Skip to content

Comments

[design] Functions for explicitly fetched signature algorithms#22672

Closed
levitte wants to merge 11 commits intoopenssl:masterfrom
levitte:design-functions-for-explicitly-fetched-signature-algorithms
Closed

[design] Functions for explicitly fetched signature algorithms#22672
levitte wants to merge 11 commits intoopenssl:masterfrom
levitte:design-functions-for-explicitly-fetched-signature-algorithms

Conversation

@levitte
Copy link
Member

@levitte levitte commented Nov 9, 2023 •
edited
Loading

This design goes into more details what was outlined in the design for
fetching composite (PKEY) algorithms and using them.

It also changes what functionality will be used for this. The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

Finally, it also takes into account the need to specify the signature
to be verified against with EVP_PKEY_verify() streaming functions,
which has been discussed in #22357.

Related to #22357 (in progress), #22129 (merged), and openssl/project#231

@levitte levitte mentioned this pull request Nov 9, 2023
Closed
2 tasks
@levitte levitte force-pushed the design-functions-for-explicitly-fetched-signature-algorithms branch from 317c78b to 07c769d Compare November 9, 2023 09:56
@levitte
Copy link
Member Author

levitte commented Nov 9, 2023 •
edited
Loading

This design is still missing some provider interfaces to be added. I'm currently looking more closely at that. But don't let that stop you from commenting or discussing further in #22671, input is welcome!

@levitte levitte force-pushed the design-functions-for-explicitly-fetched-signature-algorithms branch from 07c769d to b986ca5 Compare November 9, 2023 10:26
t8m
t8m reviewed Nov 9, 2023
View reviewed changes
Copy link
Member

@t8m t8m left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good so far, although I need to think through how applications should change to be able to use these new functions but still work with old providers and legacy.

@levitte
Copy link
Member Author

levitte commented Nov 9, 2023

This looks good so far, although I need to think through how applications should change to be able to use these new functions but still work with old providers and legacy.

This new functionality won't support legacy. This is about explicitly fetched algorithms, there's nothing legacy about that.

The streaming functions (update, final) will also not be possible to use with old providers. The one-shot functions should continue to work transparently, however.

slontis
slontis reviewed Nov 9, 2023
View reviewed changes
t8m
t8m requested changes Nov 10, 2023
View reviewed changes
@slontis slontis mentioned this pull request Nov 14, 2023
Open
@t8m t8m added branch: master Applies to master branch triaged: design The issue/pr deals with a design document labels Nov 14, 2023
@slontis slontis mentioned this pull request Dec 6, 2023
Closed
2 tasks
@openssl-machine
Copy link
Collaborator

openssl-machine commented Dec 15, 2023

This PR is waiting for the creator to make requested changes but it has not been updated for 30 days. If you have made changes or commented to the reviewer please make sure you re-request a review (see icon in the 'reviewers' section).

@slontis slontis mentioned this pull request Jan 8, 2024
Closed
@openssl-machine
Copy link
Collaborator

openssl-machine commented Jan 15, 2024

This PR is waiting for the creator to make requested changes but it has not been updated for 61 days. If you have made changes or commented to the reviewer please make sure you re-request a review (see icon in the 'reviewers' section).

@levitte levitte force-pushed the design-functions-for-explicitly-fetched-signature-algorithms branch from a4be04b to 1dd902c Compare January 16, 2024 13:41
@levitte levitte marked this pull request as ready for review January 16, 2024 13:41
@levitte
Copy link
Member Author

levitte commented Jan 16, 2024

Rebased...

Also, I had forgotten that this was still draft, it should have been made ready for review a while ago.

@levitte levitte mentioned this pull request Jan 29, 2024
Closed
@openssl-machine
Copy link
Collaborator

openssl-machine commented Feb 16, 2024

This PR is waiting for the creator to make requested changes but it has not been updated for 30 days. If you have made changes or commented to the reviewer please make sure you re-request a review (see icon in the 'reviewers' section).

@openssl-machine
Copy link
Collaborator

openssl-machine commented Mar 18, 2024

This PR is waiting for the creator to make requested changes but it has not been updated for 61 days. If you have made changes or commented to the reviewer please make sure you re-request a review (see icon in the 'reviewers' section).

@openssl-machine
Copy link
Collaborator

openssl-machine commented Apr 16, 2024

This PR has been closed. It was waiting for the creator to make requested changes but it has not been updated for 90 days.

@t8m t8m reopened this Apr 16, 2024
@t8m t8m added approval: review pending This pull request needs review by a committer approval: otc review pending tests: exempted The PR is exempt from requirements for testing labels Apr 16, 2024
@t8m
Copy link
Member

t8m commented Apr 16, 2024

@levitte please drop the unrelated fuzz-corpora submodule change.

