summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* mlkem_public_to_private: fix overread/information leaktb4 days1-3/+3
| | | | | | | | | | | | After the guts of MLKEM_public_key were changed from a union to a struct, the aligner grew the struct, leaking as many bytes of private key data as the struct grew (on normal platforms that would be 2). Ideally this would all be a bit more robust. CID 621603 621604 ok jsing kenjiro
* Call aes_set_encrypt_key_generic() from aes_set_decrypt_key_generic().jsing10 days1-2/+2
| | | | | With the renaming, aes_set_decrypt_key_generic() should now call aes_set_encrypt_key_generic() directly.
* Allow generic AES implementation to be used as a fallback.jsing10 days3-19/+65
| | | | | | | | | Rename the C based AES implementation to *_generic() and provide *_internal() wrappers for these. This allows for architectures to provide accelerated versions without having to also provide a fallback implementation. ok tb@
* Zero the round keys on AES_set_{en,de}crypt_key() function entry.jsing10 days1-1/+5
| | | | | | | This avoids leaving previous round keys around on failure, or leaving parts of previous round keys behind if reused with a smaller key size. ok tb@
* Validate AES_set_{encrypt,decrypt}_key() inputs at API boundary.jsing10 days2-18/+28
| | | | | | | | | | | Every aes_set_{encrypt,decrypt}_key_internal() implementation is currently required to check the inputs and return appropriate error codes. Pull the input validation up to the API boundary, setting key->rounds at the same time. Additionally, call aes_set_encrypt_key_internal() directly from aes_set_decrypt_key_internal(), rather than going back through the public API. ok tb@
* Remove BN_DIV2W.jsing11 days3-28/+4
| | | | | | | The BN_DIV2W define provides a code path for double word division via the C compiler, which is only enabled on hppa. Simplify the code and mop this up. ok tb@
* Re-enable bn_sqr_words() assembly.jsing11 days3-8/+8
| | | | This is now only on amd64.
* Rename old assembly bn_sqr_words() to bn_sqr_word_wise().jsing11 days6-30/+27
| | | | | | | bn_sqr_words() does not actually compute the square of the words, it only computes the square of each individual word - rename it to reflect reality. Discussed with tb@
* Deduplicate the mlkem 768 and mlkem 1024 code.beck12 days6-1788/+527
| | | | | | | | | | | This moves everything not public to mlkem_internal.c removing the old files and doing some further cleanup on the way. With this landed mlkem is out of my stack and can be changed without breaking my subsequent changes ok tb@
* Disable assembly bn_sqr_words() again for now.jsing2025-09-023-8/+8
| | | | | | | | The old assembly bn_sqr_words() does not actually square words in the bignum sense. These will have to be renamed (once I come up with a name for whatever it actually does) before we can roll forward again. Found the hard way by Janne Johansson.
* Add const here as well...jsing2025-09-011-2/+2
|
* Use bn_mul_words() from bn_mod_mul_words().jsing2025-09-011-5/+3
| | | | | | Use bn_mul_words() and bn_montgomery_reduce_words(), rather than using bn_montgomery_multiply_words(). This provides better performance on architectures that have assembly optimised bn_mul_words(), such as amd64.
* Constify bn_mul_words().jsing2025-09-013-6/+9
|
* Use bn_sqr_words() from bn_mod_sqr_words().jsing2025-09-011-5/+3
| | | | | | | | Use bn_sqr_words() and bn_montgomery_reduce_words(), rather than using bn_montgomery_multiply_words(). This provides better performance on architectures that have assembly optimised bn_sqr_words(), such as amd64. ok tb@
* Provide bn_mul_words() on amd64.jsing2025-09-012-2/+12
| | | | | This uses s2n-bignum's bignum_mul() and provides significant performance gains for a range of multiplication sizes.
* EC_GROUP_new_curve_GFp: add a sentence on what elliptic curves look liketb2025-08-311-2/+7
| | | | (for our purposes).
