| Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
|
|
Replace memcmp() with timingsafe_memcmp() for authentication tag
comparison in AES-CCM, GCM, PKCS12 and AES key unwrap code paths
to ensure constant-time behavior and avoid potential timing side
channels.
This aligns with OpenSSL 1e4a355.
ok tb@
|
|
Extend aes_test.c to include non-EVP tests for AES CFB128 and OFB128 modes
using AES_cfb128_encrypt() and AES_ofb128_encrypt(). These additions improve
test coverage by exercising the low-level interfaces with the same vectors
used in the EVP-based tests.
ok tb@
|
|
via/ok jsg
|
|
found with smatch, ok tb@
|
|
ok kenjiro
|
|
Add missing BN_CTX_end() and free prod_Z.
CID 552848 (for prod_Z)
|
|
|
|
Silences an annoying warning when running tests with ASAN.
|
|
|
|
|
|
This no longer uses basenam, so we can drop this header which isn't
available on Windows.
|
|
BIO_new(BIO_s_mem()) now allocates this pointer, so we need to free it
before assigning to it.
|
|
|
|
The __attribute__ is part of the function declaration, hence drop the
incorrect early semicolons. Fixes the build of the md test on sparc64.
In file included from /usr/src/regress/lib/libcrypto/md/md_test.c:25:
/usr/src/regress/lib/libcrypto/md/../test/test.h:61: warning: empty declaration
/usr/src/regress/lib/libcrypto/md/../test/test.h:77: warning: empty declaration
/usr/src/regress/lib/libcrypto/md/../test/test.h:114: warning: empty declaration
|
|
test_init() calls test_new(NULL, NULL), which leads to a segfault.
llvm 16 optimizes this away with -O2, however gcc 4.2.1 on sparc64
doesn't. Fix this by only inheriting the out FILE from the parent
if the latter is non-NULL.
|
|
|
|
feature to terminate the program when out of memory. Application code
should always handle failure of library functions properly. So if you
want your program to terminate, write something like
| p = malloc(...);
| if (p == NULL)
| err(1, NULL);
and don't abuse malloc_options.
Direction suggested by otto@ after anton@ pointed out that this very old
text still used an outdated data type for malloc_options and potentially
failed to define its value at compile time.
OK otto@
|
|
These formerly public functions have only ever been called from
EVP_CIPHER_asn1_to_param() and EVP_CPIHER_param_to_asn1(), either
directly if the EVP_CIPH_FLAG_DEFAULT_ASN1 flag is set, or indirectly
when set as the .[gs]et_asn1_parameters() method of the EVP_CIPHER.
This commit removes their use in .[gs]et_asn1_parameters() dating back
to long before the EVP_CIPH_FLAG_DEFAULT_ASN1 was introduced in 2010.
This way the only remaining consumer of .[gs]et_asn1_parameters() is RC2.
ok jsing
|
|
(comment tweak, no code change)
|
|
|
|
Remove the UNALIGNED_MEMOPS_ARE_FAST from AES-IGE, which can result in
implementation defined behaviour on i386/amd64. While we could keep this
purely for aligned inputs and outputs, it's probably not that important
and can be redone in a simpler form later if we want to do so.
ok tb@
|
|
|
|
pushed-back wchar_t chars.
|
|
|
|
Discussed with tb@
|
|
This makes use of EC_FIELD_ELEMENT to perform fixed width constant
time operations.
Addition and doubling of points makes use of the formulas from
"Complete addition formulas for prime order elliptic curves"
(https://eprint.iacr.org/2015/1060). These are complete and
operate in constant time.
Further work will continue in tree.
ok tb@
|
|
Provide EC_FIELD_ELEMENT and EC_FIELD_MODULUS, which allow for operations
on fixed width fields in constant time. These can in turn be used to
implement Elliptic Curve cryptography for prime fields, without needing
to use BN. This will improve the code, reduces timing leaks and enable
further optimisation.
ok beck@ tb@
|
|
Rename Time_F to time_f and tidy up implementation and usage.
time_f still uses app_timer_{user,real}, which I will clean up in a
future commit.
ok jsing
|
|
These implement constant time modular addition, subtraction and
multiplication in the Montegomery domain.
ok tb@
|
|
whirlpool was previously removed from libcrypto, and OPENSSL_NO_WHIRLPOOL
will always be defined. Remove whirlpool support from the openssl speed
command entirely.
ok jsing tb
|
|
|
|
Move bn_add_words() and bn_sub_words() from bn_add.c to bn_add_sub.c.
These have effectively been replaced in the previous rewrites. Remove
the asserts - if bad lengths are passed the results will be incorrect
and things will fail (these should use size_t instead of int, but that
is a problem for another day).
Provide bn_sub_words_borrow(), which computes a subtraction but only
returns the resulting borrow. Provide bn_add_words_masked() and
bn_sub_words_masked(), which perform an masked addition or subtraction.
These can also be used to implement constant time addition and subtraction,
especially for reduction.
ok beck@ tb@
|
|
In the diff_len < 0 case, it incorrectly uses 0 - b[0], which mishandles
the borrow - fix this by using bn_subw_subw(). Do the same in the
diff_len > 0 case for consistency. Note that this is never currently
reached since BN_usub() requires a >= b.
ok beck@ tb@
|
|
|
|
previous commit.
|
|
This is a different way of avoiding the pointer arithmetic on NULL and
avoids test breakage in pyca/cryptography. This is also a gross hack
that penalizes existing callers of BIO_s_mem(), but this is rarely
called in a hot loop and if so that will most likely be a test.
ok kenjiro joshua jsing
|
|
This causes a test failure in pyca/cryptography.
|
|
|
|
OK deraadt@
|
|
reading FILE objects. It will fail until fflush() complies POSIX-2008.
ok tb asou
|
|
ok jsing
|
|
Provide method specific functions for EC_POINT_set_to_infinity() and
EC_POINT_is_at_infinity(). These are not always the same thing and
will depend on the coordinate system in use.
ok beck@ tb@
|
|
Also, reuse the same keys for Camellia instead of having duplicates.
ok jsing tb
|
|
|
|
There are a very large number of entry points to libcrypto, which means it
is easy to run code prior to OPENSSL_init_crypto() being invoked. This
means that CPU capability detection will not have been run, leading to
poor choices with regards to the use of accelerated implementations.
Now that our CPU capability detection code has been cleaned up and is safe,
provide an openssl_init_crypto_constructor() that runs CPU capability
detection and invoke it as a library constructor. This should only be used
to invoke code that does not do memory allocation or trigger signals.
ok tb@
|
|
This is no longer used.
|
|
The arm CPU capability detection is uses SIGILL and is unsafe to call from
some contexts. Furthermore, this is only useful to detect NEON support,
which is then unused on OpenBSD due to __STRICT_ALIGNMENT. Requiring a
minimum of ARMv7+VFP+NEON is also not unreasonable.
The SHA-1, SHA-256 and SHA-512 (non-NEON) C code performs within ~5% of
the assembly, as does RSA when using the C based Montgomery multiplication.
The C versions of AES and GHASH code are around ~40-50% of the assembly,
howeer if you care about performance you really want to use
Chacha20Poly1305 on this platform.
This will enable further clean up to proceed.
ok joshua@ kinjiro@ tb@
|
|
|
