- 6bd1e15 Silence -Wformat-truncation warning in crypto/err/err.c by David Benjamin · 1 year, 8 months ago
- 23d6e4c Replace BIO_snprintf with snprintf within the library by David Benjamin · 1 year, 9 months ago
- 70be012 Use constant curve-specific groups whenever possible by David Benjamin · 2 years, 1 month ago
- 0f222e6 Clear some size_t truncations by David Benjamin · 1 year, 9 months ago
- 04c3d40 Remove CRYPTO_MUTEX from public headers by David Benjamin · 1 year, 10 months ago
- 825bec8 Remove variable expansion from CONF fuzzer by David Benjamin · 1 year, 10 months ago
- ece1f86 Re-add go:build ignore lines by David Benjamin · 1 year, 11 months ago
- bcecc7d Replace sort.Sort with sort.Slice by David Benjamin · 2 years ago
- 474ddf8 Cap the number of ECDSA and DSA sign iterations. by David Benjamin · 2 years, 1 month ago
- bab2f96 Revert go:build ignore lines by David Benjamin · 2 years, 1 month ago
- fc524c1 Make ERR and thread use system malloc. by Bob Beck · 2 years, 2 months ago
- 54b04fd Mark standalone Go scripts with go:build ignore by David Benjamin · 2 years, 2 months ago
- 029d0e7 Rewrite X.509 policy tree logic. by David Benjamin · 2 years, 3 months ago
- b7d6320 Replace OPENSSL_STATIC_ASSERT with static_assert. by David Benjamin · 2 years, 8 months ago
- 225e8d3 Use X509 certificate alias as friendlyName in PKCS12 by Alex Gaynor · 3 years, 1 month ago
- bdc35b6 Rewrite and tighten ASN1_INTEGER encoding and decoding. by David Benjamin · 3 years, 1 month ago
- 366e886 Deduplicate the rest of ASN1_INTEGER and ASN1_ENUMERATED. by David Benjamin · 3 years, 1 month ago
- 7198d11 Explicitly reject self-referential ech_outer_extensions. by David Benjamin · 3 years, 2 months ago
- f797570 Ignore duplicates in |X509_STORE_add_*| by Adam Langley · 3 years, 2 months ago
- 731d6cb Add ERR_set_error_data for compatibility. by David Benjamin · 3 years, 4 months ago
- 13c67c9 Enforce DER rules for BIT STRING values. by David Benjamin · 3 years, 5 months ago
- 491af10 Check for trailing data in extensions. by David Benjamin · 3 years, 5 months ago
- 18b6836 Update to draft-ietf-tls-esni-13. by David Benjamin · 3 years, 9 months ago
- 2d10c18 Fix i2v_GENERAL_NAME to not assume NUL terminated strings by David Benjamin · 3 years, 7 months ago
- ba423c9 Implement ClientHelloOuter handshakes. by David Benjamin · 3 years, 10 months ago
- 83a4993 Add most of an ECH client implementation. by David Benjamin · 3 years, 10 months ago
- 24545c5 Add a basic API to make ECHConfigs. by David Benjamin · 3 years, 10 months ago
- 3a036c7 Add SSL_ech_accepted API and ech_is_required alerts. by David Benjamin · 3 years, 10 months ago
- eec7f32 Use a placeholder for unknown errors in ERR_*_error_string. by David Benjamin · 4 years ago
- b571e77 Add experimental handshake hints API. by David Benjamin · 4 years ago
- 12a3e7e Check for invalid ALPN inputs in SSL_(CTX_)set_alpn_protos. by David Benjamin · 4 years ago
- 00e434d Add ECH server (draft-ietf-tls-esni-09). by Daniel McArdle · 4 years, 1 month ago
- d9ee55a Refactor HPKE API to include explicit length parameters. by Dan McArdle · 4 years ago
- c02c19e Honor SSL_TLSEXT_ERR_ALERT_FATAL in the ALPN callback. by David Benjamin · 4 years, 2 months ago
- 92de0b5 Reject bad ASN.1 templates with implicitly-tagged CHOICEs. by David Benjamin · 4 years, 4 months ago
- 51607f1 Implement draft-vvv-tls-alps-01. by Steven Valdez · 4 years, 8 months ago
- bc24805 Implement PSK variants of HPKE setup functions. by Daniel McArdle · 4 years, 7 months ago
- 74161f4 Enforce presence of ALPN when QUIC is in use. by Nick Harper · 4 years, 8 months ago
- 7d3a24d Fix the naming of alert error codes. by David Benjamin · 4 years, 8 months ago
- cac9392 Disallow TLS 1.3 compatibility mode in QUIC. by Nick Harper · 4 years, 11 months ago
- dd86e75 Check the X.509 version when parsing. by David Benjamin · 4 years, 9 months ago
- fd86eaa Fix x509v3_cache_extensions error-handling. by David Benjamin · 4 years, 9 months ago
- a27ed58 Add missing ERR_LIB_TRUST_TOKEN constants. by David Benjamin · 5 years ago
- 78987bb Implement DLEQ checks for Trust Token. by Steven Valdez · 5 years ago
- 538a124 Trust Token Implementation. by Steven Valdez · 5 years ago
- 72cff81 Require QUIC method with Transport Parameters and vice versa by Nick Harper · 5 years ago
- 0b710a3 Trust Token Key Generation. by Steven Valdez · 5 years ago
- 754d4c9 Fix client handling of 0-RTT rejects with cipher mismatch. by David Benjamin · 5 years ago
