Blame SOURCES/openssl-1.1.1-explicit-params.patch

3dfed0
diff -up openssl-1.1.1g/crypto/ec/ec_asn1.c.explicit-params openssl-1.1.1g/crypto/ec/ec_asn1.c
3dfed0
--- openssl-1.1.1g/crypto/ec/ec_asn1.c.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/crypto/ec/ec_asn1.c	2020-10-23 15:27:31.304312344 +0200
3dfed0
@@ -137,6 +137,12 @@ struct ec_parameters_st {
3dfed0
     ASN1_INTEGER *cofactor;
3dfed0
 } /* ECPARAMETERS */ ;
3dfed0
 
3dfed0
+typedef enum {
3dfed0
+    ECPKPARAMETERS_TYPE_NAMED = 0,
3dfed0
+    ECPKPARAMETERS_TYPE_EXPLICIT,
3dfed0
+    ECPKPARAMETERS_TYPE_IMPLICIT
3dfed0
+} ecpk_parameters_type_t;
3dfed0
+
3dfed0
 struct ecpk_parameters_st {
3dfed0
     int type;
3dfed0
     union {
3dfed0
@@ -535,9 +541,10 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparamet
3dfed0
             return NULL;
3dfed0
         }
3dfed0
     } else {
3dfed0
-        if (ret->type == 0)
3dfed0
+        if (ret->type == ECPKPARAMETERS_TYPE_NAMED)
3dfed0
             ASN1_OBJECT_free(ret->value.named_curve);
3dfed0
-        else if (ret->type == 1 && ret->value.parameters)
3dfed0
+        else if (ret->type == ECPKPARAMETERS_TYPE_EXPLICIT
3dfed0
+                 && ret->value.parameters != NULL)
3dfed0
             ECPARAMETERS_free(ret->value.parameters);
3dfed0
     }
3dfed0
 
3dfed0
@@ -547,7 +554,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparamet
3dfed0
          */
3dfed0
         tmp = EC_GROUP_get_curve_name(group);
3dfed0
         if (tmp) {
3dfed0
-            ret->type = 0;
3dfed0
+            ret->type = ECPKPARAMETERS_TYPE_NAMED;
3dfed0
             if ((ret->value.named_curve = OBJ_nid2obj(tmp)) == NULL)
3dfed0
                 ok = 0;
3dfed0
         } else
3dfed0
@@ -555,7 +562,7 @@ ECPKPARAMETERS *EC_GROUP_get_ecpkparamet
3dfed0
             ok = 0;
3dfed0
     } else {
3dfed0
         /* use the ECPARAMETERS structure */
3dfed0
-        ret->type = 1;
3dfed0
+        ret->type = ECPKPARAMETERS_TYPE_EXPLICIT;
3dfed0
         if ((ret->value.parameters =
3dfed0
              EC_GROUP_get_ecparameters(group, NULL)) == NULL)
3dfed0
             ok = 0;
3dfed0
@@ -894,7 +901,8 @@ EC_GROUP *EC_GROUP_new_from_ecpkparamete
3dfed0
         return NULL;
3dfed0
     }
3dfed0
 
3dfed0
-    if (params->type == 0) {    /* the curve is given by an OID */
3dfed0
+    if (params->type == ECPKPARAMETERS_TYPE_NAMED) {
3dfed0
+        /* the curve is given by an OID */
3dfed0
         tmp = OBJ_obj2nid(params->value.named_curve);
3dfed0
         if ((ret = EC_GROUP_new_by_curve_name(tmp)) == NULL) {
3dfed0
             ECerr(EC_F_EC_GROUP_NEW_FROM_ECPKPARAMETERS,
3dfed0
@@ -902,15 +910,16 @@ EC_GROUP *EC_GROUP_new_from_ecpkparamete
3dfed0
             return NULL;
3dfed0
         }
3dfed0
         EC_GROUP_set_asn1_flag(ret, OPENSSL_EC_NAMED_CURVE);
3dfed0
-    } else if (params->type == 1) { /* the parameters are given by a
3dfed0
-                                     * ECPARAMETERS structure */
3dfed0
+    } else if (params->type == ECPKPARAMETERS_TYPE_EXPLICIT) {
3dfed0
+        /* the parameters are given by an ECPARAMETERS structure */
3dfed0
         ret = EC_GROUP_new_from_ecparameters(params->value.parameters);
3dfed0
         if (!ret) {
3dfed0
             ECerr(EC_F_EC_GROUP_NEW_FROM_ECPKPARAMETERS, ERR_R_EC_LIB);
3dfed0
             return NULL;
3dfed0
         }
3dfed0
         EC_GROUP_set_asn1_flag(ret, OPENSSL_EC_EXPLICIT_CURVE);
3dfed0
-    } else if (params->type == 2) { /* implicitlyCA */
3dfed0
+    } else if (params->type == ECPKPARAMETERS_TYPE_IMPLICIT) {
3dfed0
+        /* implicit parameters inherited from CA - unsupported */
3dfed0
         return NULL;
3dfed0
     } else {
3dfed0
         ECerr(EC_F_EC_GROUP_NEW_FROM_ECPKPARAMETERS, EC_R_ASN1_ERROR);
3dfed0
@@ -940,6 +949,9 @@ EC_GROUP *d2i_ECPKParameters(EC_GROUP **
3dfed0
         return NULL;
3dfed0
     }
3dfed0
 
3dfed0
+    if (params->type == ECPKPARAMETERS_TYPE_EXPLICIT)
3dfed0
+        group->decoded_from_explicit_params = 1;
3dfed0
+
3dfed0
     if (a) {
3dfed0
         EC_GROUP_free(*a);
3dfed0
         *a = group;
3dfed0
@@ -991,6 +1003,9 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, con
3dfed0
     if (priv_key->parameters) {
3dfed0
         EC_GROUP_free(ret->group);
3dfed0
         ret->group = EC_GROUP_new_from_ecpkparameters(priv_key->parameters);
3dfed0
+        if (ret->group != NULL
3dfed0
+            && priv_key->parameters->type == ECPKPARAMETERS_TYPE_EXPLICIT)
3dfed0
+            ret->group->decoded_from_explicit_params = 1;
3dfed0
     }
3dfed0
 