@levitte levitte force-pushed the design-functions-for-explicitly-fetched-signature-algorithms branch from 1dd902c to e50903a Compare April 17, 2024 08:05
@levitte
Copy link
Member Author

levitte commented Apr 17, 2024

I squashed and rebased too, while I was at it

vdukhovni
vdukhovni requested changes Sep 21, 2024
View reviewed changes
@openssl-machine
Copy link
Collaborator

openssl-machine commented Oct 24, 2024

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented Nov 24, 2024

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented Dec 25, 2024

This PR is in a state where it requires action by @openssl/committers but the last update was 61 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented Jan 25, 2025

This PR is in a state where it requires action by @openssl/committers but the last update was 92 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented Feb 25, 2025

This PR is in a state where it requires action by @openssl/committers but the last update was 123 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented Mar 28, 2025

This PR is in a state where it requires action by @openssl/committers but the last update was 154 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented Apr 28, 2025

This PR is in a state where it requires action by @openssl/committers but the last update was 185 days ago

@openssl-machine
Copy link
Collaborator

openssl-machine commented May 29, 2025

This PR is in a state where it requires action by @openssl/committers but the last update was 216 days ago

@levitte
Copy link
Member Author

levitte commented May 29, 2025

Ping! One more review needed to finally merge this design document! @openssl/committers

@paulidale paulidale added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels May 29, 2025
@paulidale
Copy link
Contributor

paulidale commented May 29, 2025

This possibly warrants back porting to relevant older branches.

@t8m t8m added branch: 3.4 Applies to openssl-3.4 branch: 3.5 Applies to openssl-3.5 labels May 29, 2025
@openssl-machine
Copy link
Collaborator

openssl-machine commented May 30, 2025

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually.

@t8m t8m added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels May 30, 2025
openssl-machine pushed a commit that referenced this pull request May 30, 2025
@levitte @t8m
[design] Functions for explicitly fetched signature algorithms
66454bf 
This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this.  The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
    ./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #22672)
openssl-machine pushed a commit that referenced this pull request May 30, 2025
@levitte @t8m
[design] Functions for explicitly fetched signature algorithms
56b7487 
This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this.  The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
    ./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #22672)

(cherry picked from commit 66454bf)
openssl-machine pushed a commit that referenced this pull request May 30, 2025
@levitte @t8m
[design] Functions for explicitly fetched signature algorithms
1060ae3 
This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this.  The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
    ./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #22672)

(cherry picked from commit 66454bf)
@t8m
Copy link
Member

t8m commented May 30, 2025

Merged to the master, 3.4 and 3.5 branches. Thank you.

@t8m t8m closed this May 30, 2025
DDvO pushed a commit to siemens/openssl that referenced this pull request Jun 16, 2025
@levitte @DDvO
[design] Functions for explicitly fetched signature algorithms
5da2b04 
This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this.  The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
    ./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#22672)
MichaelA-Fireblocks pushed a commit to MichaelA-Fireblocks/openssl that referenced this pull request Jul 15, 2025
@levitte @MichaelA-Fireblocks
[design] Functions for explicitly fetched signature algorithms
a89000c 
This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this.  The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
    ./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#22672)
MichaelA-Fireblocks pushed a commit to MichaelA-Fireblocks/openssl that referenced this pull request Jul 15, 2025
@levitte @MichaelA-Fireblocks
[design] Functions for explicitly fetched signature algorithms
8c848d6 
This design goes into more details what was outlined in the design for
[fetching composite (PKEY) algorithms and using them].

It also changes what functionality will be used for this.  The design for
signature was originally to add modified initializers for DigestSign and
DigestVerify, but recent OTC discussions redirected us to have a closer look
at EVP_PKEY_sign() and EVP_PKEY_verify().

[fetching composite (PKEY) algorithms and using them]:
    ./fetching-composite-algorithms.md

Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#22672)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vdukhovni vdukhovni vdukhovni requested changes

@slontis slontis slontis left review comments

@Sashan Sashan Sashan requested changes

@t8m t8m t8m approved these changes

@paulidale paulidale paulidale approved these changes

+1 more reviewer

@jamuir jamuir jamuir left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

approval: ready to merge The 24 hour grace period has passed, ready to merge branch: master Applies to master branch branch: 3.4 Applies to openssl-3.4 branch: 3.5 Applies to openssl-3.5 tests: exempted The PR is exempt from requirements for testing triaged: design The issue/pr deals with a design document

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.