A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE 2026-03-18T08:02:40+00:00 2026-03-18T08:02:40+00:00 tb 2026-03-18T08:02:40+00:00 urn:sha1:e1991105df8fe12032795b7f34ed61fd9272e525 We received reports that the too generic internal ecdsa_{sign,verify}() symbol names clash in some static links. The naming here is annoying because the EC_KEY_METHOD amalgamated the no longer existing ECDH and ECDSA methods which themselves had poorly chosen method names, still reflected in public API. There are various messes here. The ECDSA verify methods are declared in ec_local.h, whereas the ECDSA sign methods are in ecdsa_local.h (which is itself pretty useless and really only about EC_KEY_METHOD). I therefore merged the ECDSA method declarations into ec_local.h and deleted ecdsa_local.h since I see no real benefit to the latter. ecdsa.c needs ec_local.h anyway. Having the method declarations next to EC_KEY_METHOD seems sensible. I left the order as it was, matching ecdsa.c. The eckey_compute_pubkey() prototype should probably be moved down. With one exception I just added an ec_key_ prefix. This leads to a a repetition of 'key' in ec_key_ecdh_compute_key() which I chose to live with because it matches the public ECDH_compute_key() (mostly used by SSH implementations). The exception is ec_key_generate_key() where I expanded the gen() leading to another _key repetition but this then matches EC_KEY_generate_key(). Thanks to Rosen Penev for reporting and sending an initial diff. See also https://github.com/gsliepen/tinc/issues/478 ok jsing 2026-03-16T22:19:32+00:00 tb 2026-03-16T22:19:32+00:00 urn:sha1:ec0894d4cccd2b2d88759796071c3ed1afd3a475 2025-05-10T05:54:39+00:00 tb 2025-05-10T05:54:39+00:00 urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709 ok jsing 2024-04-15T15:49:37+00:00 tb 2024-04-15T15:49:37+00:00 urn:sha1:3c5f500379f0c27b65b2a2e1beef801967ef2838 ok jsing 2023-08-08T13:09:28+00:00 tb 2023-08-08T13:09:28+00:00 urn:sha1:409280fb4ae64371e28c3111dba6a52b1f295a56 This was a workaround due to the historically non-constant time scalar multiplication in the EC code. Since Brumley and Tuveri implemented the Montgomery ladder, this is no longer useful and should have been removed a long time ago, as it now does more harm than good. Keep the preallocations as they still help hiding some timing info. ok jsing 2023-08-03T18:53:56+00:00 tb 2023-08-03T18:53:56+00:00 urn:sha1:44ff07e01874ea8be0c72bf9d20cb7f13b76cca8 Provide bn_rand_in_range() which is a slightly tweaked version of what was previously called bn_rand_range(). The way bn_rand_range() is called in libcrypto, the lower bound is always expressible as a word. In fact, most of the time it is 1, the DH code uses a 2, the MR tests in BPSW use 3 and an exceptinally high number appears in the Tonelli-Shanks implementation where we use 32. Converting these lower bounds to BIGNUMs on the call site is annoying so let bn_rand_interval() do that internally and route that through bn_rand_in_range(). This way we can avoid using BN_sub_word(). Adjust the bn_isqrt() test to use bn_rand_in_range() since that's the only caller that uses actual BIGNUMs as lower bounds. ok jsing 2023-07-28T09:18:10+00:00 tb 2023-07-28T09:18:10+00:00 urn:sha1:f82b526c76ed6b20c6a9efccc58da9c265c1ba89 2023-07-28T08:57:46+00:00 tb 2023-07-28T08:57:46+00:00 urn:sha1:e9620d02140d013d9a99c424c98a0b4840e3d18f It is hard to remember that ECDSA_do_{sign,verify}() call ecdsa_sign_sig(). Especially since the distinction to ECDSA_{sign,verify}() isn't clear from the names. To add to the confusion, the public API is ordered differently than the methods they call. So in this case it seems tidier to place the public API next to the methods. ok jsing 2023-07-28T08:54:41+00:00 tb 2023-07-28T08:54:41+00:00 urn:sha1:58ea26950cdeca103bbfe2c2a755c526ca370145 There is no reason to keep these. It is cleaner to keep ECDSA_sign_setup() but remove the logic for passed-in kinv and r. Refuse to cooperate as far as possible. Someone could still implement their own versions of ECDSA_{do_,}_sign_ex() and ECDSA_sign_setup() by leveraging EC_KEY_METHOD_get_sign() and building their own wrappers. We can't make such an implementation of ECDSA_sign_setup() fail, but we make the actual signing fail since we no longer "do the right thing". ok jsing 2023-07-28T08:49:43+00:00 tb 2023-07-28T08:49:43+00:00 urn:sha1:a60bb43ba730ae6d2d64a6568ee5fddecaf151e3 ECDSA_sign_setup() permits precomputing the values of the inverse of the random k and the corresponding r. These can then be fed into the signing routines ECDSA_{do_,}sign_ex() multiple times if needed. This is not a great idea and the interface adds a lot of unwanted complexity. Not to mention that nothing ever used this correctly - if s works out to 0, a special error code is thrown requesting that the caller provide new kinv and r values. Unsurprisingly, nobody ever checked for that special error code. ok jsing This commit marks the start of a libcrypto major bump. Do not build the tree until I bumped the shlib_version and synced file sets (in about 35 commits).