[openssl/openssl] 8f04db: Improve TLS handling of EC point formats (3.0)

  Branch: refs/heads/openssl-3.0
  Home:   https://github.com/openssl/openssl
  Commit: 8f04db7c12d7ce696165fa16ba718ed622e151dd
      https://github.com/openssl/openssl/commit/8f04db7c12d7ce696165fa16ba718ed622e151dd
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-07-27 (Mon, 27 Jul 2026)

  Changed paths:
    M ssl/t1_lib.c
    A test/certs/server-ec-compressed-cert.pem
    A test/certs/server-ec-compressed-key.pem
    M test/recipes/80-test_ssl_new.t
    A test/ssl-tests/33-compressed-spki.cnf
    A test/ssl-tests/33-compressed-spki.cnf.in

  Log Message:
  -----------
  Improve TLS handling of EC point formats (3.0)

The ec_point_formats extension no longer plays any role in EC
certificate selection or acceptance: tls1_check_pkey_comp() with
its callers in tls1_check_cert_param(), tls12_check_peer_sigalg()
and tls1_check_chain() are removed.  TLS 1.3 disregards
ec_point_formats already, and we can decode any form a peer might
send, so refusing a compressed peer cert in TLS 1.2 because we
didn't advertise compressed buys nothing.

A new 33-compressed-spki ssl_new test verifies that a compressed
EC leaf certificate handshakes at both TLS 1.2 and TLS 1.3 without
either side opting into LegacyECPointFormats.

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Mon Jul 27 03:30:04 2026
(Merged from https://github.com/openssl/openssl/pull/31621)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.0/ce6057-8f04db%40github.com.