mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-09 05:51:54 +08:00
Code Issues Packages Projects Releases Wiki Activity
30a4cda5e0
openssl/providers/defltprov.c

554 lines
22 KiB
C
Raw Normal View History

Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
/*
* Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <stdio.h>
Move BLAKE2 MACs to the providers This also moves the remaining parts of BLAKE2 digests to the default provider, and removes the legacy EVP implementation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-05-07 18:40:25 +08:00
#include <openssl/opensslconf.h>
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
#include <openssl/core.h>
#include <openssl/core_numbers.h>
#include <openssl/core_names.h>
#include <openssl/params.h>
PROV BIO: add a BIO_vprintf() upcall, and a provider BIO library The BIO_vprintf() will allow the provider to print any text, given a BIO supplied by libcrypto. Additionally, we add a provider library with functions to collect all the currently supplied BIO upcalls, as well as wrappers around those upcalls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:50:18 +08:00
#include "prov/bio.h"
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
#include "prov/providercommon.h"
Cleanup: move providers/common/include/internal/provider_args.h New name is providers/implementations/include/prov/implementations.h All inclusions are adapted accordingly. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10088)
2019-10-04 21:20:48 +08:00
#include "prov/implementations.h"
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
#include "prov/provider_util.h"
#include "internal/nelem.h"
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
#define ALGC(NAMES, FUNC, CHECK) { { NAMES, "provider=default", FUNC }, CHECK }
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
#define ALG(NAMES, FUNC) ALGC(NAMES, FUNC, NULL)
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
/* Functions provided by the core */
Rename provider and core get_param_types functions It was argued that names like SOMETHING_set_param_types were confusing, and a rename has been proposed to SOMETHING_settable_params, and by consequence, SOMETHING_get_param_types is renamed SOMETHING_gettable_params. This changes implements this change for the dispatched provider and core functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9591)
2019-08-15 02:17:39 +08:00
static OSSL_core_gettable_params_fn *c_gettable_params = NULL;
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
static OSSL_core_get_params_fn *c_get_params = NULL;
/* Parameters we provide to the core */
Replace OSSL_ITEM with OSSL_PARAM as parameter descriptor, everywhere Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9346)
2019-07-11 18:19:33 +08:00
static const OSSL_PARAM deflt_param_types[] = {
OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0),
OSSL_PARAM_DEFN(OSSL_PROV_PARAM_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0),
OSSL_PARAM_DEFN(OSSL_PROV_PARAM_BUILDINFO, OSSL_PARAM_UTF8_PTR, NULL, 0),
OSSL_PARAM_END
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
};
Rename provider and core get_param_types functions It was argued that names like SOMETHING_set_param_types were confusing, and a rename has been proposed to SOMETHING_settable_params, and by consequence, SOMETHING_get_param_types is renamed SOMETHING_gettable_params. This changes implements this change for the dispatched provider and core functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9591)
2019-08-15 02:17:39 +08:00
static const OSSL_PARAM *deflt_gettable_params(const OSSL_PROVIDER *prov)
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
{
return deflt_param_types;
}
Change OSSL_PARAM return size to not be a pointer. Instead of referencing the return size from the OSSL_PARAM structure, make the size a field within the structure. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9135)
2019-06-24 12:43:55 +08:00
static int deflt_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[])
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
{
Change OSSL_PARAM return size to not be a pointer. Instead of referencing the return size from the OSSL_PARAM structure, make the size a field within the structure. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9135)
2019-06-24 12:43:55 +08:00
OSSL_PARAM *p;
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL Default Provider"))
return 0;
p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR))
return 0;
p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR))
return 0;
return 1;
}
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
/*
* For the algorithm names, we use the following formula for our primary
* names:
*
* ALGNAME[VERSION?][-SUBNAME[VERSION?]?][-SIZE?][-MODE?]
*
* VERSION is only present if there are multiple versions of
* an alg (MD2, MD4, MD5). It may be omitted if there is only
* one version (if a subsequent version is released in the future,
* we can always change the canonical name, and add the old name
* as an alias).
*
* SUBNAME may be present where we are combining multiple
* algorithms together, e.g. MD5-SHA1.
*
* SIZE is only present if multiple versions of an algorithm exist
* with different sizes (e.g. AES-128-CBC, AES-256-CBC)
*
* MODE is only present where applicable.
*
* We add diverse other names where applicable, such as the names that
* NIST uses, or that are used for ASN.1 OBJECT IDENTIFIERs, or names
* we have used historically.
Tweak some algorithm naming inconsistencies Make some algorithms names better match our "canonical" style. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10092)
2019-10-04 18:50:49 +08:00
*
* Algorithm names are case insensitive, but we use all caps in our "canonical"
* names for consistency.
