vendor/openssl/3.5.5

10 files changed, 103 insertions, 15 deletions

diff --git a/doc/man7/EVP_PKEY-ML-DSA.pod b/doc/man7/EVP_PKEY-ML-DSA.pod
index 3948fe6a5a45..e87053b0a183 100644
--- a/doc/man7/EVP_PKEY-ML-DSA.pod
+++ b/doc/man7/EVP_PKEY-ML-DSA.pod
@@ -19,7 +19,7 @@ and the private key I<priv>.
 Each of the different key types has an associated security category.
 This value is one of 2, 3 or 5 for key types B<ML-DSA-44>, B<ML-DSA-65>
 and B<ML-DSA-87> respectively, which correspond to security strengths of
-128, 192 and 256 repsectively.
+128, 192 and 256 respectively.
 
 =head2 Keygen Parameters
 
diff --git a/doc/man7/EVP_PKEY-ML-KEM.pod b/doc/man7/EVP_PKEY-ML-KEM.pod
index ea9a5f0b4119..be12a50ccff8 100644
--- a/doc/man7/EVP_PKEY-ML-KEM.pod
+++ b/doc/man7/EVP_PKEY-ML-KEM.pod
@@ -110,7 +110,7 @@ configuration options programmatically.
 
 =item C<ml-kem.import_pct_type> (B<OSSL_PKEY_PARAM_ML_KEM_IMPORT_PCT_TYPE>) <UTF8 string>
 
-When an B<ML-KEM> key is imported as an explict FIPS 203 B<dk> decapsulation
+When an B<ML-KEM> key is imported as an explicit FIPS 203 B<dk> decapsulation
 key, rather than a seed, a pairwise consistency test (PCT) is optionally
 performed.
 By default, or when this parameter is set explicitly to C<random>, the PCT
diff --git a/doc/man7/EVP_SIGNATURE-ED25519.pod b/doc/man7/EVP_SIGNATURE-ED25519.pod
index 924f254aad0f..559968664e1a 100644
--- a/doc/man7/EVP_SIGNATURE-ED25519.pod
+++ b/doc/man7/EVP_SIGNATURE-ED25519.pod
@@ -134,6 +134,9 @@ since version 1.1.1.
 Valid algorithm names are B<ed25519>, B<ed448> and B<eddsa>. If B<eddsa> is
 specified, then both Ed25519 and Ed448 are benchmarked.
 
+Since Ed25519ctx is not included in FIPS 186-5, it is not present
+in the FIPS provider.
+
 =head1 EXAMPLES
 
 To sign a message using an ED25519 EVP_PKEY structure:
diff --git a/doc/man7/EVP_SIGNATURE-ML-DSA.pod b/doc/man7/EVP_SIGNATURE-ML-DSA.pod
index 3b6e795f0709..c9ccf1aafb8e 100644
--- a/doc/man7/EVP_SIGNATURE-ML-DSA.pod
+++ b/doc/man7/EVP_SIGNATURE-ML-DSA.pod
@@ -17,7 +17,7 @@ L<FIPS 204|https://csrc.nist.gov/pubs/fips/204/final> Section 4 Table 1.
 (The signatures range in size from ~2.5K to ~4.5K depending on the type chosen).
 There are 3 different security categories also depending on the type.
 
-L<EVP_SIGNATURE_fetch(3)> can be used to explicitely fetch one of the 3
+L<EVP_SIGNATURE_fetch(3)> can be used to explicitly fetch one of the 3
 algorithms which can then be used with L<EVP_PKEY_sign_message_init(3)>,
 L<EVP_PKEY_sign(3)>, L<EVP_PKEY_verify_message_init(3)>, and
 L<EVP_PKEY_verify(3)> to perform one-shot message signing or signature verification.
@@ -87,7 +87,7 @@ See L<EVP_PKEY-ML-DSA(7)> for information related to B<ML-DSA> keys.
 
 =head1 NOTES
 
-For backwards compatability reasons EVP_DigestSignInit_ex(), EVP_DigestSign(),
+For backwards compatibility reasons EVP_DigestSignInit_ex(), EVP_DigestSign(),
 EVP_DigestVerifyInit_ex() and EVP_DigestVerify() may also be used, but the digest
 passed in I<mdname> must be NULL.
 
diff --git a/doc/man7/EVP_SIGNATURE-SLH-DSA.pod b/doc/man7/EVP_SIGNATURE-SLH-DSA.pod
index de2be646ed64..c1699793ce3b 100644
--- a/doc/man7/EVP_SIGNATURE-SLH-DSA.pod
+++ b/doc/man7/EVP_SIGNATURE-SLH-DSA.pod
@@ -28,7 +28,7 @@ C<s> types have smaller signature sizes, and the C<f> variants are faster,
 (The signatures range from ~8K to ~50K depending on the type chosen). There are
 3 different security categories also depending on the type.
 
-L<EVP_SIGNATURE_fetch(3)> can be used to explicitely fetch one of the 12
+L<EVP_SIGNATURE_fetch(3)> can be used to explicitly fetch one of the 12
 algorithms which can then be used with L<EVP_PKEY_sign_message_init(3)>,
 L<EVP_PKEY_sign(3)>, L<EVP_PKEY_verify_message_init(3)>, and
 L<EVP_PKEY_verify(3)> to perform one-shot message signing or verification.
@@ -38,7 +38,7 @@ encodes the message internally as 0x00 || len(ctx) || ctx || message.
 where B<ctx> is some optional value of size 0x00..0xFF.
 OpenSSL also allows the message to not be encoded which is required for
 testing. OpenSSL does not support Pre Hash SLH-DSA Signature Generation, but this
-may be done by the user by doing Pre hash encoding externally and then chosing
+may be done by the user by doing Pre hash encoding externally and then choosing
 the option to not encode the message.
 
 =head2 SLH-DSA Signature Parameters
diff --git a/doc/man7/openssl-env.pod b/doc/man7/openssl-env.pod
index 78043d5bd68a..218eb93632ca 100644
--- a/doc/man7/openssl-env.pod
+++ b/doc/man7/openssl-env.pod
@@ -61,7 +61,7 @@ Unless OpenSSL tracing support is generally disabled,
 enable trace output of specific parts of OpenSSL libraries, by name.
 This output usually makes sense only if you know OpenSSL internals well.
 
-The value of this environment varialble is a comma-separated list of names,
+The value of this environment variable is a comma-separated list of names,
 with the following available:
 
 =over 4
@@ -173,7 +173,8 @@ OpenSSL supports a number of different algorithm implementations for
 various machines and, by default, it determines which to use based on the
 processor capabilities and run time feature enquiry.  These environment
 variables can be used to exert more control over this selection process.
-See L<OPENSSL_ia32cap(3)>, L<OPENSSL_s390xcap(3)> and L<OPENSSL_riscvcap(3)>.
+See L<OPENSSL_ia32cap(3)>, L<OPENSSL_ppccap(3)>, L<OPENSSL_riscvcap(3)>,
+and L<OPENSSL_s390xcap(3)>.
 
 =item B<NO_PROXY>, B<HTTPS_PROXY>, B<HTTP_PROXY>
 
diff --git a/doc/man7/openssl-quic-concurrency.pod b/doc/man7/openssl-quic-concurrency.pod
index ded22a1e8b92..e79dd2a3a2c6 100644
--- a/doc/man7/openssl-quic-concurrency.pod
+++ b/doc/man7/openssl-quic-concurrency.pod
@@ -196,7 +196,7 @@ Specifying this flag configures the Single-Threaded Concurrency Model (SCM).
 
 =item B<SSL_DOMAIN_FLAG_MULTI_THREAD>
 
-Speciyfing this flag configures the Contentive Concurrency Model (CCM) (unless
+Specifying this flag configures the Contentive Concurrency Model (CCM) (unless
 B<SSL_DOMAIN_FLAG_THREAD_ASSISTED> is also specified).
 
 =item B<SSL_DOMAIN_FLAG_THREAD_ASSISTED>
diff --git a/doc/man7/openssl-quic.pod b/doc/man7/openssl-quic.pod
index 2379ce7fb994..0e9e78b97625 100644
--- a/doc/man7/openssl-quic.pod
+++ b/doc/man7/openssl-quic.pod
@@ -566,7 +566,7 @@ L<SSL_accept_connection(3)>.
 
