Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update - OpenSSL 1.1.1-pre7-dev

Browse Source
This commit is contained in:
Hakase
2018-05-23 23:52:41 +09:00
parent e8a0afd4a0
commit ef253190c7
624 changed files with 189420 additions and 8064 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/fingerprints.txt
+1 -4
View File
@@ -18,10 +18,7 @@ uid Richard Levitte <richard@opensslfoundation.com>
uid Richard Levitte <levitte@openssl.org>
uid Richard Levitte <richard@openssl.com>
pub 4096R/FA40E9E2 2005-03-19
Key fingerprint = 6260 5AA4 334A F9F0 DDE5 D349 D357 7507 FA40 E9E2
uid Dr Stephen N Henson <steve@openssl.org>
pub 2048R/0E604491 2013-04-30
Key fingerprint = 8657 ABB2 60F0 56B1 E519 0839 D9C4 D26D 0E60 4491
uid Matt Caswell <matt@openssl.org>
uid Matt Caswell <frodo@baggins.org>
doc/man1/ca.pod
+7 -2
View File
@@ -184,7 +184,8 @@ The number of days to certify the certificate for.
=item B<-md alg>
The message digest to use.
Any digest supported by the OpenSSL B<dgst> command can be used.
Any digest supported by the OpenSSL B<dgst> command can be used. If the signing
key is using Ed25519 or Ed448 then you should specify "null" for the digest.
This option also applies to CRLs.
=item B<-policy arg>
@@ -469,6 +470,10 @@ versions of OpenSSL. However, to make CA certificate roll-over easier,
it's recommended to use the value B<no>, especially if combined with
the B<-selfsign> command line option.
Note that it is valid in some circumstances for certificates to be created
without any subject. In the case where there are multiple certificates without
subjects this does not count as a duplicate.
=item B<serial>
A text file containing the next serial number to use in hex. Mandatory.
@@ -745,7 +750,7 @@ L<config(5)>, L<x509v3_config(5)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ciphers.pod
+28 -30
View File
@@ -22,6 +22,7 @@ B<openssl> B<ciphers>
[B<-srp>]
[B<-stdname>]
[B<-convert name>]
[B<-ciphersuites val>]
[B<cipherlist>]
=head1 DESCRIPTION
@@ -105,10 +106,21 @@ Precede each cipher suite by its standard name.
Convert a standard cipher B<name> to its OpenSSL name.
=item B<-ciphersuites val>
Sets the list of TLSv1.3 ciphersuites. This list will be combined with any
TLSv1.2 and below ciphersuites that have been configured. The format for this
list is a simple colon (":") separated list of TLSv1.3 ciphersuite names. By
default this value is:
"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
=item B<cipherlist>
A cipher list to convert to a cipher preference list. If it is not included
then the default cipher list will be used. The format is described below.
A cipher list of TLSv1.2 and below ciphersuites to convert to a cipher
preference list. This list will be combined with any TLSv1.3 ciphersuites that
have been configured. If it is not included then the default cipher list will be
used. The format is described below.
=back
@@ -156,19 +168,20 @@ The cipher string B<@SECLEVEL=n> can be used at any point to set the security
level to B<n>, which should be a number between zero and five, inclusive.
See L<SSL_CTX_set_security_level> for a description of what each level means.
The cipher list can be prefixed with the B<DEFAULT> keyword, which enables
the default cipher list as defined below. Unlike cipher strings,
this prefix may not be combined with other strings using B<+> character.
For example, B<DEFAULT+DES> is not valid.
The content of the default list is determined at compile time and normally
corresponds to B<ALL:!COMPLEMENTOFDEFAULT:!eNULL>.
=head1 CIPHER STRINGS
The following is a list of all permitted cipher strings and their meanings.
=over 4
=item B<DEFAULT>
The default cipher list.
This is determined at compile time and is normally
B<ALL:!COMPLEMENTOFDEFAULT:!eNULL>.
When used, this must be the first cipherstring specified.
=item B<COMPLEMENTOFDEFAULT>
The ciphers included in B<ALL>, but not enabled by default. Currently
@@ -405,21 +418,6 @@ permissible.
=back
=head1 EQUAL PREFERENCE GROUPS
If configuring a server, one may also configure equal-preference groups to
partially respect the client's preferences when
B<SSL_OP_CIPHER_SERVER_PREFERENCE> is enabled. Ciphers in an equal-preference
group have equal priority and use the client order. This may be used to
enforce that AEADs are preferred but select AES-GCM vs. ChaCha20-Poly1305
based on client preferences. An equal-preference is specified with square
brackets, combining multiple selectors separated by |. For example:
[ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES128-GCM-SHA256]
Once an equal-preference group is used, future directives must be
opcode-less.
=head1 CIPHER SUITE NAMES
The following lists give the SSL or TLS cipher suites names from the
@@ -720,11 +718,11 @@ Note: the CBC modes mentioned in this RFC are not supported.
=head2 TLS v1.3 cipher suites
TLS_AES_128_GCM_SHA256 TLS13-AES-128-GCM-SHA256
TLS_AES_256_GCM_SHA384 TLS13-AES-256-GCM-SHA384
TLS_CHACHA20_POLY1305_SHA256 TLS13-CHACHA20-POLY1305-SHA256
TLS_AES_128_CCM_SHA256 TLS13-AES-128-CCM-SHA256
TLS_AES_128_CCM_8_SHA256 TLS13-AES-128-CCM-8-SHA256
TLS_AES_128_GCM_SHA256 TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384 TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256 TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_SHA256
TLS_AES_128_CCM_8_SHA256 TLS_AES_128_CCM_8_SHA256
=head2 Older names used by OpenSSL
@@ -786,7 +784,7 @@ The B<-convert> was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/cms.pod
+8 -8
View File
@@ -394,6 +394,9 @@ When encrypting a message this option may be used multiple times to specify
each recipient. This form B<must> be used if customised parameters are
required (for example to specify RSA-OAEP).
Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this
option.
=item B<-keyid>
Use subject key identifier to identify certificates instead of issuer name and
@@ -718,19 +721,16 @@ No revocation checking is done on the signer's certificate.
=head1 HISTORY
The use of multiple B<-signer> options and the B<-resign> command were first
added in OpenSSL 1.0.0
added in OpenSSL 1.0.0.
The B<keyopt> option was first added in OpenSSL 1.1.0
The B<keyopt> option was first added in OpenSSL 1.0.2.
The use of B<-recip> to specify the recipient when encrypting mail was first
added to OpenSSL 1.1.0
Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.1.0.
Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.0.2.
The use of non-RSA keys with B<-encrypt> and B<-decrypt> was first added
to OpenSSL 1.1.0.
to OpenSSL 1.0.2.
The -no_alt_chains options was first added to OpenSSL 1.1.0.
The -no_alt_chains options was first added to OpenSSL 1.0.2b.
=head1 COPYRIGHT
doc/man1/dgst.pod
+4 -2
View File
@@ -86,7 +86,9 @@ Filename to output to, or standard output by default.
=item B<-sign filename>
Digitally sign the digest using the private key in "filename".
Digitally sign the digest using the private key in "filename". Note this option
does not support Ed25519 or Ed448 private keys. Use the B<pkeyutl> command
instead for this.
=item B<-keyform arg>
@@ -233,7 +235,7 @@ The FIPS-related options were removed in OpenSSL 1.1.0
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/ecparam.pod
+3 -3
View File
@@ -92,8 +92,8 @@ currently implemented EC parameters names and exit.
=item B<-conv_form>
This specifies how the points on the elliptic curve are converted
into octet strings. Possible values are: B<compressed> (the default
value), B<uncompressed> and B<hybrid>. For more information regarding
into octet strings. Possible values are: B<compressed>, B<uncompressed> (the
default value) and B<hybrid>. For more information regarding
the point conversion forms please read the X9.62 standard.
B<Note> Due to patent issues the B<compressed> option is disabled
by default for binary curves and can be enabled by defining
@@ -182,7 +182,7 @@ L<ec(1)>, L<dsaparam(1)>
=head1 COPYRIGHT
Copyright 2003-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2003-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/genpkey.pod
+99 -90
View File
@@ -63,13 +63,27 @@ options.
Public key algorithm to use such as RSA, DSA or DH. If used this option must
precede any B<-pkeyopt> options. The options B<-paramfile> and B<-algorithm>
are mutually exclusive.
are mutually exclusive. Engines may add algorithms in addition to the standard
built-in ones.
Valid built-in algorithm names for private key generation are RSA, RSA-PSS, EC,
X25519, X448, ED25519 and ED448.
Valid built-in algorithm names for parameter generation (see the B<-genparam>
option) are DH, DSA and EC.
Note that the algorithm name X9.42 DH may be used as a synonym for the DH
algorithm. These are identical and do not indicate the type of parameters that
will be generated. Use the B<dh_paramgen_type> option to indicate whether PKCS#3
or X9.42 DH parameters are required. See L<DH Parameter Generation Options>
below for more details.
=item B<-pkeyopt opt:value>
Set the public key algorithm option B<opt> to B<value>. The precise set of
options supported depends on the public key algorithm used and its
implementation. See B<KEY GENERATION OPTIONS> below for more details.
implementation. See L<KEY GENERATION OPTIONS> and
L<PARAMETER GENERATION OPTIONS> below for more details.
=item B<-genparam>
@@ -95,9 +109,10 @@ parameters along with the PEM or DER structure.
The options supported by each algorithm and indeed each implementation of an
algorithm can vary. The options for the OpenSSL implementations are detailed
below.
below. There are no key generation options defined for the X25519, X448, ED25519
or ED448 algorithms.
=head1 RSA KEY GENERATION OPTIONS
=head2 RSA Key Generation Options
=over 4
@@ -116,32 +131,13 @@ hexadecimal value if preceded by B<0x>. Default value is 65537.
=back
=head1 RSA-PSS KEY GENERATION OPTIONS
=head2 RSA-PSS Key Generation Options
Note: by default an B<RSA-PSS> key has no parameter restrictions.
=over 4
=item B<rsa_keygen_bits:numbits>, B<rsa_keygen_pubexp:value>
These options have the same meaning as the B<RSA> algorithm.
=item B<rsa_pss_keygen_md:digest>
=item B<rsa_keygen_pubexp:value>
The RSA public exponent value. This can be a large decimal or
hexadecimal value if preceded by B<0x>. Default value is 65537.
=back
=head1 RSA-PSS KEY GENERATION OPTIONS
Note: by default an B<RSA-PSS> key has no parameter restrictions.
=over 4
=item B<rsa_keygen_bits:numbits>, B<rsa_keygen_pubexp:value>
=item B<rsa_keygen_bits:numbits>, B<rsa_keygen_primes:numprimes>, B<rsa_keygen_pubexp:value>
These options have the same meaning as the B<RSA> algorithm.
@@ -160,44 +156,9 @@ If set the key is restricted and B<len> specifies the minimum salt length.
=back
=head1 DSA PARAMETER GENERATION OPTIONS
=head2 EC Key Generation Options
=over 4
=item B<dsa_paramgen_bits:numbits>
The number of bits in the generated parameters. If not specified 1024 is used.
=back
=head1 DH PARAMETER GENERATION OPTIONS
=over 4
=item B<dh_paramgen_prime_len:numbits>
The number of bits in the prime parameter B<p>.
=item B<dh_paramgen_generator:value>
The value to use for the generator B<g>.
=item B<dh_rfc5114:num>
If this option is set then the appropriate RFC5114 parameters are used
instead of generating new parameters. The value B<num> can take the
values 1, 2 or 3 corresponding to RFC5114 DH parameters consisting of
1024 bit group with 160 bit subgroup, 2048 bit group with 224 bit subgroup
and 2048 bit group with 256 bit subgroup as mentioned in RFC5114 sections
2.1, 2.2 and 2.3 respectively.
=back
=head1 EC PARAMETER GENERATION OPTIONS
The EC parameter generation options below can also
be supplied as EC key generation options. This can (for example) generate a
key from a named curve without the need to use an explicit parameter file.
The EC key generation options can also be used for parameter generation.
=over 4
@@ -208,44 +169,80 @@ The EC curve to use. OpenSSL supports NIST curve names such as "P-256".
=item B<ec_param_enc:encoding>
The encoding to use for parameters. The "encoding" parameter must be either
"named_curve" or "explicit".
"named_curve" or "explicit". The default value is "named_curve".
=back
=head1 GOST2001 KEY GENERATION AND PARAMETER OPTIONS
=head1 PARAMETER GENERATION OPTIONS
Gost 2001 support is not enabled by default. To enable this algorithm,
one should load the ccgost engine in the OpenSSL configuration file.
See README.gost file in the engines/ccgost directory of the source
distribution for more details.
The options supported by each algorithm and indeed each implementation of an
algorithm can vary. The options for the OpenSSL implementations are detailed
below.
Use of a parameter file for the GOST R 34.10 algorithm is optional.
Parameters can be specified during key generation directly as well as
during generation of parameter file.
=head2 DSA Parameter Generation Options
=over 4
=item B<paramset:name>
=item B<dsa_paramgen_bits:numbits>
Specifies GOST R 34.10-2001 parameter set according to RFC 4357.
Parameter set can be specified using abbreviated name, object short name or
numeric OID. Following parameter sets are supported:
The number of bits in the generated prime. If not specified 1024 is used.
paramset OID Usage
A 1.2.643.2.2.35.1 Signature
B 1.2.643.2.2.35.2 Signature
C 1.2.643.2.2.35.3 Signature
XA 1.2.643.2.2.36.0 Key exchange
XB 1.2.643.2.2.36.1 Key exchange
test 1.2.643.2.2.35.0 Test purposes
=item B<dsa_paramgen_q_bits:numbits>
The number of bits in the q parameter. Must be one of 160, 224 or 256. If not
specified 160 is used.
=item B<dsa_paramgen_md:digest>
The digest to use during parameter generation. Must be one of B<sha1>, B<sha224>
or B<sha256>. If set, then the number of bits in B<q> will match the output size
of the specified digest and the B<dsa_paramgen_q_bits> parameter will be
ignored. If not set, then a digest will be used that gives an output matching
the number of bits in B<q>, i.e. B<sha1> if q length is 160, B<sha224> if it 224
or B<sha256> if it is 256.
=back
=head1 X25519 and X448 KEY GENERATION OPTIONS
=head2 DH Parameter Generation Options
The X25519 and X448 algorithms do not currently support any key generation
=over 4
=item B<dh_paramgen_prime_len:numbits>
The number of bits in the prime parameter B<p>. The default is 1024.
=item B<dh_paramgen_subprime_len:numbits>
The number of bits in the sub prime parameter B<q>. The default is 256 if the
prime is at least 2048 bits long or 160 otherwise. Only relevant if used in
conjunction with the B<dh_paramgen_type> option to generate X9.42 DH parameters.
=item B<dh_paramgen_generator:value>
The value to use for the generator B<g>. The default is 2.
=item B<dh_paramgen_type:value>
The type of DH parameters to generate. Use 0 for PKCS#3 DH and 1 for X9.42 DH.
The default is 0.
=item B<dh_rfc5114:num>
If this option is set, then the appropriate RFC5114 parameters are used
instead of generating new parameters. The value B<num> can take the
values 1, 2 or 3 corresponding to RFC5114 DH parameters consisting of
1024 bit group with 160 bit subgroup, 2048 bit group with 224 bit subgroup
and 2048 bit group with 256 bit subgroup as mentioned in RFC5114 sections
2.1, 2.2 and 2.3 respectively. If present this overrides all other DH parameter
options.
=back
=head2 EC Parameter Generation Options
The EC parameter generation options are the same as for key generation. See
L<EC Key Generation Options> above.
=head1 NOTES
The use of the genpkey program is encouraged over the algorithm specific
@@ -267,19 +264,25 @@ Generate a 2048 bit RSA key using 3 as the public exponent:
openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048 \
-pkeyopt rsa_keygen_pubexp:3
Generate 1024 bit DSA parameters:
Generate 2048 bit DSA parameters:
openssl genpkey -genparam -algorithm DSA -out dsap.pem \
-pkeyopt dsa_paramgen_bits:1024
-pkeyopt dsa_paramgen_bits:2048
Generate DSA key from parameters:
openssl genpkey -paramfile dsap.pem -out dsakey.pem
Generate 1024 bit DH parameters:
Generate 2048 bit DH parameters:
openssl genpkey -genparam -algorithm DH -out dhp.pem \
-pkeyopt dh_paramgen_prime_len:1024
-pkeyopt dh_paramgen_prime_len:2048
Generate 2048 bit X9.42 DH parameters:
openssl genpkey -genparam -algorithm DH -out dhpx.pem \
-pkeyopt dh_paramgen_prime_len:2048 \
-pkeyopt dh_paramgen_type:1
Output RFC5114 2048 bit DH parameters with 224 bit subgroup:
@@ -309,14 +312,20 @@ Generate an X25519 private key:
openssl genpkey -algorithm X25519 -out xkey.pem
Generate an ED448 private key:
openssl genpkey -algorithm ED448 -out xkey.pem
=head1 HISTORY
The ability to use NIST curve names, and to generate an EC key directly,
were added in OpenSSL 1.0.2.
were added in OpenSSL 1.0.2. The ability to generate X25519 keys was added in
OpenSSL 1.1.0. The ability to generate X448, ED25519 and ED448 keys was added in
OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/openssl.pod
+48 -9
View File
@@ -290,10 +290,22 @@ X.509 Certificate Data Management.
=over 4
=item B<blake2b512>
BLAKE2b-512 Digest
=item B<blake2s256>
BLAKE2s-256 Digest
=item B<md2>
MD2 Digest
=item B<md4>
MD4 Digest
=item B<md5>
MD5 Digest
@@ -306,29 +318,53 @@ MDC2 Digest
RMD-160 Digest
=item B<sha>
SHA Digest
=item B<sha1>
SHA-1 Digest
=item B<sha224>
SHA-224 Digest
SHA-2 224 Digest
=item B<sha256>
SHA-256 Digest
SHA-2 256 Digest
=item B<sha384>
SHA-384 Digest
SHA-2 384 Digest
=item B<sha512>
SHA-512 Digest
SHA-2 512 Digest
=item B<sha3-224>
SHA-3 224 Digest
=item B<sha3-256>
SHA-3 256 Digest
=item B<sha3-384>
SHA-3 384 Digest
=item B<sha3-512>
SHA-3 512 Digest
=item B<shake128>
SHA-3 SHAKE128 Digest
=item B<shake256>
SHA-3 SHAKE256 Digest
=item B<sm3>
SM3 Digest
=back
@@ -403,6 +439,9 @@ password argument is given and a password is required then the user is
prompted to enter one: this will typically be read from the current
terminal with echoing turned off.
Note that character encoding may be relevant, please see
L<passphrase-encoding(7)>.
=over 4
=item B<pass:password>
@@ -463,7 +502,7 @@ manual pages.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/pkeyutl.pod
+1 -1
View File
@@ -323,7 +323,7 @@ L<EVP_PKEY_CTX_set_hkdf_md(3)>, L<EVP_PKEY_CTX_set_tls1_prf_md(3)>
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/rehash.pod
+7 -1
View File
@@ -99,6 +99,12 @@ Note that current versions will not use the old style.
Do not remove existing links.
This is needed when keeping new and old-style links in the same directory.
=item B<-compat>
Generate links for both old-style (MD5) and new-style (SHA1) hashing.
This allows releases before 1.0.0 to use these links along-side newer
releases.
=item B<-v>
Print messages about old links removed and new links created.
@@ -130,7 +136,7 @@ L<x509(1)>.
=head1 COPYRIGHT
Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/s_client.pod
+28 -7
View File
@@ -71,6 +71,9 @@ B<openssl> B<s_client>
[B<-crlf>]
[B<-ign_eof>]
[B<-no_ign_eof>]
[B<-psk_identity identity>]
[B<-psk key>]
[B<-psk_session file>]
[B<-quiet>]
[B<-ssl3>]
[B<-tls1>]
@@ -99,6 +102,7 @@ B<openssl> B<s_client>
[B<-sigalgs sigalglist>]
[B<-curves curvelist>]
[B<-cipher cipherlist>]
[B<-ciphersuites val>]
[B<-serverpref>]
[B<-starttls protocol>]
[B<-xmpphost hostname>]
@@ -332,8 +336,9 @@ be used as a test that session caching is working.
