summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ec (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Replace .pkey_base_id with a .base_method pointertb2024-01-042-5/+5
| | | | | | | | | | | | | | | | Every EVP_PKEY_ASN1_METHOD is either an ASN.1 method or an alias. As such it resolves to an underlying ASN.1 method (in one step). This information can be stored in a base_method pointer in allusion to the pkey_base_id, which is the name for the nid (aka pkey_id aka type) of the underlying method. For an ASN.1 method, the base method is itself, so the base method is set as a pointer to itself. For an alias it is of course a pointer to the underlying method. Then obviously ameth->pkey_base_id is the same as ameth->base_method->pkey_id, so rework all ASN.1 methods to follow that. ok jsing
* eckey: adjust some variable names and unwrap function definitionstb2023-12-291-11/+8
| | | | ok jsing
* Clean up old_ec_priv_decode()tb2023-12-291-10/+17
| | | | | | As per usual. Stylistic adjustments and missing error check. ok jsing
* Clean up eckey_param_decode()tb2023-12-291-9/+16
| | | | | | | | This aligns eckey's parameter decoding routine with the one of other cipher abstractions: better variable names, single exit and add missing check for EVP_PKEY_assign_EC_KEY(). ok jsing
* Rework eckey_priv_decode()tb2023-12-291-49/+53
| | | | | | | | | Factor out the pubkey computation and bring it into more sensible form. This removes lots of pointless setting of errors (twice) and makes the code a bit easier on the eyes. Other than that perform some stylistic cleanup like single exit and add an error check for EVP_PKEY_assign(). ok jsing
* Move a call to X509_ALGOR_get0() down a linetb2023-12-291-2/+2
|
* Clean up pkey_ec_paramgen()tb2023-12-281-10/+17
| | | | | | | | | | This is basically the same as the dh and dsa version, except it's different because it's EC. Single exit, uniform error checking. "Plug" another leak. With this I earned another shining turd for my collection. ok jsing
* Fix pkey_ec_keygen()tb2023-12-281-13/+20
| | | | | | | | | The EC code came later, and people got better at writing terrible code. In this case, they could remain quite close to what they copy-pasted from DH, so it was relatively straightforward (for once). There's only one slight extra twist and that's easily dealt with. ok jsing
* Ignore ENGINE at the API boundarytb2023-11-292-4/+3
| | | | | | | | This removes the remaining ENGINE members from various internal structs and functions. Any ENGINE passed into a public API is now completely ignored functions returning an ENGINE always return NULL. ok jsing
* ec_print.c: Unwrap a linetb2023-11-211-3/+2
|
* Inline a better version of print_bin() in only callertb2023-11-211-42/+27
| | | | | | | | | | Instead of printing to a temporary buffer with weird gymnastics, we can simply write things out to the BIO using proper indent. This still isn't perfect since we have a CBS version of this in ecx_buf_print(), which is basically what used to be ASN1_buf_print(). Annotate this with an XXX for future cleanup. ok beck
* Fix a <= 5-byte buffer overwrite in print_bin()tb2023-11-211-2/+3
| | | | | | | | | | | | If the offset is > 124, this function would overwrite between 1 and 5 bytes of stack space after str[128]. So for a quick fix extend the buffer by 5 bytes. Obviously this is the permanent fix chosen elswehere. The proper fix will be to rewrite this function from scratch. Reported in detail by Masaru Masuda, many thanks! Fixes https://github.com/libressl/openbsd/issues/145 begrudging ok from beck
* Unifdef OPENSSL_NO_ENGINE in libcryptotb2023-11-192-43/+2
| | | | | | | This is mechanical apart from a few manual edits to avoid doubled empty lines. ok jsing
* Convert ecx_item_sign() to X509_ALGOR_set0_by_nid()tb2023-11-091-8/+5
| | | | ok jca
* Break two ridiculously long lines in ec_pub_cmp() and ec_cmp_parameters()tb2023-09-241-4/+7
|
