summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Simplify the consistency checks in old_dsa_priv_decode()tb2023-03-041-24/+13
| | | | | | | | We have long had expensive checks for DSA domain parameters in old_dsa_priv_decode(). These were implemented in a more complicated way than necesary. ok beck jsing
* Enforce a lower bound of of EC group order so 80 bits for ECDSAtb2023-03-041-2/+7
| | | | | | | | This makes sure that the elliptic curve is not completely stupid. This is conservative enough: the smallest named groups that we support have an order of 112 bits. ok beck jsing
* Cap the number of iterations in ECDSA signingtb2023-03-041-1/+15
| | | | | | | | | | | | ECDSA is essentially the same thing as DSA, except that it is slightly less stupid. Signing specifies an infinite loop, which is only possible with arbitrary ECDSA domain parameters. Fortunately, most use of ECDSA in the wild is based on well-known groups, so it is known a priori that the loop is not infinite. Still, infinite loops are bad. A retry is unlikely, 32 retries have a probability of ~2^-8000. So it's pretty safe to error out. ok beck jsing
* Cap the number of iterations in DSA signingtb2023-03-041-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The DSA standard specifies an infinite loop: if either r or s is zero in the signature calculation, a new random number k shall be generated and the whole thing is to be redone. The rationale is that, as the standard puts it, "[i]t is extremely unlikely that r = 0 or s = 0 if signatures are generated properly." The problem is... There is no cheap way to know that the DSA domain parameters we are handed are actually DSA domain parameters, so even if all our calculations are carefully done to do all the checks needed, we cannot know if we generate the signatures properly. For this we would need to do two primality checks as well as various congruences and divisibility properties. Doing this easily leads to DoS, so nobody does it. Unfortunately, it is relatively easy to generate parameters that pass all sorts of sanity checks and will always compute s = 0 since g is nilpotent. Thus, as unlikely as it is, if we are in the mathematical model, in practice it is very possible to ensure that s = 0. Read David Benjamin's glorious commit message for more information https://boringssl-review.googlesource.com/c/boringssl/+/57228 Thanks to Guido Vranken for reporting this issue, also thanks to Hanno Boeck who apparently found and reported similar problems earlier. ok beck jsing
* Small readability tweak in old_dsa_priv_decode()tb2023-03-041-3/+3
| | | | | | Explicitly check against NULL and turn early return into goto err. ok beck jsing
* Call dsa_check_keys() before signing or verifyingtb2023-03-041-23/+9
| | | | | | | | We already had some checks on both sides, but they were less precise and differed between the functions. The code here is messy enough, so any simplification is helpful... ok beck jsing
* Add dsa_check_key() calls on DSA decodingtb2023-03-041-18/+17
| | | | | | | | | | | | When decoding a public or a private key, use dsa_check_key() to ensure consistency of the DSA parameters. We do not always have sufficient information to do that, so this is not always possible. This adds new checks and replaces incomplete existing ones. On decoding the private key we will now only calculate the corresponding public key, if the sizes are sensible. This avoids potentially expensive operations. ok beck jsing
* Provide dsa_check_key()tb2023-03-042-2/+77
| | | | | | | | | | | | | | | | | | | | This is a cheap check that ensures basid parameter consistency per FIPS 186-4: 1 < g < q, that q has the allowed bit sizes 160, 224, 256 and that p is neither too small nor too large. Unfortunately, enforcing the three allowed sizes for p is not possible since the default dsa key generation has not respected this limitation. Instead of checking that p and q are prime, we only check that they are odd. Check that public and private keys, if set, are in the proper range. In particular, disallow zero values. Various versions of these checks have been added to the dsa code over time. This consolidates and extends them and in a subsequent commit wewill replace the incomplete checks. BoringSSL has a similar function of the same name, thanks to David Benjamin for pointing it out. ok beck jsing
* Provide DSA_R_INVALID_PARAMETERS error codetb2023-03-042-2/+4
| | | | | | | This has been missing for a while already and will be used in a few upcoming commits. ok beck jsing
* Mop up ECP_NISTZ256_ASM and OPENSSL_NO_EC_NISTP_64_GCC_128 leftovers.jsing2023-03-042-22/+3
| | | | | This is `unifdef -m -DOPENSSL_NO_EC_NISTP_64_GCC_128 -UECP_NISTZ256_ASM` and some manual tidy up.