=item B<-showcerts>
Display the whole server certificate chain: normally only the server
certificate itself is displayed.
Displays the server certificate list as sent by the server: it only consists of
certificates the server has sent (in the order the server has sent them). It is
B<not> a verified chain.
=item B<-prexit>
@@ -407,6 +412,11 @@ given as a hexadecimal number without leading 0x, for example -psk
1a2b3c4d.
This option must be provided in order to use a PSK cipher.
=item B<-psk_session file>
Use the pem encoded SSL_SESSION data stored in B<file> as the basis of a PSK.
Note that this will only work if TLSv1.3 is negotiated.
=item B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-tls1_3>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
These options require or disable the use of the specified SSL or TLS protocols.
@@ -505,10 +515,20 @@ ultimately selected by the server. For a list of all curves, use:
=item B<-cipher cipherlist>
This allows the cipher list sent by the client to be modified. Although
the server determines which cipher suite is used it should take the first
supported cipher in the list sent by the client. See the B<ciphers>
command for more information.
This allows the TLSv1.2 and below cipher list sent by the client to be modified.
This list will be combined with any TLSv1.3 ciphersuites that have been
configured. Although the server determines which ciphersuite is used it should
take the first supported cipher in the list sent by the client. See the
B<ciphers> command for more information.
=item B<-ciphersuites val>
This allows the TLSv1.3 ciphersuites sent by the client to be modified. This
list will be combined with any TLSv1.2 and below ciphersuites that have been
configured. Although the server determines which cipher suite is used it should
take the first supported cipher in the list sent by the client. See the
B<ciphers> command for more information. The format for this list is a simple
colon (":") separated list of TLSv1.3 ciphersuite names.
=item B<-starttls protocol>
@@ -684,7 +704,8 @@ a client certificate. Therefor merely including a client certificate
on the command line is no guarantee that the certificate works.
If there are problems verifying a server certificate then the
B<-showcerts> option can be used to show the whole chain.
B<-showcerts> option can be used to show all the certificates sent by the
server.
The B<s_client> utility is a test tool and is designed to continue the
handshake after any certificate verification errors. As a result it will
doc/man1/s_server.pod
+23 -5
View File
@@ -113,6 +113,7 @@ B<openssl> B<s_server>
[B<-curves val>]
[B<-named_curve val>]
[B<-cipher val>]
[B<-ciphersuites val>]
[B<-dhparam infile>]
[B<-record_padding val>]
[B<-debug_broken_protocol>]
@@ -156,6 +157,7 @@ B<openssl> B<s_server>
[B<-psk_identity val>]
[B<-psk_hint val>]
[B<-psk val>]
[B<-psk_session file>]
[B<-srpvfile infile>]
[B<-srpuserseed val>]
[B<-ssl3>]
@@ -533,12 +535,23 @@ For a list of all possible curves, use:
=item B<-cipher val>
This allows the cipher list used by the server to be modified. When
the client sends a list of supported ciphers the first client cipher
also included in the server list is used. Because the client specifies
the preference order, the order of the server cipherlist irrelevant. See
This allows the list of TLSv1.2 and below ciphersuites used by the server to be
modified. This list is combined with any TLSv1.3 ciphersuites that have been
configured. When the client sends a list of supported ciphers the first client
cipher also included in the server list is used. Because the client specifies
the preference order, the order of the server cipherlist is irrelevant. See
the B<ciphers> command for more information.
=item B<-ciphersuites val>
This allows the list of TLSv1.3 ciphersuites used by the server to be modified.
This list is combined with any TLSv1.2 and below ciphersuites that have been
configured. When the client sends a list of supported ciphers the first client
cipher also included in the server list is used. Because the client specifies
the preference order, the order of the server cipherlist is irrelevant. See
the B<ciphers> command for more information. The format for this list is a
simple colon (":") separated list of TLSv1.3 ciphersuite names.
=item B<-dhparam infile>
The DH parameter file to use. The ephemeral DH cipher suites generate keys
@@ -585,6 +598,11 @@ given as a hexadecimal number without leading 0x, for example -psk
1a2b3c4d.
This option must be provided in order to use a PSK cipher.
=item B<-psk_session file>
Use the pem encoded SSL_SESSION data stored in B<file> as the basis of a PSK.
Note that this will only work if TLSv1.3 is negotiated.
=item B<-listen>
This option can only be used in conjunction with one of the DTLS options above.
@@ -730,7 +748,7 @@ OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/s_time.pod
+16 -5
View File
@@ -25,6 +25,7 @@ B<openssl> B<s_time>
[B<-ssl3>]
[B<-bugs>]
[B<-cipher cipherlist>]
[B<-ciphersuites val>]
=head1 DESCRIPTION
@@ -128,10 +129,20 @@ option enables various workarounds.
=item B<-cipher cipherlist>
This allows the cipher list sent by the client to be modified. Although
the server determines which cipher suite is used it should take the first
supported cipher in the list sent by the client.
See the L<ciphers(1)> command for more information.
This allows the TLSv1.2 and below cipher list sent by the client to be modified.
This list will be combined with any TLSv1.3 ciphersuites that have been
configured. Although the server determines which cipher suite is used it should
take the first supported cipher in the list sent by the client. See the
L<ciphers(1)> command for more information.
=item B<-ciphersuites val>
This allows the TLSv1.3 ciphersuites sent by the client to be modified. This
list will be combined with any TLSv1.2 and below ciphersuites that have been
configured. Although the server determines which cipher suite is used it should
take the first supported cipher in the list sent by the client. See the
B<ciphers> command for more information. The format for this list is a simple
colon (":") separated list of TLSv1.3 ciphersuite names.
=item B<-time length>
@@ -188,7 +199,7 @@ L<s_client(1)>, L<s_server(1)>, L<ciphers(1)>
=head1 COPYRIGHT
Copyright 2004-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/speed.pod
+3 -3
View File
@@ -73,11 +73,11 @@ is only effective if RSA algorithm is specified to test.
=item B<-seconds num>
Run bechmarks for B<num> seconds.
Run benchmarks for B<num> seconds.
=item B<-bytes num>
Run bechmarks on B<num>-byte buffers. Affects ciphers, digests and the CSPRNG.
Run benchmarks on B<num>-byte buffers. Affects ciphers, digests and the CSPRNG.
=item B<[zero or more test algorithms]>
@@ -88,7 +88,7 @@ the above are tested.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man1/x509.pod
+3 -3
View File
@@ -429,7 +429,7 @@ the CA certificate file.
Sets the CA serial number file to use.
When the B<-CA> option is used to sign a certificate it uses a serial
number specified in a file. This file consist of one line containing
number specified in a file. This file consists of one line containing
an even number of hex digits with the serial number to use. After each
use the serial number is incremented and written out to the file again.
@@ -871,8 +871,8 @@ this is because some Verisign certificates don't set the S/MIME bit.
=item B<S/MIME Signing>
In addition to the common S/MIME client tests the digitalSignature bit must
be set if the keyUsage extension is present.
In addition to the common S/MIME client tests the digitalSignature bit or
the nonRepudiation bit must be set if the keyUsage extension is present.
=item B<S/MIME Encryption>
doc/man3/ASN1_TIME_set.pod
+1 -1
View File
@@ -248,7 +248,7 @@ The ASN1_TIME_compare() function was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2015-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_meth_new.pod
+10 -10
View File
@@ -21,38 +21,38 @@ BIO_meth_set_callback_ctrl - Routines to build up BIO methods
void BIO_meth_free(BIO_METHOD *biom);
int (*BIO_meth_get_write_ex(BIO_METHOD *biom))(BIO *, const char *, size_t,
int (*BIO_meth_get_write_ex(const BIO_METHOD *biom))(BIO *, const char *, size_t,
size_t *);
int (*BIO_meth_get_write(BIO_METHOD *biom))(BIO *, const char *, int);
int (*BIO_meth_get_write(const BIO_METHOD *biom))(BIO *, const char *, int);
int BIO_meth_set_write_ex(BIO_METHOD *biom,
int (*bwrite)(BIO *, const char *, size_t, size_t *));
int BIO_meth_set_write(BIO_METHOD *biom,
int (*write)(BIO *, const char *, int));
int (*BIO_meth_get_read_ex(BIO_METHOD *biom))(BIO *, char *, size_t, size_t *);
int (*BIO_meth_get_read(BIO_METHOD *biom))(BIO *, char *, int);
int (*BIO_meth_get_read_ex(const BIO_METHOD *biom))(BIO *, char *, size_t, size_t *);
int (*BIO_meth_get_read(const BIO_METHOD *biom))(BIO *, char *, int);
int BIO_meth_set_read_ex(BIO_METHOD *biom,
int (*bread)(BIO *, char *, size_t, size_t *));
int BIO_meth_set_read(BIO_METHOD *biom, int (*read)(BIO *, char *, int));
int (*BIO_meth_get_puts(BIO_METHOD *biom))(BIO *, const char *);
int (*BIO_meth_get_puts(const BIO_METHOD *biom))(BIO *, const char *);
int BIO_meth_set_puts(BIO_METHOD *biom, int (*puts)(BIO *, const char *));
int (*BIO_meth_get_gets(BIO_METHOD *biom))(BIO *, char *, int);
int (*BIO_meth_get_gets(const BIO_METHOD *biom))(BIO *, char *, int);
int BIO_meth_set_gets(BIO_METHOD *biom,
int (*gets)(BIO *, char *, int));
long (*BIO_meth_get_ctrl(BIO_METHOD *biom))(BIO *, int, long, void *);
long (*BIO_meth_get_ctrl(const BIO_METHOD *biom))(BIO *, int, long, void *);
int BIO_meth_set_ctrl(BIO_METHOD *biom,
long (*ctrl)(BIO *, int, long, void *));
int (*BIO_meth_get_create(BIO_METHOD *bion))(BIO *);
int (*BIO_meth_get_create(const BIO_METHOD *bion))(BIO *);
int BIO_meth_set_create(BIO_METHOD *biom, int (*create)(BIO *));
int (*BIO_meth_get_destroy(BIO_METHOD *biom))(BIO *);
int (*BIO_meth_get_destroy(const BIO_METHOD *biom))(BIO *);
int BIO_meth_set_destroy(BIO_METHOD *biom, int (*destroy)(BIO *));
long (*BIO_meth_get_callback_ctrl(BIO_METHOD *biom))(BIO *, int, BIO_info_cb *);
long (*BIO_meth_get_callback_ctrl(const BIO_METHOD *biom))(BIO *, int, BIO_info_cb *);
int BIO_meth_set_callback_ctrl(BIO_METHOD *biom,
long (*callback_ctrl)(BIO *, int, BIO_info_cb *));
doc/man3/BIO_s_accept.pod
+16 -4
View File
@@ -4,6 +4,8 @@
BIO_s_accept, BIO_set_accept_name, BIO_set_accept_port, BIO_get_accept_name,
BIO_get_accept_port, BIO_new_accept, BIO_set_nbio_accept, BIO_set_accept_bios,
BIO_get_peer_name, BIO_get_peer_port,
BIO_get_accept_ip_family, BIO_set_accept_ip_family,
BIO_set_bind_mode, BIO_get_bind_mode, BIO_do_accept - accept BIO
=head1 SYNOPSIS
@@ -23,6 +25,11 @@ BIO_set_bind_mode, BIO_get_bind_mode, BIO_do_accept - accept BIO
long BIO_set_nbio_accept(BIO *b, int n);
long BIO_set_accept_bios(BIO *b, char *bio);
char *BIO_get_peer_name(BIO *b);
char *BIO_get_peer_port(BIO *b);
long BIO_get_accept_ip_family(BIO *b);
long BIO_set_accept_ip_family(BIO *b, long family);
long BIO_set_bind_mode(BIO *b, long mode);
long BIO_get_bind_mode(BIO *b);
@@ -145,18 +152,23 @@ accepted a connection and retry the call.
BIO_set_accept_name(), BIO_get_accept_name(), BIO_set_accept_port(),
BIO_get_accept_port(), BIO_set_nbio_accept(), BIO_set_accept_bios(),
BIO_get_peer_name(), BIO_get_peer_port(),
BIO_get_accept_ip_family(), BIO_set_accept_ip_family(),
BIO_set_bind_mode(), BIO_get_bind_mode() and BIO_do_accept() are macros.
=head1 RETURN VALUES
BIO_do_accept(),
BIO_set_accept_name(), BIO_set_accept_port(), BIO_set_nbio_accept(),
BIO_set_accept_bios(), and BIO_set_bind_mode(), return 1 for success and 0 or
-1 for failure.
BIO_set_accept_bios(), BIO_set_accept_ip_family(), and BIO_set_bind_mode()
return 1 for success and 0 or -1 for failure.
BIO_get_accept_name() returns the accept name or NULL on error.
BIO_get_peer_name() returns the peer name or NULL on error.
BIO_get_accept_port() returns the port as a string or NULL on error.
BIO_get_accept_port() returns the accept port as a string or NULL on error.
BIO_get_peer_port() returns the peer port as a string or NULL on error.
BIO_get_accept_ip_family() returns the IP family or -1 on error.
BIO_get_bind_mode() returns the set of B<BIO_BIND> flags, or -1 on failure.
@@ -212,7 +224,7 @@ down each and finally closes both down.
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_s_connect.pod
+33 -20
View File
@@ -4,8 +4,8 @@
BIO_set_conn_address, BIO_get_conn_address,
BIO_s_connect, BIO_new_connect, BIO_set_conn_hostname, BIO_set_conn_port,
BIO_get_conn_hostname,
BIO_get_conn_port,
BIO_set_conn_ip_family, BIO_get_conn_ip_family,
BIO_get_conn_hostname, BIO_get_conn_port,
BIO_set_nbio, BIO_do_connect - connect BIO
=head1 SYNOPSIS
@@ -19,9 +19,11 @@ BIO_set_nbio, BIO_do_connect - connect BIO
long BIO_set_conn_hostname(BIO *b, char *name);
long BIO_set_conn_port(BIO *b, char *port);
long BIO_set_conn_address(BIO *b, BIO_ADDR *addr);
long BIO_set_conn_ip_family(BIO *b, long family);
const char *BIO_get_conn_hostname(BIO *b);
const char *BIO_get_conn_port(BIO *b);
const BIO_ADDR *BIO_get_conn_address(BIO *b);
const long BIO_get_conn_ip_family(BIO *b);
long BIO_set_nbio(BIO *b, long n);
@@ -69,6 +71,8 @@ list is http, telnet, socks, https, ssl, ftp, and gopher.
BIO_set_conn_address() sets the address and port information using
a BIO_ADDR(3ssl).
BIO_set_conn_ip_family() sets the IP family.
BIO_get_conn_hostname() returns the hostname of the connect BIO or
NULL if the BIO is initialized but no hostname is set.
This return value is an internal pointer which should not be modified.
@@ -79,6 +83,8 @@ This return value is an internal pointer which should not be modified.
BIO_get_conn_address() returns the address information as a BIO_ADDR.
This return value is an internal pointer which should not be modified.
BIO_get_conn_ip_family() returns the IP family of the connect BIO.
BIO_set_nbio() sets the non blocking I/O flag to B<n>. If B<n> is
zero then blocking I/O is set. If B<n> is 1 then non blocking I/O
is set. Blocking I/O is the default. The call to BIO_set_nbio()
@@ -107,10 +113,10 @@ ports. This can be avoided by checking for the presence of the ':'
character in the passed hostname and either indicating an error or
truncating the string at that point.
The values returned by BIO_get_conn_hostname(), BIO_get_conn_port(),
BIO_get_conn_ip() and BIO_get_conn_int_port() are updated when a
connection attempt is made. Before any connection attempt the values
returned are those set by the application itself.
The values returned by BIO_get_conn_hostname(), BIO_get_conn_address(),
and BIO_get_conn_port() are updated when a connection attempt is made.
Before any connection attempt the values returned are those set by the
application itself.
Applications do not have to call BIO_do_connect() but may wish to do
so to separate the connection process from other I/O processing.
@@ -124,10 +130,10 @@ then this is an indication that a connection attempt would block,
the application should then take appropriate action to wait until
the underlying socket has connected and retry the call.
BIO_set_conn_hostname(), BIO_set_conn_port(), BIO_set_conn_ip(),
BIO_set_conn_int_port(), BIO_get_conn_hostname(), BIO_get_conn_port(),
BIO_get_conn_ip(), BIO_get_conn_int_port(), BIO_set_nbio() and
BIO_do_connect() are macros.
BIO_set_conn_hostname(), BIO_set_conn_port(), BIO_get_conn_hostname(),
BIO_set_conn_address(), BIO_get_conn_port(), BIO_get_conn_address(),
BIO_set_conn_ip_family(), BIO_get_conn_ip_family(),
BIO_set_nbio(), and BIO_do_connect() are macros.
=head1 RETURN VALUES
@@ -136,21 +142,22 @@ BIO_s_connect() returns the connect BIO method.
BIO_get_fd() returns the socket or -1 if the BIO has not
been initialized.
BIO_set_conn_hostname(), BIO_set_conn_port(), BIO_set_conn_ip() and
BIO_set_conn_int_port() always return 1.
BIO_set_conn_address(), BIO_set_conn_port(), and BIO_set_conn_ip_family()
always return 1.
BIO_get_conn_hostname() returns the connected hostname or NULL is
BIO_set_conn_hostname() returns 1 on success and 0 on failure.
BIO_get_conn_address() returns the address information or NULL if none
was set.
BIO_get_conn_hostname() returns the connected hostname or NULL if
none was set.
BIO_get_conn_ip_family() returns the address family or -1 if none was set.
BIO_get_conn_port() returns a string representing the connected
port or NULL if not set.
BIO_get_conn_ip() returns a pointer to the connected IP address in
binary form or all zeros if not set.
BIO_get_conn_int_port() returns the connected port or 0 if none was
set.
BIO_set_nbio() always returns 1.
BIO_do_connect() returns 1 if the connection was successfully
@@ -188,9 +195,15 @@ to retrieve a page and copy the result to standard output.
L<BIO_ADDR(3)>
=head1 HISTORY
BIO_set_conn_int_port(), BIO_get_conn_int_port(), BIO_set_conn_ip(), and BIO_get_conn_ip()
were removed in OpenSSL 1.1.0.
Use BIO_set_conn_address() and BIO_get_conn_address() instead.
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_set_callback.pod
+11 -7
View File
@@ -114,7 +114,7 @@ is called before the free operation.
=item B<BIO_read_ex(b, data, dlen, readbytes)>
callback_ex(b, BIO_CB_READ, data, dlen, 0, 0L, 1L, readbytes)
callback_ex(b, BIO_CB_READ, data, dlen, 0, 0L, 1L, NULL)
or
@@ -123,7 +123,7 @@ or
is called before the read and
callback_ex(b, BIO_CB_READ | BIO_CB_RETURN, data, dlen, 0, 0L, retvalue,
readbytes)
&readbytes)
or
@@ -133,7 +133,7 @@ after.
=item B<BIO_write(b, data, dlen, written)>
callback_ex(b, BIO_CB_WRITE, data, dlen, 0, 0L, 1L, written)
callback_ex(b, BIO_CB_WRITE, data, dlen, 0, 0L, 1L, NULL)
or
@@ -142,7 +142,7 @@ or
is called before the write and
callback_ex(b, BIO_CB_WRITE | BIO_CB_RETURN, data, dlen, 0, 0L, retvalue,
written)
&written)
or
@@ -161,7 +161,7 @@ or
is called before the operation and
callback_ex(b, BIO_CB_GETS | BIO_CB_RETURN, buf, size, 0, 0L, retvalue,
readbytes)
&readbytes)
or
@@ -179,11 +179,11 @@ or
is called before the operation and
callback_ex(b, BIO_CB_PUTS | BIO_CB_RETURN, buf, 0, 0, 0L, retvalue, written)
callback_ex(b, BIO_CB_PUTS | BIO_CB_RETURN, buf, 0, 0, 0L, retvalue, &written)
or
callback(b, BIO_CB_WRITE|BIO_CB_RETURN, buf, 0, 0L, retvalue)
callback(b, BIO_CB_PUTS|BIO_CB_RETURN, buf, 0, 0L, retvalue)
after.
