summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ec (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Provide and use ec_group_get_field_type()tb2024-10-224-8/+17
| | | | | | | | | All internal uses of EC_METHOD_get_field_type() and EC_GROUP_method_of() are chained together. Implement this as a single API call that takes a group and use it throughout. Gets rid of another eyesore in this part of the tree. Not that there will be a shortage of eyesores anytime soon... ok jsing
* Inline a use of EC_GROUP_method_of()tb2024-10-221-2/+2
| | | | | | | | We can just reach into the group to obtain its EC_GROUP_METHOD. After all ec_local.h has to be in scope. This will permit marking this ugly API as unused internally after the next commit. ok jsing
* ec_ameth.c: fix includestb2024-10-201-3/+9
|
* ec_asn1: add missing includestb2024-10-201-2/+6
|
* ec_curve: add missing includestb2024-10-201-1/+5
|
* zap an empty linetb2024-10-201-2/+1
|
* Make ec EVP_PKEY_CTRL_MD handler match dsa/rsa more closelytb2024-10-191-11/+14
| | | | | | This makes the thing a bit easier on the eyes and improves greppability. ok joshua jsing
* EC_GROUP_check(): zap useless commentstb2024-10-191-4/+3
|
* Move EC_GROUP_check() to ec_lib.ctb2024-10-192-113/+56
| | | | EC_GROUP_check() is quite simple. It doesn't need to use its own file.
* Simplify EC_get_builtin_curves().tb2024-10-181-4/+5
| | | | | When determining the minimum of nitems and EC_CURVE_LIST_LENGTH we need neither an extra variable nor a ternary operator.
* Use better naming in ec_curve.ctb2024-10-181-33/+33
| | | | | | | Rename struct ec_list_element into struct ec_curve. Accordingly, curve_list becomes struct ec_curve ec_curve_list[]. Adjust internal API to match. suggested by jsing
* Enforce that EC Parameters correspond to a builtin curvetb2024-10-183-3/+227
| | | | | | | | | | | | | | | | | | | | | | | | | | | | EC parameters are very general. While there are some minimal sanity checks, for the parameters due to DoS risks found in the last decade, the elliptic curve code is poorly written and a target rich environment for NULL dereferences, busy loops, expensive computations and whatever other nastiness you can think of. It is not too hard to come up with parameters that reach very ugly code. While we have removed for the worst of it (the "fast" nist code and GF2m come to mind), the code very much resembles the Augean Stables. Unfortunately, curve parameters are still in use - even mandatory in some contexts - for example in machine-readable travel documents signed by ICAO country signing certification authorities (see ICAO Doc 9303). To avoid many of these DoS vectors, start enforcing that we know what the curve parameters are about, namely that they correspond to a builtin curve. This way we know that the parameters are at least as good as the standards we implement and checking this is cheap: Translate curve parameters into the ad hoc representation in the builtin curve code and check there's a match. That's very cheap since most curves are distinguished by cofactor and parameter length and we need to use an actual parameter comparison for at most half a dozen curves, usually only one or two. ok jsing
* Move EC_GROUP_new_curve_GFp() into ec_lib.ctb2024-10-182-97/+22
| | | | Another single-function file goes away.
