hidden mlkem.h: add comment to #endif

#ifdef out the inclusion of openssl/mlkem.h for now

discussed with beck and jsing

Add ML-KEM 1024 from BoringSSL

Changes include conversion from C++, basic KNF, then adaptation to
use our sha3 functions for sha3 and shake instead of the BorinSSL
version. This Adds units tests to

Add ML-KEM 1024 from BoringSSL

Changes include conversion from C++, basic KNF, then adaptation to
use our sha3 functions for sha3 and shake instead of the BorinSSL
version. This Adds units tests to run against BoringSSL and NIST test
vectors.

The future public API is the same as Boring's - but is not yet exposed
pending making bytestring.h public (which will happen separately) and
a minor bump

Currently this will just ensure we build and run regress.

ok tb@ to get it into the tree and massage from there.

show more ...

Add ML-KEM 768 from BoringSSL

Changes include conversion from C++, basic KNF, then adaptation to
use our sha3 functions for sha3 and shake instead of the BorinSSL
version. This Adds units tests to r

Add ML-KEM 768 from BoringSSL

Changes include conversion from C++, basic KNF, then adaptation to
use our sha3 functions for sha3 and shake instead of the BorinSSL
version. This Adds units tests to run against BoringSSL and NIST test
vectors.

The future public API is the same as Boring's - but is not yet exposed
pending making bytesring.h public (which will happen separately) and
a minor bump

Currently this will just ensure we build and run regress.

ok tb@ to get it into the tree and massage from there.

show more ...

Revert marking EC_GROUP_method_of() and EC_METHOD_get_field_type() unused

breaks tree as noted by krw

Mark EC_GROUP_method_of() and EC_METHOD_get_field_type() as unused

ok jsing

Make X509at_* API internal

The only consumer, yara, has been adjusted. It will be some more work
to remove this idiocy internally, but at least we will no longer have
to care about external consumer

Make X509at_* API internal

The only consumer, yara, has been adjusted. It will be some more work
to remove this idiocy internally, but at least we will no longer have
to care about external consumers.

ok beck jsing

show more ...

Zap HMAC_Init

Long deprecated, last users have been fixed.

ok beck jsing

Nuke the whrlpool (named after the galaxy) from orbit

It's just gross. Only used by a popular disk encryption utility on an
all-too-popular OS one or two decades back.

ok beck jsing

Remove DES_enc_{read,write} and DES_rw_mode

Unfortunately we'll probably never be able to get rid of DES entirely.
One part of it that is old enough to be a grandparent can go, though.

ok beck jsing

Garbage collec UI_UTIL remnants

ok beck jsing

Remove EVP_PKEY.*attr* API

I ranted enough about this recently. PKCS#12. Microsoft. 'nuff said.

ok beck jsing

Remove X509_REQ_{set,get}_extension_nids()

LibreSSL no longer supports non-standard OIDs for use in the extensions
attribute of CSRs. The API that enabled that (and nobody used of course)
can now go

Remove X509_REQ_{set,get}_extension_nids()

LibreSSL no longer supports non-standard OIDs for use in the extensions
attribute of CSRs. The API that enabled that (and nobody used of course)
can now go.

ok beck jsing

show more ...

Remove X509_check_trust() and some related defines

Someone thought it would be a good idea to append non-standard trust
information to the certs in the trust store. This API is used to
inspect that

Remove X509_check_trust() and some related defines

Someone thought it would be a good idea to append non-standard trust
information to the certs in the trust store. This API is used to
inspect that depending on the intended purpose of the cert. Only
M2Crypto thought it necessary to expose this. It was adjusted.

ok beck jsing

show more ...

Remove ERR_add_{,v}data()

Another unused bit of legacy API...

ok beck jsing

Make some more x509 conf stuff internal

This internalizes a particularly scary layer of conf used for X.509
extensions. Again unused public API...

ok beck jsing

Retire X509V3_set_conf_lhash()

Thankfully sthen removed the out-of-support PHP versions 7.4 and 8.0,
which were the last users of this API, which in turn permitted much of
this conf rampage. Now the

Retire X509V3_set_conf_lhash()

Thankfully sthen removed the out-of-support PHP versions 7.4 and 8.0,
which were the last users of this API, which in turn permitted much of
this conf rampage. Now the stub can join its guts in the attic.

ok beck jsing

show more ...

Retire X509V3_EXT_{,CRL_,REQ_}add_conf()

Fortunately all projects who want to configure their extensions using
a dangerous string DSL/API figured out the fact that one was supposed to
be using the n

Retire X509V3_EXT_{,CRL_,REQ_}add_conf()

Fortunately all projects who want to configure their extensions using
a dangerous string DSL/API figured out the fact that one was supposed to
be using the nconf version of these (the hint is the 'n', as in new).

ok beck jsing

show more ...

Remove OPENSSL_load_builtin_modules

This became obsolete with the automatic library initialization. Now it
is time for it to become an internal API.

ok beck jsing

Unexport CONF_set_nconf()

This translation device from old to new conf guts will need to stay
for a while. However, it's only needed internally.

ok beck jsing

Remove more CONF_* functions that are no longer needed

This is the next layer of unused cruft that can now go. The code lovingly
called it 'the "CONF classic" functions'. No tear was shed. Don't wor

Remove more CONF_* functions that are no longer needed

This is the next layer of unused cruft that can now go. The code lovingly
called it 'the "CONF classic" functions'. No tear was shed. Don't worry,
we still have the "New CONF" functions!

ok beck jsing

show more ...

Unexport NCONF_default

The only project I'm aware of that ever used this was rust-openssl
and they did so for no good reason. So remove this API, the crate's
code is already adjusted accordingly.

o

Unexport NCONF_default

The only project I'm aware of that ever used this was rust-openssl
and they did so for no good reason. So remove this API, the crate's
code is already adjusted accordingly.

ok beck jsing

show more ...

Inline NCONF_free_data in its only user

ok beck jsing

Remove NCONF_WIN32

Undocumented and entirely unused. Gets rid of a big, modifiable, global
table.

ok beck jsing

Retire conf_api.h and the API therein

This makes the _CONF_* layer of the conf module internal and gets rid
of the entirely unused conf_api.h.

ok beck jsing