@@ -205,6 +205,10 @@ or
after.
Note: B<cmd> == B<BIO_CTRL_SET_CALLBACK> is special, because B<parg> is not the
argument of type B<BIO_info_cb> itself. In this case B<parg> is a pointer to
the actual call parameter, see B<BIO_callback_ctrl>.
=back
=head1 EXAMPLE
doc/man3/BN_add.pod
+3 -1
View File
@@ -92,7 +92,9 @@ BN_exp() raises I<a> to the I<p>-th power and places the result in I<r>
BN_mul().
BN_mod_exp() computes I<a> to the I<p>-th power modulo I<m> (C<r=a^p %
m>). This function uses less time and space than BN_exp().
m>). This function uses less time and space than BN_exp(). Do not call this
function when B<m> is even and any of the parameters have the
B<BN_FLG_CONSTTIME> flag set.
BN_gcd() computes the greatest common divisor of I<a> and I<b> and
places the result in I<r>. I<r> may be the same B<BIGNUM> as I<a> or
doc/man3/CMS_encrypt.pod
+2 -3
View File
@@ -19,9 +19,8 @@ B<cipher> is the symmetric cipher to use. B<flags> is an optional set of flags.
=head1 NOTES
Only certificates carrying RSA keys are supported so the recipient certificates
supplied to this function must all contain RSA public keys, though they do not
have to be signed using the RSA algorithm.
Only certificates carrying RSA, Diffie-Hellman or EC keys are supported by this
function.
EVP_des_ede3_cbc() (triple DES) is the algorithm of choice for S/MIME use
because most clients will support it.
doc/man3/CMS_get0_SignerInfos.pod
+1 -1
View File
@@ -55,7 +55,7 @@ CMS_SignerInfo_set1_signer_cert().
Once all signer certificates have been set CMS_verify() can be used.
Although CMS_get0_SignerInfos() can return NULL is an error occur B<or> if
Although CMS_get0_SignerInfos() can return NULL if an error occurs B<or> if
there are no signers this is not a problem in practice because the only
error which can occur is if the B<cms> structure is not of type signedData
due to application error.
doc/man3/CMS_get1_ReceiptRequest.pod
+1 -1
View File
@@ -54,7 +54,7 @@ CMS_verify().
CMS_ReceiptRequest_create0() returns a signed receipt request structure or
NULL if an error occurred.
CMS_add1_ReceiptRequest() returns 1 for success or 0 is an error occurred.
CMS_add1_ReceiptRequest() returns 1 for success or 0 if an error occurred.
CMS_get1_ReceiptRequest() returns 1 is a signed receipt request is found and
decoded. It returns 0 if a signed receipt request is not present and -1 if
doc/man3/CRYPTO_get_ex_new_index.pod
+11 -9
View File
@@ -40,20 +40,22 @@ Several OpenSSL structures can have application-specific data attached to them,
known as "exdata."
The specific structures are:
APP
BIO
DH
DRBG
DSA
EC_KEY
ENGINE
RSA
SSL
SSL_CTX
SSL_SESSION
UI
UI_METHOD
X509
X509_STORE
X509_STORE_CTX
DH
DSA
EC_KEY
RSA
ENGINE
UI
UI_METHOD
BIO
Each is identified by an B<CRYPTO_EX_INDEX_xxx> define in the B<crypto.h>
header file. In addition, B<CRYPTO_EX_INDEX_APP> is reserved for
@@ -155,7 +157,7 @@ dup_func() should return 0 for failure and 1 for success.
=head1 COPYRIGHT
Copyright 2015-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_generate_parameters.pod
+1 -1
View File
@@ -141,7 +141,7 @@ DH_generate_parameters_ex() instead.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DH_get0_pqg.pod
+17 -3
View File
@@ -2,9 +2,11 @@
=head1 NAME
DH_get0_pqg, DH_set0_pqg, DH_get0_key, DH_set0_key, DH_clear_flags,
DH_test_flags, DH_set_flags, DH_get0_engine, DH_get_length,
DH_set_length - Routines for getting and setting data in a DH object
DH_get0_pqg, DH_set0_pqg, DH_get0_key, DH_set0_key,
DH_get0_p, DH_get0_q, DH_get0_g,
DH_get0_priv_key, DH_get0_pub_key,
DH_clear_flags, DH_test_flags, DH_set_flags, DH_get0_engine,
DH_get_length, DH_set_length - Routines for getting and setting data in a DH object
=head1 SYNOPSIS
@@ -16,6 +18,11 @@ DH_set_length - Routines for getting and setting data in a DH object
void DH_get0_key(const DH *dh,
const BIGNUM **pub_key, const BIGNUM **priv_key);
int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key);
const BIGNUM *DH_get0_p(const DH *dh);
const BIGNUM *DH_get0_q(const DH *dh);
const BIGNUM *DH_get0_g(const DH *dh);
const BIGNUM *DH_get0_priv_key(const DH *dh);
const BIGNUM *DH_get0_pub_key(const DH *dh);
void DH_clear_flags(DH *dh, int flags);
int DH_test_flags(const DH *dh, int flags);
void DH_set_flags(DH *dh, int flags);
@@ -54,6 +61,10 @@ untouched. As with DH_set0_pqg() this function transfers the memory management
of the key values to the DH object, and therefore they should not be freed
directly after this function has been called.
Any of the values B<p>, B<q>, B<g>, B<priv_key>, and B<pub_key> can also be
retrieved separately by the corresponding function DH_get0_p(), DH_get0_q(),
DH_get0_g(), DH_get0_priv_key(), and DH_get0_pub_key(), respectively.
DH_set_flags() sets the flags in the B<flags> parameter on the DH object.
Multiple flags can be passed in one go (bitwise ORed together). Any flags that
are already set are left set. DH_test_flags() tests to see whether the flags
@@ -81,6 +92,9 @@ duplicate. The same applies to DH_get0_pqg() and DH_set0_pqg().
DH_set0_pqg() and DH_set0_key() return 1 on success or 0 on failure.
DH_get0_p(), DH_get0_q(), DH_get0_g(), DH_get0_priv_key(), and DH_get0_pub_key()
return the respective value.
DH_test_flags() returns the current state of the flags in the DH object.
DH_get0_engine() returns the ENGINE set for the DH object or NULL if no ENGINE
doc/man3/DH_meth_new.pod
+2 -2
View File
@@ -23,7 +23,7 @@ DH_meth_set_generate_params - Routines to build up DH methods
const char *DH_meth_get0_name(const DH_METHOD *dhm);
int DH_meth_set1_name(DH_METHOD *dhm, const char *name);
int DH_meth_get_flags(DH_METHOD *dhm);
int DH_meth_get_flags(const DH_METHOD *dhm);
int DH_meth_set_flags(DH_METHOD *dhm, int flags);
void *DH_meth_get0_app_data(const DH_METHOD *dhm);
@@ -157,7 +157,7 @@ The functions described here were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/DSA_meth_new.pod
+2 -2
View File
@@ -25,7 +25,7 @@ DSA_meth_set_keygen - Routines to build up DSA methods
const char *DSA_meth_get0_name(const DSA_METHOD *dsam);
int DSA_meth_set1_name(DSA_METHOD *dsam, const char *name);
int DSA_meth_get_flags(DSA_METHOD *dsam);
int DSA_meth_get_flags(const DSA_METHOD *dsam);
int DSA_meth_set_flags(DSA_METHOD *dsam, int flags);
void *DSA_meth_get0_app_data(const DSA_METHOD *dsam);
@@ -205,7 +205,7 @@ The functions described here were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_POINT_add.pod
+5 -3
View File
@@ -43,10 +43,12 @@ The functions EC_POINT_make_affine and EC_POINTs_make_affine force the internal
co-ordinate system. In the case of EC_POINTs_make_affine the value B<num> provides the number of points in the array B<points> to be
forced.
EC_POINT_mul calculates the value generator * B<n> + B<q> * B<m> and stores the result in B<r>. The value B<n> may be NULL in which case the result is just B<q> * B<m>.
EC_POINT_mul is a convenient interface to EC_POINTs_mul: it calculates the value generator * B<n> + B<q> * B<m> and stores the result in B<r>.
The value B<n> may be NULL in which case the result is just B<q> * B<m> (variable point multiplication). Alternatively, both B<q> and B<m> may be NULL, and B<n> non-NULL, in which case the result is just generator * B<n> (fixed point multiplication).
When performing a single fixed or variable point multiplication, the underlying implementation uses a constant time algorithm, when the input scalar (either B<n> or B<m>) is in the range [0, ec_group_order).
EC_POINTs_mul calculates the value generator * B<n> + B<q[0]> * B<m[0]> + ... + B<q[num-1]> * B<m[num-1]>. As for EC_POINT_mul the value
B<n> may be NULL.
EC_POINTs_mul calculates the value generator * B<n> + B<q[0]> * B<m[0]> + ... + B<q[num-1]> * B<m[num-1]>. As for EC_POINT_mul the value B<n> may be NULL or B<num> may be zero.
When performing a fixed point multiplication (B<n> is non-NULL and B<num> is 0) or a variable point multiplication (B<n> is NULL and B<num> is 1), the underlying implementation uses a constant time algorithm, when the input scalar (either B<n> or B<m[0]>) is in the range [0, ec_group_order).
The function EC_GROUP_precompute_mult stores multiples of the generator for faster point multiplication, whilst
EC_GROUP_have_precompute_mult tests whether precomputation has already been done. See L<EC_GROUP_copy(3)> for information
doc/man3/EC_POINT_new.pod
+4 -1
View File
@@ -99,7 +99,10 @@ be at infinity by calling EC_POINT_set_to_infinity().
The affine co-ordinates for a point describe a point in terms of its x and y
position. The functions EC_POINT_set_affine_coordinates_GFp() and
EC_POINT_set_affine_coordinates_GF2m() set the B<x> and B<y> co-ordinates for
the point B<p> defined over the curve given in B<group>.
the point B<p> defined over the curve given in B<group>. The functions
EC_POINT_get_affine_coordinates_GFp() and
EC_POINT_get_affine_coordinates_GF2m() set B<x> and B<y>, either of which may
be NULL, to the corresponding coordinates of B<p>.
As well as the affine co-ordinates, a point can alternatively be described in
terms of its Jacobian projective co-ordinates (for Fp curves only). Jacobian
doc/man3/ENGINE_add.pod
+1
View File
@@ -568,6 +568,7 @@ extension).
=item B<OPENSSL_ENGINES>
The path to the engines directory.
Ignored in set-user-ID and set-group-ID programs.
=back
doc/man3/EVP_CIPHER_meth_new.pod
+1 -1
View File
@@ -241,7 +241,7 @@ The functions described here were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_DigestSignInit.pod
+50 -3
View File
@@ -26,7 +26,54 @@ EVP_DigestSignInit() sets up signing context B<ctx> to use digest B<type> from
ENGINE B<e> and private key B<pkey>. B<ctx> must be created with
EVP_MD_CTX_new() before calling this function. If B<pctx> is not NULL the
EVP_PKEY_CTX of the signing operation will be written to B<*pctx>: this can
be used to set alternative signing options.
be used to set alternative signing options. The digest B<type> may be NULL if
the signing algorithm supports it.
Only EVP_PKEY types that support signing can be used with these functions. This
includes MAC algorithms where the MAC generation is considered as a form of
"signing." Built-in EVP_PKEY types supported by these functions are CMAC,
Poly1305, DSA, ECDSA, HMAC, RSA, SipHash, Ed25519 and Ed448.
Not all digests can be used for all key types. The following combinations apply.
=over 4
=item DSA
Supports SHA1, SHA224, SHA256, SHA384 and SHA512
=item ECDSA
Supports SHA1, SHA224, SHA256, SHA384, SHA512 and SM3
=item RSA with no padding
Supports no digests (the digest B<type> must be NULL)
=item RSA with X931 padding
Supports SHA1, SHA256, SHA384 and SHA512
=item All other RSA padding types
Support SHA1, SHA224, SHA256, SHA384, SHA512, MD5, MD5_SHA1, MD2, MD4, MDC2,
SHA3-224, SHA3-256, SHA3-384, SHA3-512
=item Ed25519 and Ed448
Support no digests (the digest B<type> must be NULL)
=item HMAC
Supports any digest
=item CMAC, Poly1305 and SipHash
Will ignore any digest provided.
=back
If RSA-PSS is used and restrictions apply then the digest must match.
EVP_DigestSignUpdate() hashes B<cnt> bytes of data at B<d> into the
signature context B<ctx>. This function can be called several times on the
@@ -77,7 +124,7 @@ context. This means that calls to EVP_DigestSignUpdate() and
EVP_DigestSignFinal() can be called later to digest and sign additional data.
Since only a copy of the digest context is ever finalized the context must
be cleaned up after use by calling EVP_MD_CTX_cleanup() or a memory leak
be cleaned up after use by calling EVP_MD_CTX_free() or a memory leak
will occur.
The use of EVP_PKEY_size() with these functions is discouraged because some
@@ -100,7 +147,7 @@ were first added to OpenSSL 1.0.0.
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_DigestVerifyInit.pod
+2 -2
View File
@@ -76,7 +76,7 @@ context. This means that EVP_VerifyUpdate() and EVP_VerifyFinal() can
be called later to digest and verify additional data.
Since only a copy of the digest context is ever finalized the context must
be cleaned up after use by calling EVP_MD_CTX_cleanup() or a memory leak
be cleaned up after use by calling EVP_MD_CTX_free() or a memory leak
will occur.
=head1 SEE ALSO
@@ -94,7 +94,7 @@ were first added to OpenSSL 1.0.0.
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_EncryptInit.pod
-15
View File
@@ -99,7 +99,6 @@ EVP_enc_null
int EVP_CIPHER_nid(const EVP_CIPHER *e);
int EVP_CIPHER_block_size(const EVP_CIPHER *e);
int EVP_CIPHER_key_length(const EVP_CIPHER *e)
int EVP_CIPHER_key_length(const EVP_CIPHER *e);
int EVP_CIPHER_iv_length(const EVP_CIPHER *e);
unsigned long EVP_CIPHER_flags(const EVP_CIPHER *e);
@@ -457,20 +456,6 @@ This call is only valid when decrypting data.
=back
=head1 Random numbers
The following can be used to select the DRBG that is used to generate the random
numbers:
EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_SET_DRBG, 0, drbg)
The following can be used to get the DRBG:
EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GET_DRBG, 0, &drbg)
By default it's set to NULL which results in RAND_bytes() being used.
=head1 NOTES
Where possible the B<EVP> interface to symmetric ciphers should be used in
doc/man3/EVP_PKEY_ASN1_METHOD.pod
+25 -3
View File
@@ -19,6 +19,8 @@ EVP_PKEY_asn1_set_check,
EVP_PKEY_asn1_set_public_check,
EVP_PKEY_asn1_set_param_check,
EVP_PKEY_asn1_set_security_bits,
EVP_PKEY_asn1_set_set_priv_key,
EVP_PKEY_asn1_set_set_pub_key,
EVP_PKEY_get0_asn1
- manipulating and registering EVP_PKEY_ASN1_METHOD structure
@@ -112,6 +114,17 @@ EVP_PKEY_get0_asn1
int (*pkey_security_bits) (const EVP_PKEY
*pk));
void EVP_PKEY_asn1_set_set_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*set_priv_key) (EVP_PKEY *pk,
const unsigned char
*priv,
size_t len));
void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
int (*set_pub_key) (EVP_PKEY *pk,
const unsigned char *pub,
size_t len));
const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
=head1 DESCRIPTION
@@ -327,6 +340,14 @@ They MUST return 0 for an invalid key, or 1 for a valid key.
They are called by L<EVP_PKEY_check(3)>, L<EVP_PKEY_public_check(3)> and
L<EVP_PKEY_param_check(3)> respectively.
int (*set_priv_key) (EVP_PKEY *pk, const unsigned char *priv, size_t len);
int (*set_pub_key) (EVP_PKEY *pk, const unsigned char *pub, size_t len);
The set_priv_key() and set_pub_key() methods are used to set the raw private and
public key data for an EVP_PKEY. They MUST return 0 on error, or 1 on success.
They are called by L<EVP_PKEY_new_raw_private_key(3)>, and
L<EVP_PKEY_new_raw_public_key(3)> respectively.
=head2 Functions
EVP_PKEY_asn1_new() creates and returns a new B<EVP_PKEY_ASN1_METHOD>
@@ -368,8 +389,9 @@ EVP_PKEY_asn1_set_public(), EVP_PKEY_asn1_set_private(),
EVP_PKEY_asn1_set_param(), EVP_PKEY_asn1_set_free(),
EVP_PKEY_asn1_set_ctrl(), EVP_PKEY_asn1_set_item(),
EVP_PKEY_asn1_set_siginf(), EVP_PKEY_asn1_set_check(),
EVP_PKEY_asn1_set_public_check(), EVP_PKEY_asn1_set_param_check() and
EVP_PKEY_asn1_set_security_bits() set the diverse methods of the given
EVP_PKEY_asn1_set_public_check(), EVP_PKEY_asn1_set_param_check(),
EVP_PKEY_asn1_set_security_bits(), EVP_PKEY_asn1_set_set_priv_key() and
EVP_PKEY_asn1_set_set_pub_key() set the diverse methods of the given
B<EVP_PKEY_ASN1_METHOD> object.
EVP_PKEY_get0_asn1() finds the B<EVP_PKEY_ASN1_METHOD> associated
@@ -388,7 +410,7 @@ B<EVP_PKEY_ASN1_METHOD> object otherwise.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_CTX_ctrl.pod
+33 -10
View File
@@ -2,13 +2,20 @@
=head1 NAME
EVP_PKEY_CTX_ctrl, EVP_PKEY_CTX_ctrl_str,
EVP_PKEY_CTX_set_signature_md, EVP_PKEY_CTX_set_rsa_padding,
EVP_PKEY_CTX_set_rsa_pss_saltlen, EVP_PKEY_CTX_set_rsa_keygen_bits,
EVP_PKEY_CTX_set_rsa_keygen_pubexp, EVP_PKEY_CTX_set_dsa_paramgen_bits,
EVP_PKEY_CTX_ctrl,
EVP_PKEY_CTX_ctrl_str,
EVP_PKEY_CTX_set_signature_md,
EVP_PKEY_CTX_get_signature_md,
EVP_PKEY_CTX_set_mac_key,
EVP_PKEY_CTX_set_rsa_padding,
EVP_PKEY_CTX_set_rsa_pss_saltlen,
EVP_PKEY_CTX_set_rsa_keygen_bits,
EVP_PKEY_CTX_set_rsa_keygen_pubexp,
EVP_PKEY_CTX_set_dsa_paramgen_bits,
EVP_PKEY_CTX_set_dh_paramgen_prime_len,
EVP_PKEY_CTX_set_dh_paramgen_generator,
EVP_PKEY_CTX_set_dh_pad, EVP_PKEY_CTX_set_dh_nid,
EVP_PKEY_CTX_set_dh_pad,
EVP_PKEY_CTX_set_dh_nid,
EVP_PKEY_CTX_set_ec_paramgen_curve_nid,
EVP_PKEY_CTX_set_ec_param_enc - algorithm specific control operations
@@ -21,9 +28,12 @@ EVP_PKEY_CTX_set_ec_param_enc - algorithm specific control operations
int EVP_PKEY_CTX_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,
const char *value);
#include <openssl/rsa.h>
int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md);
int EVP_PKEY_CTX_get_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD **pmd);
int EVP_PKEY_CTX_set_mac_key(EVP_PKEY_CTX *ctx, unsigned char *key, int len);
#include <openssl/rsa.h>
int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int pad);
int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int len);
@@ -67,8 +77,21 @@ B<pkeyutl>, B<genpkey> and B<req> commands.
All the remaining "functions" are implemented as macros.
The EVP_PKEY_CTX_set_signature_md() macro sets the message digest type used
in a signature. It can be used with any public key algorithm supporting
signature operations.
in a signature. It can be used in the RSA, DSA and ECDSA algorithms.
The EVP_PKEY_CTX_get_signature_md() macro gets the message digest type used in a
signature. It can be used in the RSA, DSA and ECDSA algorithms.
Key generation typically involves setting up parameters to be used and
generating the private and public key data. Some algorithm implementations
allow private key data to be set explicitly using the EVP_PKEY_CTX_set_mac_key()
macro. In this case key generation is simply the process of setting up the
parameters for the key and then setting the raw key data to the value explicitly
provided by that macro. Normally applications would call
L<EVP_PKEY_new_raw_private_key(3)> or similar functions instead of this macro.
The EVP_PKEY_CTX_set_mac_key() macro can be used with any of the algorithms
supported by the L<EVP_PKEY_new_raw_private_key(3)> function.
The macro EVP_PKEY_CTX_set_rsa_padding() sets the RSA padding mode for B<ctx>.
The B<pad> parameter can take the value RSA_PKCS1_PADDING for PKCS#1 padding,
@@ -160,7 +183,7 @@ These functions were first added to OpenSSL 1.0.0.
=head1 COPYRIGHT
Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_CTX_set1_pbe_pass.pod
+70
View File
@@ -0,0 +1,70 @@
=pod
=head1 NAME
EVP_PKEY_CTX_set1_pbe_pass
- generic KDF support functions
=head1 SYNOPSIS
#include <openssl/kdf.h>
int EVP_PKEY_CTX_set1_pbe_pass(EVP_PKEY_CTX *pctx, unsigned char *pass,
int passlen);
=head1 DESCRIPTION
These functions are generic support functions for all KDF algorithms.
EVP_PKEY_CTX_set1_pbe_pass() sets the password to the B<passlen> first
bytes from B<pass>.
=begin comment
We really should have a few more, such as EVP_PKEY_CTX_set1_kdf_salt,
EVP_PKEY_CTX_set1_kdf_key (to be used by the algorithms that use a
key, such as hkdf), EVP_PKEY_CTX_set1_kdf_md (same thing here).
=end comment
=head1 STRING CTRLS
There is also support for string based control operations via
L<EVP_PKEY_CTX_ctrl_str(3)>.
The B<password> can be directly specified using the B<type> parameter
"pass" or given in hex encoding using the "hexpass" parameter.
=begin comment
Just as for the function description, the strings "salt", "hexsalt",
"key", "hexkey" and "md" should be generically specified, and
supported by the algorithms that use them.
=end comment
=head1 NOTES
All these functions are implemented as macros.
=head1 RETURN VALUES
All these functions return 1 for success and 0 or a negative value for failure.
In particular a return value of -2 indicates the operation is not supported by
the public key algorithm.
=head1 SEE ALSO
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_CTX_ctrl_str(3)>,
L<EVP_PKEY_derive(3)>
=head1 COPYRIGHT
Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/EVP_PKEY_CTX_set_hkdf_md.pod
+1 -1
View File
@@ -99,7 +99,7 @@ All these functions are implemented as macros.
A context for HKDF can be obtained by calling:
EVP_PKEY_CTX *pctx = EVP_PKEY_new_id(EVP_PKEY_HKDF, NULL);
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
The total length of the info buffer cannot exceed 1024 bytes in length: this
should be more than enough for any normal use of HKDF.
doc/man3/EVP_PKEY_CTX_set_rsa_pss_keygen_md.pod
+94
View File
@@ -0,0 +1,94 @@
=pod
=head1 NAME
EVP_PKEY_CTX_set_rsa_pss_keygen_md,
EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md,
EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen
- EVP_PKEY RSA-PSS algorithm support functions
=head1 SYNOPSIS
#include <openssl/rsa.h>
int EVP_PKEY_CTX_set_rsa_pss_keygen_md(EVP_PKEY_CTX *pctx,
const EVP_MD *md);
int EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(EVP_PKEY_CTX *pctx,
const EVP_MD *md);
int EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(EVP_PKEY_CTX *pctx,
int saltlen);
=head1 DESCRIPTION
These are the functions that implement L<RSA-PSS(7)>.
=head2 Signing and Verification
The macro EVP_PKEY_CTX_set_rsa_padding() is supported but an error is
returned if an attempt is made to set the padding mode to anything other
than B<PSS>. It is otherwise similar to the B<RSA> version.
The EVP_PKEY_CTX_set_rsa_pss_saltlen() macro is used to set the salt length.
If the key has usage restrictions then an error is returned if an attempt is
made to set the salt length below the minimum value. It is otherwise similar
to the B<RSA> operation except detection of the salt length (using
RSA_PSS_SALTLEN_AUTO is not supported for verification if the key has
usage restrictions.
The EVP_PKEY_CTX_set_signature_md() and EVP_PKEY_CTX_set_rsa_mgf1_md() macros
are used to set the digest and MGF1 algorithms respectively. If the key has
usage restrictions then an error is returned if an attempt is made to set the
digest to anything other than the restricted value. Otherwise these are
similar to the B<RSA> versions.
=head2 Key Generation
As with RSA key generation the EVP_PKEY_CTX_set_rsa_rsa_keygen_bits()
and EVP_PKEY_CTX_set_rsa_keygen_pubexp() macros are supported for RSA-PSS:
they have exactly the same meaning as for the RSA algorithm.
Optional parameter restrictions can be specified when generating a PSS key.
If any restrictions are set (using the macros described below) then B<all>
parameters are restricted. For example, setting a minimum salt length also
restricts the digest and MGF1 algorithms. If any restrictions are in place
then they are reflected in the corresponding parameters of the public key
when (for example) a certificate request is signed.
EVP_PKEY_CTX_set_rsa_pss_keygen_md() restricts the digest algorithm the
generated key can use to B<md>.
EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md() restricts the MGF1 algorithm the
generated key can use to B<md>.
EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen() restricts the minimum salt length
to B<saltlen>.
=head1 NOTES
A context for the B<RSA-PSS> algorithm can be obtained by calling:
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA_PSS, NULL);
=head1 RETURN VALUES
All these functions return 1 for success and 0 or a negative value for failure.
In particular a return value of -2 indicates the operation is not supported by
the public key algorithm.
=head1 SEE ALSO
L<RSA-PSS(7)>,
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_CTX_ctrl_str(3)>,
L<EVP_PKEY_derive(3)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/EVP_PKEY_CTX_set_scrypt_N.pod
+86
View File
@@ -0,0 +1,86 @@
=pod
=head1 NAME
EVP_PKEY_CTX_set1_scrypt_salt,
EVP_PKEY_CTX_set_scrypt_N,
EVP_PKEY_CTX_set_scrypt_r,
EVP_PKEY_CTX_set_scrypt_p,
EVP_PKEY_CTX_set_scrypt_maxmem_bytes
- EVP_PKEY scrypt KDF support functions
=head1 SYNOPSIS
#include <openssl/kdf.h>
int EVP_PKEY_CTX_set1_scrypt_salt(EVP_PKEY_CTX *pctx, unsigned char *salt,
int saltlen);
int EVP_PKEY_CTX_set_scrypt_N(EVP_PKEY_CTX *pctx, uint64_t N);
int EVP_PKEY_CTX_set_scrypt_r(EVP_PKEY_CTX *pctx, uint64_t r);
int EVP_PKEY_CTX_set_scrypt_p(EVP_PKEY_CTX *pctx, uint64_t p);
int EVP_PKEY_CTX_set_scrypt_maxmem_bytes(EVP_PKEY_CTX *pctx,
uint64_t maxmem);
=head1 DESCRIPTION
These functions are used to set up the necessary data to use the
scrypt KDF.
For more information on scrypt, see L<scrypt(7)>.
EVP_PKEY_CTX_set1_scrypt_salt() sets the B<saltlen> bytes long salt
value.
EVP_PKEY_CTX_set_scrypt_N(), EVP_PKEY_CTX_set_scrypt_r() and
EVP_PKEY_CTX_set_scrypt_p() configure the work factors N, r and p.
EVP_PKEY_CTX_set_scrypt_maxmem_bytes() sets how much RAM key
derivation may maximally use, given in bytes.
If RAM is exceeded because the load factors are chosen too high, the
key derivation will fail.
=head1 STRING CTRLS
scrypt also supports string based control operations via
L<EVP_PKEY_CTX_ctrl_str(3)>.
Similarly, the B<salt> can either be specified using the B<type>
parameter "salt" or in hex encoding by using the "hexsalt" parameter.
The work factors B<N>, B<r> and B<p> as well as B<maxmem_bytes> can be
set by using the parameters "N", "r", "p" and "maxmem_bytes",
respectively.
=head1 NOTES
The scrypt KDF also uses EVP_PKEY_CTX_set1_pbe_pass() as well as
the value from the string controls "pass" and "hexpass".
See L<EVP_PKEY_CTX_set1_pbe_pass(3)>.
All the functions described here are implemented as macros.
=head1 RETURN VALUES
All these functions return 1 for success and 0 or a negative value for
failure.
In particular a return value of -2 indicates the operation is not
supported by the public key algorithm.
=head1 SEE ALSO
L<scrypt(7)>,
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_CTX_ctrl_str(3)>,
L<EVP_PKEY_derive(3)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/EVP_PKEY_meth_new.pod
+18 -18
View File
@@ -117,35 +117,35 @@ EVP_PKEY_meth_remove
void EVP_PKEY_meth_set_param_check(EVP_PKEY_METHOD *pmeth,
int (*check) (EVP_PKEY *pkey));
void EVP_PKEY_meth_get_init(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_init(const EVP_PKEY_METHOD *pmeth,
int (**pinit) (EVP_PKEY_CTX *ctx));
void EVP_PKEY_meth_get_copy(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_copy(const EVP_PKEY_METHOD *pmeth,
int (**pcopy) (EVP_PKEY_CTX *dst,
EVP_PKEY_CTX *src));
void EVP_PKEY_meth_get_cleanup(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_cleanup(const EVP_PKEY_METHOD *pmeth,
void (**pcleanup) (EVP_PKEY_CTX *ctx));
void EVP_PKEY_meth_get_paramgen(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_paramgen(const EVP_PKEY_METHOD *pmeth,
int (**pparamgen_init) (EVP_PKEY_CTX *ctx),
int (**pparamgen) (EVP_PKEY_CTX *ctx,
EVP_PKEY *pkey));
void EVP_PKEY_meth_get_keygen(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_keygen(const EVP_PKEY_METHOD *pmeth,
int (**pkeygen_init) (EVP_PKEY_CTX *ctx),
int (**pkeygen) (EVP_PKEY_CTX *ctx,
EVP_PKEY *pkey));
void EVP_PKEY_meth_get_sign(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_sign(const EVP_PKEY_METHOD *pmeth,
int (**psign_init) (EVP_PKEY_CTX *ctx),
int (**psign) (EVP_PKEY_CTX *ctx,
unsigned char *sig, size_t *siglen,
const unsigned char *tbs,
size_t tbslen));
void EVP_PKEY_meth_get_verify(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_verify(const EVP_PKEY_METHOD *pmeth,
int (**pverify_init) (EVP_PKEY_CTX *ctx),
int (**pverify) (EVP_PKEY_CTX *ctx,
const unsigned char *sig,
size_t siglen,
const unsigned char *tbs,
size_t tbslen));
void EVP_PKEY_meth_get_verify_recover(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_verify_recover(const EVP_PKEY_METHOD *pmeth,
int (**pverify_recover_init) (EVP_PKEY_CTX
*ctx),
int (**pverify_recover) (EVP_PKEY_CTX
@@ -156,50 +156,50 @@ EVP_PKEY_meth_remove
const unsigned
char *tbs,
size_t tbslen));
void EVP_PKEY_meth_get_signctx(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_signctx(const EVP_PKEY_METHOD *pmeth,
int (**psignctx_init) (EVP_PKEY_CTX *ctx,
EVP_MD_CTX *mctx),
int (**psignctx) (EVP_PKEY_CTX *ctx,
unsigned char *sig,
size_t *siglen,
EVP_MD_CTX *mctx));
void EVP_PKEY_meth_get_verifyctx(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_verifyctx(const EVP_PKEY_METHOD *pmeth,
int (**pverifyctx_init) (EVP_PKEY_CTX *ctx,
EVP_MD_CTX *mctx),
int (**pverifyctx) (EVP_PKEY_CTX *ctx,
const unsigned char *sig,
int siglen,
EVP_MD_CTX *mctx));
void EVP_PKEY_meth_get_encrypt(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_encrypt(const EVP_PKEY_METHOD *pmeth,
int (**pencrypt_init) (EVP_PKEY_CTX *ctx),
int (**pencryptfn) (EVP_PKEY_CTX *ctx,
unsigned char *out,
size_t *outlen,
const unsigned char *in,
size_t inlen));
void EVP_PKEY_meth_get_decrypt(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_decrypt(const EVP_PKEY_METHOD *pmeth,
int (**pdecrypt_init) (EVP_PKEY_CTX *ctx),
int (**pdecrypt) (EVP_PKEY_CTX *ctx,
unsigned char *out,
size_t *outlen,
const unsigned char *in,
size_t inlen));
void EVP_PKEY_meth_get_derive(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_derive(const EVP_PKEY_METHOD *pmeth,
int (**pderive_init) (EVP_PKEY_CTX *ctx),
int (**pderive) (EVP_PKEY_CTX *ctx,
unsigned char *key,
size_t *keylen));
void EVP_PKEY_meth_get_ctrl(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_ctrl(const EVP_PKEY_METHOD *pmeth,
int (**pctrl) (EVP_PKEY_CTX *ctx, int type, int p1,
void *p2),
int (**pctrl_str) (EVP_PKEY_CTX *ctx,
const char *type,
const char *value));
void EVP_PKEY_meth_get_check(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_check(const EVP_PKEY_METHOD *pmeth,
int (**pcheck) (EVP_PKEY *pkey));
void EVP_PKEY_meth_get_public_check(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_public_check(const EVP_PKEY_METHOD *pmeth,
int (**pcheck) (EVP_PKEY *pkey));
void EVP_PKEY_meth_get_param_check(EVP_PKEY_METHOD *pmeth,
void EVP_PKEY_meth_get_param_check(const EVP_PKEY_METHOD *pmeth,
int (**pcheck) (EVP_PKEY *pkey));
=head1 DESCRIPTION
@@ -397,7 +397,7 @@ arguments.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_new.pod
+47 -4
View File
@@ -2,7 +2,14 @@
=head1 NAME
EVP_PKEY_new, EVP_PKEY_up_ref, EVP_PKEY_free - private key allocation functions
EVP_PKEY_new,
EVP_PKEY_up_ref,
EVP_PKEY_free,
EVP_PKEY_new_raw_private_key,
EVP_PKEY_new_raw_public_key,
EVP_PKEY_new_CMAC_key,
EVP_PKEY_new_mac_key
- public/private key allocation functions
=head1 SYNOPSIS
@@ -12,6 +19,14 @@ EVP_PKEY_new, EVP_PKEY_up_ref, EVP_PKEY_free - private key allocation functions
int EVP_PKEY_up_ref(EVP_PKEY *key);
void EVP_PKEY_free(EVP_PKEY *key);
EVP_PKEY *EVP_PKEY_new_raw_private_key(int type, ENGINE *e,
const unsigned char *key, size_t keylen);
EVP_PKEY *EVP_PKEY_new_raw_public_key(int type, ENGINE *e,
const unsigned char *key, size_t keylen);
EVP_PKEY *EVP_PKEY_new_CMAC_key(ENGINE *e, const unsigned char *priv,
size_t len, const EVP_CIPHER *cipher);
EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, const unsigned char *key,
int keylen);
=head1 DESCRIPTION
@@ -23,6 +38,31 @@ EVP_PKEY_up_ref() increments the reference count of B<key>.
EVP_PKEY_free() decrements the reference count of B<key> and, if the reference
count is zero, frees it up. If B<key> is NULL, nothing is done.
EVP_PKEY_new_raw_private_key() allocates a new B<EVP_PKEY>. If B<e> is non-NULL
then the new B<EVP_PKEY> structure is associated with the engine B<e>. The
B<type> argument indicates what kind of key this is. The value should be a NID
for a public key algorithm that supports raw private keys, i.e. one of
B<EVP_PKEY_HMAC>, B<EVP_PKEY_POLY1305>, B<EVP_PKEY_SIPHASH>, B<EVP_PKEY_X25519>,
B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>. B<key> points to the
raw private key data for this B<EVP_PKEY> which should be of length B<keylen>.
The length should be appropriate for the type of the key. The public key data
will be automatically derived from the given private key data (if appropriate
for the algorithm type).
EVP_PKEY_new_raw_public_key() works in the same way as
EVP_PKEY_new_raw_private_key() except that B<key> points to the raw public key
data. The B<EVP_PKEY> structure will be initialised without any private key
information. Algorithm types that support raw public keys are
B<EVP_PKEY_X25519>, B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>.
EVP_PKEY_new_CMAC_key() works in the same way as EVP_PKEY_new_raw_private_key()
except it is only for the B<EVP_PKEY_CMAC> algorithm type. In addition to the
raw private key data, it also takes a cipher algorithm to be used during
creation of a CMAC in the B<cipher> argument.
EVP_PKEY_new_mac_key() works in the same way as EVP_PKEY_new_raw_private_key().
New applications should use EVP_PKEY_new_raw_private_key() instead.
=head1 NOTES
The B<EVP_PKEY> structure is used by various OpenSSL functions which require a
@@ -34,8 +74,9 @@ used.
=head1 RETURN VALUES
EVP_PKEY_new() returns either the newly allocated B<EVP_PKEY> structure or
B<NULL> if an error occurred.
EVP_PKEY_new(), EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key(),
EVP_PKEY_new_CMAC_key() and EVP_PKEY_new_mac_key() return either the newly
allocated B<EVP_PKEY> structure or B<NULL> if an error occurred.
EVP_PKEY_up_ref() returns 1 for success and 0 for failure.
@@ -48,10 +89,12 @@ L<EVP_PKEY_set1_RSA(3)>
EVP_PKEY_new() and EVP_PKEY_free() exist in all versions of OpenSSL.
EVP_PKEY_up_ref() was first added to OpenSSL 1.1.0.
EVP_PKEY_new_raw_private_key(), EVP_PKEY_new_raw_public_key() and
EVP_PKEY_new_CMAC_key() were first added to OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_SignInit.pod
+2 -7
View File
@@ -66,11 +66,6 @@ The B<EVP> interface to digital signatures should almost always be used in
preference to the low level interfaces. This is because the code then becomes
transparent to the algorithm used and much more flexible.
Due to the link between message digests and public key algorithms the correct
digest algorithm must be used with the correct public key type. A list of
algorithms and associated public key algorithms appears in
L<EVP_DigestInit(3)>.
When signing with DSA private keys the random number generator must be seeded
or the operation will fail. The random number generator does not need to be
seeded for RSA signatures.
@@ -80,7 +75,7 @@ This means that calls to EVP_SignUpdate() and EVP_SignFinal() can be called
later to digest and sign additional data.
Since only a copy of the digest context is ever finalized the context must
be cleaned up after use by calling EVP_MD_CTX_cleanup() or a memory leak
be cleaned up after use by calling EVP_MD_CTX_free() or a memory leak
will occur.
=head1 BUGS
@@ -107,7 +102,7 @@ L<SHA1(3)>, L<dgst(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_VerifyInit.pod
+2 -7
View File
@@ -52,17 +52,12 @@ The B<EVP> interface to digital signatures should almost always be used in
preference to the low level interfaces. This is because the code then becomes
transparent to the algorithm used and much more flexible.
Due to the link between message digests and public key algorithms the correct
digest algorithm must be used with the correct public key type. A list of
algorithms and associated public key algorithms appears in
L<EVP_DigestInit(3)>.
The call to EVP_VerifyFinal() internally finalizes a copy of the digest context.
This means that calls to EVP_VerifyUpdate() and EVP_VerifyFinal() can be called
later to digest and verify additional data.
