[openssl/openssl] d17286: EC: make the group the single source of the point ...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: d172868e5337563ecc0431e52ccb612951a6c576
      https://github.com/openssl/openssl/commit/d172868e5337563ecc0431e52ccb612951a6c576
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    M apps/ec.c
    M apps/ecparam.c
    M apps/pkey.c
    M crypto/ec/ec_asn1.c
    M crypto/ec/ec_backend.c
    M crypto/ec/ec_key.c
    M crypto/ec/ec_kmeth.c
    M crypto/ec/ec_local.h
    M crypto/evp/p_lib.c
    M doc/man1/openssl-ec.pod.in
    M doc/man1/openssl-ecparam.pod.in
    M doc/man1/openssl-pkey.pod.in
    M doc/man7/EVP_PKEY-EC.pod
    M providers/implementations/keymgmt/ec_kmgmt.c
    M test/ectest.c

  Log Message:
  -----------
  EC: make the group the single source of the point conversion form

The point conversion form (compressed, uncompressed, or hybrid)
was kept both on the key and on the group, and the two could
disagree -- a key imported as compressed could re-encode as
uncompressed. The group is now the single source of truth:
encoding, parameter output, and the legacy lookup all read it from
the group, and decoding (PEM, DER, or raw parameters) records it
there, so the form round-trips faithfully.

Generated keys are always uncompressed; the point-format option at
key generation is now a documented no-op (it had had no effect for
several releases), and the unused form field on the keygen context
is dropped.  Imported keys still keep their form, and the
deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still
work.

EVP_PKEY_fromdata() and openssl pkey -text now report the form a
loaded EC key actually has, and re-encoding via PEM or DER
preserves it.

Docs drop a stale note about a compile-time macro for compressed
points on binary curves, and the EC tests now exercise both the
affine and the compressed/hybrid binary formats unconditionally
(fixing a latent bug in the compressed/hybrid form tests that were
never exercised by CI).

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Fri Jul 10 09:21:29 2026
(Merged from https://github.com/openssl/openssl/pull/30940)


  Commit: 9d59af025a025b0aaa18148868ba0c773ce0ce97
      https://github.com/openssl/openssl/commit/9d59af025a025b0aaa18148868ba0c773ce0ce97
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    M CHANGES.md
    M doc/man3/SSL_CTX_set1_curves.pod
    M ssl/ssl_lib.c
    M ssl/ssl_local.h
    M ssl/statem/extensions.c
    M ssl/statem/extensions_clnt.c
    M ssl/statem/extensions_srvr.c
    M ssl/statem/statem_local.h
    M ssl/t1_lib.c
    A test/certs/server-ec-compressed-cert.pem
    A test/certs/server-ec-compressed-key.pem
    A test/recipes/70-test_ec_point_formats.t
    M test/recipes/80-test_ssl_new.t
    A test/ssl-tests/33-compressed-spki.cnf
    A test/ssl-tests/33-compressed-spki.cnf.in
    M test/sslapitest.c
    M util/missingmacro.txt
    M util/other.syms

  Log Message:
  -----------
  Improve TLS handling of EC point formats

Decouple the ec_point_formats extension from TLS 1.2 X.509
selection and acceptance.  Remove tls1_check_pkey_comp() and its
callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3
disregards the extension already, and we can decode any point form
a peer might send, so refusing a compressed peer cert in TLS 1.2
because we didn't advertise compressed buys nothing.

The RFC 4492/8422 section 5.1.2 requirement that the peer's list
contain "uncompressed" used to be enforced in a final hook on the
client side only.  Move it to the two points where the negotiated
ciphersuite is known: the client's ServerHello parse hook, and the
server's ServerHello construct hook.  Both sites fire the alert
only when an ECC TLS 1.2 ciphersuite has been negotiated, so a
missing "uncompressed" is ignored under TLS 1.3 or a non-ECC
cipher.  The client- and server-side parse hooks now share one
function.

Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL;
our own list is built directly inside the constructors.  The
peer's list continues to be stored verbatim, and is also exposed
through the SSL_get0_ec_point_formats() accessor (now documented).
New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS
1.2 vs 1.3) plus that a compressed point form EC cert is usable on
both sides without any opt-in.

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Matt Caswell <[email protected]>
MergeDate: Fri Jul 10 09:21:30 2026
(Merged from https://github.com/openssl/openssl/pull/30940)


Compare: https://github.com/openssl/openssl/compare/234845aaabbc...9d59af025a02

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/234845-9d59af%40github.com.