Nghi Ho

Harden CLI input validation and file output (#3347) ### Issues: Resolves P469904855 ### Description of changes: Fixes input validation gaps and tightens file permissions in the CLI tool: - Always fail on DNS resolution errors in s_client regardless of quiet mode - Reject unrecognized -v2 cipher names in pkcs8 -topk8 instead of falling through - Set restrictive permissions (0600) when writing private key files ### Testing: Tests added for each change. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Add ACVP support for multi-expansion HKDF (#3352) ### Issues: Resolves P465812657 ### Description of changes: Add ACVP support for multi-expansion HKDF ### Call-outs: I renamed `TLS13_HKDFExtract` to a generic `HKDFExtract` as it's reused between TLS 1.3 KDF and KDA/HKDF. Also renamed a few other commands/operations to make the naming convention more consistent in `modulewrapper.cc` ### Testing: Run the tool against new test vectors By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Fix `grpc-master-x86_64` integration test (#3346) ### Issues: Resolves P468646736 ### Description of changes: gRPC's new certification selection offloading feature ([code change](https://github.com/grpc/grpc/pull/41937)) is causing our `grpc-master-x86_64` integration test to fail. This PR fixes that. - gRPC's cert selection callback does PEM parsing during the TLS handshake, leaving a stale error on the queue. This causes SSL_get_error to misreport a non-fatal result as fatal SSL_ERROR_SSL. BoringSSL avoids this because a later credential selection loop incidentally clears the error queue. AWS-LC doesn't have this loop, so we now clear after select_certificate_cb returns success. - gRPC also started using `SSL_CTX_set1_group_ids` / `SSL_set1_group_ids` which AWS-LC lacked. This PR adds and exposes both. ### Testing New unit tests added. `grpc-master` passes By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Update security review workflow (#3333) ### Description of changes: Update the security workflow after internal updates which introduced a new UI and addressed rate-limiting issues. The workflow will also post a comment on each PR to remind us to review the security report. ### Call-outs: PR checks will only be updated after this PR is merged, so `security-review` will still fail on this PR. ### Testing: New UI [link](https://d225oy8drgbol2.cloudfront.net/aws-lc/findings.html) By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Update concurrency in `security-review` (#3403) ### Description of changes: Update concurrency in `security-review.yml` so that jobs from different PRs do not cancel each other. ### Testing: Changes will not be reflected in this PR, but was based on [previous work](https://github.com/aws/aws-lc/blob/main/.github/workflows/image-build-android.yml#L20-L26) By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license. --------- Co-authored-by: Sean McGrail <549813+skmcgrail@users.noreply.github.com>

Prepare 5.3.0 (#3354) ### Description of changes: Prepare 5.3.0 By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.