* Rename field_data1 and field_data2.jsing2023-03-042-48/+50
| | | | | | | | Rather than pretending that these "generic" variables are used for multiple things, rename them to reflect their actual usage and use appropriate types instead of void *. ok tb@
* Avoid infinite loop in bio_asn1 state machinetb2023-03-041-2/+2
| | | | | | | | | | | | If the BIO_write() in the ASN1_STATE_DATA_COPY state fails, incorrect error handling will break out of the switch without changing the state, and the infinite for loop will immediately try the same write again, which is unlikely to succeed... Clearly this code intended to break out of the loop instead. Via OpenSSL 1.1 commit 723f616df81ea05f31407f7417f49eea89bb459a ok millert
* Link evp/cipher_method_lib.c to the buildtb2023-03-011-1/+2
| | | | ok jsing
* Convert EVP_CIPHER_meth_dup() to using calloc()tb2023-03-011-3/+2
| | | | | | | There is no reason for this to call EVP_CIPHER_meth_new(), as the flags will be copied a line later anyway. Simplify this. Requested by jsing
* Make cipher_method_lib.c compile with LibreSSLtb2023-03-011-15/+29
| | | | | | | OPENSSL_zalloc() -> calloc(), OPENSSL_free() -> free() and a few assorted cosmetic tweaks to match our style better. ok jsing
* Add EVP_CIPHER_meth_* prototypes to evp.htb2023-03-011-1/+25
| | | | | | | As usual, this will be guarded by LIBRESSL_INTERNAL || LIBRESSL_NEXT_API until the next bump. ok jsing
* Make the cleanup() method return an int againtb2023-03-014-7/+12
| | | | | | | | | This partially reverts jsing's OpenBSD commit b8185953, but without adding back the error check that potentialy results in dumb leaks. No cleanup() method in the wild returns anything but 1. Since that's the signature in the EVP_CIPHER_meth_* API, we have no choice... ok jsing
* Fix line wrapping of function pointer argumentstb2023-03-011-15/+8
| | | | ok jsing
* First KNF approximation as per knfmt(1)tb2023-03-011-60/+72
| | | | ok jsing
* Drop the EVP_CIPHER_METH_get_* functionstb2023-03-011-42/+1
| | | | | | | | Nothing interesting uses them. There's a Debian SSH-1 module and corresponding ncrack bits. That's not reason enough to have this garbage. ok jsing
* Add RCS tagtb2023-03-011-0/+1
|
* Revert OpenSSL commit aa6bb135tb2023-03-011-5/+54
| | | | | | | | | | | | This reinstates the original license on this file. Don't bother bumping the copyright year. Nothing interesting has happened in here since the initial commit. (There was one interesting commit though: "Don't care openssl_zmalloc()", which is interesting due to the lack of care, not because it's copyright worthy) ok jsing
* libcrypto: import a copy of OpenSSL 1.1's cmeth_lib.ctb2023-03-011-0/+151
| | | | | | | | | | This is the file as of OpenSSL 1.1.1 commit 82dfb986. Call the file cipher_method_lib.c since the short names in this directory are hard enough to read. This is a first step towards providing the poorly named EVP_CIPHER_meth_* API which is needed by some projects because of EVP_CIPHER opacity. ok jsing
* Rewrite/simplify BN_from_montgomery_word() and BN_from_montgomery().jsing2023-02-281-92/+85
| | | | | | | | Rename BN_from_montgomery_word() to bn_montgomery_reduce() and rewrite it to be simpler and clearer, moving further towards constant time in the process. Clean up BN_from_montgomery() in the process. ok tb@
* There is no reason to-be-cleared chunks cannot participate in delayedotto2023-02-271-27/+23
| | | | freeing; ok tb@
* Use separate lines instead of semicolons.bcook2023-02-251-4/+10
| | | | | | macOS aarch64 assembly dialect treats ; as comment instead of a newline ok tb@, jsing@
* Introduce X509_get0_uids() accessor functionjob2023-02-235-6/+44
| | | | | | | By introducing X509_get0_uids(), one can add RPKI profile compliance checks to conform the absence of the issuerUID and subjectUID. OK tb@ jsing@
* Use explicit .text instead of .previous to please Windows/MinGW on amd64tb2023-02-2311-12/+12
| | | | ok miod
* Fix up the .rodata segment's name for Windows as well.tb2023-02-231-2/+3
| | | | | | | | Here we need .rdata with some alignment goo. Fortunately, this was already present for .pdata and .xdata, so the change is easy. Also, this is a code path that doesn't affect OpenBSD at all. ok jsing miod
* Adjust parentheses in mont->ri assignment.jsing2023-02-221-2/+2
| | | | Requested by tb@
* Replace bn_sub_part_words() with bn_sub().jsing2023-02-224-370/+19
| | | | | | | | Now that bn_sub() handles word arrays with potentially different lengths, we no longer need bn_sub_part_words() - call bn_sub() instead. This allows us to entirely remove the unnecessarily complex bn_sub_part_words() code. ok tb@
* Rework bn_add()/bn_sub() to operate on word arrays.jsing2023-02-223-82/+99
| | | | | | | | Rather than working on BIGNUMs, change bn_add()/bn_sub() to operate on word arrays that potentially differ in length. This matches the behaviour of s2n-bignum's bignum_add() and bignum_sub(). ok tb@
* Rewrite and simplify BN_MONT_CTX_set()jsing2023-02-222-98/+76
| | | | | | | | | | | | | | OpenSSL commit 4d524040bc8 changed BN_MONT_CTX_set() so that it computed a 64 bit N^-1 on both BN_BITS2 == 32 and BN_BITS2 == 64 platforms. However, the way in which this was done was to duplicate half the code and wrap it in #ifdef. Rewrite this code to use a single code path on all platforms, with #ifdef being limited to setting an additional word in the temporary N and storing the result on BN_BITS2 == 32 platforms. Also remove stack based BIGNUM in favour of using the already present BN_CTX. ok tb@
* perlasm: properly spell .rodata for macOS on inteltb2023-02-211-0/+3
| | | | ok jsing
* remove extra argumentbcook2023-02-211-2/+2
| | | | ok tb@
* Unifdef MONT_WORD.jsing2023-02-212-75/+5
| | | | | | | | | | | It does not make sense to use code that is slower, currently broken and prevents the use of assembly Montgomery implementations. This is the result of `unifdef -m -DMONT_WORD`, followed by some manual clean up and the removal of the Ni bignum from BN_MONT_CTX (which was only used in the non-MONT_WORD case). ok miod@ tb@
* Move BN_MONT_CTX back to bn_local.h for now. It's still used by bn_exp.ctb2023-02-192-14/+14
|
* Rewrite BN_MONT_CTX_set_locked()jsing2023-02-191-23/+27
| | | | | | | | Rewrite and simplify BN_MONT_CTX_set_locked - in particular, only hold the lock for a short period of time, rather than holding a write lock for a module across an expensive operation. ok tb@
* First pass clean up of bn_mont.c.jsing2023-02-191-31/+37
| | | | | | | | | Use calloc() rather than malloc() with manual initialisation of all struct members to zero, use memset() instead of manually initialising all struct members to zero, use consistent naming, use BN_free() instead of BN_clear_free() (since it is the same thing). ok tb@
* Move BN_MONT_CTX_copy().jsing2023-02-191-19/+19
|
* Move struct bn_mont_ctx_st from bn_local.h to bn_mont.c.jsing2023-02-192-14/+14
| | | | | | No code outside of bn_mont.c needs access to it. ok tb@
* Provide optimised versions of bn_addw() and bn_subw() for aarch64.jsing2023-02-171-1/+35
|
* Remove now unused tangle of mul*/sqr* and BN_UMULT_* macros.jsing2023-02-171-251/+1
| | | | | | | No, I'm not trying to overwhelm you... however, we really no longer need this clutter. ok tb@
* Reimplement bn_sqr_comba{4,8}().jsing2023-02-172-102/+110
| | | | | | | | | | | | Use bignum primitives rather than the current mess of macros.The sqr_add_c macro gets replaced with bn_mulw_addtw(), while the sqr_add_c2 macro gets replaced with bn_mul2_mulw_addtw(). The variables in the comba functions have also been reordered, so that the patterns are easier to understand - the compiler can take care of optimising the inputs and outputs to avoid register moves. ok tb@
* Enable s2n-bignum word_clz() on amd64.jsing2023-02-164-4/+17
| | | | | | | | | The BN_num_bits_word() function is a hot path, being called more than 80 million times during a libcrypto regress run. The word_clz() implementation uses five instructions to do the same as the generic code that uses more than 60 instructions. Discussed with tb@
* Use bn_addw() in bn_mulw(), rather than duplicating add with carry code.jsing2023-02-161-12/+7
|
* Change include from _internal_s2n_bignum.h to s2n_bignum_internal.h.jsing2023-02-161-1/+1
|
* Include the ISC license from s2n-bignum's LICENSE file.jsing2023-02-161-1/+12
|
* Bring in word_clz.S from s2n-bignum for amd64.jsing2023-02-161-0/+48
|
* Rename bn_umul_hilo() to bn_mulw().jsing2023-02-169-105/+109
| | | | | | | | | This keeps the naming consistent with the other bignum primitives that have been recently introduced. Also, use 1/0 intead of h/l (e.g. a1 instead of ah), as this keeps consistency with other primitives and allows for naming that works with double word, triple word and quadruple word inputs/outputs. Discussed with tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-04 04:37:30 +0000