EXIST::FUNCTION:
+EVP_PKEY_get_raw_public_key             4518	1_1_1	EXIST::FUNCTION:
+EVP_PKEY_get_raw_private_key            4519	1_1_1	EXIST::FUNCTION:
+EVP_PKEY_asn1_set_get_priv_key          4520	1_1_1	EXIST::FUNCTION:
+EVP_PKEY_asn1_set_get_pub_key           4521	1_1_1	EXIST::FUNCTION:

util/mkdef.pl

@@ -126,6 +126,7 @@ my $W32=0;
 my $NT=0;
 my $UNIX=0;
 my $linux=0;
+my $aix=0;
 # Set this to make typesafe STACK definitions appear in DEF
 my $safe_stack_def = 0;
 
@@ -171,12 +172,15 @@ foreach (@ARGV, split(/ /, $config{options}))
 	if($_ eq "NT") {
 		$W32 = 1;
 		$NT = 1;
-	}
+	} elsif ($_ eq "linux") {
-	if ($_ eq "linux") {
 		$linux=1;
 		$UNIX=1;
+	} elsif ($_ eq "aix") {
+		$aix=1;
+		$UNIX=1;
+	} elsif ($_ eq "VMS") {
+		$VMS=1;
 	}
-	$VMS=1 if $_ eq "VMS";
 	if ($_ eq "zlib" || $_ eq "enable-zlib" || $_ eq "zlib-dynamic"
 			 || $_ eq "enable-zlib-dynamic") {
 		$zlib = 1;
@@ -204,11 +208,11 @@ if (!$libname) {
 }
 
 # If no platform is given, assume WIN32
-if ($W32 + $VMS + $linux == 0) {
+if ($W32 + $VMS + $linux + $aix == 0) {
 	$W32 = 1;
 }
 die "Please, only one platform at a time"
-    if ($W32 + $VMS + $linux > 1);
+    if ($W32 + $VMS + $linux + $aix > 1);
 
 if (!$do_ssl && !$do_crypto)
 	{
@@ -1237,6 +1241,8 @@ EOF
 							$prevsymversion = $symversion;
 						}
 						print OUT "        $s2;\n";
+					} elsif ($aix) {
+						print OUT "$s2\n";
                                         } elsif ($VMS) {
                                             while(++$prevnum < $n) {
                                                 my $symline=" ,SPARE -\n  ,SPARE -\n";
@@ -1288,7 +1294,7 @@ EOF
 	} elsif ($VMS) {
             print OUT ")\n";
             (my $libvmaj, my $libvmin, my $libvedit) =
-                $currversion =~ /^(\d+)_(\d+)_(\d+)$/;
+                $currversion =~ /^(\d+)_(\d+)_(\d+)[a-z]{0,2}$/;
             # The reason to multiply the edit number with 100 is to make space
             # for the possibility that we want to encode the patch letters
             print OUT "GSMATCH=LEQUAL,",($libvmaj * 100 + $libvmin),",",($libvedit * 100),"\n";

util/perl/OpenSSL/Test.pm

@@ -20,7 +20,7 @@ $VERSION = "0.8";
                                    perlapp perltest subtest));
 @EXPORT_OK = (@Test::More::EXPORT_OK, qw(bldtop_dir bldtop_file
                                          srctop_dir srctop_file
-                                         data_file
+                                         data_file data_dir
                                          pipe with cmdstr quotify
                                          openssl_versions));