summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/evp/e_aes.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add a custom copy handler for AES key wraptb2020-06-051-5/+31
| | | | | | | | | | | | | This is necessary because ctx->cipher_data is an EVP_AES_WRAP_CTX containing a pointer to ctx->iv. EVP_CIPHER_CTX_copy() uses memcpy to copy cipher_data to the target struct. The result is that the copy contains a pointer to the wrong struct, which then leads to a use-after-free. The custom copy handler fixes things up to avoid that. Issue reported by Guido Vranken ok beck inoguchi jsing
* Disallow setting the AES-GCM IV length to 0tb2020-04-301-1/+5
| | | | | | | It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)
* Disallow the use of zero length IVs in AES-GCM viatb2020-04-271-1/+11
| | | | | | | | | | | EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen.
* Revert the other hunk of r1.36 as well: in the case of CCM, ccm.key istb2019-05-121-1/+11
| | | | | | | | | assigned from aesni_ccm_init_key() via CRYPTO_ccm128_init(), so it needs to be copied over... Pointed out by Guido Vranken. ok jsing
* Revert part of r1.36: in the case of GCM, gcm.key is assigned fromtb2019-05-101-1/+7
| | | | | | | | | aesni_gcm_init_key() via CRYPTO_gcm128_init(), so it needs to be copied over... Fixes cryptofuzz issue #14352 and likely also #14374. ok beck jsing
* Some more malloc() to calloc() conversions.jsing2019-04-141-7/+5
| | | | ok tb@
* Remove two pointless chunks of code.jsing2019-04-141-16/+1
| | | | | | | | This reverts part of OpenSSL c2fd5d79, which added the same code to AES CCM, GCM and XTS. In the case of CCM and GCM nothing assigns {ccm,gcm}.key so there is never going to be anything to update (unlike XTS). ok tb@
* Provide EVP_aes_{128,192,256}_wrap(). This is a compatibletb2019-03-171-1/+145
| | | | | | | | | | | | | implementation based on the one in OpenSSL 1.0.2r which is still freely licensed. The functions are undocumented in OpenSSL. To use them, one needs to set the undocumented EVP_CIPHER_CTX_FLAG_WRAP_ALLOW flag on the EVP_CIPHER_CTX. resolves #505 ok jsing
* use freezero() instead of memset/explicit_bzero + free. Substantiallyderaadt2017-05-021-3/+2
| | | | | | | | | | reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
* LibreSSL : Truncated packet could crash via OOB readinoguchi2017-01-311-2/+7
| | | | | | | | This patch is originally from master branch of OpenSSL. - 2198b3a crypto/evp: harden AEAD ciphers. - 8e20499 crypto/evp: harden RC4_MD5 cipher. ok tom@
* Send the function codes from the error functions to the bit bucket,beck2017-01-291-9/+9
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* Replace all uses of magic numbers when operating on OPENSSL_ia32_P[] bymiod2016-11-041-4/+4
| | | | | | | | | | | | | | | meaningful constants in a private header file, so that reviewers can actually get a chance to figure out what the code is attempting to do without knowing all cpuid bits. While there, turn it from an array of two 32-bit ints into a properly aligned 64-bit int. Use of OPENSSL_ia32_P is now restricted to the assembler parts. C code will now always use OPENSSL_cpu_caps() and check for the proper bits in the whole 64-bit word it returns. i386 tests and ok jsing@
* Remove I386_ONLY define. It was only used to prefer amiod2016-11-041-3/+3
| | | | | | | faster-on-genuine-80386-but-slower-on-80486-onwards innstruction sequence in the SHA512 code, and had not been enabled in years, if at all. ok tom@ bcook@
* Correct spelling of OPENSSL_cleanse.jsing2015-09-101-5/+5
| | | | ok miod@
* Replace remaining CRYPTO_memcmp() calls with timingsafe_memcmp().jsing2015-06-201-2/+2
| | | | ok doug@ deraadt@
* Remove unnecessary include of assert.hmiod2015-02-101-2/+1
|
* Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().jsing2014-10-221-5/+4
| | | | | | | | arc4random_buf() is guaranteed to always succeed - it is worth noting that a number of the replaced function calls were already missing return value checks. ok deraadt@
* Make the BLOCK_CIPHER_{generic,custom} macros expand to more readable structmiod2014-07-121-67/+102
| | | | definitions using C99 field initializers. No functional change.
