Re: Using certificates and keys from a list

On Mon, Apr 06, 2026 at 11:12:20PM -0700, Doug Hardie wrote:

> That is some interesting code.  Quite clever.  Reminds me of some code a =
contractor wrote for the USAF (assembly language):
>=20
> 	xor a, b		bet you can't figure out what this does.
> 	xor b, a
> 	xor a, b

This is clearly a swap of two registers a<->b without touching any other
registers.

> This was way before wikipedia.  I had the contractor rewrite the
> comment to explain what it did.

Clearly intended for readers adept in Z_2 module [sic] arithmetic.

    a -> (a + b)
    b -> b + (a + b) =3D a
    a -> (a + b) + b =3D a

> Thanks to Viktor and Victor, I now have the application working in a
> test environment.  Later this week I'll generate all the needed
> certificates and put it into production.

One limitation may be worth keeping in mind.  You finally prodded me
into refactoring and simplifying the Postfix SNI code that uses those
functions, and in particular, in the SNI code path, SSL_use_cert_key(3),
rather than SSL_CTX_use_cert_and_key(3).

Now that OpenSSL 3.5 and later support PQC signature algorithms, on a
whim I tested SNI with ML-DSA-44 as one of the SNI-selected keys.
Sadly, that ran into a null-pointer-exception introduced in 3.2, but
mostly latent until 3.5, unless one loads a provider that adds novel
asymmetric signature algorithms in 3.2=E2=80=933.4.

There are now open pull requests to fix the bug, in 3.3 and 3.4 (3.2 is
EOL), and in 3.5 through "master".  These should be merged shortly.  In
the meantime, if you're using 3.5 or 3.6, best to be careful with
SSL_use_cert_and_key(3), and use it only with:

    - RSA
    - ECDSA
    - DSA (obsolete)
    - EdDSA (Ed25519 or Ed448)

Once 3.5 and 3.6 are updated, it will become safe to use this also with
ML-DSA (-44, -65 and -87).  This should be fixed in 4.0-dev before the
final 4.0 release is shipped.

Thanks for prodding me into taking the code for another spin.

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/adSlq3eVg8kNvtyM%40chardros.imrryr.org.