openbsd/src/lib/libcrypto/rsa, branch masterA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=master2026-04-07T13:16:41+00:00Rename labellen to label_len2026-04-07T13:16:41+00:00tb2026-04-07T13:16:41+00:00urn:sha1:825b6076f1b1772665d1adce40e8087ee4e3d091
Requested by jsing, ok beck
Fix NULL deref for malformed OAEP parameters in CMS decryption2026-04-07T13:15:29+00:00tb2026-04-07T13:15:29+00:00urn:sha1:e783182e57d664df5859c6b6cbd65563cdc26528
This converts rsa_cms_decrypt() to use X509_ALGOR_get0() and fixes a
NULL deref when a parameter is (invalidly) omitted similar to the fix
in ec/ec_ameth.c r1.66 from a couple years back. There is currently
an XXX annotating a hairy leak due to trying to be smart and stealing
the parameters from the oaep object. Instead, just make a copy of the
label string and free it in the exit path.
The diff adds an error for labellen == 0 since that is an invalid
encoding of pSpecifiedEmpty (see RFC 8017) -- per the DER the default
must be omitted. This way we avoid a malloc(0) implementation-defined
behavior.
This minor issue was assigned CVE-2026-28390 by OpenSSL and was reported
by too many to list. The fix is my own. It is similar to OpenSSL's fix
only because I rewiewed theirs and suggested an improvement or two.
This is the last of the "security fixes" in today's OpenSSL release that
"affect" LibreSSL. All the other bugs were already fixed a few years back
or we didn't have the code/bugs in the first place.
ok beck jsing
libcrypto: add header guards to *_local.h2025-11-26T10:19:57+00:00tb2025-11-26T10:19:57+00:00urn:sha1:4879f73ba340a5a6a1e4b5812f046c92cf362d95
An upcoming change requires the inclusion of asn1_local.h in x509_local.h
which doesn't work due to missing header guards. Add guards to all local
headers that don't have them, although reacharounds and multiple inclusions
are unlikely to occur for most of those.
ok jsing
libcrypto: rsa gen: min. distance between p and q2025-09-29T08:46:15+00:00jan2025-09-29T08:46:15+00:00urn:sha1:46c56e258ad51543fa1d174ca9568ef545233a34
This is required in NIST Special Publication 800-56B Revision 2
"Recommendation for Pair-Wise Key Establishment Using Integer
Factorization Cryptography":
6 RSA Key Pairs
6.2 Criteria for RSA Key Pairs for Key Establishment
6.2.1 Definition of a Key Pair
3. The prime factors p and q shall be generated using one of
the methods specified in Appendix B.3 of FIPS 186 such that:
c. |p – q| > 2nBits/2−100
ok djm@, tb@
zap stray space2025-08-25T18:47:39+00:00tb2025-08-25T18:47:39+00:00urn:sha1:77f522b90e5282941310b9f28674633e01d6d594Use err_local.h rather than err.h in most places2025-05-10T05:54:39+00:00tb2025-05-10T05:54:39+00:00urn:sha1:41e8f99dd1625a9f0c80ce9d4383e95b18e85709
ok jsing
Remove #error if OPENSSL_NO_FOO is defined2025-01-25T17:59:44+00:00tb2025-01-25T17:59:44+00:00urn:sha1:5d52abc236226c5a47c36b07e2256e77141e373a
discussed with jsing
rsa_pmeth: unify strcmp return checks2025-01-17T15:39:19+00:00tb2025-01-17T15:39:19+00:00urn:sha1:13bb4d5ac808eefe3abb437533ddc959dfeeceee
ok jsing
Fix two incorrect strtonum() conversions2025-01-17T08:50:07+00:00tb2025-01-17T08:50:07+00:00urn:sha1:c7b7f02c70ae7b0b2ff0afb7ffca3587c3a5e4ea
The atoi() would also accept the magic negative values and old openssl
releases would expose these as arguments to -pkeyopt rsa_pss_saltlen:-1
in the openssl pkeyutl "app". While modern openssl switched to having
readable alternatives to these, the oseid component of opensc would use
the old syntax until yesterday.
Still, this is our bug and we need to keep accepting the magic values as
such, so do so. Everything below -3 will be rejected by the RSA_ctrl()
handler later.
Debugged by Doug Engert in https://github.com/OpenSC/OpenSC/issues/3317
ok jsing op
Stop requiring the RSA_FLAG_SIGN_VER2025-01-05T15:39:12+00:00tb2025-01-05T15:39:12+00:00urn:sha1:5c33a5ef4d95e91c63b215ad65de78c9bc54ff85
You can set custom sign and verify handlers on an RSA method (wihch is
used to create RSA private and public key handles). However, even if you
set them explicitly with RSA_meth_set_{sign,verify}(3), these handlers
aren't used for the sake of "backward compatibility" (with what?). In order
to use them, you need to opt your objects into using the custom methods
you set by setting the RSA_FLAG_SIGN_VER flag.
OpenSSL 1.1 dropped this requirement and therefore nobody sets this flag
anyore. Like most of the mechanically added accessors, almost nothing
uses them, but, as found by kn, the yubco-piv-tool does. This resulted
in a public key being passed to rsa_private_encrypt(), which of course
doesn't end well.
So follow OpenSSL 1.1 and drop this muppetry. This makes kn's problem
with yubico-piv-tool go away.
ok jsing kn