3dfed0
     if (ret->group == NULL) {
3dfed0
diff -up openssl-1.1.1g/crypto/ec/ec_key.c.explicit-params openssl-1.1.1g/crypto/ec/ec_key.c
3dfed0
--- openssl-1.1.1g/crypto/ec/ec_key.c.explicit-params	2020-10-23 15:27:31.296312275 +0200
3dfed0
+++ openssl-1.1.1g/crypto/ec/ec_key.c	2020-10-23 15:27:31.304312344 +0200
3dfed0
@@ -566,6 +566,13 @@ void EC_KEY_clear_flags(EC_KEY *key, int
3dfed0
     key->flags &= ~flags;
3dfed0
 }
3dfed0
 
3dfed0
+int EC_KEY_decoded_from_explicit_params(const EC_KEY *key)
3dfed0
+{
3dfed0
+    if (key == NULL || key->group == NULL)
3dfed0
+        return -1;
3dfed0
+    return key->group->decoded_from_explicit_params;
3dfed0
+}
3dfed0
+
3dfed0
 size_t EC_KEY_key2buf(const EC_KEY *key, point_conversion_form_t form,
3dfed0
                         unsigned char **pbuf, BN_CTX *ctx)
3dfed0
 {
3dfed0
diff -up openssl-1.1.1g/crypto/ec/ec_lib.c.explicit-params openssl-1.1.1g/crypto/ec/ec_lib.c
3dfed0
--- openssl-1.1.1g/crypto/ec/ec_lib.c.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/crypto/ec/ec_lib.c	2020-10-23 15:27:31.304312344 +0200
3dfed0
@@ -211,6 +211,7 @@ int EC_GROUP_copy(EC_GROUP *dest, const
3dfed0
 
3dfed0
     dest->asn1_flag = src->asn1_flag;
3dfed0
     dest->asn1_form = src->asn1_form;
3dfed0
+    dest->decoded_from_explicit_params = src->decoded_from_explicit_params;
3dfed0
 
3dfed0
     if (src->seed) {
3dfed0
         OPENSSL_free(dest->seed);
3dfed0
diff -up openssl-1.1.1g/crypto/ec/ec_local.h.explicit-params openssl-1.1.1g/crypto/ec/ec_local.h
3dfed0
--- openssl-1.1.1g/crypto/ec/ec_local.h.explicit-params	2020-10-23 15:27:31.281312147 +0200
3dfed0
+++ openssl-1.1.1g/crypto/ec/ec_local.h	2020-10-23 15:27:31.304312344 +0200
3dfed0
@@ -217,6 +217,8 @@ struct ec_group_st {
3dfed0
     BIGNUM *order, *cofactor;
3dfed0
     int curve_name;             /* optional NID for named curve */
3dfed0
     int asn1_flag;              /* flag to control the asn1 encoding */
3dfed0
+    int decoded_from_explicit_params; /* set if decoded from explicit
3dfed0
+                                       * curve parameters encoding */
3dfed0
     point_conversion_form_t asn1_form;
3dfed0
     unsigned char *seed;        /* optional seed for parameters (appears in
3dfed0
                                  * ASN1) */
3dfed0
diff -up openssl-1.1.1g/crypto/x509/x509_txt.c.explicit-params openssl-1.1.1g/crypto/x509/x509_txt.c
3dfed0
--- openssl-1.1.1g/crypto/x509/x509_txt.c.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/crypto/x509/x509_txt.c	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -174,6 +174,8 @@ const char *X509_verify_cert_error_strin
3dfed0
         return "OCSP verification failed";
3dfed0
     case X509_V_ERR_OCSP_CERT_UNKNOWN:
3dfed0
         return "OCSP unknown cert";
3dfed0
+    case X509_V_ERR_EC_KEY_EXPLICIT_PARAMS:
3dfed0
+        return "Certificate public key has explicit ECC parameters";
3dfed0
 
3dfed0
     default:
3dfed0
         /* Printing an error number into a static buffer is not thread-safe */
3dfed0
diff -up openssl-1.1.1g/crypto/x509/x509_vfy.c.explicit-params openssl-1.1.1g/crypto/x509/x509_vfy.c
3dfed0
--- openssl-1.1.1g/crypto/x509/x509_vfy.c.explicit-params	2020-10-23 15:27:31.252311900 +0200
3dfed0
+++ openssl-1.1.1g/crypto/x509/x509_vfy.c	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -80,6 +80,7 @@ static int get_issuer_sk(X509 **issuer,
3dfed0
 static int check_dane_issuer(X509_STORE_CTX *ctx, int depth);
3dfed0
 static int check_key_level(X509_STORE_CTX *ctx, X509 *cert);
3dfed0
 static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert);
3dfed0
+static int check_curve(X509 *cert);
3dfed0
 
3dfed0
 static int get_crl_score(X509_STORE_CTX *ctx, X509 **pissuer,
3dfed0
                          unsigned int *preasons, X509_CRL *crl, X509 *x);
3dfed0
@@ -508,6 +509,14 @@ static int check_chain_extensions(X509_S
3dfed0
                 ret = 1;
3dfed0
             break;
3dfed0
         }
3dfed0
+        if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) && num > 1) {
3dfed0
+            /* Check for presence of explicit elliptic curve parameters */
3dfed0
+            ret = check_curve(x);
3dfed0
+            if (ret < 0)
3dfed0
+                ctx->error = X509_V_ERR_UNSPECIFIED;
3dfed0
+            else if (ret == 0)
3dfed0
+                ctx->error = X509_V_ERR_EC_KEY_EXPLICIT_PARAMS;
3dfed0
+        }
3dfed0
         if ((x->ex_flags & EXFLAG_CA) == 0
3dfed0
             && x->ex_pathlen != -1
3dfed0
             && (ctx->param->flags & X509_V_FLAG_X509_STRICT)) {
3dfed0
@@ -3259,6 +3268,32 @@ static int check_key_level(X509_STORE_CT
3dfed0
 }
3dfed0
 
