summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Rename ecs_local.h into ecdsa_local.htb2023-07-057-13/+13
|
* Make variables in prototypes match function declarationstb2023-07-051-6/+6
|
* Drop useless ossl_ prefixestb2023-07-058-40/+52
| | | | discussed with jsing
* Avoid outputting invalid signaturestb2023-07-041-1/+11
| | | | | | | | | | | | The caller can provide an r which will be added to the ECDSA_SIG unchecked. This can happen via ECDSA_{,do_}sign_ex() or ECDSA_sign_setup() or else via a custom sign_sig() handler. Therefore add a check that it is in the bounds required. Since k was long thrown away, there's no way to check kinv, so it needs to be trusted. Misdesigned APIs that will output garbage everywhere... ok jsing
* Clean up ECDSA verificationtb2023-07-041-14/+29
| | | | | | | | Use variable names that correspond more closely to the standard. Use an additional variable for s^-1 for readability. Annotate the code with the corresponding steps from FIPS 186-5. ok jsing
* ECDSA signing: annotate code with steps corresponding to FIPS 185-6.tb2023-07-041-3/+25
| | | | ok jsing
* Extract private key and group order in s computationtb2023-07-041-19/+18
| | | | | | | This pushes a few variables no longer needed in ossl_ecdsa_sign_sig() into ecdsa_compute_s() separating API logic and pure computation a bit more. ok beck
* Use key for the EC_KEY everywheretb2023-07-041-39/+38
|
* Some more consistency in variable namestb2023-07-041-15/+15
|
* Normalize ECDSA_SIG to be sig everywheretb2023-07-041-11/+11
|
* Normalize on digest and digest_len rather than dgst dlen dgstlen, etc.tb2023-07-041-28/+34
|
* Rework ecdsa_prepare_digest()tb2023-07-041-35/+35
| | | | | | | | Make it take an EC_KEY instead of a group order in preparation for further cleanup. Rename m into e to match the standard better. Also buy some vowels for jsing. ok beck jsing
* Plug leak in the ssltesttb2023-07-041-1/+2
| | | | | | | | Removing -tls1 moved some tests from the legacy stack to the TLSv1.3 stack. On a HRR, the alpn callback would be called twice and allocate the global twice, thereby leaking. So free it up front. Joint suffering with bcook and beck
* Factor the computation of ECDSA s into a functiontb2023-07-041-69/+88
| | | | | | | | ossl_ecdsa_sign_sig() is already complicated enough. The math bit is entirely self contained and does not need to obfuscate control flow and logic. with feedback from and ok jsing
* sign_sig: drop ckinvtb2023-07-031-5/+7
| | | | | | | | The only reason ckinv exists is to be able to avoid a copy. This copy leaks some timing info, that will be mitigated in a subsequent step. It is an unused or at least uncommonly used codepath. ok jsing
* Rework the logic in ECDSA sign_sig()tb2023-07-031-24/+30
| | | | | | | | | | | If the caller supplied both kinv and r, we don't loop but rather throw an undocumented error code that no one uses, which is intended to tell the caller to run ECDSA_sign_setup() and try again. Use a boolean that indicates this situation so that the logic becomes a bit more transparent. ok jsing
* add regress tests for the remainder of the function provided by our uuid.hjasper2023-07-031-5/+137
|
* Delete some more references to dead policy code.tobhe2023-07-031-12/+1
| | | | | | Fixes -DNAMESPACE ok tb@
* sign_sig: test on assignmenttb2023-07-031-5/+6
|
* sign_setup: split another check into twotb2023-07-031-2/+6
|
* typotobhe2023-07-031-1/+1
|
* Split range checks for ECDSA r and ECDSA stb2023-07-031-3/+8
| | | | requested by jsing
* Switch a couple of test from ucmp to cmptb2023-07-031-4/+4
| | | | | | | | This is confusing, as both sides involved should be unsigned. The ec code is undecided on whether the group order can be negative. It should never be, so lets see what happen with this slightly stricter check. discussed with jsing
* ossl_ecdsa_verify_sig(): simplify range checkstb2023-07-031-6/+4
| | | | | | | The checks whether r and s lie in the interval [1, order) were a bit uglier than necessary. Clean this up. ok beck jsing
* List variables in a somewhat more sensible ordertb2023-07-031-4/+4
|
* In ossl_ecdsa_verify_sig() use BN_CTX more idiomaticallytb2023-07-031-8/+10
| | | | ok beck jsing
