BoringSSL: Don't support parameterless DSA keys in SPKIs AND Set an EVP_PKEY's algorithm and data together by nebeid · Pull Request #3057 · aws/aws-lc

nebeid · 2026-03-02T15:59:09Z

Note: to be rebased on #3056.

Description of changes:

BoringSSL commit google/boringssl@`1bc58a3`: "Don't support parameterless DSA keys in SPKIs"

Changes (2 files):

crypto/evp_extra/p_dsa_asn1.c — Removed the CBS_len(params) == 0 branch in dsa_pub_decode that created an empty DSA_new() without parameters. Parameterless DSA keys in
SubjectPublicKeyInfo will no longer parse. This does not impact TLS, where we have never supported DSA.
crypto/evp_extra/evp_tests.txt — Updated the DSA-1024-SPKI-No-Params test to expect DECODE_ERROR instead of successful parsing.

BoringSSL commit google/boringssl@`b0ef87e`: "Set an EVP_PKEY's algorithm and data together"

Changes (8 files):

crypto/fipsmodule/evp/evp.c — Replaced evp_pkey_set_method with evp_pkey_set0(pkey, method, pkey_data) which sets method, type, and data atomically. Removed free_it from
pkey_set_type (uses evp_pkey_set0(pkey, NULL, NULL) instead). EVP_PKEY_new_raw_* functions set method via evp_pkey_set0 before calling callbacks.
- In evp_pkey_set0 implementation: BoringSSL doesn't have the type field — it derives the type from ameth at query time via EVP_PKEY_id(). AWS-LC stores type as a separate field
  that must be kept in sync.
crypto/evp_extra/internal.h — Updated declaration
crypto/evp_extra/evp_asn1.c — Moved pub_decode/priv_decode NULL checks earlier; set method via evp_pkey_set0 before calling decode callbacks
crypto/evp_extra/p_dh_asn1.c, crypto/evp_extra/p_x25519.c, crypto/fipsmodule/evp/p_ed25519.c — Use evp_pkey_set0 in keygen
crypto/fipsmodule/evp/p_kem.c, crypto/fipsmodule/evp/p_pqdsa.c — Create key first, then evp_pkey_set0(pkey, method, key) together

Adaptations for AWS-LC:

ed25519/x25519 set_priv_raw/set_pub_raw callbacks are shared with ed25519ph (AWS-LC specific), so the method must be set by the caller before invoking the callback, not by the
callback itself.

Details

crypto/fipsmodule/evp/evp.c:

EVP_PKEY_new_raw_private_key — calls evp_pkey_set0(ret, method, NULL) then method->set_priv_raw(...)
EVP_PKEY_new_raw_public_key — calls evp_pkey_set0(ret, method, NULL) then method->set_pub_raw(...)

crypto/evp_extra/evp_asn1.c:

EVP_parse_public_key — calls evp_pkey_set0(ret, method, NULL) then method->pub_decode(...)
EVP_parse_private_key — calls evp_pkey_set0(ret, method, NULL) then method->priv_decode(...)

In BoringSSL's version, all four of these just called method->callback(ret, ...) directly (no method pre-setting), and the callbacks themselves called evp_pkey_set0. We couldn't do that because the ed25519 callbacks are shared with ed25519ph.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

github-actions

clang-tidy made some suggestions

github-actions · 2026-03-02T16:06:37Z

crypto/fipsmodule/evp/evp.c

@@ -236,7 +236,11 @@ int EVP_read_pw_string_min(char *buf, int min_length, int length,
 int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from) {
  SET_DIT_AUTO_RESET;


warning: use of undeclared identifier 'SET_DIT_AUTO_RESET' [clang-diagnostic-error]

SET_DIT_AUTO_RESET; ^

github-actions · 2026-03-02T16:06:37Z

crypto/fipsmodule/evp/evp.c

@@ -441,11 +447,13 @@ int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key) {

 int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key) {
  SET_DIT_AUTO_RESET;


warning: use of undeclared identifier 'SET_DIT_AUTO_RESET' [clang-diagnostic-error]

SET_DIT_AUTO_RESET; ^

github-actions · 2026-03-02T16:06:37Z

crypto/fipsmodule/evp/evp.c

@@ -477,11 +485,13 @@ int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key) {

 int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key) {
  SET_DIT_AUTO_RESET;


warning: use of undeclared identifier 'SET_DIT_AUTO_RESET' [clang-diagnostic-error]

