Commit 804fc3ecd8 for openssl.org

commit 804fc3ecd8dbced41171c7e7eb249ce54dff50a3
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Tue Jun 30 19:14:23 2026 +0200

    apps: test ec app -param_enc option

    Exercise the previously untested -param_enc option of the ec app,
    covering named_curve and explicit parameter encodings (compared
    against checked-in reference encodings) as well as rejection of an
    invalid value.

    Assisted-by: Claude:claude-opus-4-8

    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Mon Jul 13 15:00:25 2026
    (Merged from https://github.com/openssl/openssl/pull/31799)

diff --git a/test/recipes/15-test_ec.t b/test/recipes/15-test_ec.t
index 5ae3943cb6..5b0a69f0ca 100644
--- a/test/recipes/15-test_ec.t
+++ b/test/recipes/15-test_ec.t
@@ -19,7 +19,7 @@ setup("test_ec");

 plan skip_all => 'EC is not supported in this build' if disabled('ec');

-plan tests => 17;
+plan tests => 18;

 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);

@@ -128,6 +128,30 @@ subtest 'EC point conversion form (-conv_form)' => sub {
        "an invalid conversion form is rejected");
 };

+subtest 'EC parameter encoding (-param_enc)' => sub {
+    plan tests => 6;
+
+    my $key = srctop_file("test", "testec-p256.pem");
+
+    ok(run(app(['openssl', 'ec', '-in', $key, '-pubout', '-param_enc',
+                'named_curve', '-outform', 'DER', '-out', 'ec-param-named.der'])),
+       "writing public key with named_curve parameter encoding");
+    ok(run(app(['openssl', 'ec', '-in', $key, '-pubout', '-param_enc',
+                'explicit', '-outform', 'DER', '-out', 'ec-param-explicit.der'])),
+       "writing public key with explicit parameter encoding");
+    ok((-s 'ec-param-named.der') < (-s 'ec-param-explicit.der'),
+       "named_curve encoding is smaller than explicit");
+    # The encodings are deterministic for a fixed key, so compare them
+    # against the checked-in reference files.
+    is(compare('ec-param-named.der', data_file('ec-param-named.der')), 0,
+       "named_curve encoding matches the reference file");
+    is(compare('ec-param-explicit.der', data_file('ec-param-explicit.der')), 0,
+       "explicit encoding matches the reference file");
+    ok(!run(app(['openssl', 'ec', '-in', $key, '-noout',
+                 '-param_enc', 'bogus'])),
+       "an invalid parameter encoding is rejected");
+};
+
 subtest 'Check loading of fips and non-fips keys' => sub {
     plan skip_all => "FIPS is disabled"
         if $no_fips;
diff --git a/test/recipes/15-test_ec_data/ec-param-explicit.der b/test/recipes/15-test_ec_data/ec-param-explicit.der
new file mode 100644
index 0000000000..e29a3a7208
Binary files /dev/null and b/test/recipes/15-test_ec_data/ec-param-explicit.der differ
diff --git a/test/recipes/15-test_ec_data/ec-param-named.der b/test/recipes/15-test_ec_data/ec-param-named.der
new file mode 100644
index 0000000000..7a75bb5cf8
Binary files /dev/null and b/test/recipes/15-test_ec_data/ec-param-named.der differ