pgsql: Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)
Date: 2026-08-10 00:14:26
Message-ID: E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)

cryptohash_openssl.c initialized the EVP_MD_CTX with the implicit static
digest objects (EVP_sha256() and friends). These do not dispatch
through a loaded provider. OpenSSL 3.0 and newer versions recommend to
switch to an explicit fetch, using EVP_MD_fetch(), the older routines
being deprecated, available for backward-compatibility purposes.

Now, when building with OpenSSL 3.0 or a newer bersion, we fetch the
digest by name with EVP_MD_fetch(), cache it in the context, and free it
on teardown. This has as consequence to feed the hash from a provider.
The implicit path is kept for older OpenSSL, 1.1.1 being the oldest
version still supported on HEAD, and for LibreSSL.

This is a slight change in the hashing logic. No backpatch is done as
that looks safer, and the code in the back-branches is also able to
work. This has been locally tested across OpenSSL 1.1.1 up to 3.5, so
hopefully nothing is broken.

Note: The submitted code was clearly AI-generated. I have spend a bit
of time cleaning it up, making it more consistent with the project style
in terms of coding, adjusting a few more things on the way.

Author: Mark Atwood <mark(at)reviewcommit(dot)com>
Co-authored-by: Michael Paquier <michael(at)paquier(dot)xyz>
Discussion: https://postgr.es/m/178596055358.1584287.8485463954311014881@reviewcommit.com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/b91f79cd08abba7a800d3faf79bb96e8adc8752e

Modified Files
--------------
src/common/cryptohash_openssl.c | 47 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Michael Paquier 2026-08-10 05:54:13 pgsql: Use EVP_MAC for HMAC (OpenSSL >= 3.0)
Previous Message Michael Paquier 2026-08-09 23:38:01 pgsql: Use OOM-safe routine for pgstats shared hashtable insert