Merge branch 'main' into EVP_PKEY_CTX_set_cb

.github/workflows/actions-ci.yml

@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@v3
       - name: Sanity Test Run
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get install ninja-build
           cmake -GNinja -Btest_build_dir
           ninja -C test_build_dir run_tests

.github/workflows/aws-lc-rs.yml

@@ -32,7 +32,7 @@ jobs:
           args: rust-script
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc clang ninja-build golang
       - name: Remove aws-lc submodule from crate directory
         working-directory: ./aws-lc-rs/aws-lc-sys

.github/workflows/codecov-ci.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Install lcov
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install lcov
       - uses: actions/checkout@v4
       - name: Run Code Coverage Build

.github/workflows/cross-test.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: PPC64 Build/Test
@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: PPC32 Build/Test
@@ -36,7 +36,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: PPC32 Build/Test
@@ -47,7 +47,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: PPC64LE Build/Test
@@ -58,7 +58,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: RISC-V 64 Build/Test
@@ -76,7 +76,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: armv6 Build/Test
@@ -86,7 +86,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: loongarch64 Build/Test
@@ -97,7 +97,7 @@ jobs:
     steps:
       - name: Install qemu
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y install qemu-user qemu-user-binfmt
       - uses: actions/checkout@v4
       - name: s390x Build/Test

.github/workflows/go.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Install OS Dependencies
         run: |
           which go
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build make
           sudo rm -rf /usr/local/go
           sudo rm /usr/bin/go

.github/workflows/integrations.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make
       - uses: actions/checkout@v3
       - name: Run integration build
@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update && sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang autoconf-archive libcmocka0 libcmocka-dev procps iproute2 build-essential git pkg-config gcc libtool automake libssl-dev uthash-dev autoconf doxygen libjson-c-dev libini-config-dev libcurl4-openssl-dev uuid-dev libltdl-dev libusb-1.0-0-dev libftdi-dev libglib2.0-dev pandoc
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none && sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang autoconf-archive libcmocka0 libcmocka-dev procps iproute2 build-essential git pkg-config gcc libtool automake libssl-dev uthash-dev autoconf doxygen libjson-c-dev libini-config-dev libcurl4-openssl-dev uuid-dev libltdl-dev libusb-1.0-0-dev libftdi-dev libglib2.0-dev pandoc
       - uses: actions/checkout@v3
       - name: Run integration build
         run: |
@@ -45,7 +45,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          apt-get update
+          apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           apt-get -y --no-install-recommends install cmake gcc g++ ninja-build golang make python3 python3-sphinx autoconf libtool pkg-config git libc++-dev python3-six
       - uses: actions/checkout@v3
       - name: Run integration build
@@ -57,7 +57,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make libpcap-dev binutils-dev
       - uses: actions/checkout@v3
       - name: Run integration build
@@ -69,7 +69,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make
       - uses: actions/checkout@v3
       - name: Run trousers build
@@ -81,7 +81,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make
       - uses: actions/checkout@v3
       - name: Run ntp build
@@ -93,7 +93,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update && sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make autoconf pkg-config openssl
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none && sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make autoconf pkg-config openssl
       - uses: actions/checkout@v3
       - name: Run integration build
         run: |
@@ -105,7 +105,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make
       - uses: actions/checkout@v3
       - name: Build AWS-LC, build python, run tests
@@ -127,7 +127,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make
       - uses: actions/checkout@v3
       - name: Build AWS-LC, build python, run tests
@@ -143,7 +143,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make
       - uses: actions/checkout@v3
       - name: Build AWS-LC, build openldap, run tests
@@ -155,7 +155,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install cmake gcc ninja-build golang make python3 python3-pytest autoconf pkg-config libcmocka-dev liburcu-dev libuv1-dev libnghttp2-dev libcap-dev libprotobuf-c-dev protobuf-c-compiler libfstrm-dev libjemalloc-dev
       - uses: actions/checkout@v3
       - name: Run bind9 build
@@ -167,7 +167,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install \
           cmake gcc ninja-build golang make gperf bison flex autogen autoconf \
           pkg-config libtool gettext libgmp-dev libsystemd-dev
@@ -181,7 +181,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install \
           cmake gcc ninja-build golang libnl-3-dev libnl-genl-3-dev \
           libcap-ng-dev liblz4-dev liblzo2-dev libpam-dev libcmocka-dev \
@@ -196,7 +196,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install \
           cmake gcc ninja-build golang
       - uses: actions/checkout@v4
@@ -209,7 +209,7 @@ jobs:
     steps:
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install \
           curl gnupg build-essential lcov wget python3-pip cmake gcc ninja-build golang
           sudo pip3 install gcovr

.github/workflows/opensslcomparison.yml

@@ -15,7 +15,7 @@ jobs:
 
       - name: Install OS Dependencies
         run: |
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get -y --no-install-recommends install \
             cmake gcc ninja-build golang make autoconf pkg-config openssl
 

