Commit 78669ae813 for openssl.org

commit 78669ae813f552ffb13608b92866f6f18dae671c
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date:   Sat Jul 18 21:14:23 2026 +0900

    doc: clarify raw RSA migration

    RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5
    and no padding, but the migration guide currently describes their EVP
    replacements as using no padding only.

    Document direct mappings to EVP_PKEY_sign() and
    EVP_PKEY_verify_recover(), and explain that compatibility requires no
    signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or
    RSA_NO_PADDING.

    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    MergeDate: Mon Jul 27 07:54:00 2026
    (Merged from https://github.com/openssl/openssl/pull/31996)

diff --git a/doc/man7/ossl-guide-migration.pod b/doc/man7/ossl-guide-migration.pod
index bf5c57d617..55a50a4376 100644
--- a/doc/man7/ossl-guide-migration.pod
+++ b/doc/man7/ossl-guide-migration.pod
@@ -2428,8 +2428,11 @@ See L</Deprecated low-level encryption functions>

 RSA_private_encrypt(), RSA_public_decrypt()

-This is equivalent to doing sign and verify recover operations (with a padding
-mode of none). See L</Deprecated low-level signing functions>.
+These are equivalent to L<EVP_PKEY_sign(3)> and
+L<EVP_PKEY_verify_recover(3)> operations, respectively. For compatibility
+with the legacy low-level operations, do not configure a signature digest and
+use the same padding mode as the legacy call (B<RSA_PKCS1_PADDING> or
+B<RSA_NO_PADDING>). See L</Deprecated low-level signing functions>.

 =item *