The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit bcaa2a3)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit 8e28ea9)

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit bcaa2a3)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit 8e28ea9)

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit bcaa2a3)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit 8e28ea9)

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit bcaa2a3)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit 8e28ea9)

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit bcaa2a3)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: #29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #29214)

(cherry picked from commit 8e28ea9)

The kdsa instruction is doing some parameter checking for the verify
function codes, like r/s equals zero and range checks. To handle these
cases correctly in the calling functions, the asm returns now also
condition code 2.

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#29214)

Check parameters of ECDSA signatures on verify and fail for invalid
malformed signatures in the code path for s390x accelerators. Handle
condition code of kdsa instruction for detecting invalid parameters.

For NIST P521 curves, kdsa ignores completely the upper 14 bytes of
the sections for r and s in the parameter-block, so adapt the offset
and length for bignum conversions for these curves. This will detect
cases of malformed signatures which are not covered by the kdsa
parameter checking.

Fixes: openssl#29173

Signed-off-by: Holger Dengler <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from openssl#29214)

3.6.1 CHANGES.md includes the following:
 * #28760
   "Improve the CPUINFO display for RISC-V"
 * #28797
   "Fix regression when X509_V_FLAG_CRL_CHECK_ALL is set"
 * #28955
   "Fix for TLS handshake issue with GnuTLS #28902"
 * #29155
   "fix(x509.c): fixed -checkend return values"
 * #29214
   "s390x: Check and fail on invalid malformed ECDSA signatures"
 * #29245
   "Clang format 3.6"
 * #29251
   "Fix change of behavior of the single stapled OCSP response API"

3.6.1 NEWS.md includes the following:
 * #28797
   "Fix regression when X509_V_FLAG_CRL_CHECK_ALL is set"
 * #28955
   "Fix for TLS handshake issue with GnuTLS #28902"

Co-Authored-by: Tomáš Mráz <[email protected]>
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jan 26 20:01:30 2026

3.5.5 CHANGES.md includes the following:
 * #28760
   "Improve the CPUINFO display for RISC-V"
 * #29214
   "s390x: Check and fail on invalid malformed ECDSA signatures"
 * #29262
   "Clang format 3.5"

Co-Authored-by: Tomáš Mráz <[email protected]>
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jan 26 20:03:05 2026

3.4.4 CHANGES.md includes the following:
 * #28760
   "Improve the CPUINFO display for RISC-V"
 * #29214
   "s390x: Check and fail on invalid malformed ECDSA signatures"
 * #29260
   "Clang format 3.4"

Co-Authored-by: Tomáš Mráz <[email protected]>
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jan 26 20:04:13 2026

3.3.6 CHANGES.md includes the following:
 * #29214
   "s390x: Check and fail on invalid malformed ECDSA signatures"
 * #29258
   "Clang format 3.3"

Co-Authored-by: Tomáš Mráz <[email protected]>
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jan 26 20:04:58 2026

3.0.19 CHANGES.md includes the following:
 * #29214
   "s390x: Check and fail on invalid malformed ECDSA signatures"
 * #29256
   "Clang format 3.0"

Co-Authored-by: Tomáš Mráz <[email protected]>
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jan 26 20:05:45 2026