summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/bn (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Provide an optimised bn_subw() for amd64.jsing2024-03-261-3/+22
| | | | bn_subw() will be used more widely in an upcoming change.
* Mark internal functions as static.jsing2024-03-261-5/+5
|
* Move bn_montgomery_reduce() and drop prototype.jsing2024-03-261-73/+71
| | | | No functional change.
* Fix signed integer overflow in bnrand()tb2024-03-161-1/+6
| | | | | | | | | | | | | | | If more bits than INT_MAX - 7 are requested, the calculation of number of bytes required to store the bignum triggers undefined behavior due to signed integer overflow. This will typically result in bytes becoming negative which will then make malloc() fail. If the ulimit should be high enough to make malloc() succeed, there is a bad out of bounds write in case bottom is set (an odd number was requested). On jsing's request this does not deal with another bug which we could catch with a similar check due to BN_bn2bin() failing later on as the number of words in a BIGNUM is some fraction of INT_MAX. ok jsing
* Make BN_mod_exp2_mont() and BN_mod_exp_mont_word() internaltb2024-03-023-10/+9
| | | | | | | | The former could be useful but nothing uses it. The latter is a dangerous implementation detail of Montgomery exponentiation that should never have been leaked out of the library. Fix this. ok jsing
* Make BN_mod_exp_simple() internaltb2024-03-023-6/+6
| | | | | | | This function is very slow and useful for testing purposes only. It should never have been part of the public API. Remove it from there. ok jsing
* Remove BIO_{sn,v,vsn}printf(3)tb2024-03-021-1/+2
| | | | | | | Unsued printing functionality. If something should need this we can readily add it back. ok jsing
* Replace uses of endbr64 with _CET_ENDBR from cet.htb2024-02-2415-24/+30
| | | | | | | | | cet.h is needed for other platforms to emit the relevant .gnu.properties sections that are necessary for them to enable IBT. It also avoids issues with older toolchains on macOS that explode on encountering endbr64. based on a diff by kettenis ok beck kettenis
* Garbage collect weird /* 1 */ and /* 2 */ commentstb2023-10-191-7/+7
| | | | | | If they ever had any meaning, that's long been lost. Requested by jsing
* Fix aliasing of result and exponent in the internal BN_mod_exp_recp()tb2023-10-191-12/+19
| | | | This is basically the same fix as the one applied in BN_mod_exp_simple().
* Fix aliasing of result with exponent or modulus in BN_mod_exp_simple()tb2023-10-191-10/+22
| | | | | | Reported and reminded by Guido Vranken in OpenSSL issue #21110 ok jsing
* Move bn_blind.c to rsa_blinding.ctb2023-08-092-268/+1
| | | | discussed with jsing
* Make declaration and definition of BN_BLINDING_new() match.tb2023-08-092-4/+4
| | | | Also, make mod const.
* Merge BN_BLINDING_create_param() into BN_BLINDING_new()tb2023-08-092-31/+14
|
* Set up the blinding factors on first usetb2023-08-091-27/+14
| | | | | | | Only call BN_BLINDING_setup() from BN_BLINDING_update(). This allows another simplification of the counter logic. ok jsing
* Remove retry loop in BN_BLINDING_setup()tb2023-08-091-24/+5
| | | | | | | If we generate a non-invertible blinding, we have accidentally factored the modulus. This won't happen, so get rid of this ugly complication. ok jsing
* Compute a square using BN_mod_sqr() instead of BN_mod_mul()tb2023-08-091-3/+3
| | | | ok jsing
* Simplify BN_BLINDING_invert()tb2023-08-091-14/+5
| | | | | | | If the blinding is non-NULL, Ai is set on it, so no need to check for that. Also, we can get away with a single call to BN_mod_mul(). ok jsing
* Unwrap a linetb2023-08-091-3/+2
|
* Unwrap a linetb2023-08-081-3/+2
|
* Drop the unused BN_BLINDING argument of BN_BLINDING_create_param()tb2023-08-082-10/+6
|
* Rename ret into b in BN_BLINDING_setup()tb2023-08-081-8/+8
|
* Factor the actual setup step for the blinding into a helpertb2023-08-081-30/+43
| | | | ok jsing
* Make BN_BLINDING respect some invariantstb2023-08-081-48/+17
| | | | | | | | | | | | Pass e and mod into BN_BLINDING_new() for now and unconditionally allocate A and Ai. This way non-NULL blindings always have these four members set. This allows removing several unnecessary checks in the update, convert and parameter creation code paths. Fix exit BN_BLINDING_create_param() so as to signal errors to the caller if a non-NULL blinding was passed. This fixes a long standing bug. ok jsing
* Make the bn_rand_interval() API a bit more ergonomictb2023-08-034-27/+36
| | | | | | | | | | | | | | | | | | Provide bn_rand_in_range() which is a slightly tweaked version of what was previously called bn_rand_range(). The way bn_rand_range() is called in libcrypto, the lower bound is always expressible as a word. In fact, most of the time it is 1, the DH code uses a 2, the MR tests in BPSW use 3 and an exceptinally high number appears in the Tonelli-Shanks implementation where we use 32. Converting these lower bounds to BIGNUMs on the call site is annoying so let bn_rand_interval() do that internally and route that through bn_rand_in_range(). This way we can avoid using BN_sub_word(). Adjust the bn_isqrt() test to use bn_rand_in_range() since that's the only caller that uses actual BIGNUMs as lower bounds. ok jsing
* More whitespace fixes from knfmttb2023-08-021-7/+7
|
* Remove extraneous parentheses and fix weird whitespace.tb2023-08-021-16/+15
|
* Drop the _ex from BN_BLINDING_{convert,invert}_ex()tb2023-08-022-6/+6
|
* Remove the unused BN_BLINDING_{convert,invert}()tb2023-08-022-16/+2
| | | | ok jsing
* Make BN_BLINDING_{new,update}() static in bn_blind.ctb2023-08-022-6/+4
| | | | ok jsing
* Remove the unused flags member of BN_BLINDINGtb2023-08-022-10/+4
| | | | | | | Nothing sets this, so remove it along with BN_BLINDING_NO_{UPDATE,RECREATE} and some checks that are always true. ok jsing
* Remove the unused flags accessors for BN_BLINDINGtb2023-08-022-16/+2
| | | | ok jsing
* Remove a 16 year old confusing lietb2023-08-021-2/+2
| | | | | The mod member of BN_BLINDING hasn't been /* just a reference */ since the branch prediction mitigations in OpenSSL bd31fb21 from March 2007.
