aboutsummaryrefslogtreecommitdiff
path: root/crypto/dsa/dsa_gen.c
AgeCommit message (Collapse)AuthorFilesLines
2018-12-06Following the license change, modify the boilerplates in crypto/dsa/Richard Levitte1-1/+1
[skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7789)
2018-10-30DSA: Check for sanity of input parametersVitezslav Cizek1-0/+6
dsa_builtin_paramgen2 expects the L parameter to be greater than N, otherwise the generation will get stuck in an infinite loop. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7493)
2018-04-17Update copyright yearRichard Levitte1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5990)
2018-04-05Pick a q size consistent with the digest for DSA param generationMatt Caswell1-3/+10
There are two undocumented DSA parameter generation options available in the genpkey command line app: dsa_paramgen_md and dsa_paramgen_q_bits. These can also be accessed via the EVP API but only by using EVP_PKEY_CTX_ctrl() or EVP_PKEY_CTX_ctrl_str() directly. There are no helper macros for these options. dsa_paramgen_q_bits sets the length of q in bits (default 160 bits). dsa_paramgen_md sets the digest that is used during the parameter generation (default SHA1). In particular the output length of the digest used must be equal to or greater than the number of bits in q because of this code: if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL)) goto err; if (!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL)) goto err; for (i = 0; i < qsize; i++) md[i] ^= buf2[i]; /* step 3 */ md[0] |= 0x80; md[qsize - 1] |= 0x01; if (!BN_bin2bn(md, qsize, q)) goto err; qsize here is the number of bits in q and evpmd is the digest set via dsa_paramgen_md. md and buf2 are buffers of length SHA256_DIGEST_LENGTH. buf2 has been filled with qsize bits of random seed data, and md is uninitialised. If the output size of evpmd is less than qsize then the line "md[i] ^= buf2[i]" will be xoring an uninitialised value and the random seed data together to form the least significant bits of q (and not using the output of the digest at all for those bits) - which is probably not what was intended. The same seed is then used as an input to generating p. If the uninitialised data is actually all zeros (as seems quite likely) then the least significant bits of q will exactly match the least significant bits of the seed. This problem only occurs if you use these undocumented and difficult to find options and you set the size of q to be greater than the message digest output size. This is for parameter generation only not key generation. This scenario is considered highly unlikely and therefore the security risk of this is considered negligible. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5800)
2017-06-14Fix a possible crash in dsa_builtin_paramgen2.Bernd Edlinger1-0/+2
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3675)
2016-11-14dsa/dsa_gen: add error message for seed_len < 0Sebastian Andrzej Siewior1-1/+3
prio openssl 1.1.0 seed_len < q was accepted and the seed argument was then ignored. Now DSA_generate_parameters_ex() returns an error in such a case but no error string. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1657)
2016-09-21Fix a missing NULL check in dsa_builtin_paramgenMatt Caswell1-0/+3
We should check the last BN_CTX_get() call to ensure that it isn't NULL before we try and use any of the allocated BIGNUMs. Issue reported by Shi Lei. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-17Copyright consolidation 07/10Rich Salz1-54/+6
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-28Check that we were actually allocated BIGNUMs in dsa_builtin_paramgen2Matt Caswell1-0/+2
Calls to BN_CTX_get() can fail so we should check that they were successful. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-20Remove #error from include files.Rich Salz1-3/+1
Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-08GH322 revisited: remove unused function.Rich Salz1-36/+0
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05GH601: Various spelling fixes.FdaSilvaYY1-1/+1
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-01-26Remove /* foo.c */ commentsRich Salz1-1/+0
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-12-07Cleanup: fix all sources that used EVP_MD_CTX_(create|init|destroy)Richard Levitte1-2/+2
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-12-07Adjust all accesses to EVP_MD_CTX to use accessor functions.Richard Levitte1-9/+10
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-11-09Continue standardising malloc style for libcryptoMatt Caswell1-2/+2
Continuing from previous commit ensure our style is consistent for malloc return checks. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-10-23Remove useless codeAlessandro Ghedini1-10/+2
RT#4081 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-10-23Fix memory leaks and other mistakes on errorsAlessandro Ghedini1-3/+3
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-10-07Move BN_CTX_start() call so the error case can always call BN_CTX_end().Pascal Cuoq1-1/+2
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> MR #1231
2015-08-31GH367 follow-up, for more clarityBen Kaduk1-4/+4
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-08-27GH367: Fix dsa keygen for too-short seedIsmo Puustinen1-17/+12
If the seed value for dsa key generation is too short (< qsize), return an error. Also update the documentation. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-05-14Identify and move common internal libcrypto header filesRichard Levitte1-1/+1
There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-01free null cleanup finaleRich Salz1-2/+1
Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free NULL cleanup 7Rich Salz1-24/+13
This gets BN_.*free: BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd dead code in engines/e_ubsec. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-25RAND_bytes updatesMatt Caswell1-2/+2
Ensure RAND_bytes return value is