 =item L<SSL_accept_connection(3)>
 
-Accepts a new incoming connection for a listner SSL object. A new SSL object
+Accepts a new incoming connection for a listener SSL object. A new SSL object
 representing the accepted connection is created and returned on success. If no
 incoming connection is available and the listener SSL object is configured in
 nonblocking mode, NULL is returned.
@@ -895,6 +895,20 @@ that a call to L<SSL_handle_events(3)> is performed after the specified timeout
 
 =back
 
+=head1 WINDOWS APPLICATION NOTES
+
+QUIC protocol uses UDP sockets. The recvfrom() function on Windows may fail
+with C<WSAECONNRESET> error causing OpenSSL QUIC stack to enter permanent
+error, which prevents further communication over QUIC protocol. Applications
+should disable SIO_UDP_CONNRESET and SIO_UDP_NETRESET error notification
+on UDP sockets they pass to OpenSSL QUIC stack. More details can be found here:
+https://learn.microsoft.com/en-us/windows/win32/winsock/winsock-ioctls#sio_udp_connreset-opcode-setting-i-t3
+
+OpenSSL attempts to always disable SIO_UDP_CONNRESET and SIO_UDP_NETRESET
+on UDP sockets it receives from application, but no error is reported back
+if the respective C<WSAIoctl()> calls fail. Robust application should set those
+options itself so it can handle error notifications from C<WSAIoctl()> properly.
+
 =head1 SEE ALSO
 
 L<SSL_handle_events(3)>, L<SSL_get_event_timeout(3)>,
@@ -914,7 +928,7 @@ L<SSL_is_domain(3)>, L<SSL_get0_domain(3)>
 
 =head1 COPYRIGHT
 
-Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2022-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man7/ossl-guide-migration.pod b/doc/man7/ossl-guide-migration.pod
index aa60c129baa4..0be64bed8496 100644
--- a/doc/man7/ossl-guide-migration.pod
+++ b/doc/man7/ossl-guide-migration.pod
@@ -183,9 +183,9 @@ For more information, see L<OpenSSL_version(3)>.
 
 =head3 Other major new features
 
-=head4 Certificate Management Protocol (CMP, RFC 4210)
+=head4 Certificate Management Protocol (CMP, RFC 9810)
 
-This also covers CRMF (RFC 4211) and HTTP transfer (RFC 6712)
+This also covers CRMF (RFC 4211) and HTTP transfer (RFC 9811)
 See L<openssl-cmp(1)> and L<OSSL_CMP_exec_certreq(3)> as starting points.
 
 =head4 HTTP(S) client
diff --git a/doc/man7/provider-signature.pod b/doc/man7/provider-signature.pod
index 61202b523640..3ef927feb594 100644
--- a/doc/man7/provider-signature.pod
+++ b/doc/man7/provider-signature.pod
@@ -178,26 +178,87 @@ set of "signature" functions, i.e. at least one of:
 
 =item OSSL_FUNC_signature_sign_init and OSSL_FUNC_signature_sign
 
+Used via L<EVP_PKEY_sign_init(3)> and L<EVP_PKEY_sign(3)>.
+These functions operate on pre-digested data (the "to be signed" or TBS value).
+
 =item OSSL_FUNC_signature_sign_message_init and OSSL_FUNC_signature_sign
 
+Used via L<EVP_PKEY_sign_message_init(3)> and L<EVP_PKEY_sign(3)> when signing a complete message.
+The implementation internally handles message digesting.
+
 =item OSSL_FUNC_signature_sign_message_init, OSSL_FUNC_signature_sign_message_update and OSSL_FUNC_signature_sign_message_final
 
+Streaming variant of message signing, used via L<EVP_PKEY_sign_message_init(3)>,
+L<EVP_PKEY_sign_message_update(3)>, and L<EVP_PKEY_sign_message_final(3)>.
+
 =item OSSL_FUNC_signature_verify_init and OSSL_FUNC_signature_verify
 
+Used via L<EVP_PKEY_verify_init(3)> and L<EVP_PKEY_verify(3)>.
+These functions operate on pre-digested data.
+
 =item OSSL_FUNC_signature_verify_message_init and OSSL_FUNC_signature_verify
 
