main's EVP_aes_128_cbc descriptor, the one CMAC uses, is a
LibreSslCipher, and this branch's EVP_EncryptInit_ex and
EVP_DecryptInit_ex take a LibreSslEvpCipher of the same layout, but no
test passed the one to the other. The new case does, with the
CBC-AES128 vectors of NIST SP 800-38A F.2.1 and F.2.2: encryption and
decryption without padding, and a round trip with PKCS#7 padding, in
chunks of 1, 7, 16 and 64 bytes. It covers code that already works, so
it has no red.
The cipher context test required EVP_CIPHER_CTX_cleanup with an ENGINE
set, and EVP_EncryptInit_ex given one, to throw. ENGINE support isn't
implemented, and a test shouldn't lock that in, so both checks go. The
calls still refuse an ENGINE, as the debt entry says; the null-pointer,
malformed-context and invalid-length checks stay.
GcmFinish and the TLS decrypt path compared the computed tag with the
expected one through std::memcmp, which can stop at the first differing
byte and so show how much of a tag matches. Both now compare every byte
and fold the differences, as LibreSSL does with timingsafe_memcmp.
The tests now flip each byte of the tag in turn, for every GCM vector's
EVP_DecryptFinal_ex and for the TLS record decrypt, and require each one
to be rejected.
Yunus Shaikh