* Fix copy for CCM, GCM and XTS.miod2014-07-111-12/+70
| | | | | | | | Internal pointers in CCM, GCM and XTS contexts should either be NULL or set to point to the appropriate key schedule. This needs to be adjusted when copying contexts. OpenSSL PR #3272 with further fixes, from OpenSSL trunk
* Explicitly include <openssl/opensslconf.h> in every file that referencesjsing2014-07-101-6/+9
| | | | | | | | | an OPENSSL_NO_* define. This avoids relying on something else pulling it in for us, plus it fixes several cases where the #ifndef OPENSSL_NO_XYZ is never going to do anything, since OPENSSL_NO_XYZ will never defined, due to the fact that opensslconf.h has not been included. This also includes some miscellaneous sorting/tidying of headers.
* free iv, then cleanse. from Cyril Jouvetedu2014-06-151-2/+2
|
* Add missing OPENSSL_cleanse() in aead_aes_gcm_cleanup().jsing2014-06-151-1/+2
| | | | ok beck@ miod@
* The OPENSSL_cleanse() in aes_gcm_cleanup() only cleans the gcm field of thejsing2014-06-151-2/+2
| | | | | | | EVP_AES_GCM_CTX, leaving the AES key untouched - clean the entire context, rather than just part of it. ok beck@ miod@
* tags as requested by miod and teduderaadt2014-06-121-0/+1
|
* Implement an improved version of the EVP AEAD API. Thejsing2014-05-261-23/+28
| | | | | | | | | | | | | | | | EVP_AEAD_CTX_{open,seal} functions previously returned an ssize_t that was overloaded to indicate success/failure, along with the number of bytes written as output. This change adds an explicit *out_len argument which is used to return the number of output bytes and the return value is now an int that is purely used to identify success or failure. This change effectively rides the last libcrypto crank (although I do not expect there to be many users of the EVP AEAD API currently). Thanks to Adam Langley for providing the improved code that this diff is based on. ok miod@
* Convert OPENSSL_malloc stuff back to intrinsics, a few were missedbeck2014-05-221-2/+2
| | | | | as new stuff was brought in. ok miod@
* KNF.jsing2014-05-151-10/+11
|
* Add an AEAD EVP interface to libcrypto, along with AES-GCM AEADjsing2014-05-151-33/+213
| | | | | | | implementations. This largely pulls in Adam Langley's AEAD patches from Chromium's OpenSSL. ok miod@
* Nuke OPENSSL_FIPS - having #ifdefs inside a #ifndef for the same thingjsing2014-05-081-16/+0
| | | | | | is amusing. ok deraadt@
* KNF.jsing2014-05-081-529/+491
|
* Change library to use intrinsic memory allocation functions instead ofbeck2014-04-171-3/+3
| | | | | | | | OPENSSL_foo wrappers. This changes: OPENSSL_malloc->malloc OPENSSL_free->free OPENSSL_relloc->realloc OPENSSL_freeFunc->free
* call the correct decrypt function in aes_cbc_cipher()jsg2014-04-171-1/+1
| | | | | | | | | | | | | | | | From: commit e9c80e04c1a3b5a0de8e666155ab4ecb2697a77d Author: Andy Polyakov <appro@openssl.org> Date: Wed Dec 18 21:42:46 2013 +0100 evp/e_[aes|camellia].c: fix typo in CBC subroutine. It worked because it was never called. Our e_camellia.c does not have this problem. ok miod@ deraadt@
* Merge conflicts; remove MacOS, Netware, OS/2, VMS and Windows build machinery.miod2014-04-131-7/+14
|
* resolve conflictsdjm2012-10-131-40/+1233
|
* resolve conflicts, fix local changesdjm2010-10-011-16/+19
|
* resolve conflictsdjm2009-01-091-19/+16
|
* resolve conflictsdjm2008-09-061-10/+12
|
* resolve conflictsdjm2006-06-271-3/+3
|
* resolve conflictsdjm2005-04-291-7/+25
|
* merge 0.9.7b with local changes; crank majors for libssl/libcryptomarkus2003-05-121-1/+0
|
* Merge OpenSSL 0.9.7-stable-20020605,beck2002-06-071-1/+3
| | | | correctly autogenerate obj_mac.h
* OpenSSL 0.9.7 stable 2002 05 08 mergebeck2002-05-151-0/+99
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 13:39:17 +0000