Since only a copy of the digest context is ever finalized the context must
be cleaned up after use by calling EVP_MD_CTX_cleanup() or a memory leak
be cleaned up after use by calling EVP_MD_CTX_free() or a memory leak
will occur.
=head1 BUGS
@@ -90,7 +85,7 @@ L<SHA1(3)>, L<dgst(1)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_md5.pod
+1 -1
View File
@@ -52,7 +52,7 @@ L<EVP_DigestInit(3)>
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/OBJ_nid2obj.pod
+1 -1
View File
@@ -54,7 +54,7 @@ constants.
OBJ_nid2obj(), OBJ_nid2ln() and OBJ_nid2sn() convert the NID B<n> to
an ASN1_OBJECT structure, its long name and its short name respectively,
or B<NULL> is an error occurred.
or B<NULL> if an error occurred.
OBJ_obj2nid(), OBJ_ln2nid(), OBJ_sn2nid() return the corresponding NID
for the object B<o>, the long name <ln> or the short name <sn> respectively
doc/man3/OPENSSL_VERSION_NUMBER.pod
-5
View File
@@ -47,11 +47,6 @@ number was therefore 0x0090581f.
OpenSSL_version_num() returns the version number.
The macro OPENSSL_VERSION_AT_LEAST(major,minor) can be used at compile
time test if the current version is at least as new as the version provided.
The arguments major, minor and fix correspond to the version information
as given above.
OpenSSL_version() returns different strings depending on B<t>:
=over 4
doc/man3/OPENSSL_config.pod
+12 -1
View File
@@ -48,6 +48,17 @@ application calls OPENSSL_config() it doesn't need to know or care about
ENGINE control operations because they can be performed by editing a
configuration file.
=head1 ENVIRONMENT
=over 4
=item B<OPENSSL_CONF>
The path to the config file.
Ignored in set-user-ID and set-group-ID programs.
=back
=head1 RETURN VALUES
Neither OPENSSL_config() nor OPENSSL_no_config() return a value.
@@ -64,7 +75,7 @@ deprecated in OpenSSL 1.1.0 by OPENSSL_init_crypto().
=head1 COPYRIGHT
Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2004-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/OPENSSL_fork_prepare.pod
+1 -1
View File
@@ -30,7 +30,7 @@ such as Linux that have both functions will normally not need to call these
functions as the OpenSSL library will do so automatically.
L<OPENSSL_init_crypto(3)> will register these functions with the appropriate
hander, when the B<OPENSSL_INIT_ATFORK> flag is used. For other
handler, when the B<OPENSSL_INIT_ATFORK> flag is used. For other
applications, these functions can be called directly. They should be used
according to the calling sequence described by the pthreads_atfork(3)
documentation, which is summarized here. OPENSSL_fork_prepare() should
doc/man3/OPENSSL_ia32cap.pod
+2 -2
View File
@@ -124,7 +124,7 @@ extensions.
It should be noted that whether or not some of the most "fancy"
extension code paths are actually assembled depends on current assembler
version. Base minimum of AES-NI/PCLMULQDQ, SSSE3 and SHA extension code
paths are always assembled. Besides that, minimum assembler version
paths are always assembled. Apart from that, minimum assembler version
requirements are summarized in below table:
Extension | GNU as | nasm | llvm
@@ -134,7 +134,7 @@ requirements are summarized in below table:
ADCX/ADOX | 2.23 | 2.10 | 3.3
AVX512 | 2.25 | 2.11.8 | see NOTES
AVX512IFMA | 2.26 | 2.11.8 | see NOTES
VAES | n/a | n/a |
VAES | 2.30 | 2.13.3 |
=head1 NOTES
doc/man3/OPENSSL_init_crypto.pod
+12 -10
View File
@@ -95,8 +95,10 @@ B<OPENSSL_INIT_ADD_ALL_DIGESTS> will be ignored.
=item OPENSSL_INIT_LOAD_CONFIG
With this option an OpenSSL configuration file will be automatically loaded and
used by calling OPENSSL_config(). This is not a default option.
See the description of OPENSSL_INIT_new(), below.
used by calling OPENSSL_config(). This is not a default option for libcrypto.
From OpenSSL 1.1.1 this is a default option for libssl (see
L<OPENSSL_init_ssl(3)> for further details about libssl initialisation). See the
description of OPENSSL_INIT_new(), below.
=item OPENSSL_INIT_NO_LOAD_CONFIG
@@ -139,15 +141,15 @@ CAPI engine (if available). This not a default option.
With this option the library will automatically load and initialise the
padlock engine (if available). This not a default option.
=item OPENSSL_INIT_ENGINE_DASYNC
=item OPENSSL_INIT_ENGINE_AFALG
With this option the library will automatically load and initialise the
DASYNC engine. This not a default option.
AFALG engine. This not a default option.
=item OPENSSL_INIT_ENGINE_ALL_BUILTIN
With this option the library will automatically load and initialise all the
built in engines listed above with the exception of the openssl and dasync
built in engines listed above with the exception of the openssl and afalg
engines. This not a default option.
=item OPENSSL_INIT_ATFORK
@@ -195,10 +197,10 @@ resources should be freed at an earlier time, or under the circumstances
described in the NOTES section below.
The B<OPENSSL_INIT_LOAD_CONFIG> flag will load a default configuration
file. To specify a different file, an B<OPENSSL_INIT_SETTINGS> must
be created and used. The routines
OPENSSL_INIT_new() and OPENSSL_INIT_set_config_appname() can be used to
allocate the object and set the application name, and then the
file. For optional configuration file settings, an B<OPENSSL_INIT_SETTINGS>
must be created and used.
The routines OPENSSL_init_new() and OPENSSL_INIT_set_config_appname() can
be used to allocate the object and set the application name, and then the
object can be released with OPENSSL_INIT_free() when done.
=head1 NOTES
@@ -240,7 +242,7 @@ and OPENSSL_INIT_free() functions were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/OPENSSL_malloc.pod
+7 -7
View File
@@ -78,10 +78,10 @@ OPENSSL_MALLOC_FD
int CRYPTO_mem_debug_push(const char *info, const char *file, int line);
int CRYPTO_mem_debug_pop(void);
void CRYPTO_mem_leaks(BIO *b);
void CRYPTO_mem_leaks_fp(FILE *fp);
void CRYPTO_mem_leaks_cb(int (*cb)(const char *str, size_t len, void *u),
void *u);
int CRYPTO_mem_leaks(BIO *b);
int CRYPTO_mem_leaks_fp(FILE *fp);
int CRYPTO_mem_leaks_cb(int (*cb)(const char *str, size_t len, void *u),
void *u);
=head1 DESCRIPTION
@@ -216,8 +216,8 @@ OPENSSL_malloc_init(), OPENSSL_free(), OPENSSL_clear_free()
CRYPTO_free(), CRYPTO_clear_free() and CRYPTO_get_mem_functions()
return no value.
CRYPTO_mem_leaks() and CRYPTO_mem_leaks_fp() return 1 if there
are no leaks, 0 if there are leaks and -1 if an error occurred.
CRYPTO_mem_leaks(), CRYPTO_mem_leaks_fp() and CRYPTO_mem_leaks_cb() return 1 if
there are no leaks, 0 if there are leaks and -1 if an error occurred.
OPENSSL_malloc(), OPENSSL_zalloc(), OPENSSL_realloc(),
OPENSSL_clear_realloc(),
@@ -247,7 +247,7 @@ only, say, the malloc() implementation is outright dangerous.>
=head1 COPYRIGHT
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/OSSL_STORE_open.pod
+11 -2
View File
@@ -112,6 +112,14 @@ URI, or if it's a different error (such as memory allocation
failures); if the URI was parsable but the scheme unregistered, the
top error will have the reason C<OSSL_STORE_R_UNREGISTERED_SCHEME>.
These functions make no direct assumption regarding the pass phrase received
from the password callback.
The loaders may make assumptions, however.
For example, the B<file:> scheme loader inherits the assumptions made by
OpenSSL functionality that handles the different file types; this is mostly
relevant for PKCS#12 objects.
See L<passphrase-encoding(7)> for further information.
=head1 RETURN VALUES
OSSL_STORE_open() returns a pointer to a B<OSSL_STORE_CTX> on success, or
@@ -132,7 +140,8 @@ OSSL_STORE_ctrl() and OSSL_STORE_close() returns 1 on success, or 0 on failure.
=head1 SEE ALSO
L<ossl_store(7)>, L<OSSL_STORE_INFO(3)>, L<OSSL_STORE_register_loader(3)>
L<ossl_store(7)>, L<OSSL_STORE_INFO(3)>, L<OSSL_STORE_register_loader(3)>,
L<passphrase-encoding(7)>
=head1 HISTORY
@@ -142,7 +151,7 @@ were added to OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/PEM_bytes_read_bio.pod
+6 -1
View File
@@ -55,6 +55,10 @@ use of BIO_s_file() indicates the use of the operating system stdio
functionality, which includes buffering as a feature; BIO_s_fd() is likely
to be more appropriate in such cases.
These functions make no assumption regarding the pass phrase received from the
password callback.
It will simply be treated as a byte sequence.
=head1 RETURN VALUES
PEM_bytes_read_bio() and PEM_bytes_read_bio_secmem() return 1 for success or
@@ -63,7 +67,8 @@ PEM_bytes_read_bio() and PEM_bytes_read_bio_secmem() return 1 for success or
=head1 SEE ALSO
L<PEM(3)>,
L<PEM_read_bio_ex(3)>
L<PEM_read_bio_ex(3)>,
L<passphrase-encoding(7)>
=head1 HISTORY
doc/man3/PEM_read.pod
+6 -1
View File
@@ -110,10 +110,15 @@ Instead, private keys should be stored in PKCS#8 form, with a strong PKCS#5
v2.0 PBE.
See L<PEM_write_PrivateKey(3)> and L<d2i_PKCS8PrivateKey_bio(3)>.
PEM_do_header() makes no assumption regarding the pass phrase received from the
password callback.
It will simply be treated as a byte sequence.
=head1 SEE ALSO
L<ERR_peek_last_error(3)>, L<ERR_GET_LIB(3)>,
L<d2i_PKCS8PrivateKey_bio(3)>.
L<d2i_PKCS8PrivateKey_bio(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/PEM_read_CMS.pod
+8 -1
View File
@@ -73,6 +73,12 @@ PEM_write_TYPE() writes the PEM encoding of the object B<a> to the file B<fp>.
PEM_write_bio_TYPE() similarly writes to the BIO B<bp>.
=head1 NOTES
These functions make no assumption regarding the pass phrase received from the
password callback.
It will simply be treated as a byte sequence.
=head1 RETURN VALUES
PEM_read_TYPE() and PEM_read_bio_TYPE() return a pointer to an allocated
@@ -83,7 +89,8 @@ or zero on error.
=head1 SEE ALSO
L<PEM_read(3)>
L<PEM_read(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/PEM_read_bio_PrivateKey.pod
+6 -1
View File
@@ -386,6 +386,10 @@ this:
this is a bug because an attempt will be made to reuse the data at B<x>
which is an uninitialised pointer.
These functions make no assumption regarding the pass phrase received from the
password callback.
It will simply be treated as a byte sequence.
=head1 PEM ENCRYPTION FORMAT
These old B<PrivateKey> routines use a non standard technique for encryption.
@@ -465,7 +469,8 @@ as they will be formally deprecated in a future releases.
=head1 SEE ALSO
L<EVP_EncryptInit(3)>, L<EVP_BytesToKey(3)>
L<EVP_EncryptInit(3)>, L<EVP_BytesToKey(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/PKCS12_create.pod
+6 -1
View File
@@ -60,13 +60,18 @@ should be used.
B<mac_iter> can be set to -1 and the MAC will then be omitted entirely.
PKCS12_create() makes assumptions regarding the encoding of the given pass
phrase.
See L<passphrase-encoding(7)> for more information.
=head1 RETURN VALUES
PKCS12_create() returns a valid B<PKCS12> structure or NULL if an error occurred.
=head1 SEE ALSO
L<d2i_PKCS12(3)>
L<d2i_PKCS12(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/PKCS12_newpass.pod
+2 -1
View File
@@ -102,7 +102,8 @@ this function.
=head1 SEE ALSO
L<PKCS12_create(3)>, L<ERR_get_error(3)>
L<PKCS12_create(3)>, L<ERR_get_error(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/PKCS12_parse.pod
+2 -1
View File
@@ -57,7 +57,8 @@ Attributes currently cannot be stored in the private key B<EVP_PKEY> structure.
=head1 SEE ALSO
L<d2i_PKCS12(3)>
L<d2i_PKCS12(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/PKCS5_PBKDF2_HMAC.pod
+5 -1
View File
@@ -52,6 +52,9 @@ Increasing the B<iter> parameter slows down the algorithm which makes it
harder for an attacker to perform a brute force attack using a large number
of candidate passwords.
These functions make no assumption regarding the given password.
It will simply be treated as a byte sequence.
=head1 RETURN VALUES
PKCS5_PBKDF2_HMAC() and PBKCS5_PBKDF2_HMAC_SHA1() return 1 on success or 0 on error.
@@ -59,7 +62,8 @@ PKCS5_PBKDF2_HMAC() and PBKCS5_PBKDF2_HMAC_SHA1() return 1 on success or 0 on er
=head1 SEE ALSO
L<evp(7)>, L<RAND_bytes(3)>,
L<EVP_BytesToKey(3)>
L<EVP_BytesToKey(3)>,
L<passphrase-encoding(7)>
=head1 COPYRIGHT
doc/man3/RAND_DRBG_generate.pod
+88
View File
@@ -0,0 +1,88 @@
=pod
=head1 NAME
RAND_DRBG_generate,
RAND_DRBG_bytes
- generate random bytes using the given drbg instance
=head1 SYNOPSIS
#include <openssl/rand_drbg.h>
int RAND_DRBG_generate(RAND_DRBG *drbg,
unsigned char *out, size_t outlen,
int prediction_resistance,
const unsigned char *adin, size_t adinlen);
int RAND_DRBG_bytes(RAND_DRBG *drbg,
unsigned char *out, size_t outlen);
=head1 DESCRIPTION
RAND_DRBG_generate() generates B<outlen> random bytes using the given
DRBG instance B<drbg> and stores them in the buffer at B<out>.
Before generating the output, the DRBG instance checks whether the maximum
number of generate requests (I<reseed interval>) or the maximum timespan
(I<reseed time interval>) since its last seeding have been reached.
If this is the case, the DRBG reseeds automatically.
Additionally, an immediate reseeding can be requested by setting the
B<prediction_resistance> flag to 1. See NOTES section for more details.
The caller can optionally provide additional data to be used for reseeding
by passing a pointer B<adin> to a buffer of length B<adinlen>.
This additional data is mixed into the internal state of the random
generator but does not contribute to the entropy count.
The additional data can be omitted by setting B<adin> to NULL and
B<adinlen> to 0;
RAND_DRBG_bytes() generates B<outlen> random bytes using the given
DRBG instance B<drbg> and stores them in the buffer at B<out>.
This function is a wrapper around the RAND_DRBG_generate() call,
which collects some additional data from low entropy sources
(e.g., a high resolution timer) and calls
RAND_DRBG_generate(drbg, out, outlen, 0, adin, adinlen).
=head1 RETURN VALUES
RAND_DRBG_generate() and RAND_DRBG_bytes() return 1 on success,
and 0 on failure.
=head1 NOTES
The I<reseed interval> and I<reseed time interval> of the B<drbg> are set to
reasonable default values, which in general do not have to be adjusted.
If necessary, they can be changed using L<RAND_DRBG_set_reseed_interval(3)>
and L<RAND_DRBG_set_reseed_time_interval(3)>, respectively.
A request for prediction resistance can only be satisfied by pulling fresh
entropy from one of the approved entropy sources listed in section 5.5.2 of
[NIST SP 800-90C].
Since the default DRBG implementation does not have access to such an approved
entropy source, a request for prediction resistance will always fail.
In other words, prediction resistance is currently not supported yet by the DRBG.
=head1 HISTORY
The RAND_DRBG functions were added in OpenSSL 1.1.1.
=head1 SEE ALSO
L<RAND_bytes(3)>,
L<RAND_DRBG_set_reseed_interval(3)>,
L<RAND_DRBG_set_reseed_time_interval(3)>,
L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/RAND_DRBG_get0_master.pod
+80
View File
@@ -0,0 +1,80 @@
=pod
=head1 NAME
RAND_DRBG_get0_master,
RAND_DRBG_get0_public,
RAND_DRBG_get0_private
- get access to the global RAND_DRBG instances
=head1 SYNOPSIS
#include <openssl/rand_drbg.h>
RAND_DRBG *RAND_DRBG_get0_master(void);
RAND_DRBG *RAND_DRBG_get0_public(void);
RAND_DRBG *RAND_DRBG_get0_private(void);
=head1 DESCRIPTION
The default RAND API implementation (RAND_OpenSSL()) utilizes three
shared DRBG instances which are accessed via the RAND API:
The <public> and <private> DRBG are thread-local instances, which are used
by RAND_bytes() and RAND_priv_bytes(), respectively.
The <master> DRBG is a global instance, which is not intended to be used
directly, but is used internally to reseed the other two instances.
These functions here provide access to the shared DRBG instances.
=head1 RETURN VALUES
RAND_DRBG_get0_master() returns a pointer to the <master> DRBG instance.
RAND_DRBG_get0_public() returns a pointer to the <public> DRBG instance.
RAND_DRBG_get0_private() returns a pointer to the <private> DRBG instance.
=head1 NOTES
It is not thread-safe to access the <master> DRBG instance.
The <public> and <private> DRBG instance can be accessed safely, because
they are thread-local. Note however, that changes to these two instances
apply only to the current thread.
For that reason it is recommended not to change the settings of these
three instances directly.
Instead, an application should change the default settings for new DRBG instances
at initialization time, before creating additional threads.
During initialization, it is possible to change the reseed interval
and reseed time interval.
It is also possible to exchange the reseeding callbacks entirely.
=head1 HISTORY
The RAND_DRBG functions were added in OpenSSL 1.1.1.
=head1 SEE ALSO
L<RAND_DRBG_set_callbacks(3)>,
L<RAND_DRBG_set_reseed_defaults(3)>,
L<RAND_DRBG_set_reseed_interval(3)>,
L<RAND_DRBG_set_reseed_time_interval(3)>,
L<RAND_DRBG_set_callbacks(3)>,
L<RAND_DRBG_generate(3)>,
L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/RAND_DRBG_new.pod
+127
View File
@@ -0,0 +1,127 @@
=pod
=head1 NAME
RAND_DRBG_new,
RAND_DRBG_secure_new,
RAND_DRBG_set,
RAND_DRBG_set_defaults,
RAND_DRBG_instantiate,
RAND_DRBG_uninstantiate,
RAND_DRBG_free
- initialize and cleanup a RAND_DRBG instance
=head1 SYNOPSIS
#include <openssl/rand_drbg.h>
RAND_DRBG *RAND_DRBG_new(int type,
unsigned int flags,
RAND_DRBG *parent);
RAND_DRBG *RAND_DRBG_secure_new(int type,
unsigned int flags,
RAND_DRBG *parent);
int RAND_DRBG_set(RAND_DRBG *drbg,
int type, unsigned int flags);
int RAND_DRBG_set_defaults(int type, unsigned int flags);
int RAND_DRBG_instantiate(RAND_DRBG *drbg,
const unsigned char *pers, size_t perslen);
int RAND_DRBG_uninstantiate(RAND_DRBG *drbg);
void RAND_DRBG_free(RAND_DRBG *drbg);
=head1 DESCRIPTION
RAND_DRBG_new() and RAND_DRBG_secure_new()
create a new DRBG instance of the given B<type>, allocated from the heap resp.
the secure heap
(using OPENSSL_zalloc() resp. OPENSSL_secure_zalloc()).
RAND_DRBG_set() initializes the B<drbg> with the given B<type> and B<flags>.
RAND_DRBG_set_defaults() sets the default B<type> and B<flags> for new DRBG
instances.
