openbsd/src/lib/libcrypto/pkcs12/p12_mutl.c, branch OPENBSD_7_9_BASE

Use timingsafe_memcmp when comparing authenticators

2025-06-03T08:42:15+00:00

Replace memcmp() with timingsafe_memcmp() for authentication tag comparison in AES-CCM, GCM, PKCS12 and AES key unwrap code paths to ensure constant-time behavior and avoid potential timing side channels. This aligns with OpenSSL 1e4a355. ok tb@

Use err_local.h rather than err.h in most places

2025-05-10T05:54:39+00:00

ok jsing

Fix namespace build

2024-03-24T06:48:03+00:00

noticed/ok beck

Remove a lot of PKCS12 garbage from the public API

2024-03-02T10:15:16+00:00

PKCS12 is a hot mess. Please participate in the survey at the end of https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html to increase its credibility and unanimity. ok jsing

Fix various NULL dereferences in PKCS #12

2024-01-25T13:44:08+00:00

The PKCS #7 ContentInfo has a mandatory contentType, but the content itself is OPTIONAL. Various unpacking API assumed presence of the content type is enough to access members of the content, resulting in crashes. Reported by Bahaa Naamneh on libressl-security, many thanks ok jsing

libressl _namespace.h: adjust _ALIAS() to require a semicolon

2023-02-16T08:38:17+00:00

LCRYPTO_ALIAS() and LSSL_ALIAS() contained a trailing semicolon. This does not conform to style(9), breaks editors and ctags and (most importantly) my workflow. Fix this by neutering them with asm("") so that -Wpedantic doesn't complain. There's precedent in libc's namespace.h fix suggested by & ok jsing

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Hide symbols in libcrypto/pkcs12

2022-11-12T13:03:28+00:00

ok jsing@

Add an empty pkcs12_local.h and include it where it will soon be needed.

2022-08-20T09:16:18+00:00

Prepare to provide PKCS12 accessors

2022-08-03T20:16:06+00:00

In order to be able to make pkcs12/ opaque, we need an entire family of accessors. These are in a particularly nasty tangle since this was done in about a dozen steps while sprinkling const, renaming functions, etc. The public API also adds backward compat macros for functions that were in the tree for half a day and then renamed. Of course some of them got picked up by some ports. Some of the gruesome hacks in here will go away with the next bump, but that doesn't mean that the pkcs12 directory will be prettier afterward. ok jsing