Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-03-03 19:16:19 +09:00
parent f85de4da03
commit b412d79e8b
310 changed files with 32765 additions and 19720 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man7/EVP_MAC-BLAKE2.pod
+2 -2
View File
@@ -16,9 +16,9 @@ properties, to be used with EVP_MAC_fetch():
=over 4
=item "BLAKE2BMAC", "default=yes"
=item "BLAKE2BMAC", "provider=default"
=item "BLAKE2SMAC", "default=yes"
=item "BLAKE2SMAC", "provider=default"
=back
doc/man7/EVP_MAC-CMAC.pod
+1 -1
View File
@@ -15,7 +15,7 @@ used with EVP_MAC_fetch():
=over 4
=item "CMAC", "default=yes"
=item "CMAC", "provider=default" or "provider=fips"
=back
doc/man7/EVP_MAC-GMAC.pod
+1 -1
View File
@@ -15,7 +15,7 @@ used with EVP_MAC_fetch():
=over 4
=item "GMAC", "default=yes"
=item "GMAC", "provider=default" or "provider=fips"
=back
doc/man7/EVP_MAC-HMAC.pod
+1 -1
View File
@@ -15,7 +15,7 @@ used with EVP_MAC_fetch():
=over 4
=item "HMAC", "default=yes"
=item "HMAC", "provider=default" or "provider=fips"
=back
doc/man7/EVP_MAC-KMAC.pod
+2 -2
View File
@@ -16,9 +16,9 @@ properties, to be used with EVP_MAC_fetch():
=over 4
=item "KMAC-128", "default=yes"
=item "KMAC-128", "provider=default" or "provider=fips"
=item "KMAC-256", "default=yes"
=item "KMAC-256", "provider=default" or "provider=fips"
=back
doc/man7/EVP_MAC-Poly1305.pod
+1 -1
View File
@@ -15,7 +15,7 @@ used with EVP_MAC_fetch():
=over 4
=item "POLY1305", "default=yes"
=item "POLY1305", "provider=default"
=back
doc/man7/EVP_MAC-Siphash.pod
+1 -1
View File
@@ -15,7 +15,7 @@ used with EVP_MAC_fetch():
=over 4
=item "SIPHASH", "default=yes"
=item "SIPHASH", "provider=default"
=back
doc/man7/OSSL_PROVIDER-FIPS.pod
+6 -52
View File
@@ -17,59 +17,16 @@ One of the requirements for the FIPS module is self testing. An optional callbac
mechanism is available to return information to the user using
L<OSSL_SELF_TEST_set_callback(3)>.
The parameters passed to the callback are described in L<OSSL_SELF_TEST_new(3)>
The OPENSSL FIPS module uses the following mechanism to provide information
about the self tests as they run.
This is useful for debugging if a self test is failing.
The callback also allows forcing any self test to fail, in order to check that
it operates correctly on failure.
The 'args' parameter of B<OSSL_CALLBACK> contains the B<OPENSSL_CTX> associated
with the provider that is triggering the self test. This may be useful if
multiple fips providers are present.
The OSSL_PARAM names used are:
=over 4
=item "st-phase" (B<OSSL_PROV_PARAM_SELF_TEST_PHASE>) <UTF8 string>
Each self test calls the callback 3 times with the following string values
for the phase.
=over 4
=item "Start" (B<OSSL_SELF_TEST_PHASE_START>)
This is the initial phase before the self test has run.
This is used for informational purposes only.
The value returned by the callback is ignored.
=item "Corrupt" (B<OSSL_SELF_TEST_PHASE_CORRUPT>)
The corrupt phase is run after the self test has calculated its known value.
The callback may be used to force the self test to fail by returning a value
of 0 from the callback during this phase.
Returning any other value from the callback causes the self test to run normally.
=item "Pass" (B<OSSL_SELF_TEST_PHASE_PASS>)
=item "Fail" (B<OSSL_SELF_TEST_PHASE_FAIL>)
The final phase runs after the self test is complete and indicates if a self
test passed or failed. This is used for informational purposes only.
The value returned by the callback is ignored.
"Fail" should normally only be returned if any self test was forced to fail
during the "Corrupt" phase (or if there was an error such as the integrity
check of the module failed).
Note that all self tests run even if a self test failure occurs.
=back
=item "st-type" (B<OSSL_PROV_PARAM_SELF_TEST_TYPE>) <UTF8 string>
Used as a category to identify the type of self test being run.
