summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Add TLS1_3_VERSION and SSL_OP_NO_TLSv1_3 defines under guards.jsing2018-11-062-2/+13
| | | | ok beck@ bluhm@ tb@
* Start working towards adding feature flags (rather than anti-feature flags)jsing2018-11-061-1/+10
| | | | | | | for LibreSSL. Add a (commented out) feature flag for TLSv1.3 and define the OPENSSL_NO_TLS1_3 anti-feature flag based on the feature flag. ok beck@ bluhm@ tb@
* Unbreak regress following Supported Elliptic Curve extension rename.jsing2018-11-061-49/+49
|
* Make use of bn_rand_interval() where appropriate.tb2018-11-055-33/+24
| | | | ok beck jsing
* Introduce bn_rand_interval() that allows specifying an interval [a, b)tb2018-11-052-2/+30
| | | | | | from which a a BIGNUM is chosen uniformly at random. ok beck jsing
* Eliminate a few "} else" branches, a few unneeded NULL checks beforetb2018-11-053-43/+33
| | | | | | freeing and indent nearby labels. ok beck jsing
* Remove two unnecessary BN_FLG_CONSTTIME dances: BN_mod_exp_ct() alreadytb2018-11-052-21/+7
| | | | | | takes care of this internally. ok beck jsing
* Rename the TLS Supported Elliptic Curves extension to Supported Groups.jsing2018-11-056-88/+92
| | | | | | | | | RFC 7919 renamed the Supported Elliptic Curves TLS extension to Supported Groups and redefined it to include finite field DH (FFDH) in addition to elliptic curve DH (ECDH). As such, rename the TLS extension and change the associated code to refer to groups rather than curves. ok beck@ tb@
* Rework the TLS extension handling code to improve readability/flexibility,jsing2018-11-051-89/+112
| | | | | | by moving the needs/build/parse functions into their own struct. ok beck@ tb@
* Implement coordinate blinding for EC_POINT.tb2018-11-0510-18/+110
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on OpenSSL commit 875ba8b21ecc65ad9a6bdc66971e50 by Billy Brumley, Sohaib ul Hassan and Nicola Tuveri. ok beck jsing commit 875ba8b21ecc65ad9a6bdc66971e50461660fcbb Author: Sohaib ul Hassan <soh.19.hassan@gmail.com> Date: Sat Jun 16 17:07:40 2018 +0300 Implement coordinate blinding for EC_POINT This commit implements coordinate blinding, i.e., it randomizes the representative of an elliptic curve point in its equivalence class, for prime curves implemented through EC_GFp_simple_method, EC_GFp_mont_method, and EC_GFp_nist_method. This commit is derived from the patch https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley. Coordinate blinding is a generally useful side-channel countermeasure and is (mostly) free. The function itself takes a few field multiplicationss, but is usually only necessary at the beginning of a scalar multiplication (as implemented in the patch). When used this way, it makes the values that variables take (i.e., field elements in an algorithm state) unpredictable. For instance, this mitigates chosen EC point side-channel attacks for settings such as ECDH and EC private key decryption, for the aforementioned curves. For EC_METHODs using different coordinate representations this commit does nothing, but the corresponding coordinate blinding function can be easily added in the future to extend these changes to such curves. Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com> Co-authored-by: Billy Brumley <bbrumley@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6526)
* Implement C11's aligned_alloc(3). ok guenther@otto2018-11-052-5/+84
|
* Clean up the code that checks if we can choose an EC cipher suite.jsing2018-11-053-16/+7
| | | | | | | | | The tls1_check_ec_tmp_key() function is now rather misnamed, so just inline the code. Also, rather than running tls1_get_shared_curve() once per EC cipher suite, we can run it once at the start of the ssl3_choose_cipher() function. ok bluhm@ tb@
* Consolidate all of the SSL method structs/functions into a single file.jsing2018-11-058-871/+672
| | | | Discussed with tb@
* Mop up ecdh_tmp, since it is no longer used.jsing2018-11-053-25/+4
| | | | ok bluhm@ tb@
* Define OPENSSL_NO_ASYNC - our libcryptosink does not have built in asyncjsing2018-11-041-1/+1
| | | | features (and possibly never will).
* Update the opensslfeatures.h to include all of the OPENSSL_NO_* flags thatjsing2018-11-041-8/+84
| | | | | | | | | | currently exist in OpenSSL - comment out that ones that we do not already define. Some OPENSSL_NO_* flags that we define have been removed from OpenSSL (and code that depended on these to know when features are not available now think that the features have been enabled...). We keep these defined but in their own separate group. ok bluhm@ tb@
* Reformat and sort the OPENSSL_NO_* defines.jsing2018-11-041-25/+25
|
* move X509_get0_serialNumber where it belongstb2018-11-021-1/+1
|
* whitespacetb2018-11-021-2/+2
|
* Make the documentation of -conv_form match reality. It defaultstb2018-11-011-6/+6
| | | | | | to uncompressed rather than compressed. From Jacqueline Jolicoeur
* show what went wrong with a unix domain socket, rather than fail silentlydlg2018-10-261-2/+4
| | | | | | handy if you type the path wrong or don't have permission... ok deraadt@
* Bump libcrypto/libssl/libtls majors due to symbol removals (libcrypto)jsing2018-10-243-6/+6
| | | | and changes to struct visibility/sizes (libssl).
* Make more of libssl's record layer state internal.jsing2018-10-248-88/+86
| | | | | | | | | | In January 2017, we changed large amounts of libssl's data structures to be non-visible/internal, however intentionally left things that the software ecosystem was needing to use. The four or so applications that reached into libssl for record layer related state now implement alternative code. As such, make these data structures internal. ok tb@
* Remove a GOST data symbol that should not be exported.jsing2018-10-241-1/+0
|
* Remove a bunch of ancient and highly crufty ASN.1 related code fromjsing2018-10-249-1633/+22
| | | | | | libcrypto (the "new" stuff replaced this back around 2000 or so...). ok tb@
* Remove stack related macros that should have been nuked whenjsing2018-10-241-333/+1
| | | | {CMS,KRB5,SRP} were removed.
* Avoid calling memcpy with a length <= 0. Reported due to a GCC 7.3.0tb2018-10-201-5/+6
| | | | | | | compiler warning by Pavel Kraynyukhov. A similar fix was made in OpenSSL commit 369e93398b68b8a328e6c1d766222b. ok inoguchi
* With the fixed length checks in aes_wrap.c 1.11, we can remove the uglytb2018-10-201-11/+3
| | | | length checks here.
* RFC 3394 section 2 states that we need at least two 64 bit blockstb2018-10-201-6/+6
| | | | | | | | | | | | | | for wrapping and, accordingly, three 64 bit blocks for unwrapping. That is: we need at least 16 bytes for wrapping and 24 bytes for unwrapping. This also matches the lower bounds that OpenSSL have in their CRYPTO_128_{un,}wrap() functions. In fact, if we pass an input with 'inlen < 8' to AES_unwrap_key(), this results in a segfault since then inlen -= 8 underflows. Found while playing with the Wycheproof keywrap test vectors. ok bcook
* Run Wycheproof testvectors for AES Key Wrap without padding (RFC 3394)tb2018-10-191-4/+144
| | | | | | against libcrypto. Currently contains caller-side length checks that should really be done in the library. This will be fixed after an upcoming commit to libcrypto.
* truncate long comments in audit summarytb2018-10-191-2/+7
|
* simplify BN_bin2bn() calls; no need to pre-declare the variable.tb2018-10-181-11/+6
|
* Avoid a bad out of bounds access that caused intermittent crashes.tb2018-10-181-2/+2
|
* whitespace cleanup and other minor things from gofmttb2018-10-071-44/+39
|
* make sure all CStrings are freedtb2018-10-061-3/+7
|
* plug a memory leaktb2018-10-061-1/+2
|
* wrap a few more overlong linestb2018-10-061-14/+36
|
* wrap some overlong fmt.Printfstb2018-10-061-53/+106
|
* It's slightly simpler to get the ECDH public key as an EC_POINT by usingtb2018-10-061-16/+15
| | | | | EC_KEY_set_public_key_affine_coordinates() and EC_KEY_get0_public_key() than using EC_POINT_set_affine_coordinates_GFp() directly.
* free EC_POINT and EC_GROUPtb2018-10-061-1/+4
|
* Run Wycheproof ECDH Web Crypto test vectors against libcrypto.tb2018-10-061-6/+155
|
* merge runECDSAWebCryptoTest() into runECDSATest()tb2018-10-061-53/+31
|
* factor ECDSA signature extraction into its own functiontb2018-10-061-24/+35
|
* make allocate/use/defer dances more consistent in ECDSA sig extractiontb2018-10-061-9/+8
|
* Run Wycheproof ECDSA Web Crypto test vectors against libcrypto.tb2018-10-051-7/+166
|
* Better refer to RFC 8422 which obsoletes RFC 4492.tb2018-10-041-2/+2
|
* While we don't explicitly support curve secp256r1, we can run 1250 teststb2018-10-041-11/+2
| | | | against its ANSI equivalent prime256v1 (compare RFC 4492, Appendix A).
* Plug TLS context leak in nc(1) server and client mode. Movebluhm2018-10-041-12/+10
| | | | | tls_free(3) directly after close(2) to catch all cases. based on a patch from Nan Xiao; OK tb@ deraadt@
* As per POSIX, when str{,r}chr is comparing it should convert c to a char.martijn2018-10-014-8/+10
| | | | | | | | | | The C implementation of str{,r}chr are not linked to the build, because assembly implementations are used, but change to code for easier reference. At least the i386 and amd64 are checked and seem to do the correct thing. Found thanks to the csh any/strchr change. minor pointers and OK millert@
* in ECDH, gather statistics where it makes more sensetb2018-09-301-8/+5
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-28 12:17:09 +0000