Remove the OpenSSL provider

Starting in OpenSSL 3.0, most of the functionality which we need to
implement the OpenSSL provider is deprecated. Rather than reimplement
the whole provider in order to allow it to continue to work in the
future, just remove it. Efforts would be better spent doing more
optimization work rather than chasing OpenSSL's API changes.

configure.py

@@ -563,7 +563,7 @@ def process_command_line(args): # pylint: disable=too-many-locals,too-many-state
                           help='minimize build')
 
     # Should be derived from info.txt but this runs too early
-    third_party = ['boost', 'bzip2', 'lzma', 'openssl', 'commoncrypto', 'sqlite3', 'zlib', 'tpm']
+    third_party = ['boost', 'bzip2', 'lzma', 'commoncrypto', 'sqlite3', 'zlib', 'tpm']
 
     for mod in third_party:
         mods_group.add_option('--with-%s' % (mod),

doc/api_ref/threads.rst

@@ -0,0 +1,3 @@
+Multithreading Notes
+======================
+

doc/building.rst

@@ -60,7 +60,7 @@ we might see lines like::
    INFO: Skipping (incompatible OS): darwin_secrandom getentropy win32_stats
    INFO: Skipping (incompatible compiler): aes_armv8 pmull sha1_armv8 sha2_32_armv8
    INFO: Skipping (no enabled compression schemes): compression
-   INFO: Skipping (requires external dependency): boost bzip2 lzma openssl sqlite3 tpm zlib
+   INFO: Skipping (requires external dependency): boost bzip2 lzma sqlite3 tpm zlib
 
 The ones that are skipped because they are require an external
 dependency have to be explicitly asked for, because they rely on third
@@ -356,10 +356,6 @@ by the user using
  - ``--with-sqlite3`` enables using sqlite3 databases in various contexts
    (TLS session cache, PSK database, etc).
 
- - ``--with-openssl`` adds an engine that uses OpenSSL for some ciphers, hashes,
-   and public key operations. OpenSSL 1.0.2 or later is supported. LibreSSL can
-   also be used.
-
  - ``--with-tpm`` adds support for using TPM hardware via the TrouSerS library.
 
  - ``--with-boost`` enables using some Boost libraries. In particular
@@ -960,11 +956,6 @@ Enable lzma compression
 
 Enable using zlib compression
 
-``--with-openssl``
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Enable using OpenSSL for certain operations
-
 ``--with-commoncrypto``
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 

doc/dev_ref/contributing.rst

@@ -45,7 +45,7 @@ Library Layout
 * ``filters`` is a filter/pipe API for data transforms
 * ``compression`` has the compression wrappers (zlib, bzip2, lzma)
 * ``ffi`` is the C99 API
-* ``prov`` contains bindings to external libraries like OpenSSL and PKCS #11
+* ``prov`` contains bindings to external libraries such as PKCS #11
 * ``misc`` contains odds and ends: format preserving encryption, SRP, threshold
   secret sharing, all or nothing transform, and others
 
@@ -141,7 +141,7 @@ On Linux if you have the ``lcov`` and ``gcov`` tools installed, then running
 ``./src/scripts/ci_build.py coverage`` will produce a coverage enabled build,
 run the tests, test the fuzzers against a corpus, and produce an HTML report
 of total coverage. This coverage build requires the development headers for
-zlib, bzip2, liblzma, OpenSSL, TrouSerS (libtspi), and Sqlite3.
+zlib, bzip2, liblzma, TrouSerS (libtspi), and Sqlite3.
 
 Copyright Notice
 ----------------------------------------
@@ -256,12 +256,11 @@ additional lines of code in the library. That is, if the library really does
 need this functionality, and it can be done in the library for less than that,
 then it makes sense to just write the code. Yup.
 
-Currently the (optional) external dependencies of the library are OpenSSL (for
-access to fast and side channel hardened RSA, ECDSA, AES), some compression
-libraries (zlib, bzip2, lzma), sqlite3 database, Trousers (TPM integration),
-plus various operating system utilities like basic filesystem operations. These
-provide major pieces of functionality which seem worth the trouble of
-maintaining an integration with.
+Currently the (optional) external dependencies of the library are several
+compression libraries (zlib, bzip2, lzma), sqlite3 database, Trousers (TPM
+integration), plus various operating system utilities like basic filesystem
+operations. These provide major pieces of functionality which seem worth the
+trouble of maintaining an integration with.
 