It includes the following string values:
The FIPS module passes the following type(s) to OSSL_SELF_TEST_onbegin().
=over 4
@@ -126,10 +83,8 @@ All other self test categories are run once at installation time, except for the
There is only one instance of the "Module_Integrity" and "Install_Integrity"
self tests. All other self tests may have multiple instances.
=item "st-desc" (B<OSSL_PROV_PARAM_SELF_TEST_DESC>) <UTF8 string>
Used as a sub category to identify an individual self test.
The following description strings are used.
The FIPS module passes the following descriptions(s) to OSSL_SELF_TEST_onbegin().
=over 4
@@ -187,8 +142,6 @@ DRBG tests used with the "DRBG" type.
=back
=back
=head1 EXAMPLES
A simple self test callback is shown below for illustrative purposes.
@@ -241,6 +194,7 @@ A simple self test callback is shown below for illustrative purposes.
L<openssl-fipsinstall(1)>,
L<fips_config(5)>,
L<OSSL_SELF_TEST_set_callback(3)>,
L<OSSL_SELF_TEST_new(3)>,
L<OSSL_PARAM(3)>,
L<openssl-core.h(7)>
@@ -250,7 +204,7 @@ The type and functions described here were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man7/property.pod
+6 -6
View File
@@ -52,15 +52,15 @@ The full syntax for property definitions appears below.
Each implementation of an algorithm can define any number of
properties.
For example, the default provider defines the property I<default=yes>
For example, the default provider defines the property I<provider=default>
for all of its algorithms.
Likewise, the FIPS provider defines I<fips=yes> and the legacy provider
defines I<legacy=yes> for all of their algorithms.
Likewise, OpenSSL's FIPS provider defines I<provider=fips> and the legacy
provider defines I<provider=legacy> for all of their algorithms.
=head2 Queries
A I<property query clause> is a single conditional test.
For example, "fips=yes", "default!=yes" or "?iteration.count!=3".
For example, "fips=yes", "provider!=default" or "?iteration.count!=3".
The first two represent mandatory clauses, such clauses B<must> match
for any algorithm to even be under consideration.
The third clause represents an optional clause.
@@ -117,8 +117,8 @@ Ordering of optional clauses is not significant.
=head2 Shortcut
In order to permit a more concise expression of boolean properties, there
is one short cut: a property name alone (e.g. "default") is
exactly equivalent to "default=yes" in both definitions and queries.
is one short cut: a property name alone (e.g. "my.property") is
exactly equivalent to "my.property=yes" in both definitions and queries.
=head2 Global and Local
doc/man7/provider-keyexch.pod
+86 -12
View File
@@ -31,6 +31,8 @@ provider-keyexch - The keyexch library E<lt>-E<gt> provider functions
/* Key Exchange parameters */
int OP_keyexch_set_ctx_params(void *ctx, const OSSL_PARAM params[]);
const OSSL_PARAM *OP_keyexch_settable_ctx_params(void);
int OP_keyexch_get_ctx_params(void *ctx, OSSL_PARAM params[]);
const OSSL_PARAM *OP_keyexch_gettable_ctx_params(void);
=head1 DESCRIPTION
@@ -71,6 +73,8 @@ macros in L<openssl-core_numbers.h(7)>, as follows:
OP_keyexch_set_ctx_params OSSL_FUNC_KEYEXCH_SET_CTX_PARAMS
OP_keyexch_settable_ctx_params OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS
OP_keyexch_get_ctx_params OSSL_FUNC_KEYEXCH_GET_CTX_PARAMS
OP_keyexch_gettable_ctx_params OSSL_FUNC_KEYEXCH_GETTABLE_CTX_PARAMS
A key exchange algorithm implementation may not implement all of these functions.
In order to be a consistent set of functions a provider must implement
@@ -123,14 +127,35 @@ The length of the shared secret should be written to I<*secretlen>.
If I<secret> is NULL then the maximum length of the shared secret should be
written to I<*secretlen>.
=head2 Key Exchange Parameters Functions
OP_keyexch_set_ctx_params() sets key exchange parameters associated with the
given provider side key exchange context I<ctx> to I<params>,
see L</Key Exchange Parameters>.
Any parameter settings are additional to any that were previously set.
OP_keyexch_get_ctx_params() gets key exchange parameters associated with the
given provider side key exchange context I<ctx> into I<params>,
see L</Key Exchange Parameters>.
OP_keyexch_settable_ctx_params() yields a constant B<OSSL_PARAM> array that
describes the settable parameters, i.e. parameters that can be used with
OP_signature_set_ctx_params().
If OP_keyexch_settable_ctx_params() is present, OP_keyexch_set_ctx_params() must
also be present, and vice versa.
Similarly, OP_keyexch_gettable_ctx_params() yields a constant B<OSSL_PARAM>
array that describes the gettable parameters, i.e. parameters that can be
handled by OP_signature_get_ctx_params().
If OP_keyexch_gettable_ctx_params() is present, OP_keyexch_get_ctx_params() must
also be present, and vice versa.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
Notice that not all settable parameters are also gettable, and vice versa.
=head2 Key Exchange Parameters
See L<OSSL_PARAM(3)> for further details on the parameters structure used by
the OP_keyexch_set_params() function.
OP_keyexch_set_ctx_params() sets key exchange parameters associated with the
given provider side key exchange context I<ctx> to I<params>.
Any parameter settings are additional to any that were previously set.
the OP_keyexch_set_ctx_params() and OP_keyexch_get_ctx_params() functions.
Parameters currently recognised by built-in key exchange algorithms are as
follows.
@@ -150,20 +175,69 @@ If padding is on then the derived shared secret will have its first bytes filled
with 0s where necessary to make the shared secret the same size as the largest
possible secret size.
=back
=item "ecdh-cofactor-mode" (B<OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE>) <integer>
OP_keyexch_settable_ctx_params() gets a constant B<OSSL_PARAM> array that
describes the settable parameters, i.e. parameters that can be used with
OP_signature_set_ctx_params().
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
Sets/gets the ECDH mode of operation for the associated key exchange ctx.
In the context of an Elliptic Curve Diffie-Hellman key exchange, this parameter
can be used to select between the plain Diffie-Hellman (DH) or Cofactor
Diffie-Hellman (CDH) variants of the key exchange algorithm.
When setting, the value should be 1, 0 or -1, respectively forcing cofactor mode
on, off, or resetting it to the default for the private key associated with the
given key exchange ctx.
When getting, the value should be either 1 or 0, respectively signaling if the
cofactor mode is on or off.
See also L<provider-keymgmt(7)> for the related
B<OSSL_PKEY_PARAM_USE_COFACTOR_ECDH> parameter that can be set on a
per-key basis.
=item "kdf-type" (B<OSSL_EXCHANGE_PARAM_KDF_TYPE>) <utf8_string>
Sets/gets the Key Derivation Function type to apply within the associated key
exchange ctx.
=item "kdf-digest" (B<OSSL_EXCHANGE_PARAM_KDF_DIGEST>) <utf8_string>
Sets/gets the Digest algorithm to be used as part of the Key Derivation Function
associated with the given key exchange ctx.
=item "kdf-digest-props" (B<OSSL_EXCHANGE_PARAM_KDF_DIGEST_PROPS>) <utf8_string>
Sets properties to be used upon look up of the implementation for the selected
Digest algorithm for the Key Derivation Function associated with the given key
exchange ctx.
=item "kdf-outlen" (B<OSSL_EXCHANGE_PARAM_KDF_OUTLEN>) <size_t>
Sets/gets the desired size for the output of the chosen Key Derivation Function
associated with the given key exchange ctx.
=item "kdf-ukm" (B<OSSL_EXCHANGE_PARAM_KDF_UKM>) <octet_string>
Sets/gets User Key Material to be used as part of the selected Key Derivation
Function associated with the given key exchange ctx.
=item "kdf-ukm-len" (B<OSSL_EXCHANGE_PARAM_KDF_UKM_LEN>) <size_t>
Sets/gets the size of the User Key Material to be used as part of the selected
Key Derivation Function associated with the given key exchange ctx.
=back
=head1 RETURN VALUES
OP_keyexch_newctx() and OP_keyexch_dupctx() should return the newly created
provider side key exchange context, or NULL on failure.
OP_keyexch_init(), OP_keyexch_set_peer(), OP_keyexch_derive() and
OP_keyexch_set_params() should return 1 for success or 0 on error.
OP_keyexch_init(), OP_keyexch_set_peer(), OP_keyexch_derive(),
OP_keyexch_set_params(), and OP_keyexch_get_params() should return 1 for success
or 0 on error.
OP_keyexch_settable_ctx_params() and OP_keyexch_gettable_ctx_params() should
always return a constant B<OSSL_PARAM> array.
