summaryrefslogtreecommitdiff
path: root/src (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-07-04Rework ecdsa_prepare_digest()tb1-35/+35
Make it take an EC_KEY instead of a group order in preparation for further cleanup. Rename m into e to match the standard better. Also buy some vowels for jsing. ok beck jsing
2023-07-04Plug leak in the ssltesttb1-1/+2
Removing -tls1 moved some tests from the legacy stack to the TLSv1.3 stack. On a HRR, the alpn callback would be called twice and allocate the global twice, thereby leaking. So free it up front. Joint suffering with bcook and beck
2023-07-04Factor the computation of ECDSA s into a functiontb1-69/+88
ossl_ecdsa_sign_sig() is already complicated enough. The math bit is entirely self contained and does not need to obfuscate control flow and logic. with feedback from and ok jsing
2023-07-03sign_sig: drop ckinvtb1-5/+7
The only reason ckinv exists is to be able to avoid a copy. This copy leaks some timing info, that will be mitigated in a subsequent step. It is an unused or at least uncommonly used codepath. ok jsing
2023-07-03Rework the logic in ECDSA sign_sig()tb1-24/+30
If the caller supplied both kinv and r, we don't loop but rather throw an undocumented error code that no one uses, which is intended to tell the caller to run ECDSA_sign_setup() and try again. Use a boolean that indicates this situation so that the logic becomes a bit more transparent. ok jsing
2023-07-03add regress tests for the remainder of the function provided by our uuid.hjasper1-5/+137
2023-07-03Delete some more references to dead policy code.tobhe1-12/+1
Fixes -DNAMESPACE ok tb@
2023-07-03sign_sig: test on assignmenttb1-5/+6
2023-07-03sign_setup: split another check into twotb1-2/+6
2023-07-03typotobhe1-1/+1
2023-07-03Split range checks for ECDSA r and ECDSA stb1-3/+8
requested by jsing
2023-07-03Switch a couple of test from ucmp to cmptb1-4/+4
This is confusing, as both sides involved should be unsigned. The ec code is undecided on whether the group order can be negative. It should never be, so lets see what happen with this slightly stricter check. discussed with jsing
2023-07-03ossl_ecdsa_verify_sig(): simplify range checkstb1-6/+4
The checks whether r and s lie in the interval [1, order) were a bit uglier than necessary. Clean this up. ok beck jsing
2023-07-03List variables in a somewhat more sensible ordertb1-4/+4
2023-07-03In ossl_ecdsa_verify_sig() use BN_CTX more idiomaticallytb1-8/+10
ok beck jsing
2023-07-03Split a bunch of unrelated checkstb1-3/+10
ok beck jsing
2023-07-03Make ossl_ecdsa_verify_sig() single exittb1-4/+4
ok beck jsing
2023-07-03Switch ossl_ecdsa_verify() to timingsafe_memcmp()tb1-2/+2
Requested by jsing
2023-07-03Streamline ossl_ecdsa_verify()tb1-7/+13
Make it single exit and use API more idiomatically and some other cosmetics. ok beck jsing
2023-07-03Explicit parameter printing can also use get0_order()tb1-5/+6
ok beck jsing
2023-07-03Convert ossl_ec_key_gen() and EC_KEY_check_key()tb1-23/+6
These also get the EC_GROUP_get0_order() treatment ok beck jsing
2023-07-03Convert EC_GROUP_check() to EC_GROUP_get0_order()tb1-10/+3
ok beck jsing
2023-07-03Inline two copies of EC_GROUP_order_bits()tb1-22/+6
This code is way more complicated than it needs to be. Simplify. ec_bits() was particularly stupid. ok beck jsing
2023-07-03some minor fix up;jmc1-5/+5
2023-07-03Bring back no_tls1 and no_tls1_1 as undocumented silently discarded opitonsbeck2-8/+20
While I'm here, change the no_ssl2 and no_ssl3 options to use OPTION_DISCARD as well instead of continuing to set a no-op option flag. ok jsing@ tb@
2023-07-03Switch ECDSA code to using EC_GROUP_get0_order()tb1-25/+17
ok jsing
2023-07-03Provide internal-only EC_GROUP_get0_order()tb2-3/+11
ok jsing
2023-07-03Remove the tls1.0 and 1.1 related options from the openssl(1) toolkitbeck3-159/+20
ok tb@
2023-07-03Another empty line did not want to go intb1-1/+2
2023-07-03Stop testing tls 1.0 and 1.1beck3-9/+5
They have gone behind the barn.
