summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ec (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Implement X509_get_signature_info()tb2024-08-281-1/+21
| | | | | | | | | | | | | | | | This is a slightly strange combination of OBJ_find_sigid_algs() and the security level API necessary because OBJ_find_sigid_algs() on its own isn't smart enough for the special needs of RSA-PSS and EdDSA. The API extracts the hash's NID and the pubkey's NID from the certificate's signatureAlgorithm and invokes special handlers for RSA-PSS and EdDSA for retrieving the corresponding information. This isn't entirely free for RSA-PSS, but for now we don't cache this information. The security bits calculation is a bit hand-wavy, but that's something that comes along with this sort of numerology. ok jsing
* replace atoi(3) usage with strtonum(3); ok/tweaks tb@op2024-08-261-4/+10
|
* The EC_KEY method should use the EC_KEY index, not RSAtb2024-08-031-2/+2
| | | | | | Unbreaks ssh's t-agent-pkcs11-cert regress reported by anton. ok jsing
* libcrypto: constify most error string tablestb2024-06-241-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | These constitute the bulk of the remaining global mutable state in libcrypto. This commit moves most of them into data.rel.ro, leaving out ERR_str_{functs,libraries,reasons} (which require a slightly different approach) and SYS_str_reasons which is populated on startup. The main observation is that if ERR_load_strings() is called with a 0 lib argument, the ERR_STRING_DATA argument is not actually modified. We could use this fact to cast away const on the caller side and be done with it. We can make this cleaner by adding a helper ERR_load_const_strings() which explicitly avoids the assignment to str->error overriding the error code already set in the table. In order for this to work, we need to sprinkle some const in err/err.c. CMS called ERR_load_strings() with non-0 lib argument, but this didn't actually modify the error data since it ored in the value already stored in the table. Annoyingly, we need to cast const away once, namely in the call to lh_insert() in int_err_set_item(). Fixing this would require changing the public API and is going to be tricky since it requires that the LHASH_DOALL_FN_* types adjust. ok jsing
* unwrap a linetb2024-05-191-3/+2
|
* Add missing EC_KEY_free()tb2024-05-101-1/+3
| | | | | | | | | While eckey_from_explicit_params() frees *out_eckey, eckey_from_object() and eckey_from_params() do not. These functions are currently all callled with a NULL *out_eckey, but the latter two would leak if that should ever change. ok jsing
* One empty line is enoughtb2024-04-231-18/+1
|
* Add some more comments explaining shortcomings of the APItb2024-04-181-2/+9
| | | | | | | | The case in point is the incompatibility of the very ergonomic X509_ALGOR API with the RC2-derived API massacre that is EVP_CIPHER_asn1_to_param() and its "inverse". ok jsing
* Use X509_ALGOR_get0() in ecdh_cms_set_shared_info()tb2024-04-181-6/+14
| | | | | | | | This makes things slightly less gross since it involves less reaching into nested ASN.1 structures. But don't get the idea that this means the code is now clean. ok jsing
* Test and assign in ecdh_cms_set_shared_info()tb2024-04-181-9/+7
| | | | ok jsing
* Turn ecdh_cms_set_shared_info() into single exittb2024-04-181-7/+9
| | | | ok jsing
* Remove comments from captain obvious and drop useless prototypestb2024-04-171-43/+1
|
* Shuffle EVP_PKEY_CTX setting togethertb2024-04-171-5/+3
| | | | | | | Another stroke of the already very dirty brush eliminates more traces of ADHD and/or crack. ok jsing
* ecdh_cms_encrypt(): tweak wrap_algor constructiontb2024-04-171-15/+23
| | | | | | | | | | | | | | | | This manually constructs an X509_ALGOR because the (now internal) legacy interface EVP_CIPHER_param_to_asn1() (which is an unwelcome complication thanks to RC2) is entirely incompatible with X509_ALGOR_set0() since the ASN1_TYPE can't be pulled apart nicely (because the ASN1_TYPE API is incomplete as well). Once we got this far, we get to DER-encode the inner AlgorithmIdentifier and set that blob as the parameters of another one. The same variables are reused of course and needless to say an unchecked X509_ALGOR_set0() would leak this blob on failure. So fix this by switching to the usual error checked X509_ALGOR_set0_by_nid(). ok jsing
* ecdh_cms_encrypt: tweak handling of ecdh_nidtb2024-04-171-4/+3
| | | | ok jsing
* ecdh_cms_encrypt: handle kdf_md in one gotb2024-04-171-3/+3
| | | | | | | Again the getting and the setting were interrupted by ten lines of completely unrelated code. ok jsing
* ecdh_cms_encrypt: simplify setting the KDF typetb2024-04-171-13/+6
