[openssl/openssl] 7d8465: update cms_pwri_kek_oob.der blob to use a 16 byte ...

"'Bernd Edlinger' via openssl-commits" <[email protected]> Tue, 18 Aug 2026 08:43:37 -0700
Newsgroups	gmane.comp.encryption.openssl.cvs
Message-ID	<openssl/openssl/push/refs/heads/master/[email protected]>
  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 7d8465d3de193c70afc8c764b3f1e4557859aae4
      https://github.com/openssl/openssl/commit/7d8465d3de193c70afc8c764b3f1e4557859aae4
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der

  Log Message:
  -----------
  update cms_pwri_kek_oob.der blob to use a 16 byte IV value

This changes the PWRI-KEK blob to use a 16 byte long IV value
which is needed for AES-128-CFB.

Thus ./test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der changes

from:
   69:d=6  hl=2 l=  11 prim: OBJECT            :id-alg-PWRI-KEK
   82:d=6  hl=2 l=  11 cons: SEQUENCE
   84:d=7  hl=2 l=   9 prim: OBJECT            :aes-128-cfb
   95:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:0000

to:
   69:d=6  hl=2 l=  11 prim: OBJECT            :id-alg-PWRI-KEK
   82:d=6  hl=2 l=  29 cons: SEQUENCE
   84:d=7  hl=2 l=   9 prim: OBJECT            :aes-128-cfb
   95:d=7  hl=2 l=  16 prim: OCTET STRING      [HEX DUMP]:00000000000000000000000000000000
  113:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:0000

Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Tue Aug 18 15:37:15 2026
(Merged from https://github.com/openssl/openssl/pull/31676)


  Commit: 90eb7db527023b399aa850fa0a46c73a4ac370e8
      https://github.com/openssl/openssl/commit/90eb7db527023b399aa850fa0a46c73a4ac370e8
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M crypto/evp/evp_lib.c
    M test/cmsapitest.c
    M test/recipes/80-test_cmsapi.t
    A test/recipes/80-test_cmsapi_data/cms_pwri_kek_NoIV.der

  Log Message:
  -----------
  Restore the check for missing IV param in evp_cipher_asn1_to_param_ex

STREAM ciphers (RC4) and WRAP MODE ciphers (CMS3DESwrap) do not have an IV
parameter value, all other ciphers need an IV value, previously the missing
IV param value was handled as an error condition.
The check that an IV value is there was accidentally removed for all ciphers.
This restores the check for all ciphers except RC4.

Fixes: 114d99b46bfb ("Fix incomplete checks for EVP_CIPHER_asn1_to_param")

Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Tue Aug 18 15:37:24 2026
(Merged from https://github.com/openssl/openssl/pull/31676)


Compare: https://github.com/openssl/openssl/compare/8274744b9221...90eb7db52702

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/827474-90eb7d%40github.com.