* Merge EC_GROUP_new_curve_GFp() with ec_group_new_curve()tb2024-10-181-12/+5
| | | | | | The latter was used for EC_GROUP_new_curve_GF2m() and is now pointless. ok jsing
* Split ec_asn1_parameters2group() into digestible piecestb2024-10-171-96/+144
| | | | | | | | | | | | | | | | | This becomes a simple wrapper function that currently does three checks: 1. ensure the fieldID is for a prime field 2. check that the purported prime is of reasonable size, extract and set curve coefficients and point conversion form 3. extract and set generator, order, cofactor and seed. Sanity checks such as the Hasse bound are dealt with in the EC_GROUP API, so need not be repeated here. They will become redundant once we enforce that the parameters represent a builtin curve anyway. ok jsing
* Unindent error check in EC_GROUP_set_generator()tb2024-10-151-5/+5
|
* Switch ec_asn1_group2parameters() to get0_{order,cofactor}()tb2024-10-151-11/+14
| | | | | | | | These are more ergonomic, result in more readable code, avoid a copy and we no longer ignore a possible memory allocation error due to API misdesign and bad code. ok jsing
* Provide EC_GROUP_get0_cofactor() for internal usetb2024-10-152-2/+9
| | | | | | While this is public API in OpenSSL, there are no plans to expose it. ok jsing
* Make NULL checks in ec_asn1_group2curve() explicittb2024-10-141-3/+5
|
* Fix field element encoding for elliptic curve coefficientstb2024-10-141-45/+36
| | | | | | | | | | | | SEC 1, section 2.3.5, is explicit that the encoding of an element of the field of definition for an elliptic curve needs to be a zero-padded octet string whose length matches the byte size of the field's degree. So use BN_bn2binpad() to fix this. Factor things into a simple helper to avoid copy-pasting. This gets rid of some of the most grotesque code in this file. ok jsing
* Drop an obvious comment and fix indent for setting the seedtb2024-10-141-4/+3
| | | | | | Also remove a pointless cast. ok jsing
* In ec_asn1_group2curve() rename ok to ret, per usualtb2024-10-141-4/+4
| | | | ok jsing
* Use a and b for the curve coefficientstb2024-10-111-10/+11
| | | | | | | No idea how anyone would think that tmp_1 and tmp_2 are better suited for this. ok jsing
* Clean up ec_asn1_group2fieldid()tb2024-10-111-32/+28
| | | | | | | | This drops some unnecessary freeing that was turned into a double free reachable via public API in OpenSSL 1.1. Other than that it unindents code and uses better variable names. ok jsing
* Fix a long-standing bug in ec_asn1_group2pkparameters()tb2024-10-111-2/+2
| | | | | | | Only check for the OPENSSL_EC_NAMED_CURVE being set to treat the curve parameters as named curve parameters. ok jsing
* Use defines for the CHOICE variants of ECPKPARAMETERStb2024-10-111-7/+10
| | | | ok jsing
* Remove NULL check in ec_asn1_pkparameters2group()tb2024-10-111-5/+1
| | | | | | The callers already ensure that params != NULL. ok jsing
* Use better variable names in ec_asn1_pkparameters2group()tb2024-10-111-10/+13
| | | | ok jsing
* First cleanup pass over ec_asn1_group2pkparameters()tb2024-10-111-27/+25
| | | | | | | Use better variable names and do things in a slightly more sensible order. This way the code becomes almost self-documenting. ok jsing
* Remove params argument from ec_asn1_group2parameters()tb2024-10-111-13/+8
| | | | | | | Its only caller passes NULL, so we can simplify the entry point and the exit of this function a bit. ok jsing
* Simplify ec_asn1_group2pkparameters()tb2024-10-111-15/+8
| | | | | | | The parameters argument is always NULL, so we can simplify this helper accordingly. ok jsing
* Spell NULL in a simpler fashiontb2024-10-111-3/+5
| | | | | | | | priv_key->parameters is always NULL at this point, since its corresponding entry in the ASN.1 template has ASN1_TFLG_OPTIONAL set, so there is no point in pretending to pass it to ec_asn1_group2pkparameters(). ok jsing
* Clean up i2d_ECPKParameters()tb2024-10-111-10/+13
| | | | | | | | Use better variable names and turn it into single-exit. This changes the behavior slightly in that an error is pushed onto the stack also for i2d_ECPKPARAMETERS() return values < 0. ok jsing
* Remove the unused field_mod_func from EC_GROUPtb2024-10-031-4/+1
| | | | | | | | This was only used by the NIST method. For all other group methods it's an uninitialized pointer (as EC_GROUP_new() still uses the malloc + set all members to 0 idiom). ok jsing
* Make EC{,PK}PARAMETERS_it statictb2024-10-031-3/+3
| | | | They aren't used outside of this file.
