OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2
if you are using the ssl26 packages for ssh and other things to work you will
need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs

1 files changed, 66 insertions, 105 deletions

diff --git a/src/lib/libcrypto/dsa/dsa_gen.c b/src/lib/libcrypto/dsa/dsa_gen.c
index b5e5ec06e5..2294a362d9 100644
--- a/src/lib/libcrypto/dsa/dsa_gen.c
+++ b/src/lib/libcrypto/dsa/dsa_gen.c
@@ -59,12 +59,18 @@
 #undef GENUINE_DSA
 
 #ifdef GENUINE_DSA
+/* Parameter generation follows the original release of FIPS PUB 186,
+ * Appendix 2.2 (i.e. use SHA as defined in FIPS PUB 180) */
 #define HASH    SHA
 #else
+/* Parameter generation follows the updated Appendix 2.2 for FIPS PUB 186,
+ * also Appendix 2.2 of FIPS PUB 186-1 (i.e. use SHA as defined in
+ * FIPS PUB 180-1) */
 #define HASH    SHA1
 #endif 
 
 #ifndef NO_SHA
+
 #include <stdio.h>
 #include <time.h>
 #include "cryptlib.h"
@@ -74,8 +80,9 @@
 #include <openssl/rand.h>
 
 DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
-             int *counter_ret, unsigned long *h_ret, void (*callback)(),
-             char *cb_arg)
+                int *counter_ret, unsigned long *h_ret,
+                void (*callback)(int, int, void *),
+                void *cb_arg)
         {
         int ok=0;
         unsigned char seed[SHA_DIGEST_LENGTH];
@@ -86,47 +93,63 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
         BN_MONT_CTX *mont=NULL;
         int k,n=0,i,b,m=0;
         int counter=0;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
+        int r=0;
+        BN_CTX *ctx=NULL,*ctx2=NULL,*ctx3=NULL;
         unsigned int h=2;
         DSA *ret=NULL;
 
         if (bits < 512) bits=512;
         bits=(bits+63)/64*64;
 
+        if (seed_len < 20)
+                seed_in = NULL; /* seed buffer too small -- ignore */
+        if (seed_len > 20) 
+                seed_len = 20; /* App. 2.2 of FIPS PUB 186 allows larger SEED,
+                                * but our internal buffers are restricted to 160 bits*/
         if ((seed_in != NULL) && (seed_len == 20))
                 memcpy(seed,seed_in,seed_len);
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
         if ((ctx2=BN_CTX_new()) == NULL) goto err;
+        if ((ctx3=BN_CTX_new()) == NULL) goto err;
         if ((ret=DSA_new()) == NULL) goto err;
 
         if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
 
-        r0= &(ctx2->bn[0]);
-        g= &(ctx2->bn[1]);
-        W= &(ctx2->bn[2]);
-        q= &(ctx2->bn[3]);
-        X= &(ctx2->bn[4]);
-        c= &(ctx2->bn[5]);
-        p= &(ctx2->bn[6]);
-        test= &(ctx2->bn[7]);
+        BN_CTX_start(ctx2);
+        r0 = BN_CTX_get(ctx2);
+        g = BN_CTX_get(ctx2);
+        W = BN_CTX_get(ctx2);
+        q = BN_CTX_get(ctx2);
+        X = BN_CTX_get(ctx2);
+        c = BN_CTX_get(ctx2);
+        p = BN_CTX_get(ctx2);
+        test = BN_CTX_get(ctx2);
 
         BN_lshift(test,BN_value_one(),bits-1);
 
         for (;;)
                 {
-                for (;;)
+                for (;;) /* find q */
                         {
+                        int seed_is_random;
+
                         /* step 1 */
                         if (callback != NULL) callback(0,m++,cb_arg);
 
                         if (!seed_len)
-                                RAND_bytes(seed,SHA_DIGEST_LENGTH);
+                                {
+                                RAND_pseudo_bytes(seed,SHA_DIGEST_LENGTH);
+                                seed_is_random = 1;
+                                }
                         else
-                                seed_len=0;
-
+                                {
+                                seed_is_random = 0;
+                                seed_len=0; /* use random seed if 'seed_in' turns out to be bad*/
+                                }
                         memcpy(buf,seed,SHA_DIGEST_LENGTH);
                         memcpy(buf2,seed,SHA_DIGEST_LENGTH);
+                        /* precompute "SEED + 1" for step 7: */
                         for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
                                 {
                                 buf[i]++;
@@ -142,10 +165,15 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                         /* step 3 */
                         md[0]|=0x80;
                         md[SHA_DIGEST_LENGTH-1]|=0x01;
-                        if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) abort();
+                        if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) goto err;
 
                         /* step 4 */
-                        if (DSA_is_prime(q,callback,cb_arg) > 0) break;
+                        r = BN_is_prime_fasttest(q, DSS_prime_checks, callback, ctx3, cb_arg, seed_is_random);
+                        if (r > 0)
+                                break;
+                        if (r != 0)
+                                goto err;
+
                         /* do a callback call */
                         /* step 5 */
                         }
@@ -155,16 +183,22 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
 