.github/workflows/windows-alt.yml

@@ -164,14 +164,14 @@ jobs:
       - name: Install Tools
         run: |
           set -ex
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get install --assume-yes --no-install-recommends  software-properties-common
           sudo add-apt-repository --yes ppa:longsleep/golang-backports
           sudo dpkg --add-architecture i386
           sudo mkdir -pm755 /etc/apt/keyrings
           sudo wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key
           sudo wget -NP /etc/apt/sources.list.d/ https://dl.winehq.org/wine-builds/ubuntu/dists/jammy/winehq-jammy.sources
-          sudo apt-get update
+          sudo apt-get update -o Acquire::Languages=none -o Acquire::Translation=none
           sudo apt-get install --assume-yes --no-install-recommends build-essential cmake golang-go nasm clang wget mingw-w64
           sudo apt-get install --assume-yes --install-recommends winehq-stable wine-binfmt
           sudo update-binfmts --display

crypto/fipsmodule/hmac/hmac.c

@@ -122,9 +122,14 @@ struct hmac_methods_st {
                         HASH_NAME##_has_blocksize_not_divisible_by_eight_t)   \
   OPENSSL_STATIC_ASSERT(HASH_CBLOCK <= EVP_MAX_MD_BLOCK_SIZE,                 \
                         HASH_NAME##_has_overlarge_blocksize_t)                \
-  OPENSSL_STATIC_ASSERT(                                                      \
-      sizeof(HASH_CTX) <= sizeof(union md_ctx_union),                         \
-      HASH_NAME##_has_overlarge_context_t)
+  OPENSSL_STATIC_ASSERT(HMAC_##HASH_NAME##_PRECOMPUTED_KEY_SIZE ==            \
+                            2 * HASH_NAME##_CHAINING_LENGTH,                  \
+                        HASH_NAME##_has_incorrect_precomputed_key_size)       \
+  OPENSSL_STATIC_ASSERT(HMAC_##HASH_NAME##_PRECOMPUTED_KEY_SIZE <=            \
+                            HMAC_MAX_PRECOMPUTED_KEY_SIZE,                    \
+                        HASH_NAME##_has_too_large_precomputed_key_size)       \
+  OPENSSL_STATIC_ASSERT(sizeof(HASH_CTX) <= sizeof(union md_ctx_union),       \
+                        HASH_NAME##_has_overlarge_context_t)
 
 // The maximum number of HMAC implementations
 #define HMAC_METHOD_MAX 8

crypto/hmac_extra/hmac_test.cc

@@ -91,6 +91,27 @@ static const EVP_MD *GetDigest(const std::string &name) {
   return nullptr;
 }
 
+static const size_t GetPrecomputedKeySize(const std::string &name) {
+  if (name == "MD5") {
+    return HMAC_MD5_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA1") {
+    return HMAC_SHA1_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA224") {
+    return HMAC_SHA224_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA256") {
+    return HMAC_SHA256_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA384") {
+    return HMAC_SHA384_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA512") {
+    return HMAC_SHA512_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA512/224") {
+    return HMAC_SHA512_224_PRECOMPUTED_KEY_SIZE;
+  } else if (name == "SHA512/256") {
+    return HMAC_SHA512_256_PRECOMPUTED_KEY_SIZE;
+  }
+  return 0;
+}
+
 static void RunHMACTestEVP(const std::vector<uint8_t> &key,
                            const std::vector<uint8_t> &msg,
                            const std::vector<uint8_t> &tag, const EVP_MD *md) {
@@ -252,10 +273,12 @@ TEST(HMACTest, TestVectors) {
 
     // Get the precomputed key length for later use
     // And test the precomputed key size is at most HMAC_MAX_PRECOMPUTED_KEY_SIZE
+    // and is equal to HMAC_xxx_PRECOMPUTED_KEY_SIZE, where xxx is the digest name
     ASSERT_TRUE(HMAC_set_precomputed_key_export(ctx.get()));
     size_t precomputed_key_len;
     HMAC_get_precomputed_key(ctx.get(), nullptr, &precomputed_key_len);
     ASSERT_LE(precomputed_key_len, (size_t) HMAC_MAX_PRECOMPUTED_KEY_SIZE);
+    ASSERT_EQ(GetPrecomputedKeySize(digest_str), precomputed_key_len);
 
     // Test that at this point, the context cannot be used with HMAC_Update
     ASSERT_FALSE(HMAC_Update(ctx.get(), input.data(), input.size()));

crypto/kyber/pqcrystals_kyber_ref_common/verify.c

@@ -39,9 +39,6 @@ int verify(const uint8_t *a, const uint8_t *b, size_t len)
 **************************************************/
 void cmov(uint8_t *r, const uint8_t *x, size_t len, uint8_t b)
 {
-  size_t i;
-
-  b = -b;
-  for(i=0;i<len;i++)
-    r[i] ^= b & (r[i] ^ x[i]);
+  uint8_t mask = constant_time_is_zero_8(b);
+  constant_time_select_array_8(r, r, (uint8_t*)x, mask, len);
 }

crypto/ml_kem/ml_kem_ipd_ref_common/verify.c

@@ -2,6 +2,8 @@
 #include <stdint.h>
 #include "verify.h"
 
+#include "../../internal.h"
+
 /*************************************************
 * Name:        verify
 *
@@ -39,9 +41,6 @@ int verify(const uint8_t *a, const uint8_t *b, size_t len)
 **************************************************/
 void cmov(uint8_t *r, const uint8_t *x, size_t len, uint8_t b)
 {
-  size_t i;
-
-  b = -b;
-  for(i=0;i<len;i++)
-    r[i] ^= b & (r[i] ^ x[i]);
+  uint8_t mask = constant_time_is_zero_8(b);
+  constant_time_select_array_8(r, r, (uint8_t*)x, mask, len);
 }