+Used via L<EVP_PKEY_verify_message_init(3)> and L<EVP_PKEY_verify(3)> when verifying a complete message.
+The implementation internally handles message digesting.
+
 =item OSSL_FUNC_signature_verify_message_init, OSSL_FUNC_signature_verify_message_update and OSSL_FUNC_signature_verify_message_final
 
+Streaming variant of message verification, used via L<EVP_PKEY_verify_message_init(3)>,
+L<EVP_PKEY_verify_message_update(3)>, and L<EVP_PKEY_verify_message_final(3)>.
+
 =item OSSL_FUNC_signature_verify_recover_init and OSSL_FUNC_signature_verify_recover
 
+Used via L<EVP_PKEY_verify_recover_init(3)> and L<EVP_PKEY_verify_recover(3)>.
+Applicable only to signature schemes that support signature recovery (such as RSA).
+
 =item OSSL_FUNC_signature_digest_sign_init, OSSL_FUNC_signature_digest_sign_update and OSSL_FUNC_signature_digest_sign_final
 
+Streaming digest-sign variant, used via L<EVP_DigestSignInit(3)>,
+L<EVP_DigestSignUpdate(3)>, and L<EVP_DigestSignFinal(3)>.
+
 =item OSSL_FUNC_signature_digest_verify_init, OSSL_FUNC_signature_digest_verify_update and OSSL_FUNC_signature_digest_verify_final
 
+Streaming digest-verify variant, used via L<EVP_DigestVerifyInit(3)>,
+L<EVP_DigestVerifyUpdate(3)>, and L<EVP_DigestVerifyFinal(3)>.
+
 =item OSSL_FUNC_signature_digest_sign_init and OSSL_FUNC_signature_digest_sign
 
+One-shot digest-sign variant, used via L<EVP_DigestSign(3)>.
+
 =item OSSL_FUNC_signature_digest_verify_init and OSSL_FUNC_signature_digest_verify
 
+One-shot digest-verify variant, used via L<EVP_DigestVerify(3)>.
+
+=back
+
+B<Important Note for TLS Support:> For a provider signature implementation to
+be usable within F<libssl> for TLS connections, it B<must> implement the
+digest-sign and digest-verify functions
+(OSSL_FUNC_signature_digest_sign_init/update/final or the one-shot variant, and
+OSSL_FUNC_signature_digest_verify_init/update/final or the one-shot variant).
+The TLS handshake code in F<libssl> specifically requires these digest functions
+and will not use implementations that only provide the basic sign/verify functions
+(OSSL_FUNC_signature_sign_init/sign or OSSL_FUNC_signature_verify_init/verify).
+
+The choice of which function set to implement depends on your use case:
+
+=over 4
+
+=item *
+
+For general-purpose signature operations and TLS support: implement the
+digest-sign and digest-verify functions.
+
+=item *
+
+For operations on pre-digested data only: implement the basic sign and verify
+functions.
+
+=item *
+
+For signature schemes with recovery capability: additionally implement the
+verify-recover functions.
+
 =back
 
 The OSSL_FUNC_signature_set_ctx_params() and
@@ -633,8 +694,17 @@ L<EVP_SIGNATURE_is_a(3)>, L<ASN1_item_sign_ctx(3)>
 =head1 HISTORY
 
 The provider SIGNATURE interface was introduced in OpenSSL 3.0.
-The Signature Parameters "fips-indicator", "key-check" and "digest-check"
-were added in OpenSSL 3.4.
+
+The OSSL_FUNC_signature_sign_message_init(), OSSL_FUNC_signature_sign_message_update(),
+OSSL_FUNC_signature_sign_message_final(), OSSL_FUNC_signature_verify_message_init(),
+OSSL_FUNC_signature_verify_message_update() and OSSL_FUNC_signature_verify_message_final()
+functions were added in OpenSSL 3.4.
+
+The Signature Parameters "fips-indicator", "key-check" and "digest-check" were added in
+OpenSSL 3.4.
+
+Deterministic digital signature generation for ECDSA was added to the FIPS provider in OpenSSL
+3.6.
 
 =head1 COPYRIGHT