Currently, all DRBG types are based on AES-CTR, so B<type> can be one of the
following values: NID_aes_128_ctr, NID_aes_192_ctr, NID_aes_256_ctr.
Before the DRBG can be used to generate random bits, it is necessary to set
its type and to instantiate it.
The optional B<flags> argument specifies a set of bit flags which can be
joined using the | operator. Currently, the only flag is
RAND_DRBG_FLAG_CTR_NO_DF, which disables the use of a the derivation function
ctr_df. For an explanation, see [NIST SP 800-90A Rev. 1].
If a B<parent> instance is specified then this will be used instead of
the default entropy source for reseeding the B<drbg>. It is said that the
B<drbg> is I<chained> to its B<parent>.
For more information, see the NOTES section.
RAND_DRBG_instantiate()
seeds the B<drbg> instance using random input from trusted entropy sources.
Optionally, a personalization string B<pers> of length B<perslen> can be
specified.
To omit the personalization string, set B<pers>=NULL and B<perslen>=0;
RAND_DRBG_uninstantiate()
clears the internal state of the B<drbg> and puts it back in the
uninstantiated state.
=head1 RETURN VALUES
RAND_DRBG_new() and RAND_DRBG_secure_new() return a pointer to a DRBG
instance allocated on the heap, resp. secure heap.
RAND_DRBG_set(),
RAND_DRBG_instantiate(), and
RAND_DRBG_uninstantiate()
return 1 on success, and 0 on failure.
RAND_DRBG_free() does not return a value.
=head1 NOTES
The DRBG design supports I<chaining>, which means that a DRBG instance can
use another B<parent> DRBG instance instead of the default entropy source
to obtain fresh random input for reseeding, provided that B<parent> DRBG
instance was properly instantiated, either from a trusted entropy source,
or from yet another parent DRBG instance.
For a detailed description of the reseeding process, see L<RAND_DRBG(7)>.
The default DRBG type and flags are applied only during creation of a DRBG
instance.
To ensure that they are applied to the global and thread-local DRBG instances
(<master>, resp. <public> and <private>), it is necessary to call
RAND_DRBG_set_defaults() before creating any thread and before calling any
cryptographic routines that obtain random data directly or indirectly.
=head1 HISTORY
The RAND_DRBG functions were added in OpenSSL 1.1.1.
=head1 SEE ALSO
L<OPENSSL_zalloc(3)>,
L<OPENSSL_secure_zalloc(3)>,
L<RAND_DRBG_generate(3)>,
L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/RAND_DRBG_reseed.pod
+111
View File
@@ -0,0 +1,111 @@
=pod
=head1 NAME
RAND_DRBG_reseed,
RAND_DRBG_set_reseed_interval,
RAND_DRBG_set_reseed_time_interval,
RAND_DRBG_set_reseed_defaults
- reseed a RAND_DRBG instance
=head1 SYNOPSIS
#include <openssl/rand_drbg.h>
int RAND_DRBG_reseed(RAND_DRBG *drbg,
const unsigned char *adin, size_t adinlen);
int RAND_DRBG_set_reseed_interval(RAND_DRBG *drbg,
unsigned int interval);
int RAND_DRBG_set_reseed_time_interval(RAND_DRBG *drbg,
time_t interval);
int RAND_DRBG_set_reseed_defaults(
unsigned int master_reseed_interval,
unsigned int slave_reseed_interval,
time_t master_reseed_time_interval,
time_t slave_reseed_time_interval
);
=head1 DESCRIPTION
RAND_DRBG_reseed()
reseeds the given B<drbg>, obtaining entropy input from its entropy source
and mixing in the specified additional data provided in the buffer B<adin>
of length B<adinlen>.
The additional data can be omitted by setting B<adin> to NULL and B<adinlen>
to 0.
RAND_DRBG_set_reseed_interval()
sets the reseed interval of the B<drbg>, which is the maximum allowed number
of generate requests between consecutive reseedings.
If B<interval> > 0, then the B<drbg> will reseed automatically whenever the
number of generate requests since its last seeding exceeds the given reseed
interval.
If B<interval> == 0, then this feature is disabled.
RAND_DRBG_set_reseed_time_interval()
sets the reseed time interval of the B<drbg>, which is the maximum allowed
number of seconds between consecutive reseedings.
If B<interval> > 0, then the B<drbg> will reseed automatically whenever the
elapsed time since its last reseeding exceeds the given reseed time interval.
If B<interval> == 0, then this feature is disabled.
RAND_DRBG_set_reseed_defaults() sets the default values for the reseed interval
(B<master_reseed_interval> and B<slave_reseed_interval>)
and the reseed time interval
(B<master_reseed_time_interval> and B<slave_reseed_tme_interval>)
of DRBG instances.
The default values are set independently for master DRBG instances (which don't
have a parent) and slave DRBG instances (which are chained to a parent DRBG).
=head1 RETURN VALUES
RAND_DRBG_reseed(),
RAND_DRBG_set_reseed_interval(), and
RAND_DRBG_set_reseed_time_interval(),
return 1 on success, 0 on failure.
=head1 NOTES
The default OpenSSL random generator is already set up for automatic reseeding,
so in general it is not necessary to reseed it explicitly, or to modify
its reseeding thresholds.
Normally, the entropy input for seeding a DRBG is either obtained from a
trusted os entropy source or from a parent DRBG instance, which was seeded
(directly or indirectly) from a trusted os entropy source.
In exceptional cases it is possible to replace the reseeding mechanism entirely
by providing application defined callbacks using RAND_DRBG_set_callbacks().
The reseeding default values are applied only during creation of a DRBG instance.
To ensure that they are applied to the global and thread-local DRBG instances
(<master>, resp. <public> and <private>), it is necessary to call
RAND_DRBG_set_reseed_defaults() before creating any thread and before calling any
cryptographic routines that obtain random data directly or indirectly.
=head1 HISTORY
The RAND_DRBG functions were added in OpenSSL 1.1.1.
=head1 SEE ALSO
L<RAND_DRBG_generate(3)>,
L<RAND_DRBG_bytes(3)>,
L<RAND_DRBG_set_callbacks(3)>.
L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/RAND_DRBG_set_callbacks.pod
+147
View File
@@ -0,0 +1,147 @@
=pod
=head1 NAME
RAND_DRBG_set_callbacks,
RAND_DRBG_get_entropy_fn,
RAND_DRBG_cleanup_entropy_fn,
RAND_DRBG_get_nonce_fn,
RAND_DRBG_cleanup_nonce_fn
- set callbacks for reseeding
=head1 SYNOPSIS
#include <openssl/rand_drbg.h>
int RAND_DRBG_set_callbacks(RAND_DRBG *drbg,
RAND_DRBG_get_entropy_fn get_entropy,
RAND_DRBG_cleanup_entropy_fn cleanup_entropy,
RAND_DRBG_get_nonce_fn get_nonce,
RAND_DRBG_cleanup_nonce_fn cleanup_nonce);
=head2 Callback Functions
typedef size_t (*RAND_DRBG_get_entropy_fn)(
RAND_DRBG *drbg,
unsigned char **pout,
int entropy,
size_t min_len, size_t max_len,
int prediction_resistance);
typedef void (*RAND_DRBG_cleanup_entropy_fn)(
RAND_DRBG *drbg,
unsigned char *out, size_t outlen);
typedef size_t (*RAND_DRBG_get_nonce_fn)(
RAND_DRBG *drbg,
unsigned char **pout,
int entropy,
size_t min_len, size_t max_len);
typedef void (*RAND_DRBG_cleanup_nonce_fn)(
RAND_DRBG *drbg,
unsigned char *out, size_t outlen);
=head1 DESCRIPTION
RAND_DRBG_set_callbacks() sets the callbacks for obtaining fresh entropy and
the nonce when reseeding the given B<drbg>.
The callback functions are implemented and provided by the caller.
Their parameter lists need to match the function prototypes above.
Setting the callbacks is allowed only if the DRBG has not been initialized yet.
Otherwise, the operation will fail.
To change the settings for one of the three shared DRBGs it is necessary to call
RAND_DRBG_uninstantiate() first.
The B<get_entropy>() callback is called by the B<drbg> when it requests fresh
random input.
It is expected that the callback allocates and fills a random buffer of size
B<min_len> <= size <= B<max_len> (in bytes) which contains at least B<entropy>
bits of randomness.
The B<prediction_resistance> flag indicates whether the reseeding was
triggered by a prediction resistance request.
The buffer's address is to be returned in *B<pout> and the number of collected
randomness bytes as return value.
If the callback fails to acquire at least B<entropy> bits of randomness,
it must indicate an error by returning a buffer length of 0.
If B<prediction_resistance> was requested and the random source of the DRBG
does not satisfy the conditions requested by [NIST SP 800-90C], then
it must also indicate an error by returning a buffer length of 0.
See NOTES section for more details.
The B<cleanup_entropy>() callback is called from the B<drbg> to to clear and
free the buffer allocated previously by get_entropy().
The values B<out> and B<outlen> are the random buffer's address and length,
as returned by the get_entropy() callback.
The B<get_nonce>() and B<cleanup_nonce>() callbacks are used to obtain a nonce
and free it again. A nonce is only required for instantiation (not for reseeding)
and only in the case where the DRBG uses a derivation function.
The callbacks are analogous to get_entropy() and cleanup_entropy(),
except for the missing prediction_resistance flag.
If the derivation function is disabled, then no nonce is used for instantiation,
and the B<get_nonce>() and B<cleanup_nonce>() callbacks can be omitted by
setting them to NULL.
=head1 RETURN VALUES
RAND_DRBG_set_callbacks() return 1 on success, and 0 on failure
=head1 NOTES
It is important that B<cleanup_entropy>() and B<cleanup_nonce>() clear the buffer
contents safely before freeing it, in order not to leave sensitive information
about the DRBG's state in memory.
A request for prediction resistance can only be satisfied by pulling fresh
entropy from one of the approved entropy sources listed in section 5.5.2 of
[NIST SP 800-90C].
Since the default implementation of the get_entropy callback does not have access
to such an approved entropy source, a request for prediction resistance will
always fail.
In other words, prediction resistance is currently not supported yet by the DRBG.
The derivation function is disabled during initialization by calling the
RAND_DRBG_set() function with the RAND_DRBG_FLAG_CTR_NO_DF flag.
For more information on the derivation function and when it can be omitted,
see [NIST SP 800-90A Rev. 1]. Roughly speeking it can be omitted if the random
source has "full entropy", i.e., contains 8 bits of entropy per byte.
Even if a nonce is required, the B<get_nonce>() and B<cleanup_nonce>()
callbacks can be omitted by setting them to NULL.
In this case the DRBG will automatically request an extra amount of entropy
(using the B<get_entropy>() and B<cleanup_entropy>() callbacks) which it will
utilize for the nonce, following the recommendations of [NIST SP 800-90A Rev. 1],
section 8.6.7.
=head1 HISTORY
The RAND_DRBG functions were added in OpenSSL 1.1.1.
=head1 SEE ALSO
L<RAND_DRBG_new(3)>,
L<RAND_DRBG_reseed(3)>,
L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/RAND_DRBG_set_ex_data.pod
+68
View File
@@ -0,0 +1,68 @@
=pod
=head1 NAME
RAND_DRBG_set_ex_data,
RAND_DRBG_get_ex_data,
RAND_DRBG_get_ex_new_index
- store and retrieve extra data from the DRBG instance
=head1 SYNOPSIS
#include <openssl/rand_drbg.h>
int RAND_DRBG_set_ex_data(RAND_DRBG *drbg, int idx, void *data);
void *RAND_DRBG_get_ex_data(const RAND_DRBG *drbg, int idx);
int RAND_DRBG_get_ex_new_index(long argl, void *argp,
CRYPTO_EX_new *new_func,
CRYPTO_EX_dup *dup_func,
CRYPTO_EX_free *free_func);
=head1 DESCRIPTION
RAND_DRBG_set_ex_data() enables an application to store arbitrary application
specific data B<data> in a RAND_DRBG instance B<drbg>. The index B<idx> should
be a value previously returned from a call to RAND_DRBG_get_ex_new_index().
RAND_DRBG_get_ex_data() retrieves application specific data previously stored
in an RAND_DRBG instance B<drbg>. The B<idx> value should be the same as that
used when originally storing the data.
For more detailed information see L<CRYPTO_get_ex_data(3)> and
L<CRYPTO_set_ex_data(3)> which implement these functions and
L<CRYPTO_get_ex_new_index(3)> for generating a unique index.
=head1 RETURN VALUES
RAND_DRBG_set_ex_data() returns 1 for success or 0 for failure.
RAND_DRBG_get_ex_data() returns the previously stored value or NULL on
failure. NULL may also be a valid value.
=head1 NOTES
RAND_DRBG_get_ex_new_index(...) is implemented as a macro and equivalent to
CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DRBG,...).
=head1 SEE ALSO
L<CRYPTO_get_ex_data(3)>,
L<CRYPTO_set_ex_data(3)>,
L<CRYPTO_get_ex_new_index(3)>,
L<RAND_DRBG(7)>
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/RAND_add.pod
+27 -92
View File
@@ -24,43 +24,42 @@ Deprecated:
=head1 DESCRIPTION
Random numbers are a vital part of cryptography, including key generation,
creating salts, etc., and software-based
generators must be "seeded" with external randomness before they can be
used as a cryptographically-secure pseudo-random number generator (CSPRNG).
The availability of common hardware with special instructions and
modern operating systems, which may use items such as interrupt jitter
and network packet timings, can be reasonable sources of seeding material.
These functions can be used to seed the random generator and to check its
seeded state.
In general, manual (re-)seeding of the default OpenSSL random generator
(L<RAND_OpenSSL(3)>) is not necessary (but allowed), since it does (re-)seed
itself automatically using trusted system entropy sources.
This holds unless the default RAND_METHOD has been replaced or OpenSSL was
built with automatic reseeding disabled, see L<RAND(7)> for more details.
RAND_status() indicates whether or not the CSPRNG has been sufficiently
seeded. If not, functions such as RAND_bytes(3) will fail.
RAND_status() indicates whether or not the random generator has been sufficiently
seeded. If not, functions such as L<RAND_bytes(3)> will fail.
RAND_poll() uses the system's capabilities to seed the CSPRNG using
RAND_poll() uses the system's capabilities to seed the random generator using
random input obtained from polling various trusted entropy sources.
The default choice of the entropy source can be modified at build time
using the --with-rand-seed configure option, see also the B<NOTES> section.
A summary of the configure options can be displayed with the OpenSSL
L<version(1)> command.
The default choice of the entropy source can be modified at build time,
see L<RAND(7)> for more details.
RAND_add() mixes the B<num> bytes at B<buf> into the PRNG state.
RAND_add() mixes the B<num> bytes at B<buf> into the internal state
of the random generator.
This function will not normally be needed, as mentioned above.
The B<randomness> argument is an estimate of how much randomness is
contained in
B<buf>, in bytes, and should be a number between zero and B<num>.
Details about sources of randomness and how to estimate their randomness
can be found in the literature; for example NIST SP 800-90B.
The content of B<buf> cannot be recovered from subsequent CSPRNG output.
This function will not normally be needed, as RAND_poll() should have been
configured to do the appropriate seeding for the local platform.
Applications that need to keep random state in an external file should
use L<RAND_load_file(3)>.
can be found in the literature; for example [NIST SP 800-90B].
The content of B<buf> cannot be recovered from subsequent random generator output.
Applications that intend to save and restore random state in an external file
should consider using L<RAND_load_file(3)> instead.
RAND_seed() is equivalent to RAND_add() with B<randomness> set to B<num>.
RAND_event() and RAND_screen() are equivalent to RAND_poll().
RAND_event() and RAND_screen() are equivalent to RAND_poll() and exist
for compatibility reasons only. See HISTORY section below.
=head1 RETURN VALUES
RAND_status() returns 1 if the CSPRNG has been seeded
RAND_status() returns 1 if the random generator has been seeded
with enough data, 0 otherwise.
RAND_poll() returns 1 if it generated seed data, 0 otherwise.
@@ -69,72 +68,6 @@ RAND_event() returns RAND_status().
The other functions do not return values.
=head1 NOTES
The new OpenSSL DRBG has some peculiarities which need to be taken
into account when it is selected as the default OpenSSL CSPRNG, i.e.,
when RAND_get_rand_method() == RAND_OpenSSL().
This applies in particular to the way reseeding is done by the DRBG:
=over 2
=item *
The DRBG seeds itself automatically, pulling random input from trusted
entropy sources.
Automatic reseeding occurs after a predefined number of generate requests.
The selection of the trusted entropy sources is configured at build
time using the --with-rand-seed option.
=item *
The DRBG distinguishes two different types of random input:
'entropy', which comes from a trusted source, and 'additional input',
which can optionally be added by the user and is considered untrusted.
=back
Automatic seeding can be disabled using the --with-rand-seed=none option.
=head2 DRBG with automatic seeding enabled
Calling RAND_poll() or RAND_add() is not necessary, because the DRBG
polls the entropy source automatically.
However, both calls are permitted, and do reseed the RNG.
RAND_add() can be used to add both kinds of random input, depending on the
value of the B<randomness> argument:
=over 4
=item randomness == 0:
The random bytes are mixed as additional input into the current state of
the DRBG.
Mixing in additional input is not considered a full reseeding, hence the
reseed counter is not reset.
=item randomness > 0:
The random bytes are used as entropy input for a full reseeding
(resp. reinstantiation) if the DRBG is instantiated
(resp. uninstantiated or in an error state).
A reseeding requires 16 bytes (128 bits) of randomness.
It is possible to provide less randomness than required.
In this case the missing randomness will be obtained by pulling random input
from the trusted entropy sources.
=back
=head2 DRBG with automatic seeding disabled (--with-rand-seed=none)
Calling RAND_poll() will always fail.
RAND_add() needs to be called for initial seeding and periodic reseeding.
At least 16 bytes (128 bits) of randomness have to be provided, otherwise
the (re-)seeding of the DRBG will fail.
=head1 HISTORY
RAND_event() and RAND_screen() were deprecated in OpenSSL 1.1.0 and should
@@ -142,12 +75,14 @@ not be used.
=head1 SEE ALSO
L<RAND_bytes(3)>, L<RAND_egd(3)>,
L<RAND_load_file(3)>
L<RAND_bytes(3)>,
L<RAND_egd(3)>,
L<RAND_load_file(3)>,
L<RAND(7)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/RAND_bytes.pod
+7 -5
View File
@@ -20,7 +20,7 @@ Deprecated:
=head1 DESCRIPTION
RAND_bytes() puts B<num> cryptographically strong pseudo-random bytes
into B<buf>. An error occurs if the PRNG has not been seeded with
into B<buf>. An error occurs if the CSPRNG has not been seeded with
enough randomness to ensure an unpredictable byte sequence.
RAND_priv_bytes() has the same semantics as RAND_bytes(). It is intended to
@@ -30,7 +30,7 @@ a compromise of the global generator will not affect such key generation.
=head1 RETURN VALUES
RAND_bytes() nad RAND_priv_bytes()
RAND_bytes() and RAND_priv_bytes()
return 1 on success, -1 if not supported by the current
RAND method, or 0 on other failure. The error code can be
obtained by L<ERR_get_error(3)>.
@@ -41,12 +41,14 @@ RAND_pseudo_bytes() was deprecated in OpenSSL 1.1.0; use RAND_bytes() instead.
=head1 SEE ALSO
L<RAND_bytes(3)>, L<ERR_get_error(3)>,
L<RAND_add(3)>
L<RAND_add(3)>,
L<RAND_bytes(3)>,
L<ERR_get_error(3)>,
L<RAND(7)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/RAND_cleanup.pod
+4
View File
@@ -28,6 +28,10 @@ RAND_cleanup() returns no value.
RAND_cleanup() was deprecated in OpenSSL 1.1.0; do not use it.
See L<OPENSSL_init_crypto(3)>
=head1 SEE ALSO
L<RAND(7)>
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/RAND_egd.pod
+3 -1
View File
@@ -45,7 +45,9 @@ success, or -1 if the connection failed.
=head1 SEE ALSO
L<RAND_bytes(3)>, L<RAND_add(3)>
L<RAND_add(3)>,
L<RAND_bytes(3)>,
L<RAND(7)>
=head1 COPYRIGHT
doc/man3/RAND_load_file.pod
+7 -9
View File
@@ -24,6 +24,9 @@ Do not load the same file multiple times unless its contents have
been updated by RAND_write_file() between reads.
Also, note that B<filename> should be adequately protected so that an
attacker cannot replace or examine the contents.
If B<filename> is not a regular file, then user is considered to be
responsible for any side effects, e.g. non-anticipated blocking or
capture of controlling terminal.
RAND_write_file() writes a number of random bytes (currently 128) to
file B<filename> which can be used to initialize the PRNG by calling
@@ -68,18 +71,13 @@ error.
=head1 SEE ALSO
L<RAND_bytes(3)>, L<RAND_add(3)>
=head1 HISTORY
A comment in the source since at least OpenSSL 1.0.2 said that
RAND_load_file() and RAND_write_file() were only intended for regular files,
and not really device special files such as C</dev/random>. This was
poorly enforced before OpenSSL 1.1.1.
L<RAND_add(3)>,
L<RAND_bytes(3)>,
L<RAND(7)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/RAND_set_rand_method.pod
+5 -4
View File
@@ -19,8 +19,7 @@ RAND_set_rand_method, RAND_get_rand_method, RAND_OpenSSL - select RAND method
A B<RAND_METHOD> specifies the functions that OpenSSL uses for random number
generation.
Initially, the default B<RAND_METHOD> is the OpenSSL internal implementation,
as returned by RAND_OpenSSL().
RAND_OpenSSL() returns the default B<RAND_METHOD> implementation by OpenSSL.
This implementation ensures that the PRNG state is unique for each thread.
If an B<ENGINE> is loaded that provides the RAND API, however, it will
@@ -54,11 +53,13 @@ RAND_OpenSSL() return pointers to the respective methods.
=head1 SEE ALSO
L<RAND_bytes(3)>, L<ENGINE_by_id(3)>
L<RAND_bytes(3)>,
L<ENGINE_by_id(3)>,
L<RAND(7)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/RSA_meth_new.pod
+2 -2
View File
@@ -28,7 +28,7 @@ RSA_meth_get_multi_prime_keygen, RSA_meth_set_multi_prime_keygen
const char *RSA_meth_get0_name(const RSA_METHOD *meth);
int RSA_meth_set1_name(RSA_METHOD *meth, const char *name);
int RSA_meth_get_flags(RSA_METHOD *meth);
int RSA_meth_get_flags(const RSA_METHOD *meth);
int RSA_meth_set_flags(RSA_METHOD *meth, int flags);
void *RSA_meth_get0_app_data(const RSA_METHOD *meth);
@@ -252,7 +252,7 @@ Other functions described here were added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SMIME_read_PKCS7.pod
+1 -1
View File
@@ -57,7 +57,7 @@ streaming single pass option should be available.
=head1 RETURN VALUES
SMIME_read_PKCS7() returns a valid B<PKCS7> structure or B<NULL>
is an error occurred. The error can be obtained from ERR_get_error(3).
if an error occurred. The error can be obtained from ERR_get_error(3).
=head1 SEE ALSO
doc/man3/SSL_CONF_cmd.pod
+20 -9
View File
@@ -89,10 +89,18 @@ can be either the B<NIST> name (e.g. B<P-256>) or an OpenSSL OID name
=item B<-cipher>
Sets the cipher suite list to B<value>. Note: syntax checking of B<value> is
currently not performed unless a B<SSL> or B<SSL_CTX> structure is
Sets the TLSv1.2 and below ciphersuite list to B<value>. This list will be
combined with any configured TLSv1.3 ciphersuites. Note: syntax checking
of B<value> is currently not performed unless a B<SSL> or B<SSL_CTX> structure is
associated with B<cctx>.
=item B<-ciphersuites>
Sets the available ciphersuites for TLSv1.3 to value. This is a simple colon
(":") separated list of TLSv1.3 ciphersuite names in order of preference. This
list will be combined any configured TLSv1.2 and below ciphersuites.
=item B<-cert>
Attempts to use the file B<value> as the certificate for the appropriate
@@ -219,9 +227,16 @@ Note: the command prefix (if set) alters the recognised B<cmd> values.
=item B<CipherString>
Sets the cipher suite list to B<value>. Note: syntax checking of B<value> is
currently not performed unless an B<SSL> or B<SSL_CTX> structure is
associated with B<cctx>.
Sets the ciphersuite list for TLSv1.2 and below to B<value>. This list will be
combined with any configured TLSv1.3 ciphersuites. Note: syntax
checking of B<value> is currently not performed unless an B<SSL> or B<SSL_CTX>
structure is associated with B<cctx>.
=item B<Ciphersuites>
Sets the available ciphersuites for TLSv1.3 to B<value>. This is a simple colon
(":") separated list of TLSv1.3 ciphersuite names in order of preference. This
list will be combined any configured TLSv1.2 and below ciphersuites.
=item B<Certificate>
@@ -582,10 +597,6 @@ Set supported curves to P-256, P-384:
SSL_CONF_cmd(ctx, "Curves", "P-256:P-384");
Set automatic support for any elliptic curve for key exchange:
SSL_CONF_cmd(ctx, "ECDHParameters", "Automatic");
=head1 RETURN VALUES
SSL_CONF_cmd() returns 1 if the value of B<cmd> is recognised and B<value> is
doc/man3/SSL_CTX_set_cipher_list.pod
+45 -7
View File
@@ -2,7 +2,11 @@
=head1 NAME
SSL_CTX_set_cipher_list, SSL_set_cipher_list - choose list of available SSL_CIPHERs
SSL_CTX_set_cipher_list,
SSL_set_cipher_list,
SSL_CTX_set_ciphersuites,
SSL_set_ciphersuites
- choose list of available SSL_CIPHERs
=head1 SYNOPSIS
@@ -11,18 +15,49 @@ SSL_CTX_set_cipher_list, SSL_set_cipher_list - choose list of available SSL_CIPH
int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str);
int SSL_set_cipher_list(SSL *ssl, const char *str);
int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str);
int SSL_set_ciphersuites(SSL *s, const char *str);
=head1 DESCRIPTION
SSL_CTX_set_cipher_list() sets the list of available ciphers for B<ctx>
using the control string B<str>. The format of the string is described
SSL_CTX_set_cipher_list() sets the list of available ciphers (TLSv1.2 and below)
for B<ctx> using the control string B<str>. The format of the string is described
in L<ciphers(1)>. The list of ciphers is inherited by all
B<ssl> objects created from B<ctx>.
B<ssl> objects created from B<ctx>. This function does not impact TLSv1.3
ciphersuites. Use SSL_CTX_set_ciphersuites() to configure those.
SSL_set_cipher_list() sets the list of ciphers only for B<ssl>.
SSL_set_cipher_list() sets the list of ciphers (TLSv1.2 and below) only for
B<ssl>.
SSL_CTX_set_ciphersuites() is used to configure the available TLSv1.3
ciphersuites for B<ctx>. This is a simple colon (":") separated list of TLSv1.3
ciphersuite names in order of perference. Valid TLSv1.3 ciphersuite names are:
=over 4
=item TLS_AES_128_GCM_SHA256
=item TLS_AES_256_GCM_SHA384
=item TLS_CHACHA20_POLY1305_SHA256
=item TLS_AES_128_CCM_SHA256
=item TLS_AES_128_CCM_8_SHA256
=back
An empty list is permissible. The default value for the this setting is:
"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
SSL_set_ciphersuites() is the same as SSL_CTX_set_ciphersuites() except it
configures the ciphersuites for B<ssl>.
=head1 NOTES
The control string B<str> should be universally usable and not depend
The control string B<str> for SSL_CTX_set_cipher_list() and
SSL_set_cipher_list() should be universally usable and not depend
on details of the library configuration (ciphers compiled in). Thus no
syntax checking takes place. Items that are not recognized, because the
corresponding ciphers are not compiled in or because they are mistyped,
@@ -55,6 +90,9 @@ and the handshake will fail.
SSL_CTX_set_cipher_list() and SSL_set_cipher_list() return 1 if any cipher
could be selected and 0 on complete failure.
SSL_CTX_set_ciphersuites() and SSL_set_ciphersuites() return 1 if the requested
ciphersuite list was configured, and 0 otherwise.
=head1 SEE ALSO
L<ssl(7)>, L<SSL_get_ciphers(3)>,
@@ -64,7 +102,7 @@ L<ciphers(1)>
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_info_callback.pod
+22 -8
View File
@@ -2,7 +2,11 @@
=head1 NAME
SSL_CTX_set_info_callback, SSL_CTX_get_info_callback, SSL_set_info_callback, SSL_get_info_callback - handle information callback for SSL connections
SSL_CTX_set_info_callback,
SSL_CTX_get_info_callback,
SSL_set_info_callback,
SSL_get_info_callback
- handle information callback for SSL connections
=head1 SYNOPSIS
@@ -37,7 +41,8 @@ callback function for B<ssl>.
When setting up a connection and during use, it is possible to obtain state
information from the SSL/TLS engine. When set, an information callback function
is called whenever the state changes, an alert appears, or an error occurs.
is called whenever a significant event occurs such as: the state changes,
an alert appears, or an error occurs.
The callback function is called as B<callback(SSL *ssl, int where, int ret)>.
The B<where> argument specifies information about where (in which context)
@@ -51,12 +56,15 @@ B<where> is a bitmask made up of the following bits:
=item SSL_CB_LOOP
Callback has been called to indicate state change inside a loop.
Callback has been called to indicate state change or some other significant
state machine event. This may mean that the callback gets invoked more than once
per state in some situations.
=item SSL_CB_EXIT
Callback has been called to indicate error exit of a handshake function.
(May be soft error with retry option for non-blocking setups.)
Callback has been called to indicate exit of a handshake function. This will
happen after the end of a handshake, but may happen at other times too such as
on error or when IO might otherwise block and non-blocking is being used.
=item SSL_CB_READ
@@ -84,11 +92,17 @@ Callback has been called due to an alert being sent or received.
=item SSL_CB_HANDSHAKE_START
Callback has been called because a new handshake is started.
Callback has been called because a new handshake is started. In TLSv1.3 this is
also used for the start of post-handshake message exchanges such as for the
exchange of session tickets, or for key updates. It also occurs when resuming a
handshake following a pause to handle early data.
=item SSL_CB_HANDSHAKE_DONE 0x20
Callback has been called because a handshake is finished.
Callback has been called because a handshake is finished. In TLSv1.3 this is
also used at the end of an exchange of post-handshake messages such as for
session tickets or key updates. It also occurs if the handshake is paused to
allow the exchange of early data.
=back
@@ -146,7 +160,7 @@ L<SSL_alert_type_string(3)>
=head1 COPYRIGHT
Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_num_tickets.pod
+68
View File
@@ -0,0 +1,68 @@
=pod
=head1 NAME
SSL_set_num_tickets,
SSL_get_num_tickets,
SSL_CTX_set_num_tickets,
SSL_CTX_get_num_tickets
- control the number of TLSv1.3 session tickets that are issued
=head1 SYNOPSIS
#include <openssl/ssl.h>
int SSL_set_num_tickets(SSL *s, size_t num_tickets);
size_t SSL_get_num_tickets(SSL *s);
int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets);
size_t SSL_CTX_get_num_tickets(SSL_CTX *ctx);
=head1 DESCRIPTION
SSL_CTX_set_num_tickets() and SSL_set_num_tickets() can be called for a server
application and set the number of session tickets that will be sent to the
client after a full handshake. Set the desired value (which could be 0) in the
B<num_tickets> argument. Typically these functions should be called before the
start of the handshake.
The default number of tickets is 2; the default number of tickets sent following
a resumption handshake is 1 but this cannot be changed using these functions.
The number of tickets following a resumption handshake can be reduced to 0 using
custom session ticket callbacks (see L<SSL_CTX_set_session_ticket_cb(3)>).
Tickets are also issued on receipt of a post-handshake certificate from the
client following a request by the server using
L<SSL_verify_client_post_handshake(3)>. These new tickets will be associated
with the updated client identity (i.e. including their certificate and
verification status). The number of tickets issued will normally be the same as
was used for the initial handshake. If the initial handshake was a full
handshake then SSL_set_num_tickets() can be called again prior to calling
SSL_verify_client_post_handshake() to update the number of tickets that will be
sent.
SSL_CTX_get_num_tickets() and SSL_get_num_tickets() return the number of
tickets set by a previous call to SSL_CTX_set_num_tickets() or
SSL_set_num_tickets(), or 2 if no such call has been made.
=head1 RETURN VALUES
SSL_CTX_set_num_tickets() and SSL_set_num_tickets() return 1 on success or 0 on
failure.
SSL_CTX_get_num_tickets() and SSL_get_num_tickets() return the number of tickets
that have been previously set.
=head1 HISTORY
These functions were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/SSL_CTX_set_options.pod
+2
View File
@@ -151,6 +151,8 @@ of RFC4507bis tickets for stateless session resumption.
If this option is set this functionality is disabled and tickets will
not be used by clients or servers.
This option only applies to TLSv1.2 and below. It is ignored for TLSv1.3.
=item SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
Allow legacy insecure renegotiation between OpenSSL and unpatched clients or
doc/man3/SSL_CTX_set_psk_client_callback.pod
+1 -1
View File
@@ -158,7 +158,7 @@ were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_session_ticket_cb.pod
+96 -53
View File
@@ -16,7 +16,7 @@ SSL_CTX_decrypt_session_ticket_fn - manage session ticket application data
typedef SSL_TICKET_RETURN (*SSL_CTX_decrypt_session_ticket_fn)(SSL *s, SSL_SESSION *ss,
const unsigned char *keyname,
size_t keyname_len,
SSL_TICKET_RETURN retv,
SSL_TICKET_STATUS status,
void *arg);
int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,
SSL_CTX_generate_session_ticket_fn gen_cb,
@@ -39,13 +39,13 @@ is the same as that given to SSL_CTX_set_session_ticket_cb(). The B<gen_cb>
callback is defined as type B<SSL_CTX_generate_session_ticket_fn>.
B<dec_cb> is the application defined callback invoked after session ticket
decryption has been attempted and any session ticket application data is available.
The application can call SSL_SESSION_get_ticket_appdata() at this time to retrieve
the application data. The value of B<arg> is the same as that given to
SSL_CTX_set_session_ticket_cb(). The B<retv> arguement is the result of the ticket
decryption. The B<keyname> and B<keyname_len> identify the key used to decrypt the
session ticket. The B<dec_cb> callback is defined as type
B<SSL_CTX_decrypt_session_ticket_fn>.
decryption has been attempted and any session ticket application data is
available. If ticket decryption was successful then the B<ss> argument contains
the session data. The B<keyname> and B<keyname_len> arguments identify the key
used to decrypt the session ticket. The B<status> argument is the result of the
ticket decryption. See the L<NOTES> section below for further details. The value
of B<arg> is the same as that given to SSL_CTX_set_session_ticket_cb(). The
B<dec_cb> callback is defined as type B<SSL_CTX_decrypt_session_ticket_fn>.
SSL_SESSION_set1_ticket_appdata() sets the application data specified by
B<data> and B<len> into B<ss> which is then placed into any generated session
@@ -66,17 +66,99 @@ application that a session ticket has just been decrypted.
=head1 NOTES
When the B<dec_cb> callback is invoked, the SSL_SESSION B<ss> has not yet been
assigned to the SSL B<s>. The B<retv> indicates the result of the ticket
decryption which can be modified by the callback before being returned. The
callback must check the B<retv> value before performing any action, as it's
called even if ticket decryption fails.
assigned to the SSL B<s>. The B<status> indicates the result of the ticket
decryption. The callback must check the B<status> value before performing any
action, as it is called even if ticket decryption fails.
The B<keyname> and B<keyname_len> arguments to B<dec_cb> may be used to identify
the key that was used to encrypt the session ticket.
The B<status> argument can be any of these values:
=over 4
=item SSL_TICKET_EMPTY
Empty ticket present. No ticket data will be used and a new ticket should be
sent to the client. This only occurs in TLSv1.2 or below. In TLSv1.3 it is not
valid for a client to send an empty ticket.
=item SSL_TICKET_NO_DECRYPT
The ticket couldn't be decrypted. No ticket data will be used and a new ticket
should be sent to the client.
=item SSL_TICKET_SUCCESS
A ticket was successfully decrypted, any session ticket application data should
be available. A new ticket should not be sent to the client.
=item SSL_TICKET_SUCCESS_RENEW
Same as B<SSL_TICKET_SUCCESS>, but a new ticket should be sent to the client.
=back
The return value can be any of these values:
=over 4
=item SSL_TICKET_RETURN_ABORT
The handshake should be aborted, either because of an error or because of some
policy. Note that in TLSv1.3 a client may send more than one ticket in a single
handshake. Therefore just because one ticket is unacceptable it does not mean
that all of them are. For this reason this option should be used with caution.
=item SSL_TICKET_RETURN_IGNORE
Do not use a ticket (if one was available). Do not send a renewed ticket to the
client.
=item SSL_TICKET_RETURN_IGNORE_RENEW
Do not use a ticket (if one was available). Send a renewed ticket to the client.
If the callback does not wish to change the default ticket behaviour then it
should return this value if B<status> is B<SSL_TICKET_EMPTY> or
B<SSL_TICKET_NO_DECRYPT>.
=item SSL_TICKET_RETURN_USE
Use the ticket. Do not send a renewed ticket to the client. It is an error for
the callback to return this value if B<status> has a value other than
B<SSL_TICKET_SUCCESS> or B<SSL_TICKET_SUCCESS_RENEW>.
If the callback does not wish to change the default ticket behaviour then it
should return this value if B<status> is B<SSL_TICKET_SUCCESS>.
=item SSL_TICKET_RETURN_USE_RENEW
Use the ticket. Send a renewed ticket to the client. It is an error for the
callback to return this value if B<status> has a value other than
B<SSL_TICKET_SUCCESS> or B<SSL_TICKET_SUCCESS_RENEW>.
If the callback does not wish to change the default ticket behaviour then it
should return this value if B<status> is B<SSL_TICKET_SUCCESS_RENEW>.
=back
If B<status> has the value B<SSL_TICKET_EMPTY> or B<SSL_TICKET_NO_DECRYPT> then
no session data will be available and the callback must not use the B<ss>
argument. If B<status> has the value B<SSL_TICKET_SUCCESS> or
B<SSL_TICKET_SUCCESS_RENEW> then the application can call
SSL_SESSION_get0_ticket_appdata() using the session provided in the B<ss>
argument to retrieve the application data.
When the B<gen_cb> callback is invoked, the SSL_get_session() function can be
used to retrieve the SSL_SESSION for SSL_SESSION_set1_ticket_appdata().
By default, in TLSv1.2 and below, a new session ticket is not issued on a
successful resumption and therefore B<gen_cb> will not be called. In TLSv1.3 the
default behaviour is to always issue a new ticket on resumption. In both cases
this behaviour can be changed if a ticket key callback is in use (see
L<SSL_CTX_set_tlsext_ticket_key_cb(3)>).
=head1 RETURN VALUES
The SSL_CTX_set_session_ticket_cb(), SSL_SESSION_set1_ticket_appdata() and
@@ -86,46 +168,7 @@ failure.
The B<gen_cb> callback must return 1 to continue the connection. A return of 0
will terminate the connection with an INTERNAL_ERROR alert.
The B<dec_cb> callback must return one of the following B<SSL_TICKET_RETURN>
values. Under normal circumstances the B<retv> value is returned unmodified,
but the callback can change the behavior of the post-ticket decryption code
by returning something different. The B<dec_cb> callback must check the B<retv>
value before performing any action.
typedef int SSL_TICKET_RETURN;
=over 4
=item SSL_TICKET_FATAL_ERR_MALLOC
Fatal error, malloc failure.
=item SSL_TICKET_FATAL_ERR_OTHER
Fatal error, either from parsing or decrypting the ticket.
=item SSL_TICKET_NONE
No ticket present.
