summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/rsa/rsa_eay.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Stop supporting the long-retired X9.31 standardtb2023-04-151-19/+11
| | | | | | | | This isolates the three API functions from the library so they can be easily removed and any attempt to use RSA_X931_PADDING mode will now result in an error. ok jsing
* Add a few missing bracestb2023-04-051-4/+7
| | | | ok jsing
* Set up the RSA's _method_mod_n before the initial blindingtb2023-04-051-11/+13
| | | | | | | | | | | | | | | | As observed by Bernd Edlinger, the main part of the RSA timing leak that was recently made public is that the initial blinding isn't done with Montgomery exponentiation but rather with plain exponentiation. Pull up the initialization of the cached Montgomery context to ensure we use Montgomery exponentiation. Do this for private_{de,en}crypt(). Interestingly, the latter was fixed in OpenSSL a while ago by Andy Polyakov as part of the "smooth CRT-RSA" addition. If this code was anything but completely insane this would never have been an issue in the first place. But it's libcrypto... ok jsing
* spelling fixes; from paul tagliamontejmc2022-12-261-2/+2
| | | | | | | i removed the arithmetics -> arithmetic changes, as i felt they were not clearly correct ok tb
* Make internal header file names consistenttb2022-11-261-3/+3
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Add check for BN_sub return valueinoguchi2022-01-201-2/+3
| | | | | | CID 24839 ok jsing@ millert@ tb@
* Prepare to make RSA and RSA_METHOD opaque by including rsa_locl.htb2022-01-071-1/+2
| | | | | | where it will be needed in the upcoming bump. discussed with jsing
* Consistently call BN_init() before BN_with_flags()tb2021-12-261-1/+2
| | | | | | | | | | | | | | | | BN_with_flags() preserves the BN_FLG_MALLOCED flag of the destination which results in a potential use of an uninitialized bit. In practice this doesn't matter since we don't free the cloned BIGNUMs anyway. As jsing points out, these are mostly pointless noise and should be garbage collected. I'll leave that for another rainy day. Coverity flagged one instance BN_gcd_no_branch(), the rest was found by the ever so helpful grep(1). CID 345122 ok jsing
* Provide RSA_PKCS1_OpenSSL().jsing2019-11-021-1/+7
| | | | Prompted by inoguchi@
* Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedjsing2017-08-281-8/+1
| | | | | | code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
* use freezero() instead of memset/explicit_bzero + free. Substantiallyderaadt2017-05-021-17/+5
| | | | | | | | | | reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
* revert previous accidental commitbeck2017-04-281-9/+17
|
* *** empty log message ***beck2017-04-281-17/+9
|
* Send the function codes from the error functions to the bit bucket,beck2017-01-291-44/+28
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* Split out BN_div and BN_mod into ct and nonct versions for Internal use.beck2017-01-211-5/+5
| | | | ok jsing@
* Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatbeck2017-01-211-2/+4
| | | | | | | | | | | | matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
* missing space after commatb2016-09-091-2/+2
| | | | | | (this was apparently lost during the repo surgery) ok bcook
* call BN_init on temporaries to avoid use-before-set warningsbcook2016-07-071-1/+10
| | | | ok beck@
* Remove flags for disabling constant-time operations.bcook2016-06-301-86/+52
| | | | | | | | This removes support for DSA_FLAG_NO_EXP_CONSTTIME, DH_FLAG_NO_EXP_CONSTTIME, and RSA_FLAG_NO_CONSTTIME flags, making all of these operations unconditionally constant-time. Based on the original patch by César Pereid. ok beck@
* Correct spelling of OPENSSL_cleanse.jsing2015-09-101-5/+6
| | | | ok miod@
* Fix bad indenting in LibreSSL.doug2015-06-131-2/+2
| | | | | | | | | jsg@ noticed that some of the lines in libssl and libcrypto are not indented properly. At a quick glance, it looks like it has a different control flow than it really does. I checked the history in our tree and in OpenSSL to make sure these were simple mistakes. ok miod@ jsing@
* Check for allocation error in RSA_eay_mod_exp(). Coverity CID 25217.miod2015-02-141-1/+5
| | | | ok jsing@
* BN_CTX_get() can fail - consistently check its return value.jsing2015-02-091-3/+3
| | | | | | | | | | | | | | | There are currently cases where the return from each call is checked, the return from only the last call is checked and cases where it is not checked at all (including code in bn, ec and engine). Checking the last return value is valid as once the function fails it will continue to return NULL. However, in order to be consistent check each call with the same idiom. This makes it easy to verify. Note there are still a handful of cases that do not follow the idiom - these will be handled separately. ok beck@ doug@
* None of these need to include <openssl/rand.h>jsing2014-10-181-2/+1
|
* In RSA_eay_private_encrypt(), correctly return the smaller BN; OpenSSLmiod2014-07-111-2/+2
| | | | PR #3418 via OpenSSL trunk
* Only import cryptlib.h in the four source files that actually need it.jsing2014-07-111-3/+3
| | | | | | | | Remove the openssl public includes from cryptlib.h and add a small number of includes into the source files that actually need them. While here, also sort/group/tidy the includes. ok beck@ miod@
* Explicitly include <openssl/opensslconf.h> in every file that referencesjsing2014-07-101-1/+4
| | | | | | | | | an OPENSSL_NO_* define. This avoids relying on something else pulling it in for us, plus it fixes several cases where the #ifndef OPENSSL_NO_XYZ is never going to do anything, since OPENSSL_NO_XYZ will never defined, due to the fact that opensslconf.h has not been included. This also includes some miscellaneous sorting/tidying of headers.
