[openssl/openssl] 4cf673: update cms_pwri_kek_oob.der blob to use a 16 byte ...

"'Bernd Edlinger' via openssl-commits" <[email protected]> Thu, 27 Aug 2026 08:09:38 -0700
Newsgroups	gmane.comp.encryption.openssl.cvs
Message-ID	<openssl/openssl/push/refs/heads/openssl-4.0/[email protected]>
  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: 4cf673a3d50b0d04d65c54c6ebb6932bb9040cf4
      https://github.com/openssl/openssl/commit/4cf673a3d50b0d04d65c54c6ebb6932bb9040cf4
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der

  Log Message:
  -----------
  update cms_pwri_kek_oob.der blob to use a 16 byte IV value

This changes the PWRI-KEK blob to use a 16 byte long IV value
which is needed for AES-128-CFB.

Thus ./test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der changes

from:
   69:d=6  hl=2 l=  11 prim: OBJECT            :id-alg-PWRI-KEK
   82:d=6  hl=2 l=  11 cons: SEQUENCE
   84:d=7  hl=2 l=   9 prim: OBJECT            :aes-128-cfb
   95:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:0000

to: 69:d=6  hl=2 l=  11 prim: OBJECT            :id-alg-PWRI-KEK
   82:d=6  hl=2 l=  29 cons: SEQUENCE
   84:d=7  hl=2 l=   9 prim: OBJECT            :aes-128-cfb
   95:d=7  hl=2 l=  16 prim: OCTET STRING      [HEX DUMP]:00000000000000000000000000000000
  113:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:0000
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Mounir Idrassi <[email protected]>
Merge-date: Thu Aug 27 15:07:57 2026
Merged-from: https://github.com/openssl/openssl/pull/32394


  Commit: 1671f994548a1a33246859ab6cc43200b1c65d87
      https://github.com/openssl/openssl/commit/1671f994548a1a33246859ab6cc43200b1c65d87
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M crypto/evp/evp_lib.c
    M test/cmsapitest.c
    M test/recipes/80-test_cmsapi.t
    A test/recipes/80-test_cmsapi_data/cms_pwri_kek_NoIV.der

  Log Message:
  -----------
  Restore the check for missing IV param in evp_cipher_asn1_to_param_ex

STREAM ciphers (RC4) and WRAP MODE ciphers (CMS3DESwrap) do not have an IV
parameter value, all other ciphers need an IV value, previously the missing
IV param value was handled as an error condition.
The check that an IV value is there was accidentally removed for all ciphers.
This restores the check for all ciphers except RC4.

Fixes: 114d99b46bfb ("Fix incomplete checks for EVP_CIPHER_asn1_to_param")
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Mounir Idrassi <[email protected]>
Merge-date: Thu Aug 27 15:07:58 2026
Merged-from: https://github.com/openssl/openssl/pull/32394


Compare: https://github.com/openssl/openssl/compare/9ebd4f97bfeb...1671f994548a

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/9ebd4f-1671f9%40github.com.