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
*/
Implement SHA256 in the default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-14 01:26:17 +08:00
static const OSSL_ALGORITHM deflt_digests[] = {
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
/* Our primary name:NIST name[:our older names] */
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SHA1:SHA-1", "provider=default", sha1_functions },
{ "SHA2-224:SHA-224:SHA224", "provider=default", sha224_functions },
{ "SHA2-256:SHA-256:SHA256", "provider=default", sha256_functions },
{ "SHA2-384:SHA-384:SHA384", "provider=default", sha384_functions },
{ "SHA2-512:SHA-512:SHA512", "provider=default", sha512_functions },
{ "SHA2-512/224:SHA-512/224:SHA512-224", "provider=default",
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
sha512_224_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SHA2-512/256:SHA-512/256:SHA512-256", "provider=default",
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
sha512_256_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
/* We agree with NIST here, so one name only */
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SHA3-224", "provider=default", sha3_224_functions },
{ "SHA3-256", "provider=default", sha3_256_functions },
{ "SHA3-384", "provider=default", sha3_384_functions },
{ "SHA3-512", "provider=default", sha3_512_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
Move KMAC to providers Instead of using evp_keccak_kmac128() and evp_keccak_kmac256(), we refer to the hash implementation by name, and fetch it, which should get us the implementation from providers/common/digests/sha3_prov.c. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-06-02 14:46:35 +08:00
/*
Tweak some algorithm naming inconsistencies Make some algorithms names better match our "canonical" style. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10092)
2019-10-04 18:50:49 +08:00
* KECCAK-KMAC-128 and KECCAK-KMAC-256 as hashes are mostly useful for
* the KMAC-128 and KMAC-256.
Move KMAC to providers Instead of using evp_keccak_kmac128() and evp_keccak_kmac256(), we refer to the hash implementation by name, and fetch it, which should get us the implementation from providers/common/digests/sha3_prov.c. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-06-02 14:46:35 +08:00
*/
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "KECCAK-KMAC-128:KECCAK-KMAC128", "provider=default", keccak_kmac_128_functions },
{ "KECCAK-KMAC-256:KECCAK-KMAC256", "provider=default", keccak_kmac_256_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
/* Our primary name:NIST name */
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SHAKE-128:SHAKE128", "provider=default", shake_128_functions },
{ "SHAKE-256:SHAKE256", "provider=default", shake_256_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
#ifndef OPENSSL_NO_BLAKE2
Adapt existing providers to posibly have name lists Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8985)
2019-05-23 09:39:15 +08:00
/*
* https://blake2.net/ doesn't specify size variants,
* but mentions that Bouncy Castle uses the names
* BLAKE2b-160, BLAKE2b-256, BLAKE2b-384, and BLAKE2b-512
* If we assume that "2b" and "2s" are versions, that pattern
* fits with ours. We also add our historical names.
*/
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "BLAKE2S-256:BLAKE2s256", "provider=default", blake2s256_functions },
{ "BLAKE2B-512:BLAKE2b512", "provider=default", blake2b512_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
#endif /* OPENSSL_NO_BLAKE2 */
#ifndef OPENSSL_NO_SM3
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SM3", "provider=default", sm3_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
#endif /* OPENSSL_NO_SM3 */
#ifndef OPENSSL_NO_MD5
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "MD5", "provider=default", md5_functions },
{ "MD5-SHA1", "provider=default", md5_sha1_functions },
Move digests to providers Move digest code into the relevant providers (fips, default, legacy). The headers are temporarily moved to be internal, and will be moved into providers after all external references are resolved. The deprecated digest code can not be removed until EVP_PKEY (signing) is supported by providers. EVP_MD data can also not yet be cleaned up for the same reasons. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8763)
2019-04-11 18:27:59 +08:00
#endif /* OPENSSL_NO_MD5 */
Implement SHA256 in the default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-14 01:26:17 +08:00
{ NULL, NULL, NULL }
};
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
static const OSSL_ALGORITHM_CAPABLE deflt_ciphers[] = {
Implement the NULL cipher in the default provider Libssl uses the null cipher in certain situations. It should be converted to a provided cipher. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10865)
2020-01-09 00:16:22 +08:00
ALG("NULL", null_functions),
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("AES-256-ECB", aes256ecb_functions),
ALG("AES-192-ECB", aes192ecb_functions),
ALG("AES-128-ECB", aes128ecb_functions),
ALG("AES-256-CBC", aes256cbc_functions),
ALG("AES-192-CBC", aes192cbc_functions),
ALG("AES-128-CBC", aes128cbc_functions),
ALG("AES-256-OFB", aes256ofb_functions),
ALG("AES-192-OFB", aes192ofb_functions),
ALG("AES-128-OFB", aes128ofb_functions),
ALG("AES-256-CFB", aes256cfb_functions),
ALG("AES-192-CFB", aes192cfb_functions),
ALG("AES-128-CFB", aes128cfb_functions),
ALG("AES-256-CFB1", aes256cfb1_functions),
ALG("AES-192-CFB1", aes192cfb1_functions),
ALG("AES-128-CFB1", aes128cfb1_functions),
ALG("AES-256-CFB8", aes256cfb8_functions),