SET_DIT_AUTO_RESET; ^

github-actions · 2026-03-02T16:06:37Z

crypto/fipsmodule/evp/p_ed25519.c

    key->has_private = 1;
-    OPENSSL_free(pkey->pkey.ptr);
-    pkey->pkey.ptr = key;
+    evp_pkey_set0(pkey, &ed25519_asn1_meth, key);


warning: call to undeclared function 'evp_pkey_set0'; ISO C99 and later do not support implicit function declarations [clang-diagnostic-implicit-function-declaration]

evp_pkey_set0(pkey, &ed25519_asn1_meth, key); ^

github-actions · 2026-03-02T16:06:37Z

crypto/fipsmodule/evp/p_ed25519.c

    key->has_private = 1;
-    OPENSSL_free(pkey->pkey.ptr);
-    pkey->pkey.ptr = key;
+    evp_pkey_set0(pkey, &ed25519_asn1_meth, key);


warning: use of undeclared identifier 'ed25519_asn1_meth' [clang-diagnostic-error]

evp_pkey_set0(pkey, &ed25519_asn1_meth, key); ^

codecov-commenter · 2026-03-02T16:56:34Z

Codecov Report

❌ Patch coverage is 95.34884% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.01%. Comparing base (1a308a7) to head (384a59b).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
crypto/evp_extra/p_x25519.c	0.00%	1 Missing ⚠️
crypto/fipsmodule/evp/p_ed25519.c	50.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3057   +/-   ##
=======================================
  Coverage   78.00%   78.01%           
=======================================
  Files         689      689           
  Lines      122405   122395   -10     
  Branches    17083    17082    -1     
=======================================
+ Hits        95482    95486    +4     
+ Misses      26026    26012   -14     
  Partials      897      897

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

torben-hansen · 2026-03-23T17:24:05Z

crypto/evp_extra/p_dsa_asn1.c

-      OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
-      goto err;
-    }
+  // See RFC 3279, section 2.3.2. Although RFC 3279 allows DSA parameters to be


OK, but note it might cause test to fail in some packages if they include such keys. Maybe this could flush them out.

torben-hansen · 2026-03-23T17:52:30Z

crypto/fipsmodule/evp/p_ed25519.c

    key->has_private = 1;
-    OPENSSL_free(pkey->pkey.ptr);
-    pkey->pkey.ptr = key;
+    evp_pkey_set0(pkey, &ed25519_asn1_meth, key);


Need to include the proper header files declaring both functions.

torben-hansen · 2026-03-23T18:13:46Z

crypto/evp_extra/p_dh_asn1.c

-  evp_pkey_set_method(pkey, &dh_asn1_meth);
-  pkey->pkey.dh = key;
-  return key != NULL;
+  if (key == NULL) {


These could use GUARD_PTR

Cherry-picked from BoringSSL 5b7171f2da10d5dad52d0a2e4426fbc71d4ff146. EVP_PKEY_{assign,set1}_FOO would check for NULL, return an error, but still leave the EVP_PKEY assigned to that type on failure. Check for NULL first, so that we don't leave it in that state. Adapted for AWS-LC: - RSA/DSA/EC_KEY assign functions are in crypto/fipsmodule/evp/evp.c (not split out into separate p_*_asn1.cc files as in BoringSSL) - DH assign function is in crypto/evp_extra/p_dh_asn1.c - Added NoHalfEmptyKeys test (AWS-LC did not have the BoringSSL equivalent)

Cherry-picked from BoringSSL 1bc58a303ef577f4dc5c5ed0612e9766c85dce8c. RFC 3279 allows DSA parameters to be omitted, in which case they are picked up from the issuer in an X.509 chain (which we do not support), or implicitly from some unspecified out-of-band source. Parameterless DSA keys in SubjectPublicKeyInfo will no longer parse. This does not impact TLS, where we have never supported DSA.

Cherry-picked from BoringSSL b0ef87e5e3ba9a4f4b5bba4434f6f2e630507b48. Replace evp_pkey_set_method with evp_pkey_set0, which sets both the method and key data together, avoiding half-initialized EVP_PKEY states. Adapted for AWS-LC: - RSA/DSA/EC_KEY/DH assign functions and EVP_PKEY_new_raw_* are in different files than BoringSSL (FIPS module vs evp_extra) - AWS-LC has a pkey.type field that must also be set (BoringSSL derives type from ameth) - ed25519/x25519 set_priv_raw/set_pub_raw callbacks are shared with ed25519ph (AWS-LC specific), so callers (EVP_PKEY_new_raw_*, evp_asn1 decode) set the method via evp_pkey_set0 before invoking the callback, rather than having the callback set it - KEM and PQDSA (AWS-LC specific) updated to create key first, then call evp_pkey_set0 with method+data together

nebeid temporarily deployed to auto-approve March 2, 2026 15:59 — with GitHub Actions Inactive

nebeid temporarily deployed to auto-approve March 2, 2026 16:00 — with GitHub Actions Inactive

github-actions bot reviewed Mar 2, 2026

View reviewed changes

nebeid changed the title ~~Bssl cherry pick b0ef87e5~~ Set an EVP_PKEY's algorithm and data together Mar 2, 2026