3dfed0
 /*
3dfed0
+ * Check whether the public key of ``cert`` does not use explicit params
3dfed0
+ * for an elliptic curve.
3dfed0
+ *
3dfed0
+ * Returns 1 on success, 0 if check fails, -1 for other errors.
3dfed0
+ */
3dfed0
+static int check_curve(X509 *cert)
3dfed0
+{
3dfed0
+#ifndef OPENSSL_NO_EC
3dfed0
+    EVP_PKEY *pkey = X509_get0_pubkey(cert);
3dfed0
+
3dfed0
+    /* Unsupported or malformed key */
3dfed0
+    if (pkey == NULL)
3dfed0
+        return -1;
3dfed0
+
3dfed0
+    if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
3dfed0
+        int ret;
3dfed0
+
3dfed0
+        ret = EC_KEY_decoded_from_explicit_params(EVP_PKEY_get0_EC_KEY(pkey));
3dfed0
+        return ret < 0 ? ret : !ret;
3dfed0
+    }
3dfed0
+#endif
3dfed0
+
3dfed0
+    return 1;
3dfed0
+}
3dfed0
+
3dfed0
+/*
3dfed0
  * Check whether the signature digest algorithm of ``cert`` meets the security
3dfed0
  * level of ``ctx``.  Should not be checked for trust anchors (whether
3dfed0
  * self-signed or otherwise).
3dfed0
diff -up openssl-1.1.1g/doc/man3/EC_KEY_new.pod.explicit-params openssl-1.1.1g/doc/man3/EC_KEY_new.pod
3dfed0
--- openssl-1.1.1g/doc/man3/EC_KEY_new.pod.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/doc/man3/EC_KEY_new.pod	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -9,7 +9,8 @@ EC_KEY_get0_engine,
3dfed0
 EC_KEY_get0_group, EC_KEY_set_group, EC_KEY_get0_private_key,
3dfed0
 EC_KEY_set_private_key, EC_KEY_get0_public_key, EC_KEY_set_public_key,
3dfed0
 EC_KEY_get_conv_form,
3dfed0
-EC_KEY_set_conv_form, EC_KEY_set_asn1_flag, EC_KEY_precompute_mult,
3dfed0
+EC_KEY_set_conv_form, EC_KEY_set_asn1_flag,
3dfed0
+EC_KEY_decoded_from_explicit_params, EC_KEY_precompute_mult,
3dfed0
 EC_KEY_generate_key, EC_KEY_check_key, EC_KEY_set_public_key_affine_coordinates,
3dfed0
 EC_KEY_oct2key, EC_KEY_key2buf, EC_KEY_oct2priv, EC_KEY_priv2oct,
3dfed0
 EC_KEY_priv2buf - Functions for creating, destroying and manipulating
3dfed0
@@ -38,6 +39,7 @@ EC_KEY objects
3dfed0
  point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key);
3dfed0
  void EC_KEY_set_conv_form(EC_KEY *eckey, point_conversion_form_t cform);
3dfed0
  void EC_KEY_set_asn1_flag(EC_KEY *eckey, int asn1_flag);
3dfed0
+ int EC_KEY_decoded_from_explicit_params(const EC_KEY *key);
3dfed0
  int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx);
3dfed0
  int EC_KEY_generate_key(EC_KEY *key);
3dfed0
  int EC_KEY_check_key(const EC_KEY *key);
3dfed0
@@ -118,6 +120,10 @@ EC_KEY_set_asn1_flag() sets the asn1_fla
3dfed0
 (if set). Refer to L<EC_GROUP_copy(3)> for further information on the
3dfed0
 asn1_flag.
3dfed0
 
3dfed0
+EC_KEY_decoded_from_explicit_params() returns 1 if the group of the I<key> was
3dfed0
+decoded from data with explicitly encoded group parameters, -1 if the I<key>
3dfed0
+is NULL or the group parameters are missing, and 0 otherwise.
3dfed0
+
3dfed0
 EC_KEY_precompute_mult() stores multiples of the underlying EC_GROUP generator
3dfed0
 for faster point multiplication. See also L<EC_POINT_add(3)>.
3dfed0
 
3dfed0
diff -up openssl-1.1.1g/include/openssl/ec.h.explicit-params openssl-1.1.1g/include/openssl/ec.h
3dfed0
--- openssl-1.1.1g/include/openssl/ec.h.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/include/openssl/ec.h	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -829,6 +829,8 @@ void EC_KEY_set_flags(EC_KEY *key, int f
3dfed0
 
3dfed0
 void EC_KEY_clear_flags(EC_KEY *key, int flags);
3dfed0
 
3dfed0
+int EC_KEY_decoded_from_explicit_params(const EC_KEY *key);
3dfed0
+
3dfed0
 /** Creates a new EC_KEY object using a named curve as underlying
3dfed0
  *  EC_GROUP object.
3dfed0
  *  \param  nid  NID of the named curve.
3dfed0
diff -up openssl-1.1.1g/include/openssl/x509_vfy.h.explicit-params openssl-1.1.1g/include/openssl/x509_vfy.h
3dfed0
--- openssl-1.1.1g/include/openssl/x509_vfy.h.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/include/openssl/x509_vfy.h	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -184,6 +184,7 @@ void X509_STORE_CTX_set_depth(X509_STORE
3dfed0
 # define         X509_V_ERR_OCSP_VERIFY_NEEDED                   73  /* Need OCSP verification */
3dfed0
 # define         X509_V_ERR_OCSP_VERIFY_FAILED                   74  /* Couldn't verify cert through OCSP */
3dfed0
 # define         X509_V_ERR_OCSP_CERT_UNKNOWN                    75  /* Certificate wasn't recognized by the OCSP responder */
3dfed0
+# define         X509_V_ERR_EC_KEY_EXPLICIT_PARAMS               79
3dfed0
 
