| Commit message (Collapse) | Author | Files | Lines |
|---|
|
Provide method specific functions for EC_POINT_set_to_infinity() and
EC_POINT_is_at_infinity(). These are not always the same thing and
will depend on the coordinate system in use.
ok beck@ tb@
|
|
Also, reuse the same keys for Camellia instead of having duplicates.
ok jsing tb
|
|
|
|
There are a very large number of entry points to libcrypto, which means it
is easy to run code prior to OPENSSL_init_crypto() being invoked. This
means that CPU capability detection will not have been run, leading to
poor choices with regards to the use of accelerated implementations.
Now that our CPU capability detection code has been cleaned up and is safe,
provide an openssl_init_crypto_constructor() that runs CPU capability
detection and invoke it as a library constructor. This should only be used
to invoke code that does not do memory allocation or trigger signals.
ok tb@
|
|
This is no longer used.
|
|
The arm CPU capability detection is uses SIGILL and is unsafe to call from
some contexts. Furthermore, this is only useful to detect NEON support,
which is then unused on OpenBSD due to __STRICT_ALIGNMENT. Requiring a
minimum of ARMv7+VFP+NEON is also not unreasonable.
The SHA-1, SHA-256 and SHA-512 (non-NEON) C code performs within ~5% of
the assembly, as does RSA when using the C based Montgomery multiplication.
The C versions of AES and GHASH code are around ~40-50% of the assembly,
howeer if you care about performance you really want to use
Chacha20Poly1305 on this platform.
This will enable further clean up to proceed.
ok joshua@ kinjiro@ tb@
|
|
|
|
|
|
with input from jsing
|
|
FIPS is currently revising their PBKDF2 recommendations and apparently
they want to require 16 octets.
https://github.com/pyca/cryptography/issues/12949
https://github.com/libressl/portable/issues/1168
ok kenjiro joshua jsing
|
|
Using hmacWithSHA1 isn't outrageously bad, but newly generated encrypted
password files ought to be using something better. Make it so.
https://github.com/pyca/cryptography/issues/12949
https://github.com/libressl/portable/issues/1168
ok joshua
|
|
We currently use the glorious default of NID_pbeWithMD5AndDES_CBC which
we inherited from OpenSSL. This could have been worse - there is also
NID_pbeWithMD2AndDES_CBC...
The way this diff works is that the undocumented PKCS8_encrypt() API
uses the PKCS#5v2 code path when it's passed a NID of -1 and requires
a cipher to succeed, otherwise it uses the PKCS#5v1.5 path. So pass in
a sensible cipher, namely AES-CBC-256, and let layers of muppetry
cascade to doing something resembling the right thing.
This still uses the default of hmacWithSHA1 and a somewhat short salt,
which will be improved in a subsequent commit.
https://github.com/pyca/cryptography/issues/12949
https://github.com/libressl/portable/issues/1168
ok kenjiro joshua jsing
|
|
ok jsing tb
|
|
what is going on when these break
ok tb@
|
|
binaries had become unlinkable. Change the libc definition to weak to solve
that, and to "const char * const" so that noone will try to set it late.
It must be stable before the first malloc() call, which could be before
main()...
discussion with otto, kettenis, tedu
|
|
Rework some logic, add explicit numerical checks, move assignment out of
variable declaration and use post-increment/post-decrement unless there is
a specific reason to do pre-increment.
ok kenjiro@ tb@
|
|
When checking the GCM tag, use timingsafe_memcmp() instead of memcmp().
ok tb@
|
|
SSL_alert_desc_string() is only used by our good old friends M2Crypto
and Net::SSLeay. While some of the two-letter combinations can be made
sense of without looking at the switch, I guess, this is just a
completely useless interface. The same level of uselessness can be
acchieved in a single line matching BoringSSL.
ok joshua kenjiro
|
|
"HTTP/1.0 200poo" as success; patch from Spiros Thanasoulas
|
|
Previously, invalid generalized time tests were split into a separate
set of test vectors and a flag was used when calling the test function to
indicate they should be tested as generalized only.