                 /* step 6 */
                 counter=0;
+                /* "offset = 2" */
 
                 n=(bits-1)/160;
                 b=(bits-1)-n*160;
 
                 for (;;)
                         {
+                        if (callback != NULL && counter != 0)
+                                callback(0,counter,cb_arg);
+
                         /* step 7 */
                         BN_zero(W);
+                        /* now 'buf' contains "SEED + offset - 1" */
                         for (k=0; k<=n; k++)
                                 {
+                                /* obtain "SEED + offset + k" by incrementing: */
                                 for (i=SHA_DIGEST_LENGTH-1; i >= 0; i--)
                                         {
                                         buf[i]++;
@@ -174,7 +208,8 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                                 HASH(buf,SHA_DIGEST_LENGTH,md);
 
                                 /* step 8 */
-                                if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0)) abort();
+                                if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,r0))
+                                        goto err;
                                 BN_lshift(r0,r0,160*k);
                                 BN_add(W,W,r0);
                                 }
@@ -194,23 +229,25 @@ DSA *DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
                         if (BN_cmp(p,test) >= 0)
                                 {
                                 /* step 11 */
-                                if (DSA_is_prime(p,callback,cb_arg) > 0)
-                                        goto end;
+                                r = BN_is_prime_fasttest(p, DSS_prime_checks, callback, ctx3, cb_arg, 1);
+                                if (r > 0)
+                                                goto end; /* found it */
+                                if (r != 0)
+                                        goto err;
                                 }
 
                         /* step 13 */
                         counter++;
+                        /* "offset = offset + n + 1" */
 
                         /* step 14 */
                         if (counter >= 4096) break;
-
-                        if (callback != NULL) callback(0,counter,cb_arg);
                         }
                 }
 end:
         if (callback != NULL) callback(2,1,cb_arg);
 
-        /* We now need to gernerate g */
+        /* We now need to generate g */
         /* Set r0=(p-1)/q */
         BN_sub(test,p,BN_value_one());
         BN_div(r0,NULL,test,q,ctx);
@@ -245,89 +282,13 @@ err:
                 if (h_ret != NULL) *h_ret=h;
                 }
         if (ctx != NULL) BN_CTX_free(ctx);
-        if (ctx != NULL) BN_CTX_free(ctx2);
-        if (mont != NULL) BN_MONT_CTX_free(mont);
-        return(ok?ret:NULL);
-        }
-
-int DSA_is_prime(BIGNUM *w, void (*callback)(), char *cb_arg)
-        {
-        int ok= -1,j,i,n;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
-        BIGNUM *w_1,*b,*m,*z,*tmp,*mont_1;
-        int a;
-        BN_MONT_CTX *mont=NULL;
-
-        if (!BN_is_bit_set(w,0)) return(0);
-
-        if ((ctx=BN_CTX_new()) == NULL) goto err;
-        if ((ctx2=BN_CTX_new()) == NULL) goto err;
-        if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
-
-        m=   &(ctx2->bn[2]);
-        b=   &(ctx2->bn[3]);
-        z=   &(ctx2->bn[4]);
-        w_1= &(ctx2->bn[5]);
-        tmp= &(ctx2->bn[6]);
-        mont_1= &(ctx2->bn[7]);
-
-        /* step 1 */
-        n=50;
-
-        /* step 2 */
-        if (!BN_sub(w_1,w,BN_value_one())) goto err;
-        for (a=1; !BN_is_bit_set(w_1,a); a++)
-                ;
-        if (!BN_rshift(m,w_1,a)) goto err;
-
-        BN_MONT_CTX_set(mont,w,ctx);
-        BN_to_montgomery(mont_1,BN_value_one(),mont,ctx);
-        BN_to_montgomery(w_1,w_1,mont,ctx);
-        for (i=1; i < n; i++)
+        if (ctx2 != NULL)
                 {
-                /* step 3 */
-                BN_rand(b,BN_num_bits(w)-2/*-1*/,0,0);
-                /* BN_set_word(b,0x10001L); */
-
-                /* step 4 */
-                j=0;
-                if (!BN_mod_exp_mont(z,b,m,w,ctx,mont)) goto err;
-
-                if (!BN_to_montgomery(z,z,mont,ctx)) goto err;
-
-                /* step 5 */
-                for (;;)
-                        {
-                        if (((j == 0) && (BN_cmp(z,mont_1) == 0)) ||
-                                (BN_cmp(z,w_1) == 0))
-                                break;
-
-                        /* step 6 */
-                        if ((j > 0) && (BN_cmp(z,mont_1) == 0))
-                                {
-                                ok=0;
-                                goto err;
-                                }
-
-                        j++;
-                        if (j >= a)
-                                {
-                                ok=0;
-                                goto err;
-                                }
-
-                        if (!BN_mod_mul_montgomery(z,z,z,mont,ctx)) goto err;
-                        if (callback != NULL) callback(1,j,cb_arg);
-                        }
+                BN_CTX_end(ctx2);
+                BN_CTX_free(ctx2);
                 }
-
-        ok=1;
-err:
-        if (ok == -1) DSAerr(DSA_F_DSA_IS_PRIME,ERR_R_BN_LIB);
-        BN_CTX_free(ctx);
-        BN_CTX_free(ctx2);
-        BN_MONT_CTX_free(mont);
-        
-        return(ok);
+        if (ctx3 != NULL) BN_CTX_free(ctx3);
+        if (mont != NULL) BN_MONT_CTX_free(mont);
+        return(ok?ret:NULL);
         }
 #endif