openbsd/src/lib/libcrypto/evp/e_aes.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-06-05T18:44:42+00:00 Add a custom copy handler for AES key wrap 2020-06-05T18:44:42+00:00 tb 2020-06-05T18:44:42+00:00 urn:sha1:f599916be5b15add90651fc8802c4f96fc257310 This is necessary because ctx->cipher_data is an EVP_AES_WRAP_CTX containing a pointer to ctx->iv. EVP_CIPHER_CTX_copy() uses memcpy to copy cipher_data to the target struct. The result is that the copy contains a pointer to the wrong struct, which then leads to a use-after-free. The custom copy handler fixes things up to avoid that. Issue reported by Guido Vranken ok beck inoguchi jsing Disallow setting the AES-GCM IV length to 0 2020-04-30T18:43:11+00:00 tb 2020-04-30T18:43:11+00:00 urn:sha1:1813a9138ee882b675662d47ed9fe6974bd433f3 It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff) Disallow the use of zero length IVs in AES-GCM via 2020-04-27T19:31:02+00:00 tb 2020-04-27T19:31:02+00:00 urn:sha1:59b4077b60cc24004bc23295bd2ff465be743f11 EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen. Revert the other hunk of r1.36 as well: in the case of CCM, ccm.key is 2019-05-12T15:52:46+00:00 tb 2019-05-12T15:52:46+00:00 urn:sha1:c355d03d2e34e4c37bb1eff05e29877d237b7685 assigned from aesni_ccm_init_key() via CRYPTO_ccm128_init(), so it needs to be copied over... Pointed out by Guido Vranken. ok jsing Revert part of r1.36: in the case of GCM, gcm.key is assigned from 2019-05-10T18:41:17+00:00 tb 2019-05-10T18:41:17+00:00 urn:sha1:16b15f4fa4a15b71c7c926fe8125fcd0b253aa22 aesni_gcm_init_key() via CRYPTO_gcm128_init(), so it needs to be copied over... Fixes cryptofuzz issue #14352 and likely also #14374. ok beck jsing Some more malloc() to calloc() conversions. 2019-04-14T17:27:42+00:00 jsing 2019-04-14T17:27:42+00:00 urn:sha1:a2c695645cf28a223a6da4cbfbdfd65c796e2dd6 ok tb@ Remove two pointless chunks of code. 2019-04-14T17:26:27+00:00 jsing 2019-04-14T17:26:27+00:00 urn:sha1:b85b600c49bd5a1bdc62030be1ebd1cc9ceb145d This reverts part of OpenSSL c2fd5d79, which added the same code to AES CCM, GCM and XTS. In the case of CCM and GCM nothing assigns {ccm,gcm}.key so there is never going to be anything to update (unlike XTS). ok tb@ Provide EVP_aes_{128,192,256}_wrap(). This is a compatible 2019-03-17T18:07:41+00:00 tb 2019-03-17T18:07:41+00:00 urn:sha1:9651ec05f00bf3384031fb7428d88d3daf1e1139 implementation based on the one in OpenSSL 1.0.2r which is still freely licensed. The functions are undocumented in OpenSSL. To use them, one needs to set the undocumented EVP_CIPHER_CTX_FLAG_WRAP_ALLOW flag on the EVP_CIPHER_CTX. resolves #505 ok jsing use freezero() instead of memset/explicit_bzero + free. Substantially 2017-05-02T03:59:45+00:00 deraadt 2017-05-02T03:59:45+00:00 urn:sha1:5904cc0e04409fde39a97e6580535da34eeb4291 reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck LibreSSL : Truncated packet could crash via OOB read 2017-01-31T13:17:21+00:00 inoguchi 2017-01-31T13:17:21+00:00 urn:sha1:06ad158da685c16adafadfcff434641236cac37c This patch is originally from master branch of OpenSSL. - 2198b3a crypto/evp: harden AEAD ciphers. - 8e20499 crypto/evp: harden RC4_MD5 cipher. ok tom@