3dfed0
 /* Certificate verify flags */
3dfed0
 
3dfed0
diff -up openssl-1.1.1g/ssl/statem/statem_lib.c.explicit-params openssl-1.1.1g/ssl/statem/statem_lib.c
3dfed0
--- openssl-1.1.1g/ssl/statem/statem_lib.c.explicit-params	2020-10-23 15:27:31.249311874 +0200
3dfed0
+++ openssl-1.1.1g/ssl/statem/statem_lib.c	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -1341,6 +1341,7 @@ int tls_get_message_body(SSL *s, size_t
3dfed0
 static const X509ERR2ALERT x509table[] = {
3dfed0
     {X509_V_ERR_APPLICATION_VERIFICATION, SSL_AD_HANDSHAKE_FAILURE},
3dfed0
     {X509_V_ERR_CA_KEY_TOO_SMALL, SSL_AD_BAD_CERTIFICATE},
3dfed0
+    {X509_V_ERR_EC_KEY_EXPLICIT_PARAMS, SSL_AD_BAD_CERTIFICATE},
3dfed0
     {X509_V_ERR_CA_MD_TOO_WEAK, SSL_AD_BAD_CERTIFICATE},
3dfed0
     {X509_V_ERR_CERT_CHAIN_TOO_LONG, SSL_AD_UNKNOWN_CA},
3dfed0
     {X509_V_ERR_CERT_HAS_EXPIRED, SSL_AD_CERTIFICATE_EXPIRED},
3dfed0
diff -up openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem
3dfed0
--- openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ca-cert-ec-explicit.pem	2020-10-23 15:27:31.305312352 +0200
3dfed0
@@ -0,0 +1,19 @@
3dfed0
+-----BEGIN CERTIFICATE-----
3dfed0
+MIIDGDCCAgCgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
3dfed0
+IENBMCAXDTIwMDkxNTEzMDY0MVoYDzIxMjAwOTE2MTMwNjQxWjANMQswCQYDVQQD
3dfed0
+DAJDQTCCAUswggEDBgcqhkjOPQIBMIH3AgEBMCwGByqGSM49AQECIQD/////AAAA
3dfed0
+AQAAAAAAAAAAAAAAAP///////////////zBbBCD/////AAAAAQAAAAAAAAAAAAAA
3dfed0
+AP///////////////AQgWsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEsD
3dfed0
+FQDEnTYIhucEk2pmeOETnSa3gZ9+kARBBGsX0fLhLEJH+Lzm5WOkQPJ3A32BLesz
3dfed0
+oPShOUXYmMKWT+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfUCIQD/////
3dfed0
+AAAAAP//////////vOb6racXnoTzucrC/GMlUQIBAQNCAASlXna3kSD/Yol3RA5I
3dfed0
+icjIxYb9UJoCTzb/LsxjlOvIS5OqCTzpqP0p3JrnvLPsbzq7Cf/g0bNlxAGs1iVM
3dfed0
+5NDco1MwUTAdBgNVHQ4EFgQUFk6ucH6gMXeadmuV7a1iWEnU/CIwHwYDVR0jBBgw
3dfed0
+FoAUjvUlrx6ba4Q9fICayVOcTXL3o1IwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
3dfed0
+9w0BAQsFAAOCAQEAdyUgfT0eAsZzoHFXoWN5uqi0MHuhLI37TEzkH5h7iTpDQJTQ
3dfed0
+F0SjbawfM/nxxUekRW3mjFu3lft+VA7yC0OTNBLffan/vTh+HGOvvYZSMJYgKrMG
3dfed0
+PRWgDId+n9RTcQCf+91cISvOazHixRiJG7JfRLdNZsAE+miw4HgPLFboTwpxtTDJ
3dfed0
+zJ4ssBC6P+5IHwBCtNMiilJMMMzuSaZa5iSo6M9AdXWfcQN3uhW1lgQOLOlKLcbo
3dfed0
+3UhW1GMMhTTeytM5aylbKhRsnL7ozmS44zsKZ25YaQxgjdKitFjVN6j7eyQ7C9J2
3dfed0
+bLXgl3APweLQbGGs0zv08Ad0SCCKYLHK6mMJqg==
3dfed0
+-----END CERTIFICATE-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ca-cert-ec-named.pem.explicit-params openssl-1.1.1g/test/certs/ca-cert-ec-named.pem
3dfed0
--- openssl-1.1.1g/test/certs/ca-cert-ec-named.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ca-cert-ec-named.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,14 @@
3dfed0
+-----BEGIN CERTIFICATE-----
3dfed0
+MIICJDCCAQygAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAdSb290
3dfed0
+IENBMCAXDTIwMDkxNTEzMDY1MFoYDzIxMjAwOTE2MTMwNjUwWjANMQswCQYDVQQD
3dfed0
+DAJDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPt+MXCi9+wztEvmdG2EVSk7
3dfed0
+bAiJMXJXW/u0NbcGCrrbhO1NJSHHV3Lks888sqeSPh/bif/ASJ0HX+VarMUoFIKj
3dfed0
+UzBRMB0GA1UdDgQWBBRjigU5REz8Lwf1iD6mALVhsHIanjAfBgNVHSMEGDAWgBSO
3dfed0
+9SWvHptrhD18gJrJU5xNcvejUjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB
3dfed0
+CwUAA4IBAQCQs9wpblefb2C9a7usGL1DJjWJQIFHtUf+6p/KPgEV7LF138ECjL5s
3dfed0
+0AWRd8Q8SbsBH49j2r3LLLMkvFglyRaN+FF+TCC/UQtclTb4+HgLsUT2xSU8U2cY
3dfed0
+SOnzNB5AX/qAAsdOGqOjivPtGXcXFexDKPsw3n+3rJgymBP6hbLagb47IabNhot5
3dfed0
+bMM6S+bmfpMwfsm885zr5vG2Gg9FjjH94Vx4I7eRLkjCS88gkIR1J35ecHFteOdo
3dfed0
+idOaCHQddYiKukBzgdjtTxSDXKffkaybylrwOZ8VBlQd3zC7s02d+riHCnroLnnE
3dfed0
+cwYLlJ5z6jN7zoPZ55yX/EmA0RVny2le
3dfed0
