Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-04-26 08:41:22 +09:00
parent 704c3822e0
commit a7bf77581f
91 changed files with 4677 additions and 389 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man1/info.pod
+81
View File
@@ -0,0 +1,81 @@
=pod
=head1 NAME
openssl-info,
info - print OpenSSL built-in information
=head1 SYNOPSIS
B<openssl info>
[B<-help>]
[B<-configdir> | B<-c>]
[B<-enginesdir> | B<-e>]
[B<-modulesdir> | B<-m>]
[B<-dsoext>]
[B<-dirfilesep>]
[B<-listsep]>
=head1 DESCRIPTION
This command is used to print out information about OpenSSL.
The information is written exactly as it is with no extra text, which
makes useful for scripts.
As a consequence, only one item may be chosen for each run of this
command.
=head1 OPTIONS
=over 4
=item B<-help>
Print out a usage message.
=item B<-configdir>, B<-c>
Outputs the default directory for OpenSSL configuration files.
=item B<-enginesdir>, B<-e>
Outputs the default directory for OpenSSL engine modules.
=item B<-modulesdir>, B<-m>
Outputs the default directory for OpenSSL dynamically loadable modules
other than engine modules.
=item B<-dsoext>
Outputs the DSO extension OpenSSL uses.
=item B<-dirnamesep>
Outputs the separator character between a directory specification and
a file name.
Note that on some operating systems, this is not the same as the
separator between directory elements.
=item B<-listsep>
Outputs the OpenSSL list separator character.
This is typically used to construct C<$PATH> (C<%PATH%> on Windows)
style lists.
=back
=head1 HISTORY
The B<openssl info> command was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man1/kdf.pod
+167
View File
@@ -0,0 +1,167 @@
=pod
=head1 NAME
openssl-kdf,
kdf - perform Key Derivation Function operations
=head1 SYNOPSIS
B<openssl kdf>
[B<-help>]
[B<-kdfopt> I<nm:v>]
[B<-keylen> I<num>]
[B<-out> I<filename>]
[B<-binary>]
I<kdf_name>
=head1 DESCRIPTION
The key derivation functions generate a derived key from either a secret or
password.
=head1 OPTIONS
=over 4
=item B<-help>
Print a usage message.
=item B<-keylen> I<num>
The output size of the derived key. This field is required.
=item B<-out> I<filename>
Filename to output to, or standard output by default.
=item B<-binary>
Output the derived key in binary form. Uses hexadecimal text format if not specified.
=item B<-kdfopt> I<nm:v>
Passes options to the KDF algorithm.
A comprehensive list of controls can be found in the EVP_KDF_CTX implementation
documentation.
Common control strings used by EVP_KDF_ctrl_str() are:
=over 4
=item B<key:>I<string>
Specifies the secret key as an alphanumeric string (use if the key contains
printable characters only).
The string length must conform to any restrictions of the KDF algorithm.
A key must be specified for most KDF algorithms.
=item B<hexkey:>I<string>
Specifies the secret key in hexadecimal form (two hex digits per byte).
The key length must conform to any restrictions of the KDF algorithm.
A key must be specified for most KDF algorithms.
=item B<pass:>I<string>
Specifies the password as an alphanumeric string (use if the password contains
printable characters only).
The password must be specified for PBKDF2 and scrypt.
=item B<hexpass:>I<string>
Specifies the password in hexadecimal form (two hex digits per byte).
The password must be specified for PBKDF2 and scrypt.
=item B<digest:>I<string>
Specifies the name of a digest as an alphanumeric string.
To see the list of supported digests, use the command I<list -digest-commands>.
=back
=item I<kdf_name>
Specifies the name of a supported KDF algorithm which will be used.
The supported algorithms names are TLS1-PRF, HKDF, SSKDF, PBKDF2, SSHKDF and id-scrypt.
