Skip to content

Update openssl 4.0.0 beta1#204

Draft
Flickdm wants to merge 18 commits intomicrosoft:mainfrom
Flickdm:update/openssl-4.0.0-beta1
Draft

Update openssl 4.0.0 beta1#204
Flickdm wants to merge 18 commits intomicrosoft:mainfrom
Flickdm:update/openssl-4.0.0-beta1

Conversation

@Flickdm
Copy link
Copy Markdown
Member

@Flickdm Flickdm commented Mar 26, 2026 •
edited
Loading

Description

Tracking PR to update to Openssl 4.0.0

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

  • Impacts functionality?
  • Impacts security?
  • Breaking change?
  • Includes tests?
  • Includes documentation?

How This Was Tested

<Describe the test(s) that were run to verify the changes.>

Integration Instructions

<Describe how these changes should be integrated. Use N/A if nothing is required.>

@mu-automation mu-automation bot added language:python Pull requests that update Python code impact:non-functional Does not have a functional impact labels Mar 26, 2026
@Flickdm Flickdm linked an issue Mar 26, 2026 that may be closed by this pull request
[Feature]: Create Openssl-4.0.0 Release #170
Open
@Flickdm Flickdm force-pushed the update/openssl-4.0.0-beta1 branch 8 times, most recently from e4143d3 to ce5bad7 Compare April 8, 2026 20:29
@Flickdm Flickdm added this to the OneCrypto-v1.0.2 milestone Apr 13, 2026
@Flickdm Flickdm self-assigned this Apr 13, 2026
Flickdm added 15 commits April 13, 2026 18:16
@Flickdm
OpensslPkg/BaseCryptLib: Migrate CryptHmac.c from HMAC_CTX to EVP_MAC…
004ce26 
…_CTX

Replace deprecated HMAC_CTX_new/HMAC_Init_ex/HMAC_Update/HMAC_Final/HMAC_CTX_free
with the OpenSSL 3.x EVP_MAC_CTX provider API.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Migrate RSA key context to EVP_PKEY APIs
8abd378 
Replace direct RSA* usage with a new RSA_PKEY_CTX struct holding individual
BIGNUMs (N, E, D, P, Q, Dp, Dq, QInv) plus a cached EVP_PKEY*.

- Add CryptRsaPkeyCtx.h defining RSA_PKEY_CTX and helper declarations
- RsaBuildEvpPkey(): lazily builds EVP_PKEY from stored BIGNUMs
- RsaInvalidatePkey(): invalidates the cache on component change
- RsaGetKey(): return TRUE with *BnSize=0 for unset (NULL) components
- All operations (sign/verify/encrypt/decrypt) use EVP_PKEY_CTX

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Migrate RSA consumers to RSA_PKEY_CTX
ed2f562 
Update files that consume RSA keys to work with the new RSA_PKEY_CTX type
instead of the deprecated RSA* direct usage:

- CryptPkcs7Sign.c: remove EVP_PKEY_assign_RSA; use RSA_PKEY_CTX->Pkey
- CryptPkcs1Oaep.c: remove EVP_PKEY_set1_RSA; use RSA_PKEY_CTX->Pkey
- CryptRsaPss.c: update context casting to RSA_PKEY_CTX
- CryptRsaPssSign.c: update context casting to RSA_PKEY_CTX

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Migrate CryptEc.c to EVP_PKEY APIs
90c2fbe 
Replace EC_KEY* based implementation with a new EC_PKEY_CTX struct holding
the curve NID and a cached EVP_PKEY*:

- Add CryptEcPkeyCtx.h defining EC_PKEY_CTX
- EcNewByNid(): allocates EC_PKEY_CTX with OpenSSL NID
- EcDhComputeKey(): uses EVP_PKEY_derive with OSSL_PARAM_BLD peer key
- EcDsaSign(): uses EVP_PKEY_sign producing DER; converts to raw R||S
- EcDsaVerify(): converts raw R||S to DER via i2d_ECDSA_SIG; EVP_PKEY_verify
- EC public key export: EVP_PKEY_get_octet_string_param returns 04||X||Y;
  skip leading 0x04 byte to match caller expectation of raw X||Y

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Migrate CryptDh.c to EVP_PKEY APIs
30be470 
Replace DH* based implementation with a new DH_PKEY_CTX struct:

- DH_PKEY_CTX holds BnP, BnG (set independently by DhSetParameter) and
  EVP_PKEY* (generated on DhGenerateKey)
- DhSetParameter(): stores BnP/BnG; defers key generation
- DhGenerateKey(): uses EVP_PKEY_paramgen + EVP_PKEY_keygen
- DhComputeKey(): uses EVP_PKEY_derive with peer public key

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Migrate CryptX509 to EVP_PKEY APIs
6a2ff40 
Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Migrate CryptPem to EVP_PKEY APIs
f02840f 
Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Remove OPENSSL_NO_DEPRECATED override
ef12600 
All BaseCryptLib files now use OpenSSL 3.x non-deprecated EVP_PKEY provider
APIs. Remove the OPENSSL_NO_DEPRECATED=0 override from InternalCryptLib.h
that was previously required to suppress deprecation warnings.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg/BaseCryptLib: Fix memory leak in RsaExtractBigNums
f52eaf6 
- RsaExtractBigNums now cleans up partially extracted BIGNUMs on
  failure instead of leaving them dangling in the RSA_PKEY_CTX.
- RsaGetPublicKeyFromX509 error path uses RsaFree() for proper
  cleanup of all RSA_PKEY_CTX resources.
- Fix RsaGetKey doc comment: BigNumber=NULL with sufficient BnSize
  returns TRUE (size query), not FALSE.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Update openssl submodule to 4.0.0-beta1
668f836 
Update the openssl submodule pointer to the openssl-4.0.0-beta1 tag.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Regenerate OpensslGen for OpenSSL 4.0.0-beta1
dc365bb 
Regenerate all intermediate files in OpensslGen including headers,
architecture-specific assembly files, DER encoding sources, and
the new .inc files generated from .inc.in templates introduced
in OpenSSL 4.0.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Update configure.py for OpenSSL 4.0.0-beta1
feafe52 
Fix X64-MSFT assembly filename conversion to handle both .S and
.s extensions.

Disable SM3 assembly sources in the asm filter to work around
build issues with OpenSSL 4.0.0-beta1. SM3 support will need
to be re-evaluated in a future update.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Update INFs for OpenSSL 4.0.0-beta1 sources
5b193e4 
Update the autogenerated source file lists in all OpensslLib INF
files to reflect the new and changed source files in OpenSSL
4.0.0-beta1.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Add OpensslGen root to package include paths
5f05563 
Add Library/OpensslLib/OpensslGen as a package include path in
OpensslPkg.dec. OpenSSL 4.0 introduces .inc files generated from
.inc.in templates that are included by provider source files
using paths relative to the build root. The OpensslGen directory
must be in the include search path to resolve these references.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Add CRT compat macros for OpenSSL 4.0
0b0acfa 
Add va_copy, vsnprintf, INT64_C, UINT64_C, INT32_C, and UINT32_C
macros to CrtLibSupport.h. These are required by OpenSSL 4.0
source files that were not needed in previous versions.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
Flickdm added 3 commits April 13, 2026 18:16
@Flickdm
OpensslPkg: Update BaseCryptLib for OpenSSL 4.0 API changes
a248618 
Replace direct struct member access with OpenSSL accessor
functions for ASN1_STRING, ASN1_TYPE, and ASN1_OBJECT types.
OpenSSL 4.0 makes these struct fields opaque, requiring use of
ASN1_STRING_get0_data(), ASN1_STRING_length(),
ASN1_STRING_type(), OBJ_get0_data(), and OBJ_length().

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Update stubs for OpenSSL 4.0 API changes
4d6955c 
Add null stubs for tls_parse_ctos_ech() and
tls_construct_stoc_ech() in SslExtServNull.c for the new
Encrypted Client Hello (ECH) extension in OpenSSL 4.0.

Update tls_construct_cert_status_body() signature in
SslStatServNull.c to include the new OCSP_RESPONSE parameter.

Update OSSL_STORE_SEARCH_by_name() in ossl_store.c to use
const X509_NAME parameter matching the OpenSSL 4.0 API.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm
OpensslPkg: Add C-compatible vsnprintf and sprintf wrappers
a60ea5f 
Replace the vsnprintf and sprintf macros in CrtLibSupport.h with
proper function implementations that translate standard C format
specifiers to EDK2 BasePrintLib equivalents. OpenSSL 4.0 error
reporting calls BIO_vsnprintf with C %s (ASCII string), but EDK2
BasePrintLib treats %s as Unicode, causing a segfault in the
host unit tests. The new TranslateFormatSpecifiers helper converts
C %s to EDK2 %a before calling AsciiVSPrint.

Signed-off-by: Doug Flick <dougflick@microsoft.com>
@Flickdm Flickdm force-pushed the update/openssl-4.0.0-beta1 branch from ce5bad7 to a60ea5f Compare April 13, 2026 22:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@Flickdm Flickdm

Labels

impact:non-functional Does not have a functional impact language:python Pull requests that update Python code

Projects

Project MU - UEFI Crypto Planning
Status: In Progress

Milestone

v1.1.0-OneCrypto

Development

Successfully merging this pull request may close these issues.

[Feature]: Create Openssl-4.0.0 Release

1 participant

@Flickdm