* Refactor eckey_{param2type,type2param}()tb2023-09-241-92/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EC key parameters can be determined by an OID or they can be explicitly encoded. The confusingly named eckey_{param2type,type2param}() decode a new EC key from either form of parameters, or they encode a given key's parameters in the proper way. Signature and semantics are all over the place. It also features an inlined version of EC_KEY_new_by_curve_name(). This commit brings some order into this mess. Parameters are given by a pair (ptype, pval), where the ptype is either V_ASN1_OBJECT for OID encoding or V_ASN1_SEQUENCE for explicit encoding. Accordingly, the void pointer pval is an ASN1_OBJECT or an ASN1_STRING. These pairs are abstracted away in the X509_ALGOR object. The library decides whether a given EC key uses OID or explicit parameter encoding using the asn1_flag on the EC key's internal EC_GROUP, i.e., the object representing its curve. If this flag is set, the OID is determined by the nid returned by EC_GROUP_get_curve_name(). Add 'mutually inverse' pairs of functions eckey_{to,from}_params() which wrap eckey_{to,from}_object() and eckey_{to,from}_explicit_params(). This way the EC ameth pub and priv key de/encoding functions can transparently translate from/to an X509_ALGOR object. Of course, this is just an intermediate step and if you look closely you notice const weirdness (due to the fact that the carefully planned and executed const rampage missed the ECParameters API) and all sorts of other things that need to be fixed. Who would bat an eye lid? It wouldn't be visible amid all the twitching anyway. ok jsing
* ec_ameth: clean up eckey_{pub,priv}_encode()tb2023-08-211-62/+67
| | | | | | | | | | | | | | | | | | | Factor eckey_param_free() out of eckey_pub_encode(). ASN1_OBJECT_free() is not actually needed. This will be addressed later. i2o_ECPublicKey() allocates internally if *out == NULL, so no need to do the two-call dance. Its return value is documented to be <= 0 on error, which is wrong in the sense that only 0 is returned. Keep using the same check for <= 0 as everywhere else. Set of EC_PKEY_NO_PARAMETERS after the poorly named eckey_param2type() to avoid potential underhanded side effects. In eckey_priv_encode(), error exits would leak pval was leaked a few times. Avoid this and simplify using i2d's internal allocation. Reinstate the flags in a single error path. ok jsing
* The int_ prefix also leaves the ec_ameth messtb2023-08-121-5/+5
| | | | The prefixes in here are all over the place... This removes one variety.
* Move EC_KEY and EC_KEY_METHOD typedefs to ossl_typ.htb2023-08-111-4/+1
| | | | ok jsing
* Make the bn_rand_interval() API a bit more ergonomictb2023-08-032-4/+4
| | | | | | | | | | | | | | | | | | Provide bn_rand_in_range() which is a slightly tweaked version of what was previously called bn_rand_range(). The way bn_rand_range() is called in libcrypto, the lower bound is always expressible as a word. In fact, most of the time it is 1, the DH code uses a 2, the MR tests in BPSW use 3 and an exceptinally high number appears in the Tonelli-Shanks implementation where we use 32. Converting these lower bounds to BIGNUMs on the call site is annoying so let bn_rand_interval() do that internally and route that through bn_rand_in_range(). This way we can avoid using BN_sub_word(). Adjust the bn_isqrt() test to use bn_rand_in_range() since that's the only caller that uses actual BIGNUMs as lower bounds. ok jsing
* Stop including ecdsa.h and ecdh.h internallytb2023-07-282-4/+2
| | | | | | | | These headers are now reduced to #include <openssl/ec.h> and are provided for compatiblity only. There's no point in using them. At the same time garbage collect the last uses of OPENSSL_NO_{ECDSA,ECDH} in our tree. ok jsing
* Move KDF handling to ECDH_compute_key()tb2023-07-284-16/+18
| | | | | | | | | | In OpenSSL e2285d87, the KDF handling was moved from the compute_key() method into the public API. A consequence of this change is that the ECDH_compute_key() API no longer returns -1 for some errors. Existing checks for <= 0 are safe as are those checking for the exact length as return value, which is all what the ecosystem seems to be doing. ok jsing
* Merge ecdh.h into ec.htb2023-07-281-1/+6
| | | | | | | The remaining two ECDH interfaces are relocated into ec.h. ecdh.h remains. It does nothing but include ec.h. ok jsing
* Merge ecdsa.h into ec.htb2023-07-281-1/+50
| | | | | | | | | Move the remaining ECDSA API into ec.h to match OpenSSL 1.1's interface better. In particular, the EC_KEY sign and verify method accessors are moved to the right header. Whether the rest of the ECDSA stuff belongs there is debatable, but that was upstream's choice. ok jsing
