jonathan/openssl
1
0
Fork 0
forked from rpms/openssl
Code Pull Requests Activity
Utilities from the general purpose cryptography library with TLS implementation
71 Commits 9 Branches 54 Tags 6.5 MiB
C 97.3%
Shell 2.7%
bc7dfd9722
Go to file
Clemens Lang bc7dfd9722 Fix RSA PSS padding with SHA-1 disabled 
Invocations of EVP_PKEY_CTX_set_rsa_padding(RSA_PKCS1_PSS_PADDING)
before setting an allowed digest with EVP_PKEY_CTX_set_signature_md()
would fail with SHA-1 use in signatures disabled, because OpenSSL's
internal default for the digest was SHA-1.

This isn't documented in any of the manpages, hence we expect users to
always call both EVP_PKEY_CTX_set_rsa_padding() and
EVP_PKEY_CTX_set_signature_md(). We do not want set_rsa_padding() to
fail if users set a non-SHA-1 signature algorithm after setting the
padding mode, though, so change the internal default to SHA-256 if SHA-1
is disabled.

Resolves: rhbz#2062640
2022-03-10 13:29:29 +01:00
.gitignore Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0001-Aarch64-and-ppc64le-use-lib64.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0002-Use-more-general-default-values-in-openssl.cnf.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0003-Do-not-install-html-docs.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0004-Override-default-paths-for-the-CA-directory-tree.patch Fixes override of openssl_conf in openssl.cnf 2021-07-06 13:56:08 +02:00
0005-apps-ca-fix-md-option-help-text.patch Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
0006-Disable-signature-verification-with-totally-unsafe-h.patch Update to Beta1 version 2021-07-14 13:31:08 +02:00
0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0008-Add-FIPS_mode-compatibility-macro.patch Update to Beta1 version 2021-07-14 13:31:08 +02:00
0009-Add-Kernel-FIPS-mode-flag-support.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0011-Remove-EC-curves.patch Update to Beta1 version 2021-07-14 13:31:08 +02:00
0012-Disable-explicit-ec.patch OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters 2022-02-25 12:37:01 +01:00
0024-load-legacy-prov.patch Always activate default provider via config 2021-11-23 16:52:23 +01:00
0025-for-tests.patch Always activate default provider via config 2021-11-23 16:52:23 +01:00
0031-tmp-Fix-test-names.patch KTLS and FIPS may interfere, so tests need to be tuned 2021-09-22 17:15:22 +02:00
0032-Force-fips.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0033-FIPS-embed-hmac.patch Remove volatile attribute from HMAC to make annocheck happy 2022-01-21 13:48:28 +01:00
0034.fipsinstall_disable.patch Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00
0035-speed-skip-unavailable-dgst.patch openssl speed should run in FIPS mode 2021-12-21 16:16:07 +01:00
0045-FIPS-services-minimize.patch Adjust FIPS provider version 2022-02-01 16:02:01 +01:00
0046-FIPS-s390x-hardening.patch On the s390x, zeroize all the copies of TLS premaster secret 2022-01-26 16:50:19 +01:00
0047-FIPS-early-KATS.patch KATS self-tests should run before HMAC verifcation 2022-01-21 13:48:28 +01:00
0048-correctly-handle-records.patch s_server: correctly handle 2^14 byte long records 2022-02-03 15:37:48 +01:00
0049-Selectively-disallow-SHA1-signatures.patch Fix RSA PSS padding with SHA-1 disabled 2022-03-10 13:29:29 +01:00
0050-FIPS-enable-pkcs12-mac.patch OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters 2022-02-22 16:32:34 +01:00
0051-Support-different-R_BITS-lengths-for-KBKDF.patch Support KBKDF (NIST SP800-108) with an R value of 8bits Resolves: rhbz#2027261 2022-02-24 10:14:16 +00:00
0052-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch Allow SHA1 in seclevel 2 if rh-allow-sha1-signatures = yes 2022-03-04 10:19:04 +01:00
configuration-prefix.h Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
configuration-switch.h Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
ec_curve.c Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
ectest.c OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters 2022-02-22 16:32:34 +01:00
gating.yaml Remove tier 0 functional test from gating.yaml. 2021-08-04 10:37:11 +02:00
genpatches Rebase to OpenSSL version 3.0.0 2021-04-12 00:34:30 +02:00
hobble-openssl RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
make-dummy-cert RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
Makefile.certificate RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
openssl.spec Fix RSA PSS padding with SHA-1 disabled 2022-03-10 13:29:29 +01:00
renew-dummy-cert RHEL 9.0.0 Alpha bootstrap 2020-10-15 22:27:53 +02:00
rpminspect.yaml Make rpminspect happy 2021-12-10 14:19:15 +01:00
sources Rebase to upstream version 3.0.1 2022-01-18 18:30:10 +01:00