summaryrefslogtreecommitdiffstats
path: root/CHANGES.md
diff options
context:
space:
mode:
authorRichard Levitte <levitte@openssl.org>2020-03-21 06:21:26 +0100
committerRichard Levitte <levitte@openssl.org>2020-03-25 17:01:10 +0100
commitacb90ba8ffe6a27f625607760e82842673eb9378 (patch)
treee2960e7bf66bf703ec58c26942462a1cbf27ed7b /CHANGES.md
parentEVP: Add EVP_PKEY_set_type_by_keymgmt() and use it (diff)
downloadopenssl-acb90ba8ffe6a27f625607760e82842673eb9378.tar.xz
openssl-acb90ba8ffe6a27f625607760e82842673eb9378.zip
EVP: Downgrade keys rather than upgrade
Upgrading EVP_PKEYs from containing legacy keys to containing provider side keys proved to be risky, with a number of unpleasant corner cases, and with functions like EVP_PKEY_get0_DSA() failing unexpectedly. We therefore change course, and instead of upgrading legacy internal keys to provider side internal keys, we downgrade provider side internal keys to legacy ones. To be able to do this, we add |import_from| and make it a callback function designed for evp_keymgmt_export(). This means that evp_pkey_upgrade_to_provider() is replaced with evp_pkey_downgrade(). EVP_PKEY_copy_parameters() is the most deeply affected function of this change. Fixes #11366 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11375)
Diffstat (limited to 'CHANGES.md')
-rw-r--r--CHANGES.md6
1 files changed, 6 insertions, 0 deletions
diff --git a/CHANGES.md b/CHANGES.md
index ba2569bf62..82c186a6cd 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,6 +24,12 @@ OpenSSL 3.0
### Changes between 1.1.1 and 3.0 [xx XXX xxxx] ###
+ * EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH(), and
+ EVP_PKEY_get0_EC_KEY() can now handle EVP_PKEYs with provider side
+ internal keys, if they correspond to one of those built in types.
+
+ *Richard Levitte*
+
* Added EVP_PKEY_set_type_by_keymgmt(), to initialise an EVP_PKEY to
contain a provider side internal key.