diff options
| author | Matt Caswell <matt@openssl.org> | 2018-08-09 14:31:20 +0200 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-08-22 17:35:54 +0200 |
| commit | aabbc24e424382bb44ed6f88a134e50c2ef6d897 (patch) | |
| tree | a4fada1e17a245190aab306f6038736f3e6d8e06 /doc | |
| parent | Fix BoringSSL external test failures (diff) | |
| download | openssl-aabbc24e424382bb44ed6f88a134e50c2ef6d897.tar.xz openssl-aabbc24e424382bb44ed6f88a134e50c2ef6d897.zip | |
Improve the usability of the ca app using EdDSA
Previously you had to supply "null" as the digest to use EdDSA. This changes
things so that any digest is ignored.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6901)
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/man1/ca.pod | 9 | ||||
| -rw-r--r-- | doc/man3/EVP_PKEY_get_default_digest_nid.pod | 3 |
2 files changed, 7 insertions, 5 deletions
diff --git a/doc/man1/ca.pod b/doc/man1/ca.pod index ebd8a4386a..9b282e6479 100644 --- a/doc/man1/ca.pod +++ b/doc/man1/ca.pod @@ -184,9 +184,9 @@ The number of days to certify the certificate for. =item B<-md alg> The message digest to use. -Any digest supported by the OpenSSL B<dgst> command can be used. If the signing -key is using Ed25519 or Ed448 then you should specify "null" for the digest. -This option also applies to CRLs. +Any digest supported by the OpenSSL B<dgst> command can be used. For signing +algorithms that do not support a digest (i.e. Ed25519 and Ed448) any message +digest that is set is ignored. This option also applies to CRLs. =item B<-policy arg> @@ -453,7 +453,8 @@ least one of these must be present to generate a CRL. =item B<default_md> -The same as the B<-md> option. Mandatory. +The same as the B<-md> option. Mandatory except where the signing algorithm does +not require a digest (i.e. Ed25519 and Ed448). =item B<database> diff --git a/doc/man3/EVP_PKEY_get_default_digest_nid.pod b/doc/man3/EVP_PKEY_get_default_digest_nid.pod index 3dce5c59a8..6113115aec 100644 --- a/doc/man3/EVP_PKEY_get_default_digest_nid.pod +++ b/doc/man3/EVP_PKEY_get_default_digest_nid.pod @@ -13,7 +13,8 @@ EVP_PKEY_get_default_digest_nid - get default signature digest The EVP_PKEY_get_default_digest_nid() function sets B<pnid> to the default message digest NID for the public key signature operations associated with key -B<pkey>. +B<pkey>. Note that some signature algorithms (i.e. Ed25519 and Ed448) do not use +a digest during signing. In this case B<pnid> will be set to NID_undef. =head1 NOTES |