=head1 SEE ALSO
doc/man7/provider-keymgmt.pod
+158 -9
View File
@@ -21,26 +21,30 @@ provider-keymgmt - The KEYMGMT library E<lt>-E<gt> provider functions
/* Key object information */
int OP_keymgmt_get_params(void *keydata, OSSL_PARAM params[]);
const OSSL_PARAM *OP_keymgmt_gettable_params(void);
int OP_keymgmt_set_params(void *keydata, const OSSL_PARAM params[]);
const OSSL_PARAM *OP_keymgmt_settable_params(void);
/* Key object content checks */
int OP_keymgmt_has(void *keydata, int selection);
int OP_keymgmt_match(const void *keydata1, const void *keydata2,
int selection);
/* Discovery of supported operations */
const char *OP_keymgmt_query_operation_name(int operation_id);
/* Key object import and export functions */
int OP_keymgmt_import(int selection, void *keydata, const OSSL_PARAM params[]);
const OSSL_PARAM *OP_keymgmt_import_types, (int selection);
const OSSL_PARAM *OP_keymgmt_import_types(int selection);
int OP_keymgmt_export(int selection, void *keydata,
OSSL_CALLBACK *param_cb, void *cbarg);
const OSSL_PARAM *OP_keymgmt_export_types(int selection);
/* Key object copy */
int OP_keymgmt_copy(void *keydata_to, const void *keydata_from, int selection);
/* Key object validation */
int OP_keymgmt_validate(void *keydata, int selection);
/* Discovery of supported operations */
const char *OP_keymgmt_query_operation_name(int operation_id);
=head1 DESCRIPTION
The KEYMGMT operation doesn't have much public visibility in OpenSSL
@@ -78,17 +82,21 @@ macros in L<openssl-core_numbers.h(7)>, as follows:
OP_keymgmt_get_params OSSL_FUNC_KEYMGMT_GET_PARAMS
OP_keymgmt_gettable_params OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS
OP_keymgmt_set_params OSSL_FUNC_KEYMGMT_SET_PARAMS
OP_keymgmt_settable_params OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS
OP_keymgmt_query_operation_name OSSL_FUNC_KEYMGMT_QUERY_OPERATION_NAME
OP_keymgmt_has OSSL_FUNC_KEYMGMT_HAS
OP_keymgmt_validate OSSL_FUNC_KEYMGMT_VALIDATE
OP_keymgmt_match OSSL_FUNC_KEYMGMT_MATCH
OP_keymgmt_import OSSL_FUNC_KEYMGMT_IMPORT
OP_keymgmt_import_types OSSL_FUNC_KEYMGMT_IMPORT_TYPES
OP_keymgmt_export OSSL_FUNC_KEYMGMT_EXPORT
OP_keymgmt_export_types OSSL_FUNC_KEYMGMT_EXPORT_TYPES
OP_keymgmt_copy OSSL_FUNC_KEYMGMT_COPY
=head2 Key Objects
@@ -202,7 +210,17 @@ descriptor B<OSSL_PARAM>, for parameters that OP_keymgmt_get_params()
can handle.
If OP_keymgmt_gettable_params() is present, OP_keymgmt_get_params()
must also be present.
must also be present, and vice versa.
OP_keymgmt_set_params() should update information data associated
with the given I<keydata>, see L</Information Parameters>.
OP_keymgmt_settable_params() should return a constant array of
descriptor B<OSSL_PARAM>, for parameters that OP_keymgmt_set_params()
can handle.
If OP_keymgmt_settable_params() is present, OP_keymgmt_set_params()
must also be present, and vice versa.
=head2 Key Object Checking Functions
@@ -214,7 +232,7 @@ returns NULL, the caller is free to assume that there's an algorithm
from the same provider, of the same name as the one used to fetch the
keymgmt and try to use that.
OP_keymgmt_has() should check whether the given I<keydata> the subsets
OP_keymgmt_has() should check whether the given I<keydata> contains the subsets
of data indicated by the I<selector>. A combination of several
selector bits must consider all those subsets, not just one. An
implementation is, however, free to consider an empty subset of data
@@ -228,7 +246,12 @@ B<OSSL_KEYMGMT_SELECT_PUBLIC_KEY> (or B<OSSL_KEYMGMT_SELECT_KEYPAIR>
for short) is expected to check that the pairwise consistency of
I<keydata> is valid.