nebeid requested a review from skmcgrail March 2, 2026 16:45

nebeid marked this pull request as ready for review March 2, 2026 16:45

nebeid requested a review from a team as a code owner March 2, 2026 16:45

nebeid force-pushed the bssl-cherry-pick-b0ef87e5 branch from d8c6c0e to b09ec22 Compare March 2, 2026 20:56

nebeid temporarily deployed to auto-approve March 2, 2026 20:57 — with GitHub Actions Inactive

nebeid changed the title ~~Set an EVP_PKEY's algorithm and data together~~ BoringSSL: Don't support parameterless DSA keys in SPKIs AND Set an EVP_PKEY's algorithm and data together Mar 2, 2026

nebeid temporarily deployed to auto-approve March 2, 2026 22:00 — with GitHub Actions Inactive

justsmth self-requested a review March 4, 2026 15:14

sgmenda self-assigned this Mar 6, 2026

sgmenda temporarily deployed to auto-approve March 6, 2026 18:14 — with GitHub Actions Inactive

sgmenda had a problem deploying to auto-approve March 6, 2026 18:14 — with GitHub Actions Error

nebeid requested a review from torben-hansen March 16, 2026 18:28

torben-hansen previously approved these changes Mar 23, 2026

View reviewed changes

nebeid dismissed torben-hansen’s stale review via 7322bf2 March 23, 2026 20:49

nebeid force-pushed the bssl-cherry-pick-b0ef87e5 branch from a9e2811 to 7322bf2 Compare March 23, 2026 20:49

nebeid had a problem deploying to auto-approve March 23, 2026 20:50 — with GitHub Actions Error

davidben and others added 4 commits March 23, 2026 16:57

Update build files in generated-src

c33ff43

nebeid force-pushed the bssl-cherry-pick-b0ef87e5 branch from 7322bf2 to c33ff43 Compare March 23, 2026 20:59

nebeid requested a review from torben-hansen March 23, 2026 21:00

nebeid temporarily deployed to auto-approve March 23, 2026 21:01 — with GitHub Actions Inactive

Merge branch 'main' into bssl-cherry-pick-b0ef87e5

384a59b

nebeid temporarily deployed to auto-approve March 27, 2026 12:16 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BoringSSL: Don't support parameterless DSA keys in SPKIs AND Set an EVP_PKEY's algorithm and data together#3057

BoringSSL: Don't support parameterless DSA keys in SPKIs AND Set an EVP_PKEY's algorithm and data together#3057
nebeid wants to merge 5 commits intoaws:mainfrom
nebeid:bssl-cherry-pick-b0ef87e5

nebeid commented Mar 2, 2026 •

edited

Loading

Uh oh!

github-actions bot left a comment

Uh oh!

github-actions bot Mar 2, 2026

Uh oh!

github-actions bot Mar 2, 2026

Uh oh!

github-actions bot Mar 2, 2026

Uh oh!

github-actions bot Mar 2, 2026

Uh oh!

github-actions bot Mar 2, 2026

Uh oh!

codecov-commenter commented Mar 2, 2026 •

edited

Loading

Uh oh!

torben-hansen Mar 23, 2026

Uh oh!

torben-hansen Mar 23, 2026

Uh oh!

torben-hansen Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		@@ -236,7 +236,11 @@ int EVP_read_pw_string_min(char *buf, int min_length, int length,
		int EVP_PKEY_copy_parameters(EVP_PKEY to, const EVP_PKEY from) {
		SET_DIT_AUTO_RESET;

		@@ -441,11 +447,13 @@ int EVP_PKEY_set1_RSA(EVP_PKEY pkey, RSA key) {

		int EVP_PKEY_assign_RSA(EVP_PKEY pkey, RSA key) {
		SET_DIT_AUTO_RESET;

		@@ -477,11 +485,13 @@ int EVP_PKEY_set1_DSA(EVP_PKEY pkey, DSA key) {

		int EVP_PKEY_assign_DSA(EVP_PKEY pkey, DSA key) {
		SET_DIT_AUTO_RESET;

Conversation

nebeid commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of changes:

BoringSSL commit google/boringssl@1bc58a3: "Don't support parameterless DSA keys in SPKIs"

BoringSSL commit google/boringssl@b0ef87e: "Set an EVP_PKEY's algorithm and data together"

Adaptations for AWS-LC:

Details

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

torben-hansen Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

torben-hansen Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

torben-hansen Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nebeid commented Mar 2, 2026 •

edited

Loading

BoringSSL commit google/boringssl@`1bc58a3`: "Don't support parameterless DSA keys in SPKIs"

BoringSSL commit google/boringssl@`b0ef87e`: "Set an EVP_PKEY's algorithm and data together"

codecov-commenter commented Mar 2, 2026 •

edited

Loading