* Split a bunch of unrelated checkstb2023-07-031-3/+10
| | | | ok beck jsing
* Make ossl_ecdsa_verify_sig() single exittb2023-07-031-4/+4
| | | | ok beck jsing
* Switch ossl_ecdsa_verify() to timingsafe_memcmp()tb2023-07-031-2/+2
| | | | Requested by jsing
* Streamline ossl_ecdsa_verify()tb2023-07-031-7/+13
| | | | | | | Make it single exit and use API more idiomatically and some other cosmetics. ok beck jsing
* Explicit parameter printing can also use get0_order()tb2023-07-031-5/+6
| | | | ok beck jsing
* Convert ossl_ec_key_gen() and EC_KEY_check_key()tb2023-07-031-23/+6
| | | | | | These also get the EC_GROUP_get0_order() treatment ok beck jsing
* Convert EC_GROUP_check() to EC_GROUP_get0_order()tb2023-07-031-10/+3
| | | | ok beck jsing
* Inline two copies of EC_GROUP_order_bits()tb2023-07-031-22/+6
| | | | | | | This code is way more complicated than it needs to be. Simplify. ec_bits() was particularly stupid. ok beck jsing
* some minor fix up;jmc2023-07-031-5/+5
|
* Bring back no_tls1 and no_tls1_1 as undocumented silently discarded opitonsbeck2023-07-032-8/+20
| | | | | | | | While I'm here, change the no_ssl2 and no_ssl3 options to use OPTION_DISCARD as well instead of continuing to set a no-op option flag. ok jsing@ tb@
* Switch ECDSA code to using EC_GROUP_get0_order()tb2023-07-031-25/+17
| | | | ok jsing
* Provide internal-only EC_GROUP_get0_order()tb2023-07-032-3/+11
| | | | ok jsing
* Remove the tls1.0 and 1.1 related options from the openssl(1) toolkitbeck2023-07-033-159/+20
| | | | ok tb@
* Another empty line did not want to go intb2023-07-031-1/+2
|
* Stop testing tls 1.0 and 1.1beck2023-07-033-9/+5
| | | | They have gone behind the barn.
* Trade a pair of extra braces for a missing empty linetb2023-07-031-3/+3
|
* Simplify allocation checkstb2023-07-021-11/+11
| | | | | | | | | | Instead of attempting to allocate a few times and only then check all the returned pointers for NULL, allocate and check one after the othre. This is easier on the eyes and what we usually do. Prompted by a report by Ilya Shipitsin ok beck
* Clean up dynamic tables in OPENSSL_cleanup()tb2023-07-021-1/+10
| | | | | | | | | This is not currently done in OpenSSL, but it looks more like something that was mised rather than desired behavior. There are some thread safety issues here, but those are rife in this codebase anyway (although I heard claims on some versions of this lib being "fully threadsafe"). no objection jsing
* Disable TLS 1.0 and TLS 1.1 in libsslbeck2023-07-029-161/+106
| | | | | | | | | | | | Their time has long since past, and they should not be used. This change restricts ssl to versions 1.2 and 1.3, and changes the regression tests to understand we no longer speak the legacy protocols. For the moment the magical "golden" byte for byte comparison tests of raw handshake values are disabled util jsing fixes them. ok jsing@ tb@
* Convert some tables to C99 initializerstb2023-07-023-42/+249
| | | | ok & "happy pirate day" beck
* Fix return values of ecx methodstb2023-07-021-5/+5
| | | | | | | | | It is hard to get your return values right if you choose them to be a random subset of {-2, ..., 3}. The item_verify() and the digestverify() methods don't return 0 on error, but -1. Here 0 means "failed to verify", obviously. ok jsing
* Demacro SHA-512.jsing2023-07-021-54/+112
| | | | | | | | | | | | | | | Use static inline functions instead of macros to implement SHA-512. At the same time, make two key changes - firstly, rather than trying to outsmart the compiler and shuffle variables around, write the algorithm the way it is documented and actually swap the variable contents. Secondly, instead of interleaving the message schedule update and the round, do the full message schedule update first, then process the round. Overall, we get safer and more readable code. Additionally, the compiler can generate smaller and faster code (with a gain of 5-10% across a range of architectures). ok beck@ tb@
* Fix typo in previoustb2023-07-021-2/+2
|
* Use asprintf() to avoid repetition in string constantstb2023-07-021-6/+13
| | | | | | ... since ASN1_bn_print() is stupid. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-31 06:56:59 +0000