* BN_free, BN_clear_free, BN_CTX_free, BN_BLINDING_free and BN_MONT_CTX_freejsing2014-07-101-7/+4
| | | | | | all have implicit NULL checks, so we do not need them here. ok miod@
* More KNF.jsing2014-07-091-42/+45
|
* RSA_NULL used to be a compile option allowing the RSA interfaces to bemiod2014-07-091-5/+1
| | | | | | | | compiled-in, with nonfunctional code, to be able to cope with the RSA patent. However, we don't use this option, and the RSA patent has expired more than 10 years ago, so just drop this piece.
* KNFmiod2014-07-091-397/+397
|
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* Use C99 initializers for the various FOO_METHOD structs. More readable, andmiod2014-04-271-16/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | avoid unreadable/unmaintainable constructs like that: const EVP_PKEY_ASN1_METHOD cmac_asn1_meth = { EVP_PKEY_CMAC, EVP_PKEY_CMAC, 0, "CMAC", "OpenSSL CMAC method", 0,0,0,0, 0,0,0, cmac_size, 0, 0,0,0,0,0,0,0, cmac_key_free, 0, 0,0 }; ok matthew@ deraadt@
* Change library to use intrinsic memory allocation functions instead ofbeck2014-04-171-8/+8
| | | | | | | | OPENSSL_foo wrappers. This changes: OPENSSL_malloc->malloc OPENSSL_free->free OPENSSL_relloc->realloc OPENSSL_freeFunc->free
* Merge conflicts; remove MacOS, Netware, OS/2, VMS and Windows build machinery.miod2014-04-131-3/+3
|
* OpenSSL 1.0.0f: mergedjm2012-01-051-29/+51
|
* openssl-1.0.0e: resolve conflictsdjm2011-11-031-1/+1
|
* resolve conflicts, fix local changesdjm2010-10-011-24/+4
|
* resolve conflictsdjm2009-01-091-1/+1
|
* update to openssl-0.9.8i; tested by several, especially krw@djm2009-01-051-17/+22
|
* Fix merge botch.kettenis2008-09-071-3/+0
| | | | ok miod@
* resolve conflictsdjm2008-09-061-223/+316
|
* openssl security fixes, diff from markus@, ok & "commit it" djm@pvalchev2006-10-041-0/+44
| | | | http://www.openssl.org/news/secadv_20060928.txt for more
* resolve conflictsdjm2006-06-271-100/+147
|
* resolve conflictsdjm2005-04-291-1/+1
|
* merge 0.9.7c; minor bugsfixes;markus2003-11-111-0/+2
| | | | | API addition: ERR_release_err_state_table [make includes before you build libssl/libcrypto]
* merge 0.9.7b with local changes; crank majors for libssl/libcryptomarkus2003-05-121-17/+114
|
* update to official patch from openssl.org; ok deraadt@, millert@markus2003-03-171-21/+21
|
* Enforce blinding on RSA operations involving private keys.ho2003-03-151-4/+23
| | | | From http://www.openssl.org/~geoff, modified to be enabled at all times.
* Merge OpenSSL 0.9.7-stable-20020605,beck2002-06-071-1/+1
| | | | correctly autogenerate obj_mac.h
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-27 23:41:51 +0000