openbsd/src/lib/libcrypto/dh, branch master

DH_check: teach this DoS vector about RFC 7919 primes

2026-01-23T08:32:22+00:00

ok beck

Scapy special for DH_check()

2026-01-23T08:21:52+00:00

The latest release of Scapy calls DH_check() on all the well-known Diffie-Hellman parameters for RFCs 2409, 3526, and 7919. It does this via pyca/cryptography at startup. Every single time. This is obviously very expensive, due to our 64 MR rounds (which are complete overkill now that we have BPSW). Instead of pondering the ideal number of rounds for BPSW with FFDH, simply skip the check if the parameter matches a well-known prime. These are known to be safe primes, so we can skip those super-expensive and pointless checks without any risk. This is only done for the public dh->p parameter. It could be further optimized, but with the follow-up commit adding the RFC 7919 primes this reduces the startup time to what it was before Scapy 2.7.0: < 1s. Reverting from 64 MR rounds to BN_check_primes rounds, we would still have ~8s startup time without this optimization, which isn't great for an interactive tool. Clearly, it's not entirely our fault, it's also Scapy and cryptography that do something ... suboptimal, but I think we're better off if DH_check() isn't a complete DoS vector. If you're using non-standard parameters with FFDH, you deserve it. We could consider adding a flag for non-well-known p and thus making DH_check() indicate failure for candidate primes larger than, say, 4k. https://github.com/pyca/cryptography/issues/14048 ok beck kenjiro

Use err_local.h rather than err.h in most places

2025-05-10T05:54:39+00:00

ok jsing

Remove #error if OPENSSL_NO_FOO is defined

2025-01-25T17:59:44+00:00

discussed with jsing

dh_ameth: explcitly -> explicitly

2025-01-17T05:04:25+00:00

Remove X9.42 DH rudiments

2024-11-29T15:59:57+00:00

In the unlikely event that we should ever decide to implement this after a quarter century of not needing it, we can readily put this back. Until then this is dead weight. prompted by a question by djm ok jsing

Remove weird pad member that was never set to zero after malloc() so

2024-11-29T07:42:35+00:00

the weird thing it was supposed to be doing couldn't possibly work. ok jsing

Garbage collect the DH_check*_ex() API

2024-08-30T17:44:56+00:00

This was only needed by the EVP_PKEY_*check() API, which was defanged. So this silly garbage can now go: it translated flags to errors on the error stack so that openssl *check could print ugly errors while DoS-ing the user. ok beck

Remove the pkey_{,public_,param_}check() handlers

2024-08-29T16:58:19+00:00

This disables the EVP_PKEY_*check() API and makes it fail (more precisely indicate lack of support) on all key types. This is an intermediate step to full removal. Removal is ok beck jsing

replace strtol(3) usage with strtonum(3); idea/ok/tweaks tb@

2024-08-26T22:00:47+00:00