ALG("AES-192-CFB8", aes192cfb8_functions),
ALG("AES-128-CFB8", aes128cfb8_functions),
ALG("AES-256-CTR", aes256ctr_functions),
ALG("AES-192-CTR", aes192ctr_functions),
ALG("AES-128-CTR", aes128ctr_functions),
ALG("AES-256-XTS", aes256xts_functions),
ALG("AES-128-XTS", aes128xts_functions),
Add aes_ocb cipher to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9320)
2019-09-19 18:10:25 +08:00
#ifndef OPENSSL_NO_OCB
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("AES-256-OCB", aes256ocb_functions),
ALG("AES-192-OCB", aes192ocb_functions),
ALG("AES-128-OCB", aes128ocb_functions),
Add aes_ocb cipher to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9320)
2019-09-19 18:10:25 +08:00
#endif /* OPENSSL_NO_OCB */
Add AES SIV ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10120)
2019-11-08 10:14:44 +08:00
#ifndef OPENSSL_NO_SIV
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("AES-128-SIV", aes128siv_functions),
ALG("AES-192-SIV", aes192siv_functions),
ALG("AES-256-SIV", aes256siv_functions),
Add AES SIV ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10120)
2019-11-08 10:14:44 +08:00
#endif /* OPENSSL_NO_SIV */
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("AES-256-GCM:id-aes256-GCM", aes256gcm_functions),
ALG("AES-192-GCM:id-aes192-GCM", aes192gcm_functions),
ALG("AES-128-GCM:id-aes128-GCM", aes128gcm_functions),
ALG("AES-256-CCM:id-aes256-CCM", aes256ccm_functions),
ALG("AES-192-CCM:id-aes192-CCM", aes192ccm_functions),
ALG("AES-128-CCM:id-aes128-CCM", aes128ccm_functions),
ALG("AES-256-WRAP:id-aes256-wrap:AES256-WRAP", aes256wrap_functions),
ALG("AES-192-WRAP:id-aes192-wrap:AES192-WRAP", aes192wrap_functions),
ALG("AES-128-WRAP:id-aes128-wrap:AES128-WRAP", aes128wrap_functions),
ALG("AES-256-WRAP-PAD:id-aes256-wrap-pad:AES256-WRAP-PAD",
aes256wrappad_functions),
ALG("AES-192-WRAP-PAD:id-aes192-wrap-pad:AES192-WRAP-PAD",
aes192wrappad_functions),
ALG("AES-128-WRAP-PAD:id-aes128-wrap-pad:AES128-WRAP-PAD",
aes128wrappad_functions),
ALGC("AES-128-CBC-HMAC-SHA1", aes128cbc_hmac_sha1_functions,
cipher_capable_aes_cbc_hmac_sha1),
ALGC("AES-256-CBC-HMAC-SHA1", aes256cbc_hmac_sha1_functions,
cipher_capable_aes_cbc_hmac_sha1),
ALGC("AES-128-CBC-HMAC-SHA256", aes128cbc_hmac_sha256_functions,
cipher_capable_aes_cbc_hmac_sha256),
ALGC("AES-256-CBC-HMAC-SHA256", aes256cbc_hmac_sha256_functions,
cipher_capable_aes_cbc_hmac_sha256),
Add gcm ciphers (aes and aria) to providers. The code has been modularized so that it can be shared by algorithms. A fixed size IV is now used instead of being allocated. The IV is not set into the low level struct now until the update (it uses an iv_state for this purpose). Hardware specific methods have been added to a PROV_GCM_HW object. The S390 code has been changed to just contain methods that can be accessed in a modular way. There are equivalent generic methods also for the other platforms. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/9231)
2019-07-31 19:55:16 +08:00
#ifndef OPENSSL_NO_ARIA
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("ARIA-256-GCM", aria256gcm_functions),
ALG("ARIA-192-GCM", aria192gcm_functions),
ALG("ARIA-128-GCM", aria128gcm_functions),
ALG("ARIA-256-CCM", aria256ccm_functions),
ALG("ARIA-192-CCM", aria192ccm_functions),
ALG("ARIA-128-CCM", aria128ccm_functions),
ALG("ARIA-256-ECB", aria256ecb_functions),
ALG("ARIA-192-ECB", aria192ecb_functions),
ALG("ARIA-128-ECB", aria128ecb_functions),
ALG("ARIA-256-CBC:ARIA256", aria256cbc_functions),
ALG("ARIA-192-CBC:ARIA192", aria192cbc_functions),
ALG("ARIA-128-CBC:ARIA128", aria128cbc_functions),
ALG("ARIA-256-OFB", aria256ofb_functions),
ALG("ARIA-192-OFB", aria192ofb_functions),
ALG("ARIA-128-OFB", aria128ofb_functions),
ALG("ARIA-256-CFB", aria256cfb_functions),
ALG("ARIA-192-CFB", aria192cfb_functions),
ALG("ARIA-128-CFB", aria128cfb_functions),
ALG("ARIA-256-CFB1", aria256cfb1_functions),
ALG("ARIA-192-CFB1", aria192cfb1_functions),
ALG("ARIA-128-CFB1", aria128cfb1_functions),
ALG("ARIA-256-CFB8", aria256cfb8_functions),
ALG("ARIA-192-CFB8", aria192cfb8_functions),
ALG("ARIA-128-CFB8", aria128cfb8_functions),
ALG("ARIA-256-CTR", aria256ctr_functions),
ALG("ARIA-192-CTR", aria192ctr_functions),
ALG("ARIA-128-CTR", aria128ctr_functions),
Add gcm ciphers (aes and aria) to providers. The code has been modularized so that it can be shared by algorithms. A fixed size IV is now used instead of being allocated. The IV is not set into the low level struct now until the update (it uses an iv_state for this purpose). Hardware specific methods have been added to a PROV_GCM_HW object. The S390 code has been changed to just contain methods that can be accessed in a modular way. There are equivalent generic methods also for the other platforms. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/9231)
2019-07-31 19:55:16 +08:00
#endif /* OPENSSL_NO_ARIA */
Add basic aria and camellia ciphers modes to default provider The aes code has been refactored into generic and algorithn specific parts, so that most of the code can be shared. The cipher related files have been broken up into smaller parts. Add chunked variant of mode ciphers - aria uses this (many other ciphers will use this new code instead of the generic code used by aes). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9451)
2019-08-22 09:42:54 +08:00
#ifndef OPENSSL_NO_CAMELLIA
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("CAMELLIA-256-ECB", camellia256ecb_functions),
ALG("CAMELLIA-192-ECB", camellia192ecb_functions),
ALG("CAMELLIA-128-ECB", camellia128ecb_functions),
ALG("CAMELLIA-256-CBC:CAMELLIA256", camellia256cbc_functions),
ALG("CAMELLIA-192-CBC:CAMELLIA192", camellia192cbc_functions),
ALG("CAMELLIA-128-CBC:CAMELLIA128", camellia128cbc_functions),
ALG("CAMELLIA-256-OFB", camellia256ofb_functions),
ALG("CAMELLIA-192-OFB", camellia192ofb_functions),
ALG("CAMELLIA-128-OFB", camellia128ofb_functions),
ALG("CAMELLIA-256-CFB", camellia256cfb_functions),
ALG("CAMELLIA-192-CFB", camellia192cfb_functions),
ALG("CAMELLIA-128-CFB", camellia128cfb_functions),
ALG("CAMELLIA-256-CFB1", camellia256cfb1_functions),
ALG("CAMELLIA-192-CFB1", camellia192cfb1_functions),
ALG("CAMELLIA-128-CFB1", camellia128cfb1_functions),
ALG("CAMELLIA-256-CFB8", camellia256cfb8_functions),
ALG("CAMELLIA-192-CFB8", camellia192cfb8_functions),
ALG("CAMELLIA-128-CFB8", camellia128cfb8_functions),
ALG("CAMELLIA-256-CTR", camellia256ctr_functions),
ALG("CAMELLIA-192-CTR", camellia192ctr_functions),
ALG("CAMELLIA-128-CTR", camellia128ctr_functions),
Add basic aria and camellia ciphers modes to default provider The aes code has been refactored into generic and algorithn specific parts, so that most of the code can be shared. The cipher related files have been broken up into smaller parts. Add chunked variant of mode ciphers - aria uses this (many other ciphers will use this new code instead of the generic code used by aes). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9451)
2019-08-22 09:42:54 +08:00
#endif /* OPENSSL_NO_CAMELLIA */
Fix no-des Don't refer to cipher functions in the providers that have been compiled out. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9719)
2019-08-28 23:00:01 +08:00
#ifndef OPENSSL_NO_DES
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("DES-EDE3-ECB:DES-EDE3", tdes_ede3_ecb_functions),
ALG("DES-EDE3-CBC:DES3", tdes_ede3_cbc_functions),
ALG("DES-EDE3-OFB", tdes_ede3_ofb_functions),
ALG("DES-EDE3-CFB", tdes_ede3_cfb_functions),
ALG("DES-EDE3-CFB8", tdes_ede3_cfb8_functions),
ALG("DES-EDE3-CFB1", tdes_ede3_cfb1_functions),
ALG("DES-EDE-ECB:DES-EDE", tdes_ede2_ecb_functions),
ALG("DES-EDE-CBC", tdes_ede2_cbc_functions),
ALG("DES-EDE-OFB", tdes_ede2_ofb_functions),
ALG("DES-EDE-CFB", tdes_ede2_cfb_functions),
ALG("DESX-CBC:DESX", tdes_desx_cbc_functions),
ALG("DES3-WRAP:id-smime-alg-CMS3DESwrap", tdes_wrap_cbc_functions),
ALG("DES-ECB", des_ecb_functions),
ALG("DES-CBC:DES", des_cbc_functions),
ALG("DES-OFB", des_ofb64_functions),
ALG("DES-CFB", des_cfb64_functions),
ALG("DES-CFB1", des_cfb1_functions),
ALG("DES-CFB8", des_cfb8_functions),
Fix no-des Don't refer to cipher functions in the providers that have been compiled out. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9719)
2019-08-28 23:00:01 +08:00
#endif /* OPENSSL_NO_DES */
Add blowfish ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9887)
2019-09-15 18:06:28 +08:00
#ifndef OPENSSL_NO_BF
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("BF-ECB", blowfish128ecb_functions),
ALG("BF-CBC:BF:BLOWFISH", blowfish128cbc_functions),
ALG("BF-OFB", blowfish64ofb64_functions),
ALG("BF-CFB", blowfish64cfb64_functions),
Add blowfish ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9887)
2019-09-15 18:06:28 +08:00
#endif /* OPENSSL_NO_BF */
Add IDEA ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9917)
2019-09-18 13:57:08 +08:00
#ifndef OPENSSL_NO_IDEA
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("IDEA-ECB", idea128ecb_functions),
ALG("IDEA-CBC:IDEA", idea128cbc_functions),
ALG("IDEA-OFB:IDEA-OFB64", idea128ofb64_functions),
ALG("IDEA-CFB:IDEA-CFB64", idea128cfb64_functions),
Add IDEA ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9917)
2019-09-18 13:57:08 +08:00
#endif /* OPENSSL_NO_IDEA */
Add cast5 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9929)
2019-09-18 16:55:11 +08:00
#ifndef OPENSSL_NO_CAST
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("CAST5-ECB", cast5128ecb_functions),
ALG("CAST5-CBC:CAST-CBC:CAST", cast5128cbc_functions),
ALG("CAST5-OFB", cast564ofb64_functions),
ALG("CAST5-CFB", cast564cfb64_functions),
Add cast5 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9929)
2019-09-18 16:55:11 +08:00
#endif /* OPENSSL_NO_CAST */
Add SEED ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9932)
2019-09-18 20:13:59 +08:00
#ifndef OPENSSL_NO_SEED
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("SEED-ECB", seed128ecb_functions),
ALG("SEED-CBC:SEED", seed128cbc_functions),
ALG("SEED-OFB:SEED-OFB128", seed128ofb128_functions),
ALG("SEED-CFB:SEED-CFB128", seed128cfb128_functions),
Add SEED ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9932)
2019-09-18 20:13:59 +08:00
#endif /* OPENSSL_NO_SEED */
Add sm4 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9935)
2019-09-19 13:38:51 +08:00
#ifndef OPENSSL_NO_SM4
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("SM4-ECB", sm4128ecb_functions),
ALG("SM4-CBC:SM4", sm4128cbc_functions),
ALG("SM4-CTR", sm4128ctr_functions),
ALG("SM4-OFB:SM4-OFB128", sm4128ofb128_functions),
ALG("SM4-CFB:SM4-CFB128", sm4128cfb128_functions),
Add sm4 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9935)
2019-09-19 13:38:51 +08:00
#endif /* OPENSSL_NO_SM4 */
Add rc4 cipher to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9992)
2019-09-25 08:46:39 +08:00
#ifndef OPENSSL_NO_RC4
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("RC4", rc4128_functions),
ALG("RC4-40", rc440_functions),
Add rc4_hmac_md5 cipher to default provider Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10179)
2019-10-10 14:42:20 +08:00
# ifndef OPENSSL_NO_MD5
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("RC4-HMAC-MD5", rc4_hmac_md5_functions),
Add rc4_hmac_md5 cipher to default provider Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10179)
2019-10-10 14:42:20 +08:00
# endif /* OPENSSL_NO_MD5 */
Add rc4 cipher to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9992)
2019-09-25 08:46:39 +08:00
#endif /* OPENSSL_NO_RC4 */
Add rc5 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10006)
2019-10-03 14:05:49 +08:00
#ifndef OPENSSL_NO_RC5
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("RC5-ECB", rc5128ecb_functions),
ALG("RC5-CBC", rc5128cbc_functions),
ALG("RC5-OFB", rc5128ofb64_functions),
ALG("RC5-CFB", rc5128cfb64_functions),
Add rc5 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10006)
2019-10-03 14:05:49 +08:00
#endif /* OPENSSL_NO_RC5 */
Add rc2 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9991)
2019-10-08 14:42:28 +08:00
#ifndef OPENSSL_NO_RC2
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("RC2-ECB", rc2128ecb_functions),
ALG("RC2-CBC", rc2128cbc_functions),
ALG("RC2-40-CBC", rc240cbc_functions),
ALG("RC2-64-CBC", rc264cbc_functions),
ALG("RC2-CFB", rc2128cfb128_functions),
ALG("RC2-OFB", rc2128ofb128_functions),
Add rc2 ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9991)
2019-10-08 14:42:28 +08:00
#endif /* OPENSSL_NO_RC2 */
Add ChaCha related ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10081)
2019-10-16 14:18:42 +08:00
#ifndef OPENSSL_NO_CHACHA
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("ChaCha20", chacha20_functions),
Add ChaCha related ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10081)
2019-10-16 14:18:42 +08:00
# ifndef OPENSSL_NO_POLY1305
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ALG("ChaCha20-Poly1305", chacha20_poly1305_functions),
Add ChaCha related ciphers to default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10081)
2019-10-16 14:18:42 +08:00
# endif /* OPENSSL_NO_POLY1305 */
#endif /* OPENSSL_NO_CHACHA */
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
{ { NULL, NULL, NULL }, NULL }
Implement support for AES-256-ECB in the default provider We also lay the ground work for various of other the basic AES ciphers. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8700)
2019-04-03 22:34:08 +08:00
};
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
static OSSL_ALGORITHM exported_ciphers[OSSL_NELEM(deflt_ciphers)];
Implement support for AES-256-ECB in the default provider We also lay the ground work for various of other the basic AES ciphers. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8700)
2019-04-03 22:34:08 +08:00
Move BLAKE2 MACs to the providers This also moves the remaining parts of BLAKE2 digests to the default provider, and removes the legacy EVP implementation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-05-07 18:40:25 +08:00
static const OSSL_ALGORITHM deflt_macs[] = {
#ifndef OPENSSL_NO_BLAKE2
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "BLAKE2BMAC", "provider=default", blake2bmac_functions },
{ "BLAKE2SMAC", "provider=default", blake2smac_functions },
Move CMAC to providers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-06-01 17:18:15 +08:00
#endif
#ifndef OPENSSL_NO_CMAC
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "CMAC", "provider=default", cmac_functions },
Move BLAKE2 MACs to the providers This also moves the remaining parts of BLAKE2 digests to the default provider, and removes the legacy EVP implementation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-05-07 18:40:25 +08:00
#endif
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "GMAC", "provider=default", gmac_functions },
{ "HMAC", "provider=default", hmac_functions },
{ "KMAC-128:KMAC128", "provider=default", kmac128_functions },
{ "KMAC-256:KMAC256", "provider=default", kmac256_functions },
Move SipHash to providers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-06-02 14:51:58 +08:00
#ifndef OPENSSL_NO_SIPHASH
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SIPHASH", "provider=default", siphash_functions },
Move Poly1305 to providers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-06-02 15:33:28 +08:00
#endif
#ifndef OPENSSL_NO_POLY1305
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "POLY1305", "provider=default", poly1305_functions },
Move SipHash to providers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-06-02 14:51:58 +08:00
#endif
Move BLAKE2 MACs to the providers This also moves the remaining parts of BLAKE2 digests to the default provider, and removes the legacy EVP implementation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-05-07 18:40:25 +08:00
{ NULL, NULL, NULL }
};
Add KDFs to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-08-21 11:09:10 +08:00
static const OSSL_ALGORITHM deflt_kdfs[] = {
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "HKDF", "provider=default", kdf_hkdf_functions },
{ "SSKDF", "provider=default", kdf_sskdf_functions },
{ "PBKDF2", "provider=default", kdf_pbkdf2_functions },
{ "SSHKDF", "provider=default", kdf_sshkdf_functions },
{ "X963KDF", "provider=default", kdf_x963_kdf_functions },
{ "TLS1-PRF", "provider=default", kdf_tls1_prf_functions },
{ "KBKDF", "provider=default", kdf_kbkdf_functions },
Add KDFs to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-08-21 11:09:10 +08:00
#ifndef OPENSSL_NO_CMS
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "X942KDF", "provider=default", kdf_x942_kdf_functions },
Add KDFs to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-08-21 11:09:10 +08:00
#endif
#ifndef OPENSSL_NO_SCRYPT
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "SCRYPT:id-scrypt", "provider=default", kdf_scrypt_functions },
Add KDFs to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-08-21 11:09:10 +08:00
