summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/bn (follow)
Commit message (Collapse)AuthorAgeFilesLines
* const correct BN_MONT_CTX_copy()tb10 days2-4/+4
| | | | ok jsing
* Convert bn_exp to BN_MONT_CTX_create()tb2025-02-131-53/+38
| | | | | | | | This simplifies the handling of the BN_MONT_CTX passed in and unifies the exit paths. Also zap some particularly insightful comments by our favorite captain. ok jsing
* Convert BPSW to BN_MONT_CTX_create()tb2025-02-131-5/+2
| | | | ok jsing
* Convert BN_MONT_CTX_set_locked() to BN_MONT_CTX_create()tb2025-02-131-4/+2
| | | | ok jsing
* bn: add internal BN_MONT_CTX_create()tb2025-02-132-2/+22
| | | | | | | | | | | | | This does what the public BN_MONT_CTX_new() should have done in the first place rather than doing the toolkit thing of returning an invalid object that you need to figure out how to populate and with what because the docs are abysmal. It takes the required arguments and calls BN_MONT_CTX_set(), which all callers do immediately after _new() (except for DSA which managed to squeeze 170 lines of garbage between the two calls). ok jsing
* Rename BN_mod_exp_recp() to BN_mod_exp_reciprocal()tb2025-02-122-5/+5
| | | | | (leaving out a dotasm comment that would become harder to read than it already is)
* bn_recp: reformat another ugly commenttb2025-02-041-5/+6
|
* Inline BN_reciprocal() in its only callertb2025-02-041-36/+10
| | | | | | | | | | | This is simpler, doesn't need an auxiliary function of dubious value, avouds an auxiliary variable and gets rid of a bunch of comments that are hard to make sense of. This doesn't bother to invalidate recp->shift since on error you should not be reusing the RECP_CTX without reinitializing it. ok jsing
* Start cleaning up BN_div_reciprocal() a bittb2025-02-041-24/+23
| | | | | | | | | The fast path where no division is performed can be dealt with without BN_CTX, so do that up front so there's no need to clean up before return. Error check BN_CTX_get() on each use asd simplify the logic for optional input parameters. KNF for an ugly comment. ok jsing
* bn_recp: Avoid complication for negative modulitb2025-01-222-13/+5
| | | | | | | Instead of doing a weird dance, set the sign on N in BN_RECP_CTX_create(). Since we're not exposing a general purpose calculator API, we can simplify. ok jsing
* Rename BN_div_recp() into BN_div_reciprocal()tb2025-01-222-7/+7
| | | | Requested by jsing
* Split BN_mod_sqr_reciprocal() out of BN_mod_mul_reciprocal()tb2025-01-223-23/+19
| | | | | | | | There's no need for BN_mod_mul_reciprocal() to have this complication. The caller knows when x == y, so place the burden on the caller. This simplifies both the caller side and the implementation in bn_recp.c. ok jsing
* BN_mod_mul_reciprocal: remove y == NULL complicationtb2025-01-221-14/+11
| | | | | | | No caller ever passes y == NULL, so remove the corresponding contortions and unindent the relevant bits. ok jsing
* Move BN_RECP_CTX to the heaptb2025-01-213-67/+48
| | | | | | | | | | | | | | This introduces a BN_RECP_CTX_create() function that allocates and populates the BN_RECP_CTX in a single call, without taking an unused BN_CTX argument. At the same time, make the N and Nr members BIGNUMs on the heap which are allocated by BN_RECP_CTX_create() and freed by BN_RECP_CTX_free() and remove the unnecessary flags argument. Garbage collect the now unused BN_RECP_CTX_{new,init,set}(). ok jsing
* Improve order of things in BN_RECP_CTX_set()tb2025-01-081-3/+4
| | | | + some whitespace cosmetics
* Remove parentheses in return statementstb2025-01-081-8/+8
|
* Add a space after commatb2025-01-081-3/+3
|
* Remove superfluous parenthesestb2025-01-081-13/+13
|
* BN_div_recp() can't be static since it is directly exercised by bn_test.ctb2025-01-062-3/+5
|
* fix ugly whitespacetb2025-01-061-4/+4
|
* Shuffle functions into a more sensible ordertb2025-01-062-42/+39
| | | | | | BN_reciprocal() is only called by BN_div_recp() which in turn is only called by BN_mod_mul_reciprocal(). So use this order and make the first two static.