=item SSL_TICKET_EMPTY
Empty ticket present.
=item SSL_TICKET_NO_DECRYPT
The ticket couldn't be decrypted.
=item SSL_TICKET_SUCCESS
A ticket was successfully decrypted, any session ticket application data should
be available.
=item TICKET_SUCCESS_RENEW
Same as B<TICKET_SUCCESS>, but the ticket needs to be renewed.
=back
The B<dec_cb> callback must return a value as described in L<NOTES> above.
=head1 SEE ALSO
@@ -139,7 +182,7 @@ SSL_SESSION_get_ticket_appdata() were added to OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_tlsext_ticket_key_cb.pod
+2 -2
View File
@@ -133,7 +133,7 @@ Reference Implementation:
HMAC_CTX *hctx, int enc)
{
if (enc) { /* create new session */
if (RAND_bytes(iv, EVP_MAX_IV_LENGTH))
if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
return -1; /* insufficient random */
key = currentkey(); /* something that you need to implement */
@@ -190,7 +190,7 @@ L<SSL_CTX_set_session_id_context(3)>,
=head1 COPYRIGHT
Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2014-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_tlsext_use_srtp.pod
+1 -1
View File
@@ -101,7 +101,7 @@ L<SSL_export_keying_material(3)>
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_use_certificate.pod
+9 -2
View File
@@ -106,7 +106,7 @@ B<x>, B<pkey> and B<chain> are set only if all were not previously set.
If B<override> is non-0, then the certificate, private key and chain certs
are always set. If B<pkey> is NULL, then the public key of B<x> is used as
the private key. This is intended to be used with hardware (via the ENGINE
inteface) that stores the private key securely, such that it cannot be
interface) that stores the private key securely, such that it cannot be
accessed by OpenSSL. The reference count of the public key is incremented
(twice if there is no private key); it is not copied nor duplicated. This
allows all private key validations checks to succeed without an actual
@@ -170,6 +170,13 @@ L<SSL_CTX_set_default_passwd_cb(3)>.
of view, it however does not make sense as the data in the certificate
is considered public anyway.)
All of the functions to set a new certificate will replace any existing
certificate of the same type that has already been set. Similarly all of the
functions to set a new private key will replace any private key that has already
been set. Applications should call L<SSL_CTX_check_private_key(3)> or
L<SSL_check_private_key(3)> as appropriate after loading a new certificate and
private key to confirm that the certificate and key match.
=head1 RETURN VALUES
On success, the functions return 1.
@@ -187,7 +194,7 @@ L<SSL_CTX_add_extra_chain_cert(3)>
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_use_psk_identity_hint.pod
+1 -1
View File
@@ -135,7 +135,7 @@ were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_connect.pod
+15
View File
@@ -35,6 +35,21 @@ nothing is to be done, but select() can be used to check for the required
condition. When using a buffering BIO, like a BIO pair, data must be written
into or retrieved out of the BIO before being able to continue.
Many systems implement Nagle's algorithm by default which means that it will
buffer outgoing TCP data if a TCP packet has already been sent for which no
corresponding ACK has been received yet from the peer. This can have performance
impacts after a successful TLSv1.3 handshake or a successful TLSv1.2 (or below)
resumption handshake, because the last peer to communicate in the handshake is
the client. If the client is also the first to send application data (as is
typical for many protocols) then this data could be buffered until an ACK has
been received for the final handshake message.
The B<TCP_NODELAY> socket option is often available to disable Nagle's
algorithm. If an application opts to disable Nagle's algorithm consideration
should be given to turning it back on again later if appropriate. The helper
function BIO_set_tcp_ndelay() can be used to turn on or off the B<TCP_NODELAY>
option.
=head1 RETURN VALUES
The following return values can occur:
doc/man3/SSL_get_ciphers.pod
+21 -3
View File
@@ -2,9 +2,13 @@
=head1 NAME
SSL_get1_supported_ciphers, SSL_get_client_ciphers,
SSL_get_ciphers, SSL_CTX_get_ciphers,
SSL_bytes_to_cipher_list, SSL_get_cipher_list
SSL_get1_supported_ciphers,
SSL_get_client_ciphers,
SSL_get_ciphers,
SSL_CTX_get_ciphers,
SSL_bytes_to_cipher_list,
SSL_get_cipher_list,
SSL_get_shared_ciphers
- get list of available SSL_CIPHERs
=head1 SYNOPSIS
@@ -19,6 +23,7 @@ SSL_bytes_to_cipher_list, SSL_get_cipher_list
int isv2format, STACK_OF(SSL_CIPHER) **sk,
STACK_OF(SSL_CIPHER) **scsvs);
const char *SSL_get_cipher_list(const SSL *ssl, int priority);
char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size);
=head1 DESCRIPTION
@@ -58,6 +63,19 @@ listed for B<ssl> with B<priority>. If B<ssl> is NULL, no ciphers are
available, or there are less ciphers than B<priority> available, NULL
is returned.
SSL_get_shared_ciphers() creates a colon separated and NUL terminated list of
SSL_CIPHER names that are available in both the client and the server. B<buf> is
the buffer that should be populated with the list of names and B<size> is the
size of that buffer. A pointer to B<buf> is returned on success or NULL on
error. If the supplied buffer is not large enough to contain the complete list
of names then a truncated list of names will be returned. Note that just because
a ciphersuite is available (i.e. it is configured in the cipher list) and shared
by both the client and the server it does not mean that it is enabled (see the
description of SSL_get1_supported_ciphers() above). This function will return
available shared ciphersuites whether or not they are enabled. This is a server
side function only and must only be called after the completion of the initial
handshake.
=head1 NOTES
The details of the ciphers obtained by SSL_get_ciphers(), SSL_CTX_get_ciphers()
doc/man3/SSL_get_error.pod
+5 -6
View File
@@ -38,11 +38,10 @@ if and only if B<ret E<gt> 0>.
=item SSL_ERROR_ZERO_RETURN
The TLS/SSL connection has been closed.
If the protocol version is SSL 3.0 or higher, this result code is returned only
if a closure alert has occurred in the protocol, i.e. if the connection has been
closed cleanly.
Note that in this case B<SSL_ERROR_ZERO_RETURN> does not necessarily
The TLS/SSL peer has closed the connection for writing by sending the
"close notify" alert.
No more data can be read.
Note that B<SSL_ERROR_ZERO_RETURN> does not necessarily
indicate that the underlying transport has been closed.
=item SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE
@@ -141,7 +140,7 @@ SSL_ERROR_WANT_CLIENT_HELLO_CB was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_get_session.pod
+6 -1
View File
@@ -48,6 +48,11 @@ SSL_SESSION object that cannot be used for resumption in TLSv1.3. It also
enables applications to obtain information about all sessions sent by the
server.
A session will be automatically removed from the session cache and marked as
non-resumable if the connection is not closed down cleanly, e.g. if a fatal
error occurs on the connection or L<SSL_shutdown(3)> is not called prior to
L<SSL_free(3)>.
In TLSv1.3 it is recommended that each SSL_SESSION object is only used for
resumption once.
@@ -95,7 +100,7 @@ L<SSL_SESSION_free(3)>
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_get_version.pod
+7 -8
View File
@@ -20,15 +20,14 @@ protocol information of a connection
=head1 DESCRIPTION
SSL_client_version() returns the protocol version used by the client when
initiating the connection.
SSL_get_version() returns the name of the protocol used for the
connection.
initiating the connection. SSL_get_version() returns the name of the protocol
used for the connection. SSL_version() returns the protocol version used for the
connection. They should only be called after the initial handshake has been
completed. Prior to that the results returned from these functions may be
unreliable.
SSL_is_dtls() returns one if the connection is using DTLS, zero if not.
SSL_version() returns the protocol version used for the connection.
=head1 RETURN VALUES
SSL_get_version() returns one of the following strings:
@@ -57,7 +56,7 @@ The connection uses the TLSv1.3 protocol.
=item unknown
This indicates that no version has been set (no connection established).
This indicates an unknown protocol version.
=back
@@ -98,7 +97,7 @@ SSL_is_dtls() was added in OpenSSL 1.1.0.
=head1 COPYRIGHT
Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_read_early_data.pod
+50 -9
View File
@@ -41,9 +41,9 @@ can be used to send data from the server to the client when the client has not
yet completed the authentication stage of the handshake.
Early data has weaker security properties than other data sent over an SSL/TLS
connection. In particular the data does not have forward secrecy and there are
no guarantees that the same early data was not replayed across multiple
connections. For this reason extreme care should be exercised when using early
connection. In particular the data does not have forward secrecy. There are also
additional considerations around replay attacks (see L<REPLAY PROTECTION>
below). For these reasons extreme care should be exercised when using early
data. For specific details, consult the TLS 1.3 specification.
When a server receives early data it may opt to immediately respond by sending
@@ -171,12 +171,16 @@ connection attempt. By default the server does not accept early data; a
server may indicate support for early data by calling
SSL_CTX_set_max_early_data() or
SSL_set_max_early_data() to set it for the whole SSL_CTX or an individual SSL
object respectively. Similarly the SSL_CTX_get_max_early_data() and
object respectively. The B<max_early_data> parameter specifies the maximum
amount of early data in bytes that is permitted to be sent on a single
connection. Similarly the SSL_CTX_get_max_early_data() and
SSL_get_max_early_data() functions can be used to obtain the current maximum
early data settings for the SSL_CTX and SSL objects respectively.
Generally a server application will either use both of SSL_read_early_data()
and SSL_CTX_set_max_early_data() (or SSL_set_max_early_data()), or neither
of them, since there is no practical benefit from using only one of them.
early data settings for the SSL_CTX and SSL objects respectively. Generally a
server application will either use both of SSL_read_early_data() and
SSL_CTX_set_max_early_data() (or SSL_set_max_early_data()), or neither of them,
since there is no practical benefit from using only one of them. If the maximum
early data setting for a server is non-zero then replay protection is
automatically enabled (see L</REPLAY PROTECTION> below).
In the event that the current maximum early data setting for the server is
different to that originally specified in a session that a client is resuming
@@ -209,6 +213,43 @@ Nagle's algorithm. If an application opts to disable Nagle's algorithm
consideration should be given to turning it back on again after the handshake is
complete if appropriate.
=head1 REPLAY PROTECTION
When early data is in use the TLS protocol provides no security guarantees that
the same early data was not replayed across multiple connections. As a
mitigation for this issue OpenSSL automatically enables replay protection if the
server is configured with a non-zero max early data value. With replay
protection enabled sessions are forced to be single use only. If a client
attempts to reuse a session ticket more than once, then the second and
subsequent attempts will fall back to a full handshake (and any early data that
was submitted will be ignored). Note that single use tickets are enforced even
if a client does not send any early data.
The replay protection mechanism relies on the internal OpenSSL server session
cache (see L<SSL_CTX_set_session_cache_mode(3)>). By default sessions will be
added to the cache whenever a session ticket is issued. When a client attempts
to resume the session OpenSSL will check for its presence in the internal cache.
If it exists then the resumption is allowed and the session is removed from the
cache. If it does not exist then the resumption is not allowed and a full
handshake will occur.
Note that some applications may maintain an external cache of sessions (see
L<SSL_CTX_sess_set_new_cb(3)> and similar functions). It is the application's
responsibility to ensure that any sessions in the external cache are also
populated in the internal cache and that once removed from the internal cache
they are similarly removed from the external cache. Failing to do this could
result in an application becoming vulnerable to replay attacks. Note that
OpenSSL will lock the internal cache while a session is removed but that lock is
not held when the remove session callback (see L<SSL_CTX_sess_set_remove_cb(3)>)
is called. This could result in a small amount of time where the session has
been removed from the internal cache but is still available in the external
cache. Applications should be designed with this in mind in order to minimise
the possibility of replay attacks.
The OpenSSL replay protection does not apply to external Pre Shared Keys (PSKs)
(e.g. see SSL_CTX_set_psk_find_session_callback(3)). Therefore extreme caution
should be applied when combining external PSKs with early data.
=head1 RETURN VALUES
SSL_write_early_data() returns 1 for success or 0 for failure. In the event of a
@@ -248,7 +289,7 @@ All of the functions described above were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_shutdown.pod
+42 -23
View File
@@ -35,35 +35,52 @@ performed, so that the peers stay synchronized.
SSL_shutdown() supports both uni- and bidirectional shutdown by its 2 step
behaviour.
=over 4
SSL_shutdown() only closes the write direction.
It is not possible to call SSL_write() after calling SSL_shutdown().
The read direction is closed by the peer.
=item When the application is the first party to send the "close notify"
=head2 First to close the connection
When the application is the first party to send the "close notify"
alert, SSL_shutdown() will only send the alert and then set the
SSL_SENT_SHUTDOWN flag (so that the session is considered good and will
be kept in cache). SSL_shutdown() will then return with 0. If a unidirectional
shutdown is enough (the underlying connection shall be closed anyway), this
first call to SSL_shutdown() is sufficient. In order to complete the
bidirectional shutdown handshake, SSL_shutdown() must be called again.
The second call will make SSL_shutdown() wait for the peer's "close notify"
shutdown alert. On success, the second call to SSL_shutdown() will return
with 1.
be kept in the cache).
SSL_shutdown() will then return with 0.
If a unidirectional shutdown is enough (the underlying connection shall be
closed anyway), this first call to SSL_shutdown() is sufficient.
=item If the peer already sent the "close notify" alert B<and> it was
In order to complete the bidirectional shutdown handshake, the peer needs
to send back a "close notify" alert.
The SSL_RECEIVED_SHUTDOWN flag will be set after receiving and processing
it.
SSL_shutdown() will return 1 when it has been received.
The peer is still allowed to send data after receiving the "close notify"
event.
If the peer did send data it needs to be processed by calling SSL_read()
before calling SSL_shutdown() a second time.
SSL_read() will indicate the end of the peer data by returning <= 0
and SSL_get_error() returning SSL_ERROR_ZERO_RETURN.
It is recommended to call SSL_read() between SSL_shutdown() calls.
=head2 Peer closes the connection
If the peer already sent the "close notify" alert B<and> it was
already processed implicitly inside another function
(L<SSL_read(3)>), the SSL_RECEIVED_SHUTDOWN flag is set.
SSL_read() will return <= 0 in that case, and SSL_get_error() will return
SSL_ERROR_ZERO_RETURN.
SSL_shutdown() will send the "close notify" alert, set the SSL_SENT_SHUTDOWN
flag and will immediately return with 1.
Whether SSL_RECEIVED_SHUTDOWN is already set can be checked using the
SSL_get_shutdown() (see also L<SSL_set_shutdown(3)> call.
=back
=head1 NOTES
It is therefore recommended, to check the return value of SSL_shutdown()
and call SSL_shutdown() again, if the bidirectional shutdown is not yet
complete (return value of the first call is 0).
It is recommended to do a bidirectional shutdown by checking the return value
of SSL_shutdown() and call it again until it returns 1 or a fatal error.
The behaviour of SSL_shutdown() additionally depends on the underlying BIO.
If the underlying BIO is B<blocking>, SSL_shutdown() will only return once the
handshake step has been finished or an error occurred.
@@ -92,8 +109,9 @@ The following return values can occur:
=item Z<>0
The shutdown is not yet finished. Call SSL_shutdown() for a second time,
if a bidirectional shutdown shall be performed.
The shutdown is not yet finished: the "close notify" was send but the peer
did not send it back yet.
Call SSL_shutdown() again to do a bidirectional shutdown.
The output of L<SSL_get_error(3)> may be misleading, as an
erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred.
@@ -104,11 +122,12 @@ and the peer's "close notify" alert was received.
=item E<lt>0
The shutdown was not successful because a fatal error occurred either
at the protocol level or a connection failure occurred. It can also occur if
action is need to continue the operation for non-blocking BIOs.
Call L<SSL_get_error(3)> with the return value B<ret>
to find out the reason.
The shutdown was not successful.
Call L<SSL_get_error(3)> with the return value B<ret> to find out the reason.
It can occur if an action is needed to continue the operation for non-blocking
BIOs.
It can also occur when not all data was read using SSL_read().
=back
@@ -122,7 +141,7 @@ L<ssl(7)>, L<bio(7)>
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/UI_STRING.pod
+1 -1
View File
@@ -137,7 +137,7 @@ L<UI(3)>
=head1 COPYRIGHT
Copyright 2001-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/X509_NAME_get_index_by_NID.pod
+1 -1
View File
@@ -49,7 +49,7 @@ of space needed in B<buf> (excluding the final null) is returned.
=head1 NOTES
X509_NAME_get_text_by_NID() and X509_NAME_get_text_by_OBJ() should be
considered deprecaated because they
considered deprecated because they
have various limitations which make them
of minimal use in practice. They can only find the first matching
entry and will copy the contents of the field verbatim: this can
doc/man3/X509_STORE_add_cert.pod
+1 -1
View File
@@ -90,7 +90,7 @@ L<X509_STORE_get0_param(3)>
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the OpenSSL license (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/X509_VERIFY_PARAM_set_flags.pod
+11 -1
View File
@@ -11,7 +11,9 @@ X509_VERIFY_PARAM_get_auth_level, X509_VERIFY_PARAM_set_time,
X509_VERIFY_PARAM_get_time,
X509_VERIFY_PARAM_add0_policy, X509_VERIFY_PARAM_set1_policies,
X509_VERIFY_PARAM_set1_host, X509_VERIFY_PARAM_add1_host,
X509_VERIFY_PARAM_set_hostflags, X509_VERIFY_PARAM_get0_peername,
X509_VERIFY_PARAM_set_hostflags,
X509_VERIFY_PARAM_get_hostflags,
X509_VERIFY_PARAM_get0_peername,
X509_VERIFY_PARAM_set1_email, X509_VERIFY_PARAM_set1_ip,
X509_VERIFY_PARAM_set1_ip_asc
- X509 verification parameters
@@ -54,6 +56,7 @@ X509_VERIFY_PARAM_set1_ip_asc
const char *name, size_t namelen);
void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
unsigned int flags);
unsigned int X509_VERIFY_PARAM_get_hostflags(const X509_VERIFY_PARAM *param);
char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param);
int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,
const char *email, size_t emaillen);
@@ -139,6 +142,9 @@ calling L<X509_check_host(3)>, hostname checks are out of scope
with the DANE-EE(3) certificate usage, and the internal check will
be suppressed as appropriate when DANE support is added to OpenSSL.
X509_VERIFY_PARAM_get_hostflags() returns any host flags previously set via a
call to X509_VERIFY_PARAM_set_hostflags().
X509_VERIFY_PARAM_add1_host() adds B<name> as an additional reference
identifier that can match the peer's certificate. Any previous names
set via X509_VERIFY_PARAM_set1_host() or X509_VERIFY_PARAM_add1_host()
@@ -186,6 +192,8 @@ failure.
X509_VERIFY_PARAM_get_flags() returns the current verification flags.
X509_VERIFY_PARAM_get_hostflags() returns any current host flags.
X509_VERIFY_PARAM_get_inh_flags() returns the current inheritance flags.
X509_VERIFY_PARAM_set_time() and X509_VERIFY_PARAM_set_depth() do not return
@@ -349,6 +357,8 @@ The B<X509_V_FLAG_NO_ALT_CHAINS> flag was added in OpenSSL 1.1.0
The flag B<X509_V_FLAG_CB_ISSUER_CHECK> was deprecated in
OpenSSL 1.1.0, and has no effect.
X509_VERIFY_PARAM_get_hostflags() was added in OpenSSL 1.1.0i.
=head1 COPYRIGHT
Copyright 2009-2018 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/X509_cmp_time.pod
+1 -1
View File
@@ -46,7 +46,7 @@ X509_cmp_time() and X509_cmp_current_time() return -1 if B<asn1_time>
is earlier than, or equal to, B<cmp_time> (resp. current time), and 1
otherwise. These methods return 0 on error.
X509_time_ad() and X509_time_adj_ex() return a pointer to the updated
X509_time_adj() and X509_time_adj_ex() return a pointer to the updated
ASN1_TIME structure, and NULL on error.
=head1 COPYRIGHT

Some files were not shown because too many files have changed in this diff Show More