+-----END CERTIFICATE-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem
3dfed0
--- openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ca-key-ec-explicit.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,10 @@
3dfed0
+-----BEGIN PRIVATE KEY-----
3dfed0
+MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB
3dfed0
+AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA
3dfed0
+///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV
3dfed0
+AMSdNgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg
3dfed0
+9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8A
3dfed0
+AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQgdEf20fpuqEZU
3dfed0
+tZ4ORoq4vb5ETV4a6QOl/iGnDQt++/ihRANCAASlXna3kSD/Yol3RA5IicjIxYb9
3dfed0
+UJoCTzb/LsxjlOvIS5OqCTzpqP0p3JrnvLPsbzq7Cf/g0bNlxAGs1iVM5NDc
3dfed0
+-----END PRIVATE KEY-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ca-key-ec-named.pem.explicit-params openssl-1.1.1g/test/certs/ca-key-ec-named.pem
3dfed0
--- openssl-1.1.1g/test/certs/ca-key-ec-named.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ca-key-ec-named.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,5 @@
3dfed0
+-----BEGIN PRIVATE KEY-----
3dfed0
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgCTrYrMKcyV49+w4B
3dfed0
+TWr2WTZsMM4aFpaYulKAuhiuQ7mhRANCAAT7fjFwovfsM7RL5nRthFUpO2wIiTFy
3dfed0
+V1v7tDW3Bgq624TtTSUhx1dy5LPPPLKnkj4f24n/wEidB1/lWqzFKBSC
3dfed0
+-----END PRIVATE KEY-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem
3dfed0
--- openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ee-cert-ec-explicit.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,16 @@
3dfed0
+-----BEGIN CERTIFICATE-----
3dfed0
+MIIChzCCAi6gAwIBAgIBAjAKBggqhkjOPQQDAjANMQswCQYDVQQDDAJDQTAgFw0y
3dfed0
+MDA5MTUxMzE0MzlaGA8yMTIwMDkxNjEzMTQzOVowGTEXMBUGA1UEAwwOc2VydmVy
3dfed0
+LmV4YW1wbGUwggFLMIIBAwYHKoZIzj0CATCB9wIBATAsBgcqhkjOPQEBAiEA////
3dfed0
+/wAAAAEAAAAAAAAAAAAAAAD///////////////8wWwQg/////wAAAAEAAAAAAAAA
3dfed0
+AAAAAAD///////////////wEIFrGNdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n
3dfed0
+0mBLAxUAxJ02CIbnBJNqZnjhE50mt4GffpAEQQRrF9Hy4SxCR/i85uVjpEDydwN9
3dfed0
+gS3rM6D0oTlF2JjClk/jQuL+Gn+bjufrSnwPnhYrzjNXazFezsu2QGg3v1H1AiEA
3dfed0
+/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVECAQEDQgAE+7TDP7C9VqQP
3dfed0
+TnqoJc/Fvf/N45BX+lBfmfiGBeRKtSsvrERUlymzQ4/nxVtymozAgFxQ0my998HH
3dfed0
+TSVCj7Sq56N9MHswHQYDVR0OBBYEFKKwEfKYhNv6fbQf0Xd0te7J3GZdMB8GA1Ud
3dfed0
+IwQYMBaAFGOKBTlETPwvB/WIPqYAtWGwchqeMAkGA1UdEwQCMAAwEwYDVR0lBAww
3dfed0
+CgYIKwYBBQUHAwEwGQYDVR0RBBIwEIIOc2VydmVyLmV4YW1wbGUwCgYIKoZIzj0E
3dfed0
+AwIDRwAwRAIgb4UITAOFlATeaayWQX9r5gf61qcnzT7TjXCekf7ww9oCIBDltg/u
3dfed0
+ZvS9gqviMFuPjTuk/FhsCTAUzTT7WmgcWeH7
3dfed0
+-----END CERTIFICATE-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem
3dfed0
--- openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ee-cert-ec-named-explicit.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,11 @@
3dfed0
+-----BEGIN CERTIFICATE-----
3dfed0
+MIIBlDCCATqgAwIBAgIBAjAKBggqhkjOPQQDAjANMQswCQYDVQQDDAJDQTAgFw0y
3dfed0
+MDA5MTUxMzE0NDVaGA8yMTIwMDkxNjEzMTQ0NVowGTEXMBUGA1UEAwwOc2VydmVy
3dfed0
+LmV4YW1wbGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQv5PnMStW/Wx9lpvjl
3dfed0
+JTsFIjc2wBv14sNuMh1hfNX8ZJcoCfAAKYu6ujxXt328GWBMaubRbBjOd/eqpEst
3dfed0
+tYKzo30wezAdBgNVHQ4EFgQUmb/qcE413hkpmtjEMyRZZFcN1TYwHwYDVR0jBBgw
3dfed0
+FoAUFk6ucH6gMXeadmuV7a1iWEnU/CIwCQYDVR0TBAIwADATBgNVHSUEDDAKBggr
3dfed0
+BgEFBQcDATAZBgNVHREEEjAQgg5zZXJ2ZXIuZXhhbXBsZTAKBggqhkjOPQQDAgNI
3dfed0
+ADBFAiEA9y6J8rdAbO0mDZscIb8rIn6HgxBW4WAqTlFeZeHjjOYCIAmt2ldyObOL
3dfed0
+tXaiaxYX3WAOR1vmfzsdrkCAOCfAkpbo
3dfed0
+-----END CERTIFICATE-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem.explicit-params openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem
3dfed0
--- openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ee-cert-ec-named-named.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,11 @@
3dfed0
+-----BEGIN CERTIFICATE-----
3dfed0
+MIIBkzCCATqgAwIBAgIBAjAKBggqhkjOPQQDAjANMQswCQYDVQQDDAJDQTAgFw0y
3dfed0
+MDA5MTUxNDEwNDhaGA8yMTIwMDkxNjE0MTA0OFowGTEXMBUGA1UEAwwOc2VydmVy
3dfed0
+LmV4YW1wbGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS0YU57+RFRWxr/frnL
3dfed0
++vOYkY3h9roKnvxCG07wK5tevEYtSdKz0KsHvDBDatw1r3JNv+m2p54/3AqFPAZ3
3dfed0
+5b0Po30wezAdBgNVHQ4EFgQUypypuZrUl0BEmbuhfJpo3QFNIvUwHwYDVR0jBBgw
3dfed0
+FoAUY4oFOURM/C8H9Yg+pgC1YbByGp4wCQYDVR0TBAIwADATBgNVHSUEDDAKBggr
3dfed0
+BgEFBQcDATAZBgNVHREEEjAQgg5zZXJ2ZXIuZXhhbXBsZTAKBggqhkjOPQQDAgNH
3dfed0
+ADBEAiAEkKD7H5uxQ4YbQOiN4evbu5RCV5W7TVE80iBfcY5u4wIgGcwr++lVNX0Q
3dfed0
+CTT+M3ukDjOA8OEvKUz1TiDuRAQ29qU=
3dfed0
+-----END CERTIFICATE-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem
3dfed0
--- openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ee-key-ec-explicit.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,10 @@
3dfed0
+-----BEGIN PRIVATE KEY-----
3dfed0
+MIIBeQIBADCCAQMGByqGSM49AgEwgfcCAQEwLAYHKoZIzj0BAQIhAP////8AAAAB
3dfed0
+AAAAAAAAAAAAAAAA////////////////MFsEIP////8AAAABAAAAAAAAAAAAAAAA
3dfed0
+///////////////8BCBaxjXYqjqT57PrvVV2mIa8ZR0GsMxTsPY7zjw+J9JgSwMV
3dfed0
+AMSdNgiG5wSTamZ44ROdJreBn36QBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt6zOg
3dfed0
+9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8A
3dfed0
+AAAA//////////+85vqtpxeehPO5ysL8YyVRAgEBBG0wawIBAQQg0cmpcTcEYG5G
3dfed0
+ZaVkGjtsBc3sLZn1EuV9qNK2qx6iNzmhRANCAAT7tMM/sL1WpA9Oeqglz8W9/83j
3dfed0
+kFf6UF+Z+IYF5Eq1Ky+sRFSXKbNDj+fFW3KajMCAXFDSbL33wcdNJUKPtKrn
3dfed0
+-----END PRIVATE KEY-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem.explicit-params openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem
3dfed0
--- openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ee-key-ec-named-explicit.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,5 @@
3dfed0
+-----BEGIN PRIVATE KEY-----
3dfed0
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg2ue+X5ZFJPJPQG2E
3dfed0
+WQY4ALv2PkPp2Gy6KrMiokgmjkehRANCAAQv5PnMStW/Wx9lpvjlJTsFIjc2wBv1
3dfed0
+4sNuMh1hfNX8ZJcoCfAAKYu6ujxXt328GWBMaubRbBjOd/eqpEsttYKz
3dfed0
+-----END PRIVATE KEY-----
3dfed0
diff -up openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem.explicit-params openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem
3dfed0
--- openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem.explicit-params	2020-10-23 15:27:31.306312361 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/ee-key-ec-named-named.pem	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -0,0 +1,5 @@
3dfed0
+-----BEGIN PRIVATE KEY-----
3dfed0
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgGSoneIKG3//ujXGu
3dfed0
+/EoJdNhpKZj026EF/YQ5FblUBWahRANCAAS0YU57+RFRWxr/frnL+vOYkY3h9roK
3dfed0
+nvxCG07wK5tevEYtSdKz0KsHvDBDatw1r3JNv+m2p54/3AqFPAZ35b0P
3dfed0
+-----END PRIVATE KEY-----
3dfed0
diff -up openssl-1.1.1g/test/certs/setup.sh.explicit-params openssl-1.1.1g/test/certs/setup.sh
3dfed0
--- openssl-1.1.1g/test/certs/setup.sh.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/test/certs/setup.sh	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -116,6 +116,10 @@ openssl x509 -in ca-cert-md5.pem -trusto
3dfed0
 # CA has 768-bit key
3dfed0
 OPENSSL_KEYBITS=768 \
3dfed0
 ./mkcert.sh genca "CA" ca-key-768 ca-cert-768 root-key root-cert
3dfed0
+# EC cert with explicit curve
3dfed0
+./mkcert.sh genca "CA" ca-key-ec-explicit ca-cert-ec-explicit root-key root-cert
3dfed0
+# EC cert with named curve
3dfed0
+./mkcert.sh genca "CA" ca-key-ec-named ca-cert-ec-named root-key root-cert
3dfed0
 