* Remove more *_options() stufftb2023-07-311-2/+1
| | | | | | | The public symbols were removed. Some prototypes and in the case of DES even the implementation remained. ok jsing
* Remove various ${thing}_optionstb2023-07-281-21/+1
| | | | | | | | | | Various, ancient ciphers exposed some of their innards via an _options() API. Apart from openssl version/speed, only some lua thingie in nmap ever looked at these. Go figure. hppa testing by miod, i386 testing by sthen. Thanks! ok jsing
* Remove the get_rfc*_prime_*() APItb2023-07-282-66/+2
| | | | | | | Inconsistently named with the rest of the API, so OpenSSL 1.1 introduced the same functions with a BN_ prefix. We'll keep the latter. ok jsing
* Make BN_BLINDING internaltb2023-07-283-35/+24
| | | | | | | | | | RSA is pretty bad. In my most optimistic moments I dream of a world that stopped using it. That won't happen during my lifetime, unfortunately. Blinding is one way of making it a little less leaky. Unfortunately this side-channel leak mitigation leaked out of the library for no good reason. Let's at least fix that aspect of it. ok jsing
* Mark read/write registers as non-overlapping for bn_qwmulw_{addqw_,}addw()jsing2023-07-241-3/+3
| | | | | | This does not cause an issue currently, however if called differently to their current usage, it can lead to an input being overwritten and incorrect results being generated.
* Simplify indent handling in bn_print()tb2023-07-221-6/+3
| | | | variant of a suggestion by jsing
* Cap the size of numbers we check for primalitytb2023-07-201-1/+12
| | | | | | | | | | | We refuse to generate RSA keys larger than 16k and DH keys larger than 10k. Primality checking with adversarial input is a DoS vector, so simply don't do this. Introduce a cap of 32k for numbers we try to test for primality, which should be more than large enough for use withing a non-toolkit crypto library. This is one way of mitigating the DH_check()/EVP_PKEY_param_check() issue. ok jsing miod
* Pull BIGNUM constants out of get_* function bodiestb2023-07-101-315/+331
| | | | | | | | | The get_rfc*_prime_* functions will be removed. The constants will remain for the BN_get_rfc*_prime_* functions. Make the latter call BN_bin2bn() directly on these constants rather than going through get_*. This avoids some overlong lines. Also KNF for some comments. Reduces the diff I currently carry by quite a bit.
* bn_print: string.h is no longer neededtb2023-07-101-2/+1
|
* Reimplement BN_print() and BN_print_fp()tb2023-07-092-47/+45
| | | | | | | | These can now use the internal version of BN_bn2hex() and be direct wrappers of BIO_printf() and fprintf() as they should have been all along. ok jsing
* Simplify bn_print()tb2023-07-091-5/+3
| | | | | | | We no longer need to do weird things as taking the length of the hex string and jumping over a sign we didn't need. ok jsing
* Refactor BN_bn2hex()tb2023-07-092-8/+57
| | | | | | | | | Various outputting functions are variants of BN_bn2hex(). They do not want a sign or they display the BIGNUM at nibble granularity instead of byte granularity. So add this functionality to an internal variant of BN_bn2hex(). with/ok jsing
* Provide optimised bn_subw() for riscv64.jsing2023-07-091-1/+18
|
* Provide optimised bn_addw() for riscv64.jsing2023-07-091-1/+18
|
* Hide symbols in bnbeck2023-07-0818-18/+152
| | | | ok tb@
* Provide optimised bn_mulw() for riscv64.jsing2023-07-071-7/+11
| | | | | This provides a 1.5-2x performance gain for BN multiplication, with a similar improvement being seen for RSA operations.
* Use an unsigned long long and corresponding formatstb2023-07-071-3/+3
| | | | | | Fixes build on 32 bit. Reported by claudio
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-26 10:33:42 +0000