| | | | | | | | | It is much simpler to avoid the key_type variable altogether and inline its use. Also it makes no sense to have 15 unrelated lines between the getting of the kdf type, checking its content, and then actually setting it to EVP_PKEY_ECDH_KDF_X9_63. ok jsing
* Use error checked X509_ALGOR_set0_by_nidtb2024-04-171-5/+5
| | | | | | | | While setting the parameters to type V_ASN1_UNDEF can't actually fail, it is cleaner to just do the check. Using the by_nid() variant also removes the need for an unchecked nested OBJ_nid2obj() call. ok jsing
* ecdh_cms_encrypt: simplify handling of pkeytb2024-04-171-15/+6
| | | | | | | The pkey is only used in one scope. i2o allocates if passed a pointer to NULL, so use that to drop two unnecessary local variables. ok jsing
* Transfer ownership before setting unused bitstb2024-04-171-2/+4
| | | | | | | This looks like a use after free, but setting the unused bits to 0 can't actually fail. ok jsing
* Turn ecdh_cms_encrypt() into single exittb2024-04-171-7/+7
| | | | | | Also use ret instead of rv. ok jsing
* Fix error check in ecdh_cms_encrypt()tb2024-04-171-2/+2
| | | | | | | | ASN1_TYPE_get() returns V_ASN1_* constants. Checking the return for NID_undef instead means that we actually check for V_ASN1_EOC, which makes absolutely no sense here. Clearly V_ASN1_UNDEF was intended. ok jsing
* More X9.62 stuff was never used outside of ec_asn1.ctb2024-04-151-35/+5
| | | | | | We only need the ASN.1 items. ok jsing
* EC_PRIVATEKEY becomes internal-only, tootb2024-04-151-10/+10
| | | | ok jsing
* Unexport the ECPKPARAMETERS APItb2024-04-152-14/+12
| | | | ok jsing
* Make ECPARAMETERS_{new,free,it} internal-onlytb2024-04-151-5/+5
| | | | ok jsing
* Fix indenttb2024-04-141-3/+3
| | | | pointed out by jsing
* Error check X509_ALGOR_set0() in {dsa,ec}_pkey_ctrl()tb2024-04-131-3/+8
| | | | | | | | | | These are four versions of near identical code: PKCS#7 and CMS controls for DSA and EC. The checks are rather incomplete and should probably be merged somehow (see the Ed25519 version in ecx_methods(). For now, only replace X509_ALGOR_set0() with its internal by_nid() version and, while there, spell NULL correctly. ok jca
* Hide deprecated functions in ec.hbeck2024-04-103-11/+12
| | | | | | use LCRYPTO_UNUSED and remove the LIBRESSL_INTERNAL guard ok tb@
* Simplify ecx_cms_sign_or_verify() using X509_ALGOR_set0_by_nid()tb2024-04-021-5/+3
| | | | ok jsing
* Implement Ed25519 signatures for CMS (RFC 8419)tb2024-03-291-1/+62
| | | | | | | | | | | | | | | | | | | | This adds support for Edwards curve digital signature algorithms in the cryptographic message syntax, as specified in RFC 8419. Only Ed25519 is supported since that is the only EdDSA algorithm that LibreSSL supports (this is unlikely to change ever, but, as they say - never is a very long time). This has the usual curly interactions between EVP and CMS with poorly documented interfaces and lots of confusing magic return values and controls. This improves upon existing control handlers by documenting what is being done and why. Unlike other (draft) implementations we also happen to use the correct hashing algorithm. There are no plans to implement RFC 8418. joint work with job at p2k23 ok jsing
* Unify *_up_ref() implementationstb2024-03-271-3/+2
| | | | | | No need for an inconsistently named local variable and a ternary operator. ok jsing
* Bye bye gost, bye, bye turdinesstb2024-03-241-668/+1
| | | | ok beck
* Replace .pkey_base_id with a .base_method pointertb2024-01-042-5/+5
| | | | | | | | | | | | | | | | Every EVP_PKEY_ASN1_METHOD is either an ASN.1 method or an alias. As such it resolves to an underlying ASN.1 method (in one step). This information can be stored in a base_method pointer in allusion to the pkey_base_id, which is the name for the nid (aka pkey_id aka type) of the underlying method. For an ASN.1 method, the base method is itself, so the base method is set as a pointer to itself. For an alias it is of course a pointer to the underlying method. Then obviously ameth->pkey_base_id is the same as ameth->base_method->pkey_id, so rework all ASN.1 methods to follow that. ok jsing
* eckey: adjust some variable names and unwrap function definitionstb2023-12-291-11/+8
| | | | ok jsing
* Clean up old_ec_priv_decode()tb2023-12-291-10/+17
| | | | | | As per usual. Stylistic adjustments and missing error check. ok jsing
* Clean up eckey_param_decode()tb2023-12-291-9/+16
| | | | | | | | This aligns eckey's parameter decoding routine with the one of other cipher abstractions: better variable names, single exit and add missing check for EVP_PKEY_assign_EC_KEY(). ok jsing
* Rework eckey_priv_decode()tb2023-12-291-49/+53
| | | | | | | | | Factor out the pubkey computation and bring it into more sensible form. This removes lots of pointless setting of errors (twice) and makes the code a bit easier on the eyes. Other than that perform some stylistic cleanup like single exit and add an error check for EVP_PKEY_assign(). ok jsing