3dfed0
 # client intermediate ca: cca-cert
3dfed0
 # trust variants: +serverAuth, -serverAuth, +clientAuth, -clientAuth
3dfed0
@@ -184,6 +188,14 @@ OPENSSL_SIGALG=md5 \
3dfed0
 # 768-bit leaf key
3dfed0
 OPENSSL_KEYBITS=768 \
3dfed0
 ./mkcert.sh genee server.example ee-key-768 ee-cert-768 ca-key ca-cert
3dfed0
+# EC cert with explicit curve signed by named curve ca
3dfed0
+./mkcert.sh genee server.example ee-key-ec-explicit ee-cert-ec-explicit ca-key-ec-named ca-cert-ec-named
3dfed0
+# EC cert with named curve signed by explicit curve ca
3dfed0
+./mkcert.sh genee server.example ee-key-ec-named-explicit \
3dfed0
+    ee-cert-ec-named-explicit ca-key-ec-explicit ca-cert-ec-explicit
3dfed0
+# EC cert with named curve signed by named curve ca
3dfed0
+./mkcert.sh genee server.example ee-key-ec-named-named \
3dfed0
+    ee-cert-ec-named-named ca-key-ec-named ca-cert-ec-named
3dfed0
 
3dfed0
 # Proxy certificates, off of ee-client
3dfed0
 # Start with some good ones
3dfed0
diff -up openssl-1.1.1g/test/ec_internal_test.c.explicit-params openssl-1.1.1g/test/ec_internal_test.c
3dfed0
--- openssl-1.1.1g/test/ec_internal_test.c.explicit-params	2020-04-21 14:22:39.000000000 +0200
3dfed0
+++ openssl-1.1.1g/test/ec_internal_test.c	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -183,6 +183,106 @@ static int field_tests_default(int n)
3dfed0
     return ret;
3dfed0
 }
3dfed0
 
3dfed0
+/*
3dfed0
+ * Tests behavior of the decoded_from_explicit_params flag and API
3dfed0
+ */
3dfed0
+static int decoded_flag_test(void)
3dfed0
+{
3dfed0
+    EC_GROUP *grp;
3dfed0
+    EC_GROUP *grp_copy = NULL;
3dfed0
+    ECPARAMETERS *ecparams = NULL;
3dfed0
+    ECPKPARAMETERS *ecpkparams = NULL;
3dfed0
+    EC_KEY *key = NULL;
3dfed0
+    unsigned char *encodedparams = NULL;
3dfed0
+    const unsigned char *encp;
3dfed0
+    int encodedlen;
3dfed0
+    int testresult = 0;
3dfed0
+
3dfed0
+    /* Test EC_GROUP_new not setting the flag */
3dfed0
+    grp = EC_GROUP_new(EC_GFp_simple_method());
3dfed0
+    if (!TEST_ptr(grp)
3dfed0
+        || !TEST_int_eq(grp->decoded_from_explicit_params, 0))
3dfed0
+        goto err;
3dfed0
+    EC_GROUP_free(grp);
3dfed0
+
3dfed0
+    /* Test EC_GROUP_new_by_curve_name not setting the flag */
3dfed0
+    grp = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
3dfed0
+    if (!TEST_ptr(grp)
3dfed0
+        || !TEST_int_eq(grp->decoded_from_explicit_params, 0))
3dfed0
+        goto err;
3dfed0
+
3dfed0
+    /* Test EC_GROUP_new_from_ecparameters not setting the flag */
3dfed0
+    if (!TEST_ptr(ecparams = EC_GROUP_get_ecparameters(grp, NULL))
3dfed0
+        || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecparameters(ecparams))
3dfed0
+        || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
3dfed0
+        goto err;
3dfed0
+    EC_GROUP_free(grp_copy);
3dfed0
+    grp_copy = NULL;
3dfed0
+    ECPARAMETERS_free(ecparams);
3dfed0
+    ecparams = NULL;
3dfed0
+
3dfed0
+    /* Test EC_GROUP_new_from_ecpkparameters not setting the flag */
3dfed0
+    if (!TEST_int_eq(EC_GROUP_get_asn1_flag(grp), OPENSSL_EC_NAMED_CURVE)
3dfed0
+        || !TEST_ptr(ecpkparams = EC_GROUP_get_ecpkparameters(grp, NULL))
3dfed0
+        || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecpkparameters(ecpkparams))
3dfed0
+        || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0)
3dfed0
+        || !TEST_ptr(key = EC_KEY_new())
3dfed0
+    /* Test EC_KEY_decoded_from_explicit_params on key without a group */
3dfed0
+        || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), -1)
3dfed0
+        || !TEST_int_eq(EC_KEY_set_group(key, grp_copy), 1)
3dfed0
+    /* Test EC_KEY_decoded_from_explicit_params negative case */
3dfed0
+        || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), 0))
3dfed0
+        goto err;
3dfed0
+    EC_GROUP_free(grp_copy);
3dfed0
+    grp_copy = NULL;
3dfed0
+    ECPKPARAMETERS_free(ecpkparams);
3dfed0
+    ecpkparams = NULL;
3dfed0
+
3dfed0
+    /* Test d2i_ECPKParameters with named params not setting the flag */
3dfed0
+    if (!TEST_int_gt(encodedlen = i2d_ECPKParameters(grp, &encodedparams), 0)
3dfed0
+        || !TEST_ptr(encp = encodedparams)
3dfed0
+        || !TEST_ptr(grp_copy = d2i_ECPKParameters(NULL, &encp, encodedlen))
3dfed0
+        || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
3dfed0
+        goto err;
3dfed0
+    EC_GROUP_free(grp_copy);
3dfed0
+    grp_copy = NULL;
3dfed0
+    OPENSSL_free(encodedparams);
3dfed0
+    encodedparams = NULL;
3dfed0
+
3dfed0
+    /* Asn1 flag stays set to explicit with EC_GROUP_new_from_ecpkparameters */
3dfed0
+    EC_GROUP_set_asn1_flag(grp, OPENSSL_EC_EXPLICIT_CURVE);
3dfed0
+    if (!TEST_ptr(ecpkparams = EC_GROUP_get_ecpkparameters(grp, NULL))
3dfed0
+        || !TEST_ptr(grp_copy = EC_GROUP_new_from_ecpkparameters(ecpkparams))
3dfed0
+        || !TEST_int_eq(EC_GROUP_get_asn1_flag(grp_copy), OPENSSL_EC_EXPLICIT_CURVE)
3dfed0
+        || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 0))
3dfed0
+        goto err;
3dfed0
+    EC_GROUP_free(grp_copy);
3dfed0
+    grp_copy = NULL;
3dfed0
+
3dfed0
+    /* Test d2i_ECPKParameters with explicit params setting the flag */
3dfed0
+    if (!TEST_int_gt(encodedlen = i2d_ECPKParameters(grp, &encodedparams), 0)
3dfed0
+        || !TEST_ptr(encp = encodedparams)
3dfed0
+        || !TEST_ptr(grp_copy = d2i_ECPKParameters(NULL, &encp, encodedlen))
3dfed0
+        || !TEST_int_eq(EC_GROUP_get_asn1_flag(grp_copy), OPENSSL_EC_EXPLICIT_CURVE)
3dfed0
+        || !TEST_int_eq(grp_copy->decoded_from_explicit_params, 1)
3dfed0
+        || !TEST_int_eq(EC_KEY_set_group(key, grp_copy), 1)
3dfed0
+    /* Test EC_KEY_decoded_from_explicit_params positive case */
3dfed0
+        || !TEST_int_eq(EC_KEY_decoded_from_explicit_params(key), 1))
3dfed0
+        goto err;
3dfed0
+
3dfed0
+    testresult = 1;
3dfed0
+
3dfed0
+ err:
3dfed0
+    EC_KEY_free(key);
3dfed0
+    EC_GROUP_free(grp);
3dfed0
+    EC_GROUP_free(grp_copy);
3dfed0
+    ECPARAMETERS_free(ecparams);
3dfed0
+    ECPKPARAMETERS_free(ecpkparams);
3dfed0
+    OPENSSL_free(encodedparams);
3dfed0
+
3dfed0
+    return testresult;
3dfed0
+}
3dfed0
+
3dfed0
 int setup_tests(void)
3dfed0
 {
3dfed0
     crv_len = EC_get_builtin_curves(NULL, 0);
3dfed0
@@ -196,6 +296,7 @@ int setup_tests(void)
3dfed0
     ADD_TEST(field_tests_ec2_simple);
3dfed0
 #endif
3dfed0
     ADD_ALL_TESTS(field_tests_default, crv_len);
3dfed0
+    ADD_TEST(decoded_flag_test);
3dfed0
     return 1;
3dfed0
 }
3dfed0
 
