From 4dcfdfce93d6c5b5065323b0488ea93a938acb49 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 27 May 2020 11:50:05 +0100 Subject: [PATCH] Make it clear that you can't use all ciphers for CMAC Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/12107) --- doc/man3/EVP_PKEY_new.pod | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/man3/EVP_PKEY_new.pod b/doc/man3/EVP_PKEY_new.pod index 667269cc62..faf5a117e5 100644 --- a/doc/man3/EVP_PKEY_new.pod +++ b/doc/man3/EVP_PKEY_new.pod @@ -66,7 +66,8 @@ B, B, B or B. EVP_PKEY_new_CMAC_key() works in the same way as EVP_PKEY_new_raw_private_key() except it is only for the B algorithm type. In addition to the raw private key data, it also takes a cipher algorithm to be used during -creation of a CMAC in the B argument. +creation of a CMAC in the B argument. The cipher should be a standard +encryption only cipher. For example AEAD and XTS ciphers should not be used. EVP_PKEY_new_mac_key() works in the same way as EVP_PKEY_new_raw_private_key(). New applications should use EVP_PKEY_new_raw_private_key() instead. -- 2.25.1