[openssl/openssl] 742b25: update cms_pwri_kek_oob.der blob to use a 16 byte ...

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: 742b25d9cebb2a7a12314f293d92b5804a87eddd
      https://github.com/openssl/openssl/commit/742b25d9cebb2a7a12314f293d92b5804a87eddd
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der

  Log Message:
  -----------
  update cms_pwri_kek_oob.der blob to use a 16 byte IV value

This changes the PWRI-KEK blob to use a 16 byte long IV value
which is needed for AES-128-CFB.

Thus ./test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der changes

from:
   69:d=6  hl=2 l=  11 prim: OBJECT            :id-alg-PWRI-KEK
   82:d=6  hl=2 l=  11 cons: SEQUENCE
   84:d=7  hl=2 l=   9 prim: OBJECT            :aes-128-cfb
   95:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:0000

to: 69:d=6  hl=2 l=  11 prim: OBJECT            :id-alg-PWRI-KEK
   82:d=6  hl=2 l=  29 cons: SEQUENCE
   84:d=7  hl=2 l=   9 prim: OBJECT            :aes-128-cfb
   95:d=7  hl=2 l=  16 prim: OCTET STRING      [HEX DUMP]:00000000000000000000000000000000
  113:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:0000
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Mounir Idrassi <[email protected]>
Merge-date: Thu Aug 27 15:07:57 2026
Merged-from: https://github.com/openssl/openssl/pull/32394
(cherry picked from commit 4cf673a3d50b0d04d65c54c6ebb6932bb9040cf4)


  Commit: 058f3d316e86d1acdc957bc69aee85a27e0afc9c
      https://github.com/openssl/openssl/commit/058f3d316e86d1acdc957bc69aee85a27e0afc9c
  Author: Bernd Edlinger <[email protected]>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M crypto/evp/evp_lib.c
    M test/cmsapitest.c
    M test/recipes/80-test_cmsapi.t
    A test/recipes/80-test_cmsapi_data/cms_pwri_kek_NoIV.der

  Log Message:
  -----------
  Restore the check for missing IV param in evp_cipher_asn1_to_param_ex

STREAM ciphers (RC4) and WRAP MODE ciphers (CMS3DESwrap) do not have an IV
parameter value, all other ciphers need an IV value, previously the missing
IV param value was handled as an error condition.
The check that an IV value is there was accidentally removed for all ciphers.
This restores the check for all ciphers except RC4.

Fixes: 114d99b46bfb ("Fix incomplete checks for EVP_CIPHER_asn1_to_param")
Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Mounir Idrassi <[email protected]>
Merge-date: Thu Aug 27 15:07:58 2026
Merged-from: https://github.com/openssl/openssl/pull/32394
(cherry picked from commit 1671f994548a1a33246859ab6cc43200b1c65d87)


Compare: https://github.com/openssl/openssl/compare/3289551d989b...058f3d316e86

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/328955-058f3d%40github.com.