3dfed0
diff -up openssl-1.1.1g/test/recipes/25-test_verify.t.explicit-params openssl-1.1.1g/test/recipes/25-test_verify.t
3dfed0
--- openssl-1.1.1g/test/recipes/25-test_verify.t.explicit-params	2020-10-23 15:27:31.253311908 +0200
3dfed0
+++ openssl-1.1.1g/test/recipes/25-test_verify.t	2020-10-23 15:27:31.306312361 +0200
3dfed0
@@ -27,7 +27,7 @@ sub verify {
3dfed0
     run(app([@args]));
3dfed0
 }
3dfed0
 
3dfed0
-plan tests => 137;
3dfed0
+plan tests => 142;
3dfed0
 
3dfed0
 # Canonical success
3dfed0
 ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),
3dfed0
@@ -280,6 +280,27 @@ ok(verify("ee-cert-md5", "sslserver", ["
3dfed0
 ok(!verify("ee-cert-md5", "sslserver", ["root-cert"], ["ca-cert"]),
3dfed0
    "reject md5 leaf at auth level 1");
3dfed0
 
3dfed0
+# Explicit vs named curve tests
3dfed0
+SKIP: {
3dfed0
+    skip "EC is not supported by this OpenSSL build", 5
3dfed0
+        if disabled("ec");
3dfed0
+    ok(verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
3dfed0
+               ["ca-cert-ec-named"]),
3dfed0
+        "accept explicit curve leaf with named curve intermediate without strict");
3dfed0
+    ok(verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
3dfed0
+               ["ca-cert-ec-explicit"]),
3dfed0
+        "accept named curve leaf with explicit curve intermediate without strict");
3dfed0
+    ok(!verify("ee-cert-ec-explicit", "sslserver", ["root-cert"],
3dfed0
+               ["ca-cert-ec-named"], "-x509_strict"),
3dfed0
+        "reject explicit curve leaf with named curve intermediate with strict");
3dfed0
+    ok(!verify("ee-cert-ec-named-explicit", "sslserver", ["root-cert"],
3dfed0
+               ["ca-cert-ec-explicit"], "-x509_strict"),
3dfed0
+        "reject named curve leaf with explicit curve intermediate with strict");
3dfed0
+    ok(verify("ee-cert-ec-named-named", "sslserver", ["root-cert"],
3dfed0
+              ["ca-cert-ec-named"], "-x509_strict"),
3dfed0
+        "accept named curve leaf with named curve intermediate with strict");
3dfed0
+}
3dfed0
+
3dfed0
 # Depth tests, note the depth limit bounds the number of CA certificates
3dfed0
 # between the trust-anchor and the leaf, so, for example, with a root->ca->leaf
3dfed0
 # chain, depth = 1 is sufficient, but depth == 0 is not.
3dfed0
diff -up openssl-1.1.1g/util/libcrypto.num.explicit-params openssl-1.1.1g/util/libcrypto.num
3dfed0
--- openssl-1.1.1g/util/libcrypto.num.explicit-params	2020-10-23 15:27:31.265312011 +0200
3dfed0
+++ openssl-1.1.1g/util/libcrypto.num	2020-10-23 15:31:37.424413877 +0200
3dfed0
@@ -4587,6 +4587,7 @@ EVP_PKEY_meth_set_digestverify
3dfed0
 EVP_PKEY_meth_get_digestverify          4541	1_1_1e	EXIST::FUNCTION:
3dfed0
 EVP_PKEY_meth_get_digestsign            4542	1_1_1e	EXIST::FUNCTION:
3dfed0
 RSA_get0_pss_params                     4543	1_1_1e	EXIST::FUNCTION:RSA
3dfed0
+EC_KEY_decoded_from_explicit_params     4547	1_1_1h	EXIST::FUNCTION:EC
3dfed0
 FIPS_drbg_reseed                        6348	1_1_0g	EXIST::FUNCTION:
3dfed0
 FIPS_selftest_check                     6349	1_1_0g	EXIST::FUNCTION:
3dfed0
 FIPS_rand_set_method                    6350	1_1_0g	EXIST::FUNCTION: