diff options
Diffstat (limited to 'secure/lib/libcrypto/man/man7/provider-asym_cipher.7')
| -rw-r--r-- | secure/lib/libcrypto/man/man7/provider-asym_cipher.7 | 247 |
1 files changed, 93 insertions, 154 deletions
diff --git a/secure/lib/libcrypto/man/man7/provider-asym_cipher.7 b/secure/lib/libcrypto/man/man7/provider-asym_cipher.7 index 1c647936d89b..48ec1e424338 100644 --- a/secure/lib/libcrypto/man/man7/provider-asym_cipher.7 +++ b/secure/lib/libcrypto/man/man7/provider-asym_cipher.7 @@ -1,4 +1,5 @@ -.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42) +.\" -*- mode: troff; coding: utf-8 -*- +.\" Automatically generated by Pod::Man 5.0102 (Pod::Simple 3.45) .\" .\" Standard preamble: .\" ======================================================================== @@ -15,29 +16,12 @@ .ft R .fi .. -.\" Set up some character translations and predefined strings. \*(-- will -.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left -.\" double quote, and \*(R" will give a right double quote. \*(C+ will -.\" give a nicer C++. Capital omega is used to do unbreakable dashes and -.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, -.\" nothing in troff, for use with C<>. -.tr \(*W- -.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>. .ie n \{\ -. ds -- \(*W- -. ds PI pi -. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch -. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch -. ds L" "" -. ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ -. ds -- \|\(em\| -. ds PI \(*p -. ds L" `` -. ds R" '' . ds C` . ds C' 'br\} @@ -68,77 +52,17 @@ . \} .\} .rr rF -.\" Fear. Run. Save yourself. No user-serviceable parts. -. \" fudge factors for nroff and troff -.if n \{\ -. ds #H 0 -. ds #V .8m -. ds #F .3m -. ds #[ \f1 -. ds #] \fP -.\} -.if t \{\ -. ds #H ((1u-(\\\\n(.fu%2u))*.13m) -. ds #V .6m -. ds #F 0 -. ds #[ \& -. ds #] \& -.\} -. \" simple accents for nroff and troff -.if n \{\ -. ds ' \& -. ds ` \& -. ds ^ \& -. ds , \& -. ds ~ ~ -. ds / -.\} -.if t \{\ -. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" -. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' -. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' -. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' -. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' -. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' -.\} -. \" troff and (daisy-wheel) nroff accents -.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' -.ds 8 \h'\*(#H'\(*b\h'-\*(#H' -.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] -.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' -.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' -.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] -.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] -.ds ae a\h'-(\w'a'u*4/10)'e -.ds Ae A\h'-(\w'A'u*4/10)'E -. \" corrections for vroff -.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' -.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' -. \" for low resolution devices (crt and lpr) -.if \n(.H>23 .if \n(.V>19 \ -\{\ -. ds : e -. ds 8 ss -. ds o a -. ds d- d\h'-1'\(ga -. ds D- D\h'-1'\(hy -. ds th \o'bp' -. ds Th \o'LP' -. ds ae ae -. ds Ae AE -.\} -.rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "PROVIDER-ASYM_CIPHER 7ossl" -.TH PROVIDER-ASYM_CIPHER 7ossl "2023-09-19" "3.0.11" "OpenSSL" +.TH PROVIDER-ASYM_CIPHER 7ossl 2025-07-01 3.5.1 OpenSSL .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh -.SH "NAME" +.SH NAME provider\-asym_cipher \- The asym_cipher library <\-> provider functions -.SH "SYNOPSIS" +.SH SYNOPSIS .IX Header "SYNOPSIS" .Vb 2 \& #include <openssl/core_dispatch.h> @@ -175,28 +99,28 @@ provider\-asym_cipher \- The asym_cipher library <\-> provider functions \& int OSSL_FUNC_asym_cipher_set_ctx_params(void *ctx, const OSSL_PARAM params[]); \& const OSSL_PARAM *OSSL_FUNC_asym_cipher_settable_ctx_params(void *provctx); .Ve -.SH "DESCRIPTION" +.SH DESCRIPTION .IX Header "DESCRIPTION" This documentation is primarily aimed at provider authors. See \fBprovider\fR\|(7) for further information. .PP -The asymmetric cipher (\s-1OSSL_OP_ASYM_CIPHER\s0) operation enables providers to +The asymmetric cipher (OSSL_OP_ASYM_CIPHER) operation enables providers to implement asymmetric cipher algorithms and make them available to applications -via the \s-1API\s0 functions \fBEVP_PKEY_encrypt\fR\|(3), +via the API functions \fBEVP_PKEY_encrypt\fR\|(3), \&\fBEVP_PKEY_decrypt\fR\|(3) and other related functions). .PP -All \*(L"functions\*(R" mentioned here are passed as function pointers between -\&\fIlibcrypto\fR and the provider in \s-1\fBOSSL_DISPATCH\s0\fR\|(3) arrays via -\&\s-1\fBOSSL_ALGORITHM\s0\fR\|(3) arrays that are returned by the provider's +All "functions" mentioned here are passed as function pointers between +\&\fIlibcrypto\fR and the provider in \fBOSSL_DISPATCH\fR\|(3) arrays via +\&\fBOSSL_ALGORITHM\fR\|(3) arrays that are returned by the provider's \&\fBprovider_query_operation()\fR function -(see \*(L"Provider Functions\*(R" in \fBprovider\-base\fR\|(7)). +(see "Provider Functions" in \fBprovider\-base\fR\|(7)). .PP -All these \*(L"functions\*(R" have a corresponding function type definition +All these "functions" have a corresponding function type definition named \fBOSSL_FUNC_{name}_fn\fR, and a helper function to retrieve the -function pointer from an \s-1\fBOSSL_DISPATCH\s0\fR\|(3) element named +function pointer from an \fBOSSL_DISPATCH\fR\|(3) element named \&\fBOSSL_FUNC_{name}\fR. -For example, the \*(L"function\*(R" \fBOSSL_FUNC_asym_cipher_newctx()\fR has these: +For example, the "function" \fBOSSL_FUNC_asym_cipher_newctx()\fR has these: .PP .Vb 3 \& typedef void *(OSSL_FUNC_asym_cipher_newctx_fn)(void *provctx); @@ -204,7 +128,7 @@ For example, the \*(L"function\*(R" \fBOSSL_FUNC_asym_cipher_newctx()\fR has the \& OSSL_FUNC_asym_cipher_newctx(const OSSL_DISPATCH *opf); .Ve .PP -\&\s-1\fBOSSL_DISPATCH\s0\fR\|(3) arrays are indexed by numbers that are provided as +\&\fBOSSL_DISPATCH\fR\|(3) arrays are indexed by numbers that are provided as macros in \fBopenssl\-core_dispatch.h\fR\|(7), as follows: .PP .Vb 3 @@ -237,7 +161,7 @@ Similarly, OSSL_FUNC_asym_cipher_set_ctx_params is optional but if it is present so must OSSL_FUNC_asym_cipher_settable_ctx_params. .PP An asymmetric cipher algorithm must also implement some mechanism for generating, -loading or importing keys via the key management (\s-1OSSL_OP_KEYMGMT\s0) operation. +loading or importing keys via the key management (OSSL_OP_KEYMGMT) operation. See \fBprovider\-keymgmt\fR\|(7) for further details. .SS "Context Management Functions" .IX Subsection "Context Management Functions" @@ -259,30 +183,30 @@ context in the \fIctx\fR parameter and return the duplicate copy. \&\fBOSSL_FUNC_asym_cipher_encrypt_init()\fR initialises a context for an asymmetric encryption given a provider side asymmetric cipher context in the \fIctx\fR parameter, and a pointer to a provider key object in the \fIprovkey\fR parameter. -The \fIparams\fR, if not \s-1NULL,\s0 should be set on the context in a manner similar to +The \fIparams\fR, if not NULL, should be set on the context in a manner similar to using \fBOSSL_FUNC_asym_cipher_set_ctx_params()\fR. The key object should have been previously generated, loaded or imported into -the provider using the key management (\s-1OSSL_OP_KEYMGMT\s0) operation (see \fBprovider\-keymgmt\fR\|(7)). +the provider using the key management (OSSL_OP_KEYMGMT) operation (see \fBprovider\-keymgmt\fR\|(7)). \&\fBOSSL_FUNC_asym_cipher_encrypt()\fR performs the actual encryption itself. A previously initialised asymmetric cipher context is passed in the \fIctx\fR parameter. The data to be encrypted is pointed to by the \fIin\fR parameter which is \fIinlen\fR bytes long. -Unless \fIout\fR is \s-1NULL,\s0 the encrypted data should be written to the location +Unless \fIout\fR is NULL, the encrypted data should be written to the location pointed to by the \fIout\fR parameter and it should not exceed \fIoutsize\fR bytes in length. The length of the encrypted data should be written to \fI*outlen\fR. -If \fIout\fR is \s-1NULL\s0 then the maximum length of the encrypted data should be +If \fIout\fR is NULL then the maximum length of the encrypted data should be written to \fI*outlen\fR. .SS "Decryption Functions" .IX Subsection "Decryption Functions" \&\fBOSSL_FUNC_asym_cipher_decrypt_init()\fR initialises a context for an asymmetric decryption given a provider side asymmetric cipher context in the \fIctx\fR parameter, and a pointer to a provider key object in the \fIprovkey\fR parameter. -The \fIparams\fR, if not \s-1NULL,\s0 should be set on the context in a manner similar to +The \fIparams\fR, if not NULL, should be set on the context in a manner similar to using \fBOSSL_FUNC_asym_cipher_set_ctx_params()\fR. The key object should have been previously generated, loaded or imported into -the provider using the key management (\s-1OSSL_OP_KEYMGMT\s0) operation (see +the provider using the key management (OSSL_OP_KEYMGMT) operation (see \&\fBprovider\-keymgmt\fR\|(7)). .PP \&\fBOSSL_FUNC_asym_cipher_decrypt()\fR performs the actual decryption itself. @@ -290,102 +214,117 @@ A previously initialised asymmetric cipher context is passed in the \fIctx\fR parameter. The data to be decrypted is pointed to by the \fIin\fR parameter which is \fIinlen\fR bytes long. -Unless \fIout\fR is \s-1NULL,\s0 the decrypted data should be written to the location +Unless \fIout\fR is NULL, the decrypted data should be written to the location pointed to by the \fIout\fR parameter and it should not exceed \fIoutsize\fR bytes in length. The length of the decrypted data should be written to \fI*outlen\fR. -If \fIout\fR is \s-1NULL\s0 then the maximum length of the decrypted data should be +If \fIout\fR is NULL then the maximum length of the decrypted data should be written to \fI*outlen\fR. .SS "Asymmetric Cipher Parameters" .IX Subsection "Asymmetric Cipher Parameters" -See \s-1\fBOSSL_PARAM\s0\fR\|(3) for further details on the parameters structure used by +See \fBOSSL_PARAM\fR\|(3) for further details on the parameters structure used by the \fBOSSL_FUNC_asym_cipher_get_ctx_params()\fR and \fBOSSL_FUNC_asym_cipher_set_ctx_params()\fR functions. .PP \&\fBOSSL_FUNC_asym_cipher_get_ctx_params()\fR gets asymmetric cipher parameters associated with the given provider side asymmetric cipher context \fIctx\fR and stores them in \&\fIparams\fR. -Passing \s-1NULL\s0 for \fIparams\fR should return true. +Passing NULL for \fIparams\fR should return true. .PP \&\fBOSSL_FUNC_asym_cipher_set_ctx_params()\fR sets the asymmetric cipher parameters associated with the given provider side asymmetric cipher context \fIctx\fR to \fIparams\fR. Any parameter settings are additional to any that were previously set. -Passing \s-1NULL\s0 for \fIparams\fR should return true. +Passing NULL for \fIparams\fR should return true. .PP Parameters currently recognised by built-in asymmetric cipher algorithms are as follows. Not all parameters are relevant to, or are understood by all asymmetric cipher algorithms: -.ie n .IP """pad-mode"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_PAD_MODE\s0\fR) <\s-1UTF8\s0 string> \s-1OR\s0 <integer>" 4 -.el .IP "``pad-mode'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_PAD_MODE\s0\fR) <\s-1UTF8\s0 string> \s-1OR\s0 <integer>" 4 -.IX Item "pad-mode (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <UTF8 string> OR <integer>" +.IP """pad-mode"" (\fBOSSL_ASYM_CIPHER_PARAM_PAD_MODE\fR) <UTF8 string> OR <integer>" 4 +.IX Item """pad-mode"" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <UTF8 string> OR <integer>" The type of padding to be used. The interpretation of this value will depend on the algorithm in use. -.ie n .IP """digest"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST\s0\fR) <\s-1UTF8\s0 string>" 4 -.el .IP "``digest'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST\s0\fR) <\s-1UTF8\s0 string>" 4 -.IX Item "digest (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST) <UTF8 string>" -Gets or sets the name of the \s-1OAEP\s0 digest algorithm used when \s-1OAEP\s0 padding is in +.IP """digest"" (\fBOSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST\fR) <UTF8 string>" 4 +.IX Item """digest"" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST) <UTF8 string>" +Gets or sets the name of the OAEP digest algorithm used when OAEP padding is in use. -.ie n .IP """digest"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_DIGEST\s0\fR) <\s-1UTF8\s0 string>" 4 -.el .IP "``digest'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_DIGEST\s0\fR) <\s-1UTF8\s0 string>" 4 -.IX Item "digest (OSSL_ASYM_CIPHER_PARAM_DIGEST) <UTF8 string>" +.IP """digest"" (\fBOSSL_ASYM_CIPHER_PARAM_DIGEST\fR) <UTF8 string>" 4 +.IX Item """digest"" (OSSL_ASYM_CIPHER_PARAM_DIGEST) <UTF8 string>" Gets or sets the name of the digest algorithm used