 At this point the most plausible examples of an appropriate new external
 dependency are all deeper integrations with system level cryptographic systems

doc/dev_ref/todo.rst

@@ -75,8 +75,6 @@ External Providers, Hardware Support
 
 * Add support ARMv8.4-A SHA-512, SHA-3, SM3 and RNG
 * Aarch64 inline asm for BigInt
-* Extend OpenSSL provider (DH, HMAC, CMAC, GCM)
-* Support using BoringSSL instead of OpenSSL or LibreSSL
 * /dev/crypto provider (ciphers, hashes)
 * Windows CryptoNG provider (ciphers, hashes)
 * Extend Apple CommonCrypto provider (HMAC, CMAC, RSA, ECDSA, ECDH)

doc/packaging.rst

@@ -12,11 +12,6 @@ In most environments, zlib, bzip2, and sqlite are already installed, so there is
 no reason to not include support for them in Botan as well. Build with options
 ``--with-zlib --with-bzip2 --with-sqlite3`` to enable these features.
 
-Even though OpenSSL is also typically already installed, using
-``--with-openssl`` by default is *not recommended*. OpenSSL is sometimes faster
-and sometimes slower than Botan, and the relative speeds vary depending on the
-algorithm and CPU.
-
 Set Path to the System CA bundle
 ---------------------------------
 

doc/side_channels.rst

@@ -80,9 +80,6 @@ inversions are combined using the CRT. This process does leak the value of
 
 See blinding.cpp and rsa.cpp.
 
-If the OpenSSL provider is enabled, then no explicit blinding is done; we assume
-OpenSSL handles this. See openssl_rsa.cpp.
-
 Decryption of PKCS #1 v1.5 Ciphertexts
 ----------------------------------------
 

src/lib/block/block_cipher.cpp

@@ -77,10 +77,6 @@
   #include <botan/internal/threefish_512.h>
 #endif
 
-#if defined(BOTAN_HAS_OPENSSL)
-  #include <botan/internal/openssl.h>
-#endif
-
 #if defined(BOTAN_HAS_COMMONCRYPTO)
   #include <botan/internal/commoncrypto.h>
 #endif
@@ -102,17 +98,6 @@ BlockCipher::create(const std::string& algo,
       }
 #endif
 
-#if defined(BOTAN_HAS_OPENSSL)
-   if(provider.empty() || provider == "openssl")
-      {
-      if(auto bc = make_openssl_block_cipher(algo))
-         return bc;
-
-      if(!provider.empty())
-         return nullptr;
-      }
-#endif
-
    // TODO: CryptoAPI
    // TODO: /dev/crypto
 
@@ -307,7 +292,7 @@ BlockCipher::create_or_throw(const std::string& algo,
 
 std::vector<std::string> BlockCipher::providers(const std::string& algo)
    {
-   return probe_providers_of<BlockCipher>(algo, { "base", "openssl", "commoncrypto" });
+   return probe_providers_of<BlockCipher>(algo, { "base", "commoncrypto" });
    }
 
 }

src/lib/ffi/ffi.cpp

@@ -41,7 +41,6 @@ int ffi_map_error_type(Botan::ErrorType err)
 
       case Botan::ErrorType::SystemError:
       case Botan::ErrorType::IoError:
-      case Botan::ErrorType::OpenSSLError:
       case Botan::ErrorType::Pkcs11Error:
       case Botan::ErrorType::CommonCryptoError:
       case Botan::ErrorType::TPMError:

src/lib/hash/hash.cpp

@@ -89,10 +89,6 @@
   #include <botan/internal/blake2b.h>
 #endif
 
-#if defined(BOTAN_HAS_OPENSSL)
-  #include <botan/internal/openssl.h>
-#endif
-
 #if defined(BOTAN_HAS_COMMONCRYPTO)
   #include <botan/internal/commoncrypto.h>
 #endif
@@ -114,17 +110,6 @@ std::unique_ptr<HashFunction> HashFunction::create(const std::string& algo_spec,
       }
 #endif
 
-#if defined(BOTAN_HAS_OPENSSL)
-   if(provider.empty() || provider == "openssl")
-      {
-      if(auto hash = make_openssl_hash(algo_spec))
-         return hash;
-
-      if(!provider.empty())
-         return nullptr;
-      }
-#endif
-
    if(provider.empty() == false && provider != "base")
       return nullptr; // unknown provider
 
@@ -336,7 +321,7 @@ HashFunction::create_or_throw(const std::string& algo,
 
 std::vector<std::string> HashFunction::providers(const std::string& algo_spec)
    {
-   return probe_providers_of<HashFunction>(algo_spec, {"base", "openssl", "commoncrypto"});
+   return probe_providers_of<HashFunction>(algo_spec, {"base", "commoncrypto"});
    }
 