* Rewrite bn2binpad.jsing2024-11-081-58/+44
| | | | | | | | | | | | | | | Rewrite bn2binpad, removing some OpenSSL specific behaviour and unnecessary complexity. Our BN_num_bytes() does not return bogus lengths, so we don't need to see if things work out with nominated outputs. Swipe away some endianness_t, but continue to ignore negatives and don't dare give away padded zeroes. Implement a more readable constant time conversion. In particular, the little endian is the less common use case, which we can implement by reversing the padded output in place, rather than complicating all of the conversion code. ok beck@ tb@
* Clean up PPC CPU capabilities and Montgomery code.jsing2024-11-012-1090/+2
| | | | | | | | | | ppc64-mont.pl (which produces bn_mul_mont_fpu64()) is unused on both powerpc and powerpc64, so remove it. ppccap.c doesn't actually contain anything to do with CPU capabilities - it just provides a bn_mul_mont() that calls bn_mul_mont_int() (which ppc-mont.pl generates). Change ppc-mont.pl to generate bn_mul_mont() directly and remove ppccap.c. ok tb@
* libcrypto: constify most error string tablestb2024-06-241-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | These constitute the bulk of the remaining global mutable state in libcrypto. This commit moves most of them into data.rel.ro, leaving out ERR_str_{functs,libraries,reasons} (which require a slightly different approach) and SYS_str_reasons which is populated on startup. The main observation is that if ERR_load_strings() is called with a 0 lib argument, the ERR_STRING_DATA argument is not actually modified. We could use this fact to cast away const on the caller side and be done with it. We can make this cleaner by adding a helper ERR_load_const_strings() which explicitly avoids the assignment to str->error overriding the error code already set in the table. In order for this to work, we need to sprinkle some const in err/err.c. CMS called ERR_load_strings() with non-0 lib argument, but this didn't actually modify the error data since it ored in the value already stored in the table. Annoyingly, we need to cast const away once, namely in the call to lh_insert() in int_err_set_item(). Fixing this would require changing the public API and is going to be tricky since it requires that the LHASH_DOALL_FN_* types adjust. ok jsing
* Rewrite BN_bn2mpi() using CBB.jsing2024-06-221-24/+35
| | | | | | | | | | | | | | The content is effectively a u32 length prefixed field, so use CBB_add_u32_length_prefixed(). Use BN_bn2binpad() rather than manually padding if we need to extend and use sensible variable names so that the code becomes more readable. Note that since CBB can fail we now need to be able to indicate failure. This means that BN_bn2mpi() can now return -1 when it would not have previously (correct callers will check that BN_bn2mpi() returns a positive length). ok tb@
* bn_convert: zap extra blank linetb2024-04-171-2/+1
|
* Rewrite BN_mpi2bn() using CBS and bn_bin2bn_cbs().jsing2024-04-171-32/+29
| | | | ok tb@
* Rewrite BN_lebin2bn() using CBS.jsing2024-04-171-48/+16
| | | | | | | We get an implementation of this for free by having bn_bin2bn_cbs() use CBS_get_u8() instead of CBS_get_last_u8(). ok tb@
* Invert BN_BITS2 handling in bn_bin2bn_cbs() and bn_hex2bn_cbs().jsing2024-04-161-11/+11
| | | | | | This results in simpler code. Suggested by tb@ during review.
* Rewrite BN_bin2bn() using CBS.jsing2024-04-161-35/+58
| | | | ok tb@
* Provide bn_expand_bytes().jsing2024-04-162-2/+16
| | | | | | This will be used in an upcoming change. ok tb@
* Rename bn_expand() to bn_expand_bits().jsing2024-04-163-10/+7
| | | | | | | Also change the bits type from int to size_t, since that's what the callers are passing and we can avoid unnecessary input validation. ok tb@
* Prevent negative zero from being created via BN bit functions.jsing2024-04-151-1/+7
| | | | | | | | | | | | Both BN_clear_bit() and BN_mask_bits() can create zero values - in both cases ensure that the negative sign is correctly handled if the value becomes zero. Thanks to Guido Vranken for providing a reproducer. Fixes oss-fuzz #67901 ok tb@
* Remove the prototype of BN_gcd_nonct()tb2024-04-101-2/+1
|
* Hide symbols in bn.hbeck2024-04-104-18/+10
| | | | | | | Mark them LCRYPTO_UNUSED appropriately and remove the LIBRESSL_INTERNAL guards around them ok tb@
* Provide an optimised bn_subw() for amd64.jsing2024-03-261-3/+22
| | | | bn_subw() will be used more widely in an upcoming change.
* Mark internal functions as static.jsing2024-03-261-5/+5
|
* Move bn_montgomery_reduce() and drop prototype.jsing2024-03-261-73/+71
| | | | No functional change.
* Fix signed integer overflow in bnrand()tb2024-03-161-1/+6
| | | | | | | | | | | | | | | If more bits than INT_MAX - 7 are requested, the calculation of number of bytes required to store the bignum triggers undefined behavior due to signed integer overflow. This will typically result in bytes becoming negative which will then make malloc() fail. If the ulimit should be high enough to make malloc() succeed, there is a bad out of bounds write in case bottom is set (an odd number was requested). On jsing's request this does not deal with another bug which we could catch with a similar check due to BN_bn2bin() failing later on as the number of words in a BIGNUM is some fraction of INT_MAX. ok jsing
* Make BN_mod_exp2_mont() and BN_mod_exp_mont_word() internaltb2024-03-023-10/+9
| | | | | | | | The former could be useful but nothing uses it. The latter is a dangerous implementation detail of Montgomery exponentiation that should never have been leaked out of the library. Fix this. ok jsing
* Make BN_mod_exp_simple() internaltb2024-03-023-6/+6
| | | | | | | This function is very slow and useful for testing purposes only. It should never have been part of the public API. Remove it from there. ok jsing
* Remove BIO_{sn,v,vsn}printf(3)tb2024-03-021-1/+2
| | | | | | | Unsued printing functionality. If something should need this we can readily add it back. ok jsing
* Replace uses of endbr64 with _CET_ENDBR from cet.htb2024-02-2415-24/+30
| | | | | | | | | cet.h is needed for other platforms to emit the relevant .gnu.properties sections that are necessary for them to enable IBT. It also avoids issues with older toolchains on macOS that explode on encountering endbr64. based on a diff by kettenis ok beck kettenis
* Garbage collect weird /* 1 */ and /* 2 */ commentstb2023-10-191-7/+7
| | | | | | If they ever had any meaning, that's long been lost. Requested by jsing
* Fix aliasing of result and exponent in the internal BN_mod_exp_recp()tb2023-10-191-12/+19
| | | | This is basically the same fix as the one applied in BN_mod_exp_simple().
* Fix aliasing of result with exponent or modulus in BN_mod_exp_simple()tb2023-10-191-10/+22
| | | | | | Reported and reminded by Guido Vranken in OpenSSL issue #21110 ok jsing
* Move bn_blind.c to rsa_blinding.ctb2023-08-092-268/+1
| | | | discussed with jsing
* Make declaration and definition of BN_BLINDING_new() match.tb2023-08-092-4/+4
| | | | Also, make mod const.
* Merge BN_BLINDING_create_param() into BN_BLINDING_new()tb2023-08-092-31/+14
|
* Set up the blinding factors on first usetb2023-08-091-27/+14
| | | | | | | Only call BN_BLINDING_setup() from BN_BLINDING_update(). This allows another simplification of the counter logic. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 13:39:19 +0000