=back
=head1 EXAMPLES
Use TLS1-PRF to create a hex-encoded derived key from a secret key and seed:
openssl kdf -keylen 16 -kdfopt digest:SHA256 -kdfopt key:secret \
-kdfopt seed:seed TLS1-PRF
Use HKDF to create a hex-encoded derived key from a secret key, salt and info:
openssl kdf -keylen 10 -kdfopt digest:SHA256 -kdfopt key:secret \
-kdfopt salt:salt -kdfopt info:label HKDF
Use SSKDF with KMAC to create a hex-encoded derived key from a secret key, salt and info:
openssl kdf -keylen 64 -kdfopt mac:KMAC128 -kdfopt maclen:20 \
-kdfopt hexkey:b74a149a161545 -kdfopt hexinfo:348a37a2 \
-kdfopt hexsalt:3638271ccd68a2 SSKDF
Use SSKDF with HMAC to create a hex-encoded derived key from a secret key, salt and info:
openssl kdf -keylen 16 -kdfopt mac:HMAC -kdfopt digest:SHA256 \
-kdfopt hexkey:b74a149a -kdfopt hexinfo:348a37a2 \
-kdfopt hexsalt:3638271c SSKDF
Use SSKDF with Hash to create a hex-encoded derived key from a secret key, salt and info:
openssl kdf -keylen 14 -kdfopt digest:SHA256 \
-kdfopt hexkey:6dbdc23f045488 \
-kdfopt hexinfo:a1b2c3d4 SSKDF
Use SSHKDF to create a hex-encoded derived key from a secret key, hash and session_id:
openssl kdf -keylen 16 -kdfopt digest:SHA256 \
-kdfopt hexkey:0102030405 \
-kdfopt hexxcghash:06090A \
-kdfopt hexsession_id:01020304 \
-kdfopt type:A SSHKDF
Use PBKDF2 to create a hex-encoded derived key from a password and salt:
openssl kdf -keylen 32 -kdfopt digest:SHA256 -kdfopt pass:password \
-kdfopt salt:salt -kdfopt iter:2 PBKDF2
Use scrypt to create a hex-encoded derived key from a password and salt:
openssl kdf -keylen 64 -kdfopt pass:password -kdfopt salt:NaCl \
-kdfopt N:1024 -kdfopt r:8 -kdfopt p:16 \
-kdfopt maxmem_bytes:10485760 id-scrypt
=head1 NOTES
The KDF mechanisms that are available will depend on the options
used when building OpenSSL.
=head1 SEE ALSO
L<EVP_KDF_CTX(3)>,
L<EVP_KDF_SCRYPT(7)>
L<EVP_KDF_TLS1_PRF(7)>
L<EVP_KDF_PBKDF2(7)>
L<EVP_KDF_HKDF(7)>
L<EVP_KDF_SS(7)>
L<EVP_KDF_SSHKDF(7)>
=head1 HISTORY
Added in OpenSSL 3.0
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man1/openssl.pod
+10 -2
View File
@@ -167,6 +167,14 @@ Generation of Private Key or Parameters.
Generation of RSA Private Key. Superseded by L<genpkey(1)>.
=item B<info>
Display diverse information built into the OpenSSL libraries.
=item B<kdf>
Key Derivation Functions.
=item B<mac>
Message Authentication Code Calculation.
@@ -612,7 +620,7 @@ L<crl(1)>, L<crl2pkcs7(1)>, L<dgst(1)>,
L<dhparam(1)>, L<dsa(1)>, L<dsaparam(1)>,
L<ec(1)>, L<ecparam(1)>,
L<enc(1)>, L<engine(1)>, L<errstr(1)>, L<gendsa(1)>, L<genpkey(1)>,
L<genrsa(1)>, L<mac(1)>, L<nseq(1)>, L<ocsp(1)>,
L<genrsa(1)>, L<kdf(1)>, L<mac(1)>, L<nseq(1)>, L<ocsp(1)>,
L<passwd(1)>,
L<pkcs12(1)>, L<pkcs7(1)>, L<pkcs8(1)>,
L<pkey(1)>, L<pkeyparam(1)>, L<pkeyutl(1)>, L<prime(1)>,
@@ -632,7 +640,7 @@ manual pages.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_s_mem.pod
+16
View File
@@ -88,6 +88,22 @@ a buffering BIO to the chain will speed up the process.
Calling BIO_set_mem_buf() on a BIO created with BIO_new_secmem() will
give undefined results, including perhaps a program crash.
Switching the memory BIO from read write to read only is not supported and
can give undefined results including a program crash. There are two notable
exceptions to the rule. The first one is to assign a static memory buffer
immediately after BIO creation and set the BIO as read only.
The other supported sequence is to start with read write BIO then temporarily
switch it to read only and call BIO_reset() on the read only BIO immediately
before switching it back to read write. Before the BIO is freed it must be
switched back to the read write mode.
Calling BIO_get_mem_ptr() on read only BIO will return a BUF_MEM that
contains only the remaining data to be read. If the close status of the
BIO is set to BIO_NOCLOSE, before freeing the BUF_MEM the data pointer
in it must be set to NULL as the data pointer does not point to an
allocated memory.
=head1 BUGS
There should be an option to set the maximum size of a memory BIO.
doc/man3/ECDSA_SIG_new.pod
+1 -1
View File
@@ -200,7 +200,7 @@ ANSI X9.62, US Federal Information Processing Standard FIPS 186-2
=head1 SEE ALSO
L<DSA_new(3)>,
L<EC_KEY_new(3)>,
L<EVP_DigestSignInit(3)>,
L<EVP_DigestVerifyInit(3)>
doc/man3/EVP_KDF_CTX.pod
+3 -2
View File
@@ -151,9 +151,9 @@ The value string is expected to be the name of a MAC.
This control expects one argument: C<EVP_MD *md>
For MAC implementations that use a message digest as an underlying computation
algorithm, this control set what the digest algorithm should be.
algorithm, this control sets what the digest algorithm should be.
EVP_KDF_ctrl_str() type string: "md"
EVP_KDF_ctrl_str() type string: "digest"
The value string is expected to be the name of a digest.
@@ -232,6 +232,7 @@ L<EVP_KDF_TLS1_PRF(7)>
L<EVP_KDF_PBKDF2(7)>
L<EVP_KDF_HKDF(7)>
L<EVP_KDF_SS(7)>
L<EVP_KDF_SSHKDF(7)>
=head1 HISTORY
doc/man3/EVP_chacha20.pod
+9 -1
View File
@@ -21,7 +21,15 @@ The ChaCha20 stream cipher for EVP.
=item EVP_chacha20()
The ChaCha20 stream cipher. The key length is 256 bits, the IV is 96 bits long.
The ChaCha20 stream cipher. The key length is 256 bits, the IV is 128 bits long.
The first 32 bits consists of a counter in little-endian order followed by a 96
bit nonce. For example a nonce of:
000000000000000000000002
With an initial counter of 42 (2a in hex) would be expressed as:
2a000000000000000000000000000002
=item EVP_chacha20_poly1305()
doc/man3/OpenSSL_version.pod
+45 -2
View File
@@ -8,8 +8,8 @@ OPENSSL_VERSION_PRE_RELEASE_STR, OPENSSL_VERSION_BUILD_METADATA_STR,
OPENSSL_VERSION_TEXT,
OPENSSL_version_major, OPENSSL_version_minor, OPENSSL_version_patch,
OPENSSL_version_pre_release, OPENSSL_version_build_metadata, OpenSSL_version,
OPENSSL_VERSION_NUMBER, OpenSSL_version_num
- get OpenSSL version number
OPENSSL_VERSION_NUMBER, OpenSSL_version_num, OPENSSL_info
- get OpenSSL version number and other information
=head1 SYNOPSIS
@@ -37,6 +37,8 @@ OPENSSL_VERSION_NUMBER, OpenSSL_version_num
const char *OpenSSL_version(int t);
const char *OPENSSL_info(int t);
Deprecated:
/* from openssl/opensslv.h */
@@ -127,6 +129,47 @@ if available or "ENGINESDIR: N/A" otherwise.
For an unknown B<t>, the text "not available" is returned.
OPENSSL_info() also returns different strings depending on B<t>:
=over 4
=item OPENSSL_INFO_CONFIG_DIR
The configured C<OPENSSLDIR>, which is the default location for
OpenSSL configuration files.
=item OPENSSL_INFO_ENGINES_DIR
The configured C<ENGINESDIR>, which is the default location for
OpenSSL engines.
=item OPENSSL_INFO_MODULES_DIR
The configured C<MODULESDIR>, which is the default location for
dynamically loadable OpenSSL modules other than engines.
=item OPENSSL_INFO_DSO_EXTENSION
The configured dynamically loadable module extension.
=item OPENSSL_INFO_DIR_FILENAME_SEPARATOR
The separator between a directory specification and a file name.
Note that on some operating systems, this is not the same as the
separator between directory elements.
=item OPENSSL_INFO_LIST_SEPARATOR
The OpenSSL list separator.
This is typically used in strings that are lists of items, such as the
value of the environment variable C<$PATH> on Unix (where the
separator is ":") or C<%PATH%> on Windows (where the separator is
";").
=back
For an unknown B<t>, NULL is returned.
=head1 BACKWARD COMPATIBILITY
For compatibility, some older macros and functions are retained or
doc/man3/SSL_CTX_set_client_hello_cb.pod
+2
View File
@@ -65,6 +65,8 @@ both required, and on success the caller must release the storage allocated for
B<*out> using OPENSSL_free(). The contents of B<*out> is an array of integers
holding the numerical value of the TLS extension types in the order they appear
in the ClientHello. B<*outlen> contains the number of elements in the array.
In situations when the ClientHello has no extensions, the function will return
success with B<*out> set to NULL and B<*outlen> set to 0.
=head1 NOTES