* Move a call to X509_ALGOR_get0() down a linetb2023-12-291-2/+2
|
* Clean up pkey_ec_paramgen()tb2023-12-281-10/+17
| | | | | | | | | | This is basically the same as the dh and dsa version, except it's different because it's EC. Single exit, uniform error checking. "Plug" another leak. With this I earned another shining turd for my collection. ok jsing
* Fix pkey_ec_keygen()tb2023-12-281-13/+20
| | | | | | | | | The EC code came later, and people got better at writing terrible code. In this case, they could remain quite close to what they copy-pasted from DH, so it was relatively straightforward (for once). There's only one slight extra twist and that's easily dealt with. ok jsing
* Ignore ENGINE at the API boundarytb2023-11-292-4/+3
| | | | | | | | This removes the remaining ENGINE members from various internal structs and functions. Any ENGINE passed into a public API is now completely ignored functions returning an ENGINE always return NULL. ok jsing
* ec_print.c: Unwrap a linetb2023-11-211-3/+2
|
* Inline a better version of print_bin() in only callertb2023-11-211-42/+27
| | | | | | | | | | Instead of printing to a temporary buffer with weird gymnastics, we can simply write things out to the BIO using proper indent. This still isn't perfect since we have a CBS version of this in ecx_buf_print(), which is basically what used to be ASN1_buf_print(). Annotate this with an XXX for future cleanup. ok beck
* Fix a <= 5-byte buffer overwrite in print_bin()tb2023-11-211-2/+3
| | | | | | | | | | | | If the offset is > 124, this function would overwrite between 1 and 5 bytes of stack space after str[128]. So for a quick fix extend the buffer by 5 bytes. Obviously this is the permanent fix chosen elswehere. The proper fix will be to rewrite this function from scratch. Reported in detail by Masaru Masuda, many thanks! Fixes https://github.com/libressl/openbsd/issues/145 begrudging ok from beck
* Unifdef OPENSSL_NO_ENGINE in libcryptotb2023-11-192-43/+2
| | | | | | | This is mechanical apart from a few manual edits to avoid doubled empty lines. ok jsing
* Convert ecx_item_sign() to X509_ALGOR_set0_by_nid()tb2023-11-091-8/+5
| | | | ok jca
* Break two ridiculously long lines in ec_pub_cmp() and ec_cmp_parameters()tb2023-09-241-4/+7
|
* Refactor eckey_{param2type,type2param}()tb2023-09-241-92/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EC key parameters can be determined by an OID or they can be explicitly encoded. The confusingly named eckey_{param2type,type2param}() decode a new EC key from either form of parameters, or they encode a given key's parameters in the proper way. Signature and semantics are all over the place. It also features an inlined version of EC_KEY_new_by_curve_name(). This commit brings some order into this mess. Parameters are given by a pair (ptype, pval), where the ptype is either V_ASN1_OBJECT for OID encoding or V_ASN1_SEQUENCE for explicit encoding. Accordingly, the void pointer pval is an ASN1_OBJECT or an ASN1_STRING. These pairs are abstracted away in the X509_ALGOR object. The library decides whether a given EC key uses OID or explicit parameter encoding using the asn1_flag on the EC key's internal EC_GROUP, i.e., the object representing its curve. If this flag is set, the OID is determined by the nid returned by EC_GROUP_get_curve_name(). Add 'mutually inverse' pairs of functions eckey_{to,from}_params() which wrap eckey_{to,from}_object() and eckey_{to,from}_explicit_params(). This way the EC ameth pub and priv key de/encoding functions can transparently translate from/to an X509_ALGOR object. Of course, this is just an intermediate step and if you look closely you notice const weirdness (due to the fact that the carefully planned and executed const rampage missed the ECParameters API) and all sorts of other things that need to be fixed. Who would bat an eye lid? It wouldn't be visible amid all the twitching anyway. ok jsing
* ec_ameth: clean up eckey_{pub,priv}_encode()tb2023-08-211-62/+67
| | | | | | | | | | | | | | | | | | | Factor eckey_param_free() out of eckey_pub_encode(). ASN1_OBJECT_free() is not actually needed. This will be addressed later. i2o_ECPublicKey() allocates internally if *out == NULL, so no need to do the two-call dance. Its return value is documented to be <= 0 on error, which is wrong in the sense that only 0 is returned. Keep using the same check for <= 0 as everywhere else. Set of EC_PKEY_NO_PARAMETERS after the poorly named eckey_param2type() to avoid potential underhanded side effects. In eckey_priv_encode(), error exits would leak pval was leaked a few times. Avoid this and simplify using i2d's internal allocation. Reinstate the flags in a single error path. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-22 11:25:58 +0000