* Tweak EC_GROUP_check_discriminant()tb2023-07-261-28/+28
| | | | | | | | Make the logic and control flow a bit more explicit and use a single extra variable for computing the discriminant. Call it discriminant, not tmp, tmp_1 or tmp_2. ok jsing
* Unindent a big block in EC_GROUP_get_affine_coordinates()tb2023-07-261-32/+34
|
* Introduce and use ec_encode_scalar()tb2023-07-261-43/+48
| | | | | | | | | | | | This introduces two "inverses" of the ec_decode_scalar() function that take a BIGNUM, reduce it modulo p and then encodes it into the curve's field representation. For setting projective coordinates, we need a specialized helper that deals with the Z_is_one optimization that is used to optimize for calculations in standard affine coordinates of the projective plane. This is used for simplifying EC_POINT_set_Jprojective_coordinates() and for cleaning up and streamlining EC_GROUP_set_curve(). ok jsing
* Garbage collect the unused order in check_discriminant()tb2023-07-261-4/+2
| | | | ok jsing
* Streamline check_discriminant()tb2023-07-261-14/+6
| | | | | | Instead of inlining EC_GROUP_get_curve(), we can simply call it... ok jsing
* Introduce ec_decode_scalar()tb2023-07-261-81/+39
| | | | | | | | | This is a helper that decodes a scalar from field-internal representation to a representation as a BIGNUM in the interval [0, p). This simplifies EC_GROUP_get_curve() and EC_POINT_get_Jprojective_coordinates() to a few obvious lines and prepares cleanup in EC_POINT_get_affine_coordinates(). ok jsing
* Use EC_POINT_set_to_infinity() rather than inlining ittb2023-07-261-6/+4
|
* Fix a few more 0/NULL misspellingstb2023-07-251-8/+8
|
* Use [a,b), not [a,b-1] in a commenttb2023-07-251-2/+2
|
* EC_POINT_is_on_curve() error is -1, not 0.tb2023-07-251-2/+2
| | | | ok miod
* Tweak previous. Should have been 60 instead of 64tb2023-07-221-3/+3
|
* Adapt bn_print() for EdDSA key printingtb2023-07-221-7/+40
| | | | | | | | This is essentially a reimplementation of ASN1_buf_print(). The latter was only added for these printing purposes and it will be removed again since nothing uses it. We can then simply remove t_pkey.c in the upcoming bump. ok jsing
* Unbreak the namespace build after a broken mk.conf and tool misfire hadbeck2023-07-073-26/+3
| | | | | | | | me aliasing symbols not in the headers I was procesing. This unbreaks the namespace build so it will pass again ok tb@
* Hide symbols in hkdf, evp, err, ecdsa, and ecbeck2023-07-0713-13/+157
| | | | | | (part 2 of commit) ok jsing@
* Mop up remaining uses of ASN1_bn_print()tb2023-07-071-17/+6
| | | | | | | This removes lots of silly buffers and will allow us to make this API go away. ok jsing
* Convert ecpk_print_explicit_parameters() to bn_printf()tb2023-07-061-34/+8
| | | | | | | This eliminates a few stupid dances the horrible ASN1_bn_print() API required. ok jsing
* don't return in a void functionbcook2023-07-051-2/+2
| | | | ok tb@
* Mop up last uses of ECDHerror() and ECDSAerror()tb2023-07-052-2/+12
| | | | ok jsing
* Rename ecs_local.h into ecdsa_local.htb2023-07-051-2/+2
|
* Drop useless ossl_ prefixestb2023-07-053-15/+15
| | | | discussed with jsing
* Explicit parameter printing can also use get0_order()tb2023-07-031-5/+6
| | | | ok beck jsing
* Convert ossl_ec_key_gen() and EC_KEY_check_key()tb2023-07-031-23/+6
| | | | | | These also get the EC_GROUP_get0_order() treatment ok beck jsing
* Convert EC_GROUP_check() to EC_GROUP_get0_order()tb2023-07-031-10/+3
| | | | ok beck jsing
* Inline two copies of EC_GROUP_order_bits()tb2023-07-031-22/+6
| | | | | | | This code is way more complicated than it needs to be. Simplify. ec_bits() was particularly stupid. ok beck jsing
* Provide internal-only EC_GROUP_get0_order()tb2023-07-032-3/+11
| | | | ok jsing
* Fix return values of ecx methodstb2023-07-021-5/+5
| | | | | | | | | It is hard to get your return values right if you choose them to be a random subset of {-2, ..., 3}. The item_verify() and the digestverify() methods don't return 0 on error, but -1. Here 0 means "failed to verify", obviously. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-21 19:21:27 +0000