* Fix ASN1_INTEGER_to_BN() misusetb2024-10-031-16/+16
| | | | | | | Same issue/leak as for BN_to_ASN1_INTEGER(). Stop reusing the elliptic curve parameters a and b for order and cofacter. It's confusing. ok jsing
* Switch field_bits to be an inttb2024-10-031-3/+3
| | | | ok jsing
* Fix BN_to_ASN1_INTEGER() misusetb2024-10-031-7/+6
| | | | | | | You can either let this API reuse an existing ASN1_INTEGER or you can let it allocate a new one. If you try to do both at the same time, you'll leak. ok jsing
* Remove the pkey_{,public_,param_}check() handlerstb2024-08-291-40/+1
| | | | | | | | This disables the EVP_PKEY_*check() API and makes it fail (more precisely indicate lack of support) on all key types. This is an intermediate step to full removal. Removal is ok beck jsing
* Implement X509_get_signature_info()tb2024-08-281-1/+21
| | | | | | | | | | | | | | | | This is a slightly strange combination of OBJ_find_sigid_algs() and the security level API necessary because OBJ_find_sigid_algs() on its own isn't smart enough for the special needs of RSA-PSS and EdDSA. The API extracts the hash's NID and the pubkey's NID from the certificate's signatureAlgorithm and invokes special handlers for RSA-PSS and EdDSA for retrieving the corresponding information. This isn't entirely free for RSA-PSS, but for now we don't cache this information. The security bits calculation is a bit hand-wavy, but that's something that comes along with this sort of numerology. ok jsing
* replace atoi(3) usage with strtonum(3); ok/tweaks tb@op2024-08-261-4/+10
|
* The EC_KEY method should use the EC_KEY index, not RSAtb2024-08-031-2/+2
| | | | | | Unbreaks ssh's t-agent-pkcs11-cert regress reported by anton. ok jsing
* libcrypto: constify most error string tablestb2024-06-241-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | These constitute the bulk of the remaining global mutable state in libcrypto. This commit moves most of them into data.rel.ro, leaving out ERR_str_{functs,libraries,reasons} (which require a slightly different approach) and SYS_str_reasons which is populated on startup. The main observation is that if ERR_load_strings() is called with a 0 lib argument, the ERR_STRING_DATA argument is not actually modified. We could use this fact to cast away const on the caller side and be done with it. We can make this cleaner by adding a helper ERR_load_const_strings() which explicitly avoids the assignment to str->error overriding the error code already set in the table. In order for this to work, we need to sprinkle some const in err/err.c. CMS called ERR_load_strings() with non-0 lib argument, but this didn't actually modify the error data since it ored in the value already stored in the table. Annoyingly, we need to cast const away once, namely in the call to lh_insert() in int_err_set_item(). Fixing this would require changing the public API and is going to be tricky since it requires that the LHASH_DOALL_FN_* types adjust. ok jsing
* unwrap a linetb2024-05-191-3/+2
|
* Add missing EC_KEY_free()tb2024-05-101-1/+3
| | | | | | | | | While eckey_from_explicit_params() frees *out_eckey, eckey_from_object() and eckey_from_params() do not. These functions are currently all callled with a NULL *out_eckey, but the latter two would leak if that should ever change. ok jsing
* One empty line is enoughtb2024-04-231-18/+1
|
* Add some more comments explaining shortcomings of the APItb2024-04-181-2/+9
| | | | | | | | The case in point is the incompatibility of the very ergonomic X509_ALGOR API with the RC2-derived API massacre that is EVP_CIPHER_asn1_to_param() and its "inverse". ok jsing
* Use X509_ALGOR_get0() in ecdh_cms_set_shared_info()tb2024-04-181-6/+14
| | | | | | | | This makes things slightly less gross since it involves less reaching into nested ASN.1 structures. But don't get the idea that this means the code is now clean. ok jsing
* Test and assign in ecdh_cms_set_shared_info()tb2024-04-181-9/+7
| | | | ok jsing
* Turn ecdh_cms_set_shared_info() into single exittb2024-04-181-7/+9
| | | | ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-04 14:05:46 +0000