#endif
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "KRB5KDF", "provider=default", kdf_krb5kdf_functions },
KDF: use string names not macros to align with other algorithms. Only the KDF and PRF algorithms used the macros for their names, all other algorithms used a string name directly. This brings the KDFs and PRFs into line with the rest. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10293)
2019-10-30 09:00:19 +08:00
{ NULL, NULL, NULL }
Add KDFs to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-08-21 11:09:10 +08:00
};
Implement PKCS#3 DH Key Exchange in the default provider We add the capability for the default provider to perform PKCS#3 Diffie-Hellman key exchange. At this point the implementation is not used because libcrypto still uses legacy handling for Diffie-Hellman. Note X9.42 DH is not touched by this commit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9266)
2019-06-27 19:36:30 +08:00
static const OSSL_ALGORITHM deflt_keyexch[] = {
Fix no-dh The recent move of the DH code into the default provider broke no-dh. This adds back in various missing guards. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9399)
2019-07-17 18:40:41 +08:00
#ifndef OPENSSL_NO_DH
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH:dhKeyAgreement", "provider=default", dh_keyexch_functions },
Add X25519/X448 Key Exchange to the default provider Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
2020-01-25 01:13:40 +08:00
#endif
#ifndef OPENSSL_NO_EC
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "ECDH:id-ecPublicKey", "provider=default", ecdh_keyexch_functions },
{ "X25519", "provider=default", x25519_keyexch_functions },
{ "X448", "provider=default", x448_keyexch_functions },
Adapt DH to use with KEYMGMT The biggest part in this was to move the key->param builder from EVP to the DH ASN.1 method, and to implement the KEYMGMT support in the provider DH. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9394)
2019-07-07 16:56:46 +08:00
#endif
{ NULL, NULL, NULL }
};
Implement DSA in the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
2019-08-30 20:33:37 +08:00
static const OSSL_ALGORITHM deflt_signature[] = {
#ifndef OPENSSL_NO_DSA
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA:dsaEncryption", "provider=default", dsa_signature_functions },
Implement DSA in the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
2019-08-30 20:33:37 +08:00
#endif
Fix default provider merge glitch Property "default" no longer exists, replace "default=yes" with "provider=default" Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11150)
2020-02-22 10:27:14 +08:00
{ "RSA:rsaEncryption", "provider=default", rsa_signature_functions },
Implement DSA in the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
2019-08-30 20:33:37 +08:00
{ NULL, NULL, NULL }
};
Move RSA Asym cipher code to the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10152)
2019-10-28 21:40:39 +08:00
static const OSSL_ALGORITHM deflt_asym_cipher[] = {
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA:rsaEncryption", "provider=default", rsa_asym_cipher_functions },
Move RSA Asym cipher code to the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10152)
2019-10-28 21:40:39 +08:00
{ NULL, NULL, NULL }
};
Implement DSA in the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
2019-08-30 20:33:37 +08:00
Adapt DH to use with KEYMGMT The biggest part in this was to move the key->param builder from EVP to the DH ASN.1 method, and to implement the KEYMGMT support in the provider DH. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9394)
2019-07-07 16:56:46 +08:00
static const OSSL_ALGORITHM deflt_keymgmt[] = {
#ifndef OPENSSL_NO_DH
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH:dhKeyAgreement", "provider=default", dh_keymgmt_functions },
Implement DSA in the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
2019-08-30 20:33:37 +08:00
#endif
#ifndef OPENSSL_NO_DSA
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA:dsaEncryption", "provider=default", dsa_keymgmt_functions },
Fix no-dh The recent move of the DH code into the default provider broke no-dh. This adds back in various missing guards. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9399)
2019-07-17 18:40:41 +08:00
#endif
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA:rsaEncryption", "provider=default", rsa_keymgmt_functions },
Implement Provider side Key Management for X25519 and X448 Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
2020-01-28 00:57:03 +08:00
#ifndef OPENSSL_NO_EC
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "EC:id-ecPublicKey", "provider=default", ec_keymgmt_functions },
{ "X25519", "provider=default", x25519_keymgmt_functions },
{ "X448", "provider=default", x448_keymgmt_functions },
Implement Provider side Key Management for X25519 and X448 Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10964)
2020-01-28 00:57:03 +08:00
#endif
Implement PKCS#3 DH Key Exchange in the default provider We add the capability for the default provider to perform PKCS#3 Diffie-Hellman key exchange. At this point the implementation is not used because libcrypto still uses legacy handling for Diffie-Hellman. Note X9.42 DH is not touched by this commit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9266)
2019-06-27 19:36:30 +08:00
{ NULL, NULL, NULL }
};
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
/*
* Unlike most algorithms in the default provider, the serializers are allowed
* for use in FIPS mode because they are not FIPS relevant, and therefore have
* the "fips=yes" property.
*/
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
static const OSSL_ALGORITHM deflt_serializer[] = {
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA", "provider=default,fips=yes,format=text,type=private",
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
rsa_priv_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA", "provider=default,fips=yes,format=text,type=public",
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
rsa_pub_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA", "provider=default,fips=yes,format=der,type=private",
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
rsa_priv_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA", "provider=default,fips=yes,format=der,type=public",
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
rsa_pub_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA", "provider=default,fips=yes,format=pem,type=private",
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
rsa_priv_pem_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "RSA", "provider=default,fips=yes,format=pem,type=public",
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
rsa_pub_pem_serializer_functions },
Fix no-dh The new serializer code broke no-dh builds so we add some more guards to fix it. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10644)
2019-12-18 19:14:29 +08:00
#ifndef OPENSSL_NO_DH
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=text,type=private",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_priv_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=text,type=public",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_pub_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=text,type=parameters",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_param_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=der,type=private",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_priv_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=der,type=public",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_pub_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=der,type=parameters",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_param_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=pem,type=private",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_priv_pem_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=pem,type=public",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_pub_pem_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DH", "provider=default,fips=yes,format=pem,type=parameters",
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
dh_param_pem_serializer_functions },
Fix no-dh The new serializer code broke no-dh builds so we add some more guards to fix it. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10644)
2019-12-18 19:14:29 +08:00
#endif
PROV SERIALIZER: add support for writing DH keys and parameters Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:57:56 +08:00
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
#ifndef OPENSSL_NO_DSA
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=text,type=private",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_priv_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=text,type=public",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_pub_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=text,type=parameters",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_param_text_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=der,type=private",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_priv_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=der,type=public",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_pub_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=der,type=parameters",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_param_der_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=pem,type=private",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_priv_pem_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=pem,type=public",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_pub_pem_serializer_functions },
Introduce the provider property Replace the properties default, fips and legacy with a single property called "provider". So, for example, instead of writing "default=yes" to get algorithms from the default provider you would instead write "provider=default". We also have a new "fips" property to indicate that an algorithm is compatible with FIPS mode. This applies to all the algorithms in the FIPS provider, as well as any non-cryptographic algorithms (currently only serializers). Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11097)
2020-02-15 06:49:26 +08:00
{ "DSA", "provider=default,fips=yes,format=pem,type=parameters",
Add the DSA serializers to the default provider tools The DSA serializers are implemented, but didn't get added to the default provider's serializer algorithm table. Fixes #10645 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10772)
2020-01-07 23:00:19 +08:00
dsa_param_pem_serializer_functions },
#endif
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
{ NULL, NULL, NULL }
};
Implement SHA256 in the default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-14 01:26:17 +08:00
static const OSSL_ALGORITHM *deflt_query(OSSL_PROVIDER *prov,
int operation_id,
int *no_cache)
{
*no_cache = 0;
switch (operation_id) {
case OSSL_OP_DIGEST:
return deflt_digests;
Implement support for AES-256-ECB in the default provider We also lay the ground work for various of other the basic AES ciphers. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8700)
2019-04-03 22:34:08 +08:00
case OSSL_OP_CIPHER:
Add AES_CBC_HMAC_SHA ciphers to providers. Also Add ability for providers to dynamically exclude cipher algorithms. Cipher algorithms are only returned from providers if their capable() method is either NULL, or the method returns 1. This is mainly required for ciphers that only have hardware implementations. If there is no hardware support, then the algorithm needs to be not available. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10146)
2020-01-06 11:02:16 +08:00
ossl_prov_cache_exported_algorithms(deflt_ciphers, exported_ciphers);
return exported_ciphers;
Move BLAKE2 MACs to the providers This also moves the remaining parts of BLAKE2 digests to the default provider, and removes the legacy EVP implementation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-05-07 18:40:25 +08:00
case OSSL_OP_MAC:
return deflt_macs;
Add KDFs to providers Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-08-21 11:09:10 +08:00
case OSSL_OP_KDF:
return deflt_kdfs;
Adapt DH to use with KEYMGMT The biggest part in this was to move the key->param builder from EVP to the DH ASN.1 method, and to implement the KEYMGMT support in the provider DH. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9394)
2019-07-07 16:56:46 +08:00
case OSSL_OP_KEYMGMT:
return deflt_keymgmt;
Implement PKCS#3 DH Key Exchange in the default provider We add the capability for the default provider to perform PKCS#3 Diffie-Hellman key exchange. At this point the implementation is not used because libcrypto still uses legacy handling for Diffie-Hellman. Note X9.42 DH is not touched by this commit. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9266)
2019-06-27 19:36:30 +08:00
case OSSL_OP_KEYEXCH:
return deflt_keyexch;
Implement DSA in the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9753)
2019-08-30 20:33:37 +08:00
case OSSL_OP_SIGNATURE:
return deflt_signature;
Move RSA Asym cipher code to the default provider Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10152)
2019-10-28 21:40:39 +08:00
case OSSL_OP_ASYM_CIPHER:
return deflt_asym_cipher;
PROV SERIALIZER: add support for writing RSA keys This also adds the missing accessor RSA_get0_pss_params(), so those parameters can be included in the PKCS#8 data structure without needing to know the inside of the RSA structure. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:56:22 +08:00
case OSSL_OP_SERIALIZER:
return deflt_serializer;
Implement SHA256 in the default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-14 01:26:17 +08:00
}
return NULL;
}
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
/* Functions we provide to the core */
static const OSSL_DISPATCH deflt_dispatch_table[] = {
Rename provider and core get_param_types functions It was argued that names like SOMETHING_set_param_types were confusing, and a rename has been proposed to SOMETHING_settable_params, and by consequence, SOMETHING_get_param_types is renamed SOMETHING_gettable_params. This changes implements this change for the dispatched provider and core functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9591)
2019-08-15 02:17:39 +08:00
{ OSSL_FUNC_PROVIDER_GETTABLE_PARAMS, (void (*)(void))deflt_gettable_params },
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
{ OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))deflt_get_params },
Implement SHA256 in the default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-14 01:26:17 +08:00
{ OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))deflt_query },
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
{ 0, NULL }
};
OSSL_provider_init_fn ossl_default_provider_init;
int ossl_default_provider_init(const OSSL_PROVIDER *provider,
const OSSL_DISPATCH *in,
Replumbing: give the possibility for the provider to create a context OSSL_provider_init() gets another output parameter, holding a pointer to a provider side context. It's entirely up to the provider to define the context and what it's being used for. This pointer is passed back to other provider functions, typically the provider global get_params and set_params functions, and also the diverse algorithm context creators, and of course, the teardown function. With this, a provider can be instantiated more than once, or be re-loaded as the case may be, while maintaining instance state. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8848)
2019-04-30 19:41:51 +08:00
const OSSL_DISPATCH **out,
void **provctx)
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
{
Replumbing: Adapt the default and legacy providers to use library context upcall Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9160)
2019-06-14 17:41:32 +08:00
OSSL_core_get_library_context_fn *c_get_libctx = NULL;
PROV BIO: add a BIO_vprintf() upcall, and a provider BIO library The BIO_vprintf() will allow the provider to print any text, given a BIO supplied by libcrypto. Additionally, we add a provider library with functions to collect all the currently supplied BIO upcalls, as well as wrappers around those upcalls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10394)
2019-11-18 08:50:18 +08:00
if (!ossl_prov_bio_from_dispatch(in))
return 0;
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
for (; in->function_id != 0; in++) {
switch (in->function_id) {
Rename provider and core get_param_types functions It was argued that names like SOMETHING_set_param_types were confusing, and a rename has been proposed to SOMETHING_settable_params, and by consequence, SOMETHING_get_param_types is renamed SOMETHING_gettable_params. This changes implements this change for the dispatched provider and core functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9591)
2019-08-15 02:17:39 +08:00
case OSSL_FUNC_CORE_GETTABLE_PARAMS:
c_gettable_params = OSSL_get_core_gettable_params(in);
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
break;
case OSSL_FUNC_CORE_GET_PARAMS:
c_get_params = OSSL_get_core_get_params(in);
break;
Replumbing: Adapt the default and legacy providers to use library context upcall Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9160)
2019-06-14 17:41:32 +08:00
case OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT:
c_get_libctx = OSSL_get_core_get_library_context(in);
break;
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
default:
/* Just ignore anything we don't understand */
break;
}
}
Replumbing: Adapt the default and legacy providers to use library context upcall Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9160)
2019-06-14 17:41:32 +08:00
if (c_get_libctx == NULL)
return 0;
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
*out = deflt_dispatch_table;
Replumbing: Adapt the default and legacy providers to use library context upcall Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9160)
2019-06-14 17:41:32 +08:00
/*
* We want to make sure that all calls from this provider that requires
* a library context use the same context as the one used to call our
* functions. We do that by passing it along as the provider context.
*/
*provctx = c_get_libctx(provider);
Add a skeleton default provider Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8513)
2019-03-13 20:02:55 +08:00
return 1;
}
Reference in New Issue Copy Permalink