- Update to 3.5.0:

* Changes:
    - Default encryption cipher for the req, cms, and smime applications
      changed from des-ede3-cbc to aes-256-cbc.
    - The default TLS supported groups list has been changed to include
      and prefer hybrid PQC KEM groups. Some practically unused groups
      were removed from the default list.
    - The default TLS keyshares have been changed to offer X25519MLKEM768
      and and X25519.
    - All BIO_meth_get_*() functions were deprecated.
  * New features:
    - Support for server side QUIC (RFC 9000)
    - Support for 3rd party QUIC stacks including 0-RTT support
    - Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
    - A new configuration option no-tls-deprecated-ec to disable support
      for TLS groups deprecated in RFC8422
    - A new configuration option enable-fips-jitter to make the FIPS
      provider to use the JITTER seed source
    - Support for central key generation in CMP
    - Support added for opaque symmetric key objects (EVP_SKEY)
    - Support for multiple TLS keyshares and improved TLS key establishment
      group configurability
    - API support for pipelining in provided cipher algorithms
  * Remove patches:
    - openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
    - openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
    - openssl-3-add-defines-CPACF-funcs.patch
    - openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch
    - openssl-3-add-xof-state-handling-s3_absorb.patch
    - openssl-3-fix-state-handling-sha3_absorb_s390x.patch

OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=139

openssl-3-fix-s390x_sha3_absorb.patch

@@ -0,0 +1,50 @@
+From 979dc530010e3c0f045edf6e38c7ab894ffba7f2 Mon Sep 17 00:00:00 2001
+From: Ingo Franzki <ifranzki@linux.ibm.com>
+Date: Thu, 5 Sep 2024 08:45:29 +0200
+Subject: [PATCH] s390x: Fix s390x_sha3_absorb() when no data is processed by
+ KIMD
+
+If the data to absorb is less than a block, then the KIMD instruction is
+called with zero bytes. This is superfluous, and causes incorrect hash
+output later on if this is the very first absorb call, i.e. when the
+xof_state is still XOF_STATE_INIT and MSA 12 is available. In this case
+the NIP flag is set in the function code for KIMD, but KIMD ignores the
+NIP flag when it is called with zero bytes to process.
+
+Skip any KIMD calls for zero length data. Also do not set the xof_state
+to XOF_STATE_ABSORB until the first call to KIMD with data. That way,
+the next KIMD (with non-zero length data) or KLMD call will get the NIP
+flag set and will then honor it to produce correct output.
+
+Fixes: https://github.com/openssl/openssl/commit/25f5d7b85f6657cd2f9f1ab7ae87f319d9bafe54
+
+Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+
+Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/25388)
+---
+ providers/implementations/digests/sha3_prov.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+Index: openssl-3.2.3/providers/implementations/digests/sha3_prov.c
+===================================================================
+--- openssl-3.2.3.orig/providers/implementations/digests/sha3_prov.c
++++ openssl-3.2.3/providers/implementations/digests/sha3_prov.c
+@@ -192,10 +192,12 @@ static size_t s390x_sha3_absorb(void *vc
+     if (!(ctx->xof_state == XOF_STATE_INIT ||
+           ctx->xof_state == XOF_STATE_ABSORB))
+         return 0;
+-    fc = ctx->pad;
+-    fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0;
+-    ctx->xof_state = XOF_STATE_ABSORB;
+-    s390x_kimd(inp, len - rem, fc, ctx->A);
++    if (len - rem > 0) {
++        fc = ctx->pad;
++        fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0;
++        ctx->xof_state = XOF_STATE_ABSORB;
++        s390x_kimd(inp, len - rem, fc, ctx->A);
++    }
+     return rem;
+ }
+