2023-07-03Trade a pair of extra braces for a missing empty linetb1-3/+3
2023-07-02Simplify allocation checkstb1-11/+11
Instead of attempting to allocate a few times and only then check all the returned pointers for NULL, allocate and check one after the othre. This is easier on the eyes and what we usually do. Prompted by a report by Ilya Shipitsin ok beck
2023-07-02Clean up dynamic tables in OPENSSL_cleanup()tb1-1/+10
This is not currently done in OpenSSL, but it looks more like something that was mised rather than desired behavior. There are some thread safety issues here, but those are rife in this codebase anyway (although I heard claims on some versions of this lib being "fully threadsafe"). no objection jsing
2023-07-02Disable TLS 1.0 and TLS 1.1 in libsslbeck9-161/+106
Their time has long since past, and they should not be used. This change restricts ssl to versions 1.2 and 1.3, and changes the regression tests to understand we no longer speak the legacy protocols. For the moment the magical "golden" byte for byte comparison tests of raw handshake values are disabled util jsing fixes them. ok jsing@ tb@
2023-07-02Convert some tables to C99 initializerstb3-42/+249
ok & "happy pirate day" beck
2023-07-02Fix return values of ecx methodstb1-5/+5
It is hard to get your return values right if you choose them to be a random subset of {-2, ..., 3}. The item_verify() and the digestverify() methods don't return 0 on error, but -1. Here 0 means "failed to verify", obviously. ok jsing
2023-07-02Demacro SHA-512.jsing1-54/+112
Use static inline functions instead of macros to implement SHA-512. At the same time, make two key changes - firstly, rather than trying to outsmart the compiler and shuffle variables around, write the algorithm the way it is documented and actually swap the variable contents. Secondly, instead of interleaving the message schedule update and the round, do the full message schedule update first, then process the round. Overall, we get safer and more readable code. Additionally, the compiler can generate smaller and faster code (with a gain of 5-10% across a range of architectures). ok beck@ tb@
2023-07-02Fix typo in previoustb1-2/+2
2023-07-02Use asprintf() to avoid repetition in string constantstb1-6/+13
... since ASN1_bn_print() is stupid. ok jsing
2023-07-02Split ECPKParameters_print()tb1-121/+150
This function has two entirely independent parts, so instead of a huge if/else just use two functions. In ecpk_print_explicity parameters() do some additional boring cleanup such as switching to actually using the local BN_CTX and shuffling things into a slightly more sensible order. ok jsing
2023-07-02Switch sign_sig() and sign_setup() to using BN_CTXtb1-47/+73
Both these functions use a BN_CTX internally to deal with the EC API that usually requires one. However, they don't actually make use of it. Get the BIGNUMs from the BN_CTX instead, which simplifies the cleanup. Also defer allocation of the ECDSA_SIG to the very end. Instead of using its internal r and s, use two local r and s variables and transfer those to the ECDSA_SIG on success. ok beck jsing
2023-07-02Revert hunk accidentally committed in r1.39tb1-11/+1
2023-07-02Rework handling of the out_kinv and out_r pointerstb1-8/+15
suggested by jsing
2023-07-02Replace bn_sqr_words() with bn_sqr_add_words().jsing1-35/+23
In order to implement efficient squaring, we compute the sum of products (omitting the squares), double the sum of products and then finally compute and add in the squares. However, for reasons unknown the final calculation was implemented as two separate steps. Replace bn_sqr_words() with bn_sqr_add_words() such that we do the computation in one step, avoid the need for temporary BN and remove needless overhead. This gives us a performance gain across most architectures (even with the loss of sse2 on i386, for example). ok tb@
2023-07-02Rename ctx_in into in_ctx, kinvp into out_kinv and rp into out_rtb1-12/+13
2023-07-02Rename a few variables from X to xtb1-14/+14
2023-07-02Simplify things by switching to bn_rand_interval()tb1-22/+19
This avoids some silly dances in ECDSA signature generation by replacing them with a single API call. Also garbage collect the now unnecessary range. ok beck jsing
2023-07-02Unconditionally zero the ECDH keytb1-6/+3
While memset() is quite expensive, we can afford zeroing a few extra bytes to make this code more readable. ok beck jsing
2023-07-02Teach openssl ca about Ed25519 certificatestb1-18/+27
This adds a few logic curlies to end up setting the EVP_MD to EVP_md_null() as required by the API. This way ASN1_item_sign() now knows how to behave. "ok = (rv == 2);" beck
2023-07-02Teach openssl req about EdDSA certstb1-1/+8
After a few things in libcrypto were adjusted, this diff makes issuing certificate requests with Ed25519 work. ok beck
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-13 06:28:08 +0000