=head2 Key Object Import and Export Functions
OP_keymgmt_match() should check if the data subset indicated by
I<selection> in I<keydata1> and I<keydata2> match. It is assumed that
the caller has ensured that I<keydata1> and I<keydata2> are both owned
by the implementation of this function.
=head2 Key Object Import, Export and Copy Functions
OP_keymgmt_import() should import data indicated by I<selection> into
I<keydata> with values taken from the B<OSSL_PARAM> array I<params>.
@@ -245,12 +268,100 @@ OP_keymgmt_export_types() should return a constant array of descriptor
B<OSSL_PARAM> for data indicated by I<selection>, that the
OP_keymgmt_export() callback can expect to receive.
OP_keymgmt_copy() should copy data subsets indicated by I<selection>
from I<keydata_from> to I<keydata_to>. It is assumed that the caller
has ensured that I<keydata_to> and I<keydata_from> are both owned by
the implementation of this function.
=head2 Built-in RSA Import/Export Types
The following Import/Export types are available for the built-in RSA algorithm:
=over 4
=item "n" (B<OSSL_PKEY_PARAM_RSA_N>) <integer>
The RSA "n" value.
=item "e" (B<OSSL_PKEY_PARAM_RSA_E>) <integer>
The RSA "e" value.
=item "d" (B<OSSL_PKEY_PARAM_RSA_D>) <integer>
The RSA "d" value.
=item "rsa-factor" (B<OSSL_PKEY_PARAM_RSA_FACTOR>) <integer>
An RSA factor. In 2 prime RSA these are often known as "p" or "q". This value
may be repeated up to 10 times in a single key.
=item "rsa-exponent" (B<OSSL_PKEY_PARAM_RSA_EXPONENT>) <integer>
An RSA CRT (Chinese Remainder Theorem) exponent. This value may be repeated up
to 10 times in a single key.
=item "rsa-coefficient" (B<OSSL_PKEY_PARAM_RSA_COEFFICIENT>) <integer>
An RSA CRT (Chinese Remainder Theorem) coefficient. This value may be repeated
up to 9 times in a single key.
=back
=head2 Built-in DSA and Diffie-Hellman Import/Export Types
The following Import/Export types are available for the built-in DSA and
Diffie-Hellman algorithms:
=over 4
=item "pub" (B<OSSL_PKEY_PARAM_PUB_KEY>) <integer> or <octet string>
The public key value.
=item "priv" (B<OSSL_PKEY_PARAM_PRIV_KEY>) <integer> or <octet string>
The private key value.
=item "p" (B<OSSL_PKEY_PARAM_FFC_P>) <integer>
A DSA or Diffie-Hellman "p" value.
=item "q" (B<OSSL_PKEY_PARAM_FFC_Q>) <integer>
A DSA or Diffie-Hellman "q" value.
=item "g" (B<OSSL_PKEY_PARAM_FFC_G>) <integer>
A DSA or Diffie-Hellman "g" value.
=back
=head2 Built-in X25519, X448, ED25519 and ED448 Import/Export Types
The following Import/Export types are available for the built-in X25519, X448,
ED25519 and X448 algorithms:
=over 4
=item "pub" (B<OSSL_PKEY_PARAM_PUB_KEY>) <octet string>
The public key value.
=item "priv" (B<OSSL_PKEY_PARAM_PRIV_KEY>) <octet string>
The private key value.
=back
=head2 Information Parameters
See L<OSSL_PARAM(3)> for further details on the parameters structure.
Parameters currently recognised by built-in keymgmt algorithms'
OP_keymgmt_get_params:
Parameters currently recognised by built-in keymgmt algorithms
are as follows.
Not all parameters are relevant to, or are understood by all keymgmt
algorithms:
=over 4
@@ -278,8 +389,46 @@ dimensions handled in the rest of the same provider.
The value should be the number of security bits of the given key.
Bits of security is defined in SP800-57.
=item "use-cofactor-flag" (B<OSSL_PKEY_PARAM_USE_COFACTOR_FLAG>,
B<OSSL_PKEY_PARAM_USE_COFACTOR_ECDH>) <integer>
The value should be either 1 or 0, to respectively enable or disable
use of the cofactor in operations using this key.
In the context of a key that can be used to perform an Elliptic Curve
Diffie-Hellman key exchange, this parameter can be used to mark a requirement
for using the Cofactor Diffie-Hellman (CDH) variant of the key exchange
algorithm.
See also L<provider-keyexch(7)> for the related
B<OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE> parameter that can be set on a
per-operation basis.
