agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Use EVP_MAC for HMAC (OpenSSL >= 3.0)
Date: Mon, 10 Aug 2026 05:54:13 +0000
Message-ID: <E1wtIxh-00000000v7G-3Wo8@gemulon.postgresql.org> (raw)
Use EVP_MAC for HMAC (OpenSSL >= 3.0)
The legacy HMAC_CTX interface (HMAC_CTX_new(), HMAC_Init_ex(), etc.) has
been deprecated since OpenSSL 3.0. The legacy routines do not dispatch
through the provider framework, so a loaded provider's HMAC
implementation could be bypassed.
This commit updates hmac_openssl.c to use EVP_MAC when building with
OpenSSL 3.0 or newer versions. OpenSSL 1.1.1 is the oldest version
supported on HEAD, so the legacy routines need to be kept. Note that
LibreSSL uses the legacy routines.
Like b91f79cd08ab, no backpatch is done.
Author: Mark Atwood <mark@reviewcommit.com>
Co-authored-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/178596055149.1584250.13974609482797470185@reviewcommit.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/1f3b9bb109b8b1a7bb60d2d7343c1759679e501b
Modified Files
--------------
src/common/hmac_openssl.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 77 insertions(+), 1 deletion(-)
Message-ID: <E1wtIxh-00000000v7G-3Wo8@gemulon.postgresql.org>
Permalink: ../E1wtIxh-00000000v7G-3Wo8@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtIxh-00000000v7G-3Wo8@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Use EVP_MAC for HMAC (OpenSSL >= 3.0)
In-Reply-To: <E1wtIxh-00000000v7G-3Wo8@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox