summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/rsa (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Merge remainder of rsa_crpt.c into rsa_eay.ctb2023-08-092-128/+54
| | | | | Most of these are one line wrappers around methods implemented in rsa_eay.c by default.
* Move RSA blinding API from rsa_crpt.c to rsa_blinding.ctb2023-08-092-102/+102
|
* Move RSA_blinding_{on,off}() to the bottom of the filetb2023-08-091-29/+29
|
* Move bn_blind.c to rsa_blinding.ctb2023-08-092-1/+269
| | | | discussed with jsing
* Merge BN_BLINDING_create_param() into BN_BLINDING_new()tb2023-08-091-2/+2
|
* Drop the unused BN_BLINDING argument of BN_BLINDING_create_param()tb2023-08-081-4/+5
|
* Simplify RSA_setup_blinding()tb2023-08-081-21/+16
| | | | | | | Make this look a bit more like other code we cleaned up avoiding nesting and unnecessary else branches. ok jsing
* Drop the _ex from BN_BLINDING_{convert,invert}_ex()tb2023-08-021-6/+6
|
* Make BN_BLINDING internaltb2023-07-284-6/+7
| | | | | | | | | | RSA is pretty bad. In my most optimistic moments I dream of a world that stopped using it. That won't happen during my lifetime, unfortunately. Blinding is one way of making it a little less leaky. Unfortunately this side-channel leak mitigation leaked out of the library for no good reason. Let's at least fix that aspect of it. ok jsing
* Add missing license for rsa_local.htb2023-07-211-1/+57
| | | | discussed with jsing
* Hide symbols in rsabeck2023-07-0816-18/+129
| | | | ok tb@
* Rename RSA_eay_* to rsa_*.jsing2023-07-071-44/+33
| | | | | | | | Rename all of the RSA_eay_* functions to rsa_*, as well as changing the method name (and naming). Reorder things slightly so that we can remove all of the prototypes for static functions. ok tb@
* Mop up remaining uses of ASN1_bn_print()tb2023-07-071-41/+10
| | | | | | | This removes lots of silly buffers and will allow us to make this API go away. ok jsing
* Add missing rsa_security_bit() handler to the RSA-PSS ASN1_METHODtb2023-05-191-1/+2
| | | | | | Prompted by a report by Steffen Ullrich on libressl@openbsd.org ok jsing
* Salt shares the blame of the continued existence of the X9.31 padding modetb2023-05-051-2/+2
|
* Add back support for RSA_X931_PADDINGtb2023-05-053-65/+127
| | | | | | | This makes the custom stalt stack work again. Tested by robert as part of a larger diff ok jsing
* Bring back the X9.31 padding helperstb2023-05-051-0/+164
| | | | | | | | | | Nothing should be using this anymore, except that salt decided to use it in its home-cooked protocol, which already had its share of issues. Hopefully the efforts to switch salt to something more reasonable and standardized like mTLS will succeed sooner rather than later. tested as part of a larger patch by robert ok jsing
* Remove X9.31 supporttb2023-04-252-173/+1
| | | | ok jsing
* Wire up truncated SHA-2, SHA-3 and related thingstb2023-04-251-1/+8
| | | | from jsing
* Bring includes into canonical ordertb2023-04-181-2/+3
| | | | Requested by jsing
* Move some includes out of OPENSSL_NO_DEPRECATEDtb2023-04-181-3/+1
| | | | | | | | | | | | | Some headers were included conditionally on OPENSSL_NO_DEPRECATED in hopes that eventually the mess of everything includes everything will magically resolve itself. Of course everyone would end up building openssl with OPENSSL_NO_DEPRECATED over time... Right. Surprisingly, the ecosystem has come to rely on these implicit inclusions, so about two dozen ports would fail to build because of this. Patching this would be easy but really not worth the effort. ok jsing
* Stop supporting the long-retired X9.31 standardtb2023-04-152-113/+57
| | | | | | | | This isolates the three API functions from the library so they can be easily removed and any attempt to use RSA_X931_PADDING mode will now result in an error. ok jsing
* Prepare rsa.h for X9.31 support removaltb2023-04-151-1/+5
| | | | | | | | | | This wraps the three public functions in the usual #if stanza. RSA_X931_PADDING is unfortunately exposed by rust-openssl and erlang. Therefore it will remain visible to avoid breaking the build of lang/rust. Its use in the library will be neutered shortly. ok jsing
* The NBs have been duly noted and ignored. Drop them.tb2023-04-131-14/+1
|
* Remove files that definitely contain no code anymoretb2023-04-131-68/+0
| | | | (experts disagree whether they ever did)
* Move RSA_generate_key() from rsa_depr.c to rsa_gen.ctb2023-04-132-34/+35
| | | | Discussed with jsing
* Move a few functions out of OPENSSL_NO_DEPRECATEDtb2023-04-092-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | Geoff Thorpe added OPENSSL_NO_DEPRECATED nearly two decades ago. The hope was that at some point some functions can be dropped. Most of the functions marked deprecated are actually unused nowadays but unfortunately some of them are still used in the ecosystem. Move them out of OPENSSL_NO_DEPRECATED so we can define it without breaking the consumers in the next bump. ERR_remove_state() is still used by a dozen or so ports. This isn't a big deal since it is just a stupid wrapper for the not quite as deprecated ERR_remove_thread_state(). It's not worth patching these ports. Annoyingly, {DH,DSA}_generate_parameters() and RSA_generate_key() are still used. They "make use" of the old-style BN_GENCB callback, which is therefore more difficult to remove - in case you don't know know: that's the thing responsible for printing pretty '.', '+' and '*' when you generate keys. Most annoyingly, DH_generate_parameters() was added to rust-openssl in 2020 for "advanced DH support". This is very unfortunate since cargo bundles a rust-openssl and updates it only every few years or so. As a consequence we're going to be stuck with this nonsense for a good while. ok beck jsing
* Add a few missing bracestb2023-04-051-4/+7
| | | | ok jsing
* Set up the RSA's _method_mod_n before the initial blindingtb2023-04-051-11/+13
| | | | | | | | | | | | | | | | As observed by Bernd Edlinger, the main part of the RSA timing leak that was recently made public is that the initial blinding isn't done with Montgomery exponentiation but rather with plain exponentiation. Pull up the initialization of the cached Montgomery context to ensure we use Montgomery exponentiation. Do this for private_{de,en}crypt(). Interestingly, the latter was fixed in OpenSSL a while ago by Andy Polyakov as part of the "smooth CRT-RSA" addition. If this code was anything but completely insane this would never have been an issue in the first place. But it's libcrypto... ok jsing
* Convert BN_copy() with missing error checks to bn_copy()tb2023-03-271-2/+3
| | | | ok jsing
* Pull in <openssl/rsa.h> directlytb2023-03-251-1/+2
| | | | | | This is needed for many reasons. It is currently pulled in via x509.h but only when OPENSSL_NO_DEPRECATED is undefined. Again this should be fixed in the public header as well.