This simplifies the code a bit, and makes converting to the new test
framework easier.
ok jsing
|
|
ok beck
|
|
ok jsing tb beck
|
|
This caused test_fail to always be called when used in certain conditions,
and wrapping with do {} while (0) fixes this.
|
|
Add a basic test case for HKDF using EVP_PKEY_HKDF to evp_test.c.
This test verifies the correct derivation of output keying material
using SHA-256, matching the test vector from RFC 5869 Appendix A.1.
ok tb@ joshua@
|
|
|
|
This adds significant complexity to the code. On amd64 and aarch64 it
results in a minimal slowdown for aligned inputs and a performance
improvement for unaligned inputs.
ok beck@ joshua@ tb@
|
|
|
|
|
|
to use; spotted by lucas@
|
|
Add a test framework for use in LibreSSL regression tests. This test
framework aims to be as lightweight and as simple to use as possible.
The design is mostly inspired by Go's test system, and aims to be a
drop-in utility in most existing regress tests.
ok jsing tb beck
|
|
|
|
SOCKS4A is a fairly obscure extension to the olde SOCKS4 protocol that
allows passing the destination as a string rather than a literal IPv4
address, which is the only thing that vanilla SOCKS4 supports.
The motivation for adding something so niche is to test the SOCKS4A
server code in ssh(1)'s dynamic forwarding (-D) support.
ok tb@
|
|
Discussed with tb@
|
|
Check if ctx->data is NULL before calling freezero(). Also add
HKDF and TLS1-PRF to the EVP_PKEY cleanup regression test, as
they no longer crash with this change.
ok tb@
|
|
|
|
Initialize the output buffer with MLKEM1024_PUBLIC_KEY_BYTES
instead of MLKEM768_PUBLIC_KEY_BYTES.
ok tb@
|
|
The last #else branch in CRYPTO_gcm128_init() doesn't initialize the
function pointers for gmult/ghash, which results in a segfault when
using GCM on architectures taking this branch, notably sparc64.
found by and fix from jca
|
|
This is currently done in a rather silly way. Shift the index by 1
and avoid weird pointer dances. Rather than relying on static
initialization, use code to obviate a comment.
ok beck joshua jsing
|
|
|
|
ok tb@, joshua@
|
|
ok tb@, joshua@
|
|
This is a precursor to adding new group ids for post quantum
stuff which are up in the 4000 range, so using the array index
as the group id will be silly. Instead we just add the group
id to the structure and we walk the list to find it.
This should never be a very large list for us, so no need
to do anything cuter than linear search for now.
ok jsing@, joshua@
|
|
Even though this should remain internal, make it the same
as the public key marshal function, and make the needed
fallout changes in regress.
ok kenjiro@, tb@
|
|
ok tb@
|
|
Even though this should remain internal, make it the same
as the public key marshal function, and make the needed
fallout changes in regress.
This does not yet do the bikeshed of renaming the structure
field in the regress ctx, that will wait until a follow on
to convert 1024 in a similar manner
ok tb@
|
|
ok jsing@, joshua@
|
|
- Get rid of CBB/CBS usage in public api
- Make void functions return int that can fail if malloc fails.
Along with some fallout and resulting bikeshedding in the regress tests.
ok jsing@, tb@
|
|
AES_ecb_encrypt() does not really do ECB - provide an
aes_ecb_encrypt_internal that actually does multiple blocks and call this
from aes_ecb_cipher(). Provide ECB with its own key initialisation
function, which allows aes_init_key() to be simplified considerably.
The block function pointer is now unused, so mop this up.
ok joshua@ tb@
|
|
Provide aes_{en,de}crypt_block128() which have correct function signatures
and use these when calling the various mode functions.
ok joshua@ tb@
|
|
Provide AES-NI with its own aesni_ofb_cipher() and switch aes_ofb_cipher()
to call AES_ofb128_encrypt() directly.
ok joshua@ tb@
|
