tree 212ed7880e08d21131bf058ddc633c2d6f6913cb
parent fda22fa7dbe9b841a2605ca78fbd32f2e3cb1a91
author David Benjamin <davidben@google.com> 1744044626 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1744663345 -0700

Add EVP_marshal_digest_algorithm_no_params

See https://boringssl-review.googlesource.com/c/boringssl/+/67088 for a
discussion of the long and sordid history here. It seems the default is
actually without NULL, but a bunch of use cases (primarily ones we care
about) require you to include the NULL due to historical mistakes.

We care about encoding digest AlgIds in:

- RSASSA-PKCS1-v1_5 DigestInfo: NULL should be included, though we
  don't use that function here.

- RSASSA-PSS and RSAES-OAEP AlgIds: NULL should be included. We don't
  use that function here, but we may in the future.

- PKCS#12: This is ambiguous, but I think the best behavior for now is
  to continue sending NULL. See comment added to that file.

- OCSP: I think this actually should omit the NULL, but we, OpenSSL, and
  Go all include it, so I've included it for now.

- PKCS#7 and (if we implement it) CMS: This should omit the NULL. We
  currently don't use this function in our PKCS#7 implementation.

Although the default probably should be to omit it, we seem to want to
include it in almost all our current callers, I've added a no_params
variant for the new behavior for now. In the future we can reevaluate
this and, if desired:

- Add a with_null API
- Make the unsuffixed one into the no_params one
  (backwards-incompatible)
- Retire the no_params one

Fixed: 42290589
Change-Id: Icc62f9af8cddfbdb5317b3a0b0fb2bf46ff74408
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/78449
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>