 }

src/lib/kdf/kdf.cpp

@@ -221,7 +221,7 @@ KDF::create_or_throw(const std::string& algo,
 
 std::vector<std::string> KDF::providers(const std::string& algo_spec)
    {
-   return probe_providers_of<KDF>(algo_spec, { "base" });
+   return probe_providers_of<KDF>(algo_spec);
    }
 
 }

src/lib/mac/mac.cpp

@@ -69,7 +69,6 @@ MessageAuthenticationCode::create(const std::string& algo_spec,
 #if defined(BOTAN_HAS_HMAC)
    if(req.algo_name() == "HMAC" && req.arg_count() == 1)
       {
-      // TODO OpenSSL
       if(provider.empty() || provider == "base")
          {
          if(auto hash = HashFunction::create(req.arg(0)))
@@ -99,7 +98,6 @@ MessageAuthenticationCode::create(const std::string& algo_spec,
 #if defined(BOTAN_HAS_CMAC)
    if((req.algo_name() == "CMAC" || req.algo_name() == "OMAC") && req.arg_count() == 1)
       {
-      // TODO: OpenSSL CMAC
       if(provider.empty() || provider == "base")
          {
          if(auto bc = BlockCipher::create(req.arg(0)))
@@ -128,7 +126,7 @@ MessageAuthenticationCode::create(const std::string& algo_spec,
 std::vector<std::string>
 MessageAuthenticationCode::providers(const std::string& algo_spec)
    {
-   return probe_providers_of<MessageAuthenticationCode>(algo_spec, {"base", "openssl"});
+   return probe_providers_of<MessageAuthenticationCode>(algo_spec);
    }
 
 //static

src/lib/modes/cipher_mode.cpp

@@ -31,10 +31,6 @@
   #include <botan/internal/xts.h>
 #endif
 
-#if defined(BOTAN_HAS_OPENSSL)
-  #include <botan/internal/openssl.h>
-#endif
-
 #if defined(BOTAN_HAS_COMMONCRYPTO)
   #include <botan/internal/commoncrypto.h>
 #endif
@@ -68,19 +64,6 @@ std::unique_ptr<Cipher_Mode> Cipher_Mode::create(const std::string& algo,
       }
 #endif
 
-#if defined(BOTAN_HAS_OPENSSL)
-   if(provider.empty() || provider == "openssl")
-      {
-      std::unique_ptr<Cipher_Mode> openssl_cipher(make_openssl_cipher_mode(algo, direction));
-
-      if(openssl_cipher)
-         return openssl_cipher;
-
-      if(!provider.empty())
-         return std::unique_ptr<Cipher_Mode>();
-      }
-#endif
-
 #if defined(BOTAN_HAS_STREAM_CIPHER)
    if(auto sc = StreamCipher::create(algo))
       {
@@ -188,7 +171,7 @@ std::unique_ptr<Cipher_Mode> Cipher_Mode::create(const std::string& algo,
 //static
 std::vector<std::string> Cipher_Mode::providers(const std::string& algo_spec)
    {
-   const std::vector<std::string>& possible = { "base", "openssl", "commoncrypto" };
+   const std::vector<std::string>& possible = { "base", "commoncrypto" };
    std::vector<std::string> providers;
    for(auto&& prov : possible)
       {

src/lib/pbkdf/pbkdf.cpp

@@ -70,7 +70,7 @@ PBKDF::create_or_throw(const std::string& algo,
 
 std::vector<std::string> PBKDF::providers(const std::string& algo_spec)
    {
-   return probe_providers_of<PBKDF>(algo_spec, { "base", "openssl" });
+   return probe_providers_of<PBKDF>(algo_spec);
    }
 
 void PBKDF::pbkdf_timed(uint8_t out[], size_t out_len,

src/lib/pbkdf/pwdhash.cpp

@@ -54,8 +54,6 @@ std::unique_ptr<PasswordHashFamily> PasswordHashFamily::create(const std::string
 #if defined(BOTAN_HAS_PBKDF2)
    if(req.algo_name() == "PBKDF2")
       {
-      // TODO OpenSSL
-
       if(provider.empty() || provider == "base")
          {
          if(auto mac = MessageAuthenticationCode::create("HMAC(" + req.arg(0) + ")"))
@@ -128,7 +126,7 @@ PasswordHashFamily::create_or_throw(const std::string& algo,
 
 std::vector<std::string> PasswordHashFamily::providers(const std::string& algo_spec)
    {
-   return probe_providers_of<PasswordHashFamily>(algo_spec, { "base", "openssl" });
+   return probe_providers_of<PasswordHashFamily>(algo_spec);
    }
 
 }