=back
=head1 RETURN VALUES
OP_keymgmt_new() should return a valid reference to the newly created provider
side key object, or NULL on failure.
OP_keymgmt_import(), OP_keymgmt_export(), OP_keymgmt_get_params() and
OP_keymgmt_set_params() should return 1 for success or 0 on error.
OP_keymgmt_validate() should return 1 on successful validation, or 0 on
failure.
OP_keymgmt_has() should return 1 if all the selected data subsets are contained
in the given I<keydata> or 0 otherwise.
OP_keymgmt_query_operation_name() should return a pointer to a string matching
the requested operation, or NULL if the same name used to fetch the keymgmt
applies.
OP_keymgmt_gettable_params() and OP_keymgmt_settable_params()
OP_keymgmt_import_types(), OP_keymgmt_export_types()
should
always return a constant B<OSSL_PARAM> array.
=head1 SEE ALSO
L<provider(7)>
doc/man7/provider.pod
+16 -10
View File
@@ -260,8 +260,12 @@ algorithm identifier to the appropriate fetching function.
The default provider is built in as part of the F<libcrypto> library.
Should it be needed (if other providers are loaded and offer
implementations of the same algorithms), the property "default=yes"
can be used as a search criterion for these implementations.
implementations of the same algorithms), the property "provider=default"
can be used as a search criterion for these implementations. Some
non-cryptographic algorithms (such as serializers for loading keys and
parameters from files) are not FIPS algorithm implementations in themselves but
support algorithms from the FIPS provider and are allowed for use in "FIPS
mode". The property "fips=yes" can be used to select such algorithms.
=head2 FIPS provider
@@ -269,8 +273,10 @@ The FIPS provider is a dynamically loadable module, and must therefore
be loaded explicitly, either in code or through OpenSSL configuration
(see L<config(5)>).
Should it be needed (if other providers are loaded and offer
implementations of the same algorithms), the property "fips=yes" can
be used as a search criterion for these implementations.
implementations of the same algorithms), the property "provider=fips" can
be used as a search criterion for these implementations. All algorithm
implementations in the FIPS provider can also be selected with the property
"fips=yes".
=head2 Legacy provider
@@ -278,7 +284,7 @@ The legacy provider is a dynamically loadable module, and must therefore
be loaded explicitly, either in code or through OpenSSL configuration
(see L<config(5)>).
Should it be needed (if other providers are loaded and offer
implementations of the same algorithms), the property "legacy=yes" can be
implementations of the same algorithms), the property "provider=legacy" can be
used as a search criterion for these implementations.
=head1 EXAMPLES
@@ -300,21 +306,21 @@ Fetch any available implementation of AES-128-CBC in the default context:
Fetch an implementation of SHA2-256 from the default provider in the default
context:
EVP_MD *md = EVP_MD_fetch(NULL, "SHA2-256", "default=yes");
EVP_MD *md = EVP_MD_fetch(NULL, "SHA2-256", "provider=default");
...
EVP_MD_meth_free(md);
Fetch an implementation of SHA2-256 that is not from the default provider in the
default context:
EVP_MD *md = EVP_MD_fetch(NULL, "SHA2-256", "default=no");
EVP_MD *md = EVP_MD_fetch(NULL, "SHA2-256", "provider!=default");
...
EVP_MD_meth_free(md);
Fetch an implementation of SHA2-256 from the default provider in the specified
context:
EVP_MD *md = EVP_MD_fetch(ctx, "SHA2-256", "default=yes");
EVP_MD *md = EVP_MD_fetch(ctx, "SHA2-256", "provider=default");
...
EVP_MD_meth_free(md);
@@ -324,11 +330,11 @@ implementation of WHIRLPOOL from it:
/* This only needs to be done once - usually at application start up */
OSSL_PROVIDER *legacy = OSSL_PROVIDER_load(NULL, "legacy");
EVP_MD *md = EVP_MD_fetch(NULL, "WHIRLPOOL", "legacy=yes");
EVP_MD *md = EVP_MD_fetch(NULL, "WHIRLPOOL", "provider=legacy");
...
EVP_MD_meth_free(md);
Note that in the above example the property string "legacy=yes" is optional
Note that in the above example the property string "provider=legacy" is optional
since, assuming no other providers have been loaded, the only implementation of
the "whirlpool" algorithm is in the "legacy" provider. Also note that the
default provider should be explicitly loaded if it is required in addition to