* Remove a few extra spacestb2023-03-111-2/+2
|
* Call BN_free() instead of BN_clear_free().jsing2023-03-071-9/+9
| | | | | | | BN_clear_free() is a wrapper that calls BN_free() - call BN_free() directly instead. ok tb@
* Fix incorrect RSA_public_decrypt() return checktb2023-03-061-4/+8
| | | | | | | | | | RSA_public_decrypt() returns <= 0 on error. Assigning to a size_t and checking for == 0 is not the right thing to do here. Neither is blindly turning the check into <= 0... Found by Niels Dossche ok jsing
* spelling fixes; from paul tagliamontejmc2022-12-261-2/+2
| | | | | | | i removed the arithmetics -> arithmetic changes, as i felt they were not clearly correct ok tb
* Make internal header file names consistenttb2022-11-2614-41/+41
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Rename out to err to conform with standard naming scheme.tobhe2022-11-081-4/+4
|
* Fix leak of pk if EVP_PKEY_set1_RSA() fails.tobhe2022-11-081-5/+9
| | | | | Found with CodeChecker feedback and ok tb@
* Remove mkerr.pl remnants from LibreSSLkn2022-07-122-12/+2
| | | | | | | This script is not used at all and files are edited by hand instead. Thus remove misleading comments incl. the obsolete script/config. Feedback OK jsing tb
* Expose new API in headers.tb2022-07-071-3/+1
| | | | | | | These are mostly security-level related, but there are also ASN1_TIME and ASN_INTEGER functions here, as well as some missing accessors. ok jsing
* Sync with changes in dsa_meth.ctb2022-07-042-11/+12
| | | | pointed out by jsing
* Prepare to provide EVP_PKEY_security_bits()tb2022-06-271-1/+8
| | | | | | | This also provides a pkey_security_bits member to the PKEY ASN.1 methods and a corresponding setter EVP_PKEY_asn1_set_security_bits(). ok beck jsing
* Prepare to provide RSA_security_bits()tb2022-06-272-2/+12
| | | | ok beck jsing
* Fix a buffer overread in OAEP padding removaltb2022-02-201-11/+11
| | | | | | | | | This only occurs on very small payloads and tightly allocated buffers that don't usually occur in practice. This is OpenSSL f61c6804 ok inoguchi jsing
* Fix check for BN_mod_inverse_ct return valueinoguchi2022-01-202-5/+5
| | | | ok jsing@ millert@ tb@
* Add check for BN_sub return valueinoguchi2022-01-201-2/+3
| | | | | | CID 24839 ok jsing@ millert@ tb@
* Make RSA, RSA_PSS_PARAMS and RSA_METHOD opaquetb2022-01-142-82/+78
| | | | | | | Move the struct internals to rsa_locl.h and provide a missing typedef in ossl_typ.h. ok inoguchi jsing
* Remove obsolete key formatstb2022-01-141-13/+1
| | | | | | | | | | This removes NETSCAPE_X509, NETSCAPE{,_ENCRYPTED}_PKEY, RSA_NET, Netscape_RSA things. Some of the nasty tentacles that could go in principle are used in some test suites, so we need to keep them... All this was removed as part of OpenSSL commit 0bc2f365. ok inoguchi jsing
* Unifdef LIBRESSL_OPAQUE_* and LIBRESSL_NEXT_APItb2022-01-141-3/+1
| | | | | This marks the start of major surgery in libcrypto. Do not attempt to build the tree for a while (~50 commits).
* Prepare to provide EVP_PKEY_check()tb2022-01-101-4/+14
| | | | | | | | | | | | | | | | | | This allows checking the validity of an EVP_PKEY. Only RSA and EC keys are supported. If a check function is set the EVP_PKEY_METHOD, it will be used, otherwise the check function on the EVP_PKEY_ASN1_METHOD is used. The default ASN.1 methods wrap RSA_check_key() and EC_KEY_check_key(), respectively. The corresponding setters are EVP_PKEY_{asn1,meth}_set_check(). It is unclear why the PKEY method has no const while the ASN.1 method has const. Requested by tobhe and used by PHP 8.1. Based on OpenSSL commit 2aee35d3 ok inoguchi jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 02:24:35 +0000