by the algorithm (where applicable). -.ie n .IP """digest-props"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS\s0\fR) <\s-1UTF8\s0 string>" 4 -.el .IP "``digest-props'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS\s0\fR) <\s-1UTF8\s0 string>" 4 -.IX Item "digest-props (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS) <UTF8 string>" -Gets or sets the properties to use when fetching the \s-1OAEP\s0 digest algorithm. -.ie n .IP """digest-props"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_DIGEST_PROPS\s0\fR) <\s-1UTF8\s0 string>" 4 -.el .IP "``digest-props'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_DIGEST_PROPS\s0\fR) <\s-1UTF8\s0 string>" 4 -.IX Item "digest-props (OSSL_ASYM_CIPHER_PARAM_DIGEST_PROPS) <UTF8 string>" +.IP """digest-props"" (\fBOSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS\fR) <UTF8 string>" 4 +.IX Item """digest-props"" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS) <UTF8 string>" +Gets or sets the properties to use when fetching the OAEP digest algorithm. +.IP """digest-props"" (\fBOSSL_ASYM_CIPHER_PARAM_DIGEST_PROPS\fR) <UTF8 string>" 4 +.IX Item """digest-props"" (OSSL_ASYM_CIPHER_PARAM_DIGEST_PROPS) <UTF8 string>" Gets or sets the properties to use when fetching the cipher digest algorithm. -.ie n .IP """mgf1\-digest"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST\s0\fR) <\s-1UTF8\s0 string>" 4 -.el .IP "``mgf1\-digest'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST\s0\fR) <\s-1UTF8\s0 string>" 4 -.IX Item "mgf1-digest (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST) <UTF8 string>" -Gets or sets the name of the \s-1MGF1\s0 digest algorithm used when \s-1OAEP\s0 or \s-1PSS\s0 padding +.IP """mgf1\-digest"" (\fBOSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST\fR) <UTF8 string>" 4 +.IX Item """mgf1-digest"" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST) <UTF8 string>" +Gets or sets the name of the MGF1 digest algorithm used when OAEP or PSS padding is in use. -.ie n .IP """mgf1\-digest\-props"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS\s0\fR) <\s-1UTF8\s0 string>" 4 -.el .IP "``mgf1\-digest\-props'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS\s0\fR) <\s-1UTF8\s0 string>" 4 -.IX Item "mgf1-digest-props (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS) <UTF8 string>" -Gets or sets the properties to use when fetching the \s-1MGF1\s0 digest algorithm. -.ie n .IP """oaep-label"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL\s0\fR) <octet string ptr>" 4 -.el .IP "``oaep-label'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL\s0\fR) <octet string ptr>" 4 -.IX Item "oaep-label (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string ptr>" -Gets the \s-1OAEP\s0 label used when \s-1OAEP\s0 padding is in use. -.ie n .IP """oaep-label"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL\s0\fR) <octet string>" 4 -.el .IP "``oaep-label'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL\s0\fR) <octet string>" 4 -.IX Item "oaep-label (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string>" -Sets the \s-1OAEP\s0 label used when \s-1OAEP\s0 padding is in use. -.ie n .IP """tls-client-version"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION\s0\fR) <unsigned integer>" 4 -.el .IP "``tls-client-version'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION\s0\fR) <unsigned integer>" 4 -.IX Item "tls-client-version (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer>" -The \s-1TLS\s0 protocol version first requested by the client. -.ie n .IP """tls-negotiated-version"" (\fB\s-1OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION\s0\fR) <unsigned integer>" 4 -.el .IP "``tls-negotiated-version'' (\fB\s-1OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION\s0\fR) <unsigned integer>" 4 -.IX Item "tls-negotiated-version (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer>" -The negotiated \s-1TLS\s0 protocol version. +.IP """mgf1\-digest\-props"" (\fBOSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS\fR) <UTF8 string>" 4 +.IX Item """mgf1-digest-props"" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS) <UTF8 string>" +Gets or sets the properties to use when fetching the MGF1 digest algorithm. +.IP """oaep-label"" (\fBOSSL_ASYM_CIPHER_PARAM_OAEP_LABEL\fR) <octet string ptr>" 4 +.IX Item """oaep-label"" (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string ptr>" +Gets the OAEP label used when OAEP padding is in use. +.IP """oaep-label"" (\fBOSSL_ASYM_CIPHER_PARAM_OAEP_LABEL\fR) <octet string>" 4 +.IX Item """oaep-label"" (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string>" +Sets the OAEP label used when OAEP padding is in use. +.IP """tls-client-version"" (\fBOSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION\fR) <unsigned integer>" 4 +.IX Item """tls-client-version"" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer>" +The TLS protocol version first requested by the client. +.IP """tls-negotiated-version"" (\fBOSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION\fR) <unsigned integer>" 4 +.IX Item """tls-negotiated-version"" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer>" +The negotiated TLS protocol version. +.IP """implicit-rejection"" (\fBOSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION\fR) <unsigned integer>" 4 +.IX Item """implicit-rejection"" (OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION) <unsigned integer>" +Gets or sets the use of the implicit rejection mechanism for RSA PKCS#1 v1.5 +decryption. When set (non zero value), the decryption API will return +a deterministically random value if the PKCS#1 v1.5 padding check fails. +This makes exploitation of the Bleichenbacher significantly harder, even +if the code using the RSA decryption API is not implemented in side-channel +free manner. Set by default in OpenSSL providers. +.PP +The OpenSSL FIPS provider also supports the following parameters: +.IP """fips-indicator"" (\fBOSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR\fR) <integer>" 4 +.IX Item """fips-indicator"" (OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR) <integer>" +A getter that returns 1 if the operation is FIPS approved, or 0 otherwise. +This may be used after calling either \fBOSSL_FUNC_asym_cipher_encrypt()\fR or +\&\fBOSSL_FUNC_asym_cipher_decrypt()\fR. It may return 0 if "key-check" is set to 0. +.IP """key-check"" (\fBOSSL_ASYM_CIPHER_PARAM_FIPS_KEY_CHECK\fR) <integer>" 4 +.IX Item """key-check"" (OSSL_ASYM_CIPHER_PARAM_FIPS_KEY_CHECK) <integer>" +If required this parameter should be set using either +\&\fBOSSL_FUNC_asym_cipher_encrypt_init()\fR or \fBOSSL_FUNC_asym_cipher_decrypt_init()\fR. +The default value of 1 causes an error during the init if the key is not FIPS +approved (e.g. The key has a security strength of less than 112 bits). Setting +this to 0 will ignore the error and set the approved "fips-indicator" to 0. +This option breaks FIPS compliance if it causes the approved "fips-indicator" +to return 0. .PP \&\fBOSSL_FUNC_asym_cipher_gettable_ctx_params()\fR and \fBOSSL_FUNC_asym_cipher_settable_ctx_params()\fR -get a constant \s-1\fBOSSL_PARAM\s0\fR\|(3) array that describes the gettable and settable +get a constant \fBOSSL_PARAM\fR\|(3) array that describes the gettable and settable parameters, i.e. parameters that can be used with \fBOSSL_FUNC_asym_cipherget_ctx_params()\fR and \fBOSSL_FUNC_asym_cipher_set_ctx_params()\fR respectively. .SH "RETURN VALUES" .IX Header "RETURN VALUES" \&\fBOSSL_FUNC_asym_cipher_newctx()\fR and \fBOSSL_FUNC_asym_cipher_dupctx()\fR should return the newly -created provider side asymmetric cipher context, or \s-1NULL\s0 on failure. +created provider side asymmetric cipher context, or NULL on failure. .PP All other functions should return 1 for success or 0 on error. .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fBprovider\fR\|(7) -.SH "HISTORY" +.SH HISTORY .IX Header "HISTORY" -The provider \s-1ASYM_CIPHER\s0 interface was introduced in OpenSSL 3.0. -.SH "COPYRIGHT" +The provider ASYM_CIPHER interface was introduced in OpenSSL 3.0. +The Asymmetric Cipher Parameters "fips-indicator" and "key-check" +were added in OpenSSL 3.4. +.SH COPYRIGHT .IX Header "COPYRIGHT" -Copyright 2019\-2023 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2019\-2025 The OpenSSL Project Authors. All Rights Reserved. .PP -Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use +Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy -in the file \s-1LICENSE\s0 in the source distribution or at +in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. |