- f9cc26f Require handshake flights end at record boundaries. by David Benjamin · 5 years ago
- f8fcab9 Add a test for ERR_error_string_n. by David Benjamin · 5 years ago
- 35c1075 Give ERR_error_string_n a return value for convenience. by David Benjamin · 5 years ago
- 98e848a Add XOF compilation compatibility flags by Shelley Vohr · 6 years ago
- 9806ae0 Check the second ClientHello's PSK binder on resumption. by David Benjamin · 6 years ago
- 2c65707 Add EVP_PKEY support for X25519. by David Benjamin · 6 years ago
- 8728af4 Reject obviously invalid DSA parameters during signing. by David Benjamin · 6 years ago
- d7266ec Enforce key usage for RSA keys in TLS 1.2. by Jesse Selover · 6 years ago
- 6c1b376 Implement server support for delegated credentials. by Christopher Patton · 7 years ago
- 8285ccd Fix SSL_R_TOO_MUCH_READ_EARLY_DATA. by David Benjamin · 6 years ago
- 5ecfb10 Modernize OPENSSL_COMPILE_ASSERT, part 2. by David Benjamin · 6 years ago
- c8e0f90 Add an interface for QUIC integration. by Steven Valdez · 7 years ago
- 371305f Push an error on sigalg mismatch in X509_verify. by David Benjamin · 7 years ago
- 8c7c635 Support symbol prefixes by Joshua Liebow-Feeser · 7 years ago
- 681ff27 Flatten most of the crypto target. by David Benjamin · 7 years ago
- 1c2532f Fix error strings for SSL_R_TLS13_DOWNGRADE. by David Benjamin · 7 years ago
- 826ce15 Support OpenSSL APIs SSL[_CTX]_set1_sigalgs[_list]. by Adam Langley · 7 years ago
- 4732c54 Add ECDH_compute_key_fips inside the module. by Adam Langley · 7 years ago
- 0080d83 Implement the client side of certificate compression. by Adam Langley · 7 years ago
- 5267ef7 Reject unexpected application data in bidirectional shutdown. by David Benjamin · 7 years ago
- caf8ddd Add SSL_SESSION_set1_id. by David Benjamin · 7 years ago
- d12f2ba Tweak RSA errors for compatibility. by David Benjamin · 7 years ago
- 103ed08 Implement legacy OCSP APIs for libssl. by David Benjamin · 7 years ago
- 2e67153 Add PKCS12_create. by David Benjamin · 7 years ago
- bc2562e Treat PKCS#12 passwords as UTF-8. by David Benjamin · 7 years ago
- ae153bb Use new encoding functions in ASN1_mbstring_ncopy. by David Benjamin · 7 years ago
- 5d626b2 Add some more compatibility functions. by David Benjamin · 7 years ago
- ed188fd Enforce supported_versions in the second ServerHello. by David Benjamin · 7 years ago
- 3c37d0a Reland "Fix bssl client/server's error-handling." by David Benjamin · 7 years ago
- 0cdbc87 Revert "Fix bssl client/server's error-handling." by Steven Valdez · 7 years ago
- e7ca8a5 Fix bssl client/server's error-handling. by David Benjamin · 7 years ago
- c1c6eeb Check d is mostly-reduced in RSA_check_key. by David Benjamin · 7 years ago
- 2a19a17 Limit ASN.1 constructed types recursive definition depth by David Benjamin · 7 years ago
- fa65113 Push an error if custom private keys fail. by David Benjamin · 7 years ago
- 0ab3f0c Notice earlier if a server echoes the TLS 1.3 compatibility session ID. by David Benjamin · 7 years ago
- 36fcc4c Implement Token Binding by Nick Harper · 8 years ago
- f88242d SSL_export_keying_material should work in half-RTT. by David Benjamin · 7 years ago
- 650d8c3 Implement TLS 1.3 early exporters. by David Benjamin · 7 years ago
- 47b8f00 Reimplement OBJ_txt2obj and add a lower-level function. by David Benjamin · 7 years ago
- a838f9d Make ECDSA signing 10% faster and plug some timing leaks. by David Benjamin · 7 years ago
- e7c95d9 Run TLS 1.3 tests at all variants and fix bugs. by David Benjamin · 7 years ago
- b25a899 Add the ability to save and restore the error state. by David Benjamin · 7 years ago
- a65c252 Further simplify error queue flags. by David Benjamin · 7 years ago
- e1c3dad Error data is always a NUL-terminated malloced string. by David Benjamin · 7 years ago
- 808f832 Run the comment converter on libcrypto. by David Benjamin · 8 years ago
- f4ecc84 Prevent both early data and custom extensions from being accepted. by Steven Valdez · 8 years ago
- 5aaaa98 Detect WatchGuard's TLS 1.3 interference failure mode. by David Benjamin · 8 years ago
- b529253 Implement scrypt from RFC 7914. by David Benjamin · 8 years ago
- 2f3404b Enforce incrementing counter for TLS 1.2 AES-GCM. by Steven Valdez · 8 years ago
- 8ebc9ea Update BN_enhanced_miller_rabin_primality_test to enforce preconditions and accept BN_prime_checks. by Steven Valdez · 8 years ago
- 6fdea2a Move PKCS#7 functions into their own directory. by David Benjamin · 8 years ago
- de254b4 Enforce max_early_data_size on the server. by Alessandro Ghedini · 8 years ago