* Remove bn_dump.3tb2025-08-311-415/+0
| | | | | | Not installed for nearly a decade since it only "documents" internal functions and structs and the internal function doco gets more out of sync with reality with every (much needed) pass over bn/
* Reorder functions since they've been renamed.jsing2025-08-311-17/+17
|
* Rename prototype for bn_mul_normal().jsing2025-08-311-2/+2
| | | | This was missed in the previous commit.
* Rename bn_mul_words()/bn_mul_add_words().jsing2025-08-3014-111/+106
| | | | | | | | | | | | | | Most bn_.*_words() functions operate on two word arrays, however bn_mul_words() and bn_mul_add_words() operate on one word array and multiply by a single word. Rename these to bn_mulw_words() and bn_mulw_add_words() to reflect this, following naming scheme that we use for primitives. This frees up bn_mul_words() to actually be used for multiplying two word arrays. Rename bn_mul_normal() to bn_mul_words(), which will then become one of the possible assembly integration points. ok tb@
* Rework bn_sqr() to use bn_sqr_words().jsing2025-08-304-26/+27
| | | | | | | | | | | | Rework some of the squaring code so that it calls bn_sqr_words() and use this as the integration point for assembly. Convert bn_sqr_normal() to bn_sqr_words(), which is then used on architectures that do not provide their own version. This means that we resume using the assembly version of bn_sqr_words() on i386, mips64 and powerpc, which can provide considerable performance gains. ok tb@
* Remove OPENSSL_VAR_AS_FUNCTION #undeftb2025-08-291-3/+1
| | | | | | The code supporting this toggle has long been removed from all the forks. discussed with jsing
* ec_mult.c: place this code under my ISC licensetb2025-08-261-58/+13
| | | | | | | | I have effectively rewritten the entirety of this file end of 2024. This isn't code I'm particularly proud of, but it's much better than it was before (it's not as if that involved any sort of challenge...) requested by/ok jsing
* zap stray spacetb2025-08-251-2/+2
|
* Move opensslconf.h to a machine-independent placetb2025-08-2514-158/+7
| | | | | | | | | | | | After drilling through many layers of fossilized turds from a long-forgotten millenium, jsing and I finally found oil^Wa machine-independent version of opensslconf.h. Remove the no longer needed versions in arch/*/ and move one copy to the top level. Add an RCS tag and place the remaining garbage in the public domain. ok jsing
* Hide primitive BOOLEAN itemstb2025-08-222-2/+8
| | | | Rides the libcrypto bump from a couple days ago
* x_crl.c: wont -> won't + KNF for a commenttb2025-08-191-3/+4
|
* An executive decision has been taken to expose marshal private key as welltb2025-08-195-9/+13
| | | | rides the libcrypto bump
* same crank for libssl and libtls as for libcryptotb2025-08-192-2/+2
|
* bump libcrypto minor after symbol additiontb2025-08-191-1/+1
|
* Expose beck's version of BoringSSL's ML-KEM APitb2025-08-191-0/+16
| | | | | | | | | | | | | This includes interfaces for public and private keys for ML-KEM 768 and 1024. Marshalling and parsing of public keys and parsing of the wasteful NIST format of private keys (marshalling this private key format is deliberately omitted from the public API). Decapsulation and encapsulation of shared secrets. This will soon be used to implement the X25519MLKEM768 hybrid key agreement in libssl. ok beck jsing
* Add back the ASN1_{,F,T}BOOLEAN_it ASN.1 itemstb2025-08-191-0/+3
| | | | | | | | | | I was overeager to remove those a while back. This was dumb because this is about a basic ASN.1 type. The Gentoo maintainers found that tpm2-tools uses templated ASN.1 involving them. Fixes https://github.com/libressl/portable/issues/1178 ok beck jsing
* sync with crypto_namespace.h: avoid asm("") for MSVCtb2025-08-181-1/+5
| | | | Removes another patch in portable
* Avoid asm("") for MSVCtb2025-08-181-1/+5
| | | | | | This allows us to get rid of an ugly patch in portable. ok jsing
* Mop up the now unused RC4_CHUNK defines.jsing2025-08-1713-130/+0
| | | | ok tb@
* Further simplify the rc4 implementation.jsing2025-08-171-117/+45
| | | | | | | | | | | | | | | | The RC4_CHUNK related code is intended to process native word sized chunks if the input and output are naturally aligned. However, RC4_CHUNK is currently a mess of machine dependent defines. Replace this with uint64_t on all architectures - 64 bit architectures will be happy with this and on 32 bit architectures the compiler can decompose this into multiple 32 bit operations. Provide separate rc4_chunk() implementations for big and little endian, since not all architectures have a byte swap instruction that would make this a cheap conversion. Thanks to gkoehler@ and tb@ for testing on big endian. ok tb@
* Tweak comment in asn1_item_free: KNF, missing comma, wont -> won't.tb2025-08-141-3/+4
|
* unbreak tree after commiting from wrong placebeck2025-08-141-223/+1
|
* revert accidental disabling of ssl_security_cert() in -r1.52tb2025-08-141-2/+2
|
* Add a reasonable ML-KEM API for public use.beck2025-08-149-304/+1387
| | | | | | | | | | | | | | | Adapt the tests to use this API. This does not yet make the symbols public in Symbols.list which will happen shortly with a bump. This includes some partial rototilling of the non-public interfaces which will be shortly continued when the internal code is deduplicated to not have multiple copies for ML-KEM 768 and ML-KEM 1024 (which is just an artifact of unravelling the boring C++ code). ok jsing@, tb@
* Use faster versions of bignum_{mul,sqr}_{4_8,6_12,8_16}() if possible.jsing2025-08-141-10/+41
| | | | | | | | If ADX instructions are available, use the non-_alt version of s2n-bignum's bignum_{mul,sqr}_{4_8,6_12,8_16}(), which are faster than the _alt non-ADX versions. ok tb@
* Provide amd64 specific versions of bn_mul_comba6() and bn_sqr_comba6().jsing2025-08-142-2/+22
| | | | | | | These use s2n-bignum's bignum_mul_6_12_alt() and bignum_sqr_6_12_alt() functions. ok tb@
* Provide bn_mod_add_words() and bn_mod_sub_words() on amd64.jsing2025-08-142-2/+25
| | | | | | These use s2n-bignum's bignum_modadd() and bignum_modsub() routines. ok tb@
* Add special handling for multiplication and squaring of BNs with six words.jsing2025-08-142-2/+6
| | | | | | | In these cases make use of bn_mul_comba6() or bn_sqr_comba6(), which are faster than the normal path. ok tb@
* Hook additional s2n-bignum routines to the amd64 build.jsing2025-08-141-1/+11
|
* Add CPU feature detection for ADX on amd64.jsing2025-08-142-5/+10
| | | | | | | | Add detection of Multi-Precision Add-Carry Instruction Extensions on amd64. s2n-bignum provides a number of fast multiplication routines that can leverage these instructions. ok tb@
* Clean up parts of rc4.jsing2025-08-141-79/+40
| | | | | | | | | | | | Provide a static inline rc4_step() function that replaces the near identical RC4_STEP and RC4_LOOP macros. Simplify the processing loop and use for loops with small constants, which the compiler can unroll if it wants to do so. Inline the SK_LOOP macro in rc4_set_key_internal(), also using a small loop that the compiler will most likely unroll. ok tb@
* Revise include to match the name that we use.jsing2025-08-1210-20/+20
|
* Replace SPDX-License-Identifier with actual license.jsing2025-08-1210-20/+130
|
* Add RCS tags to new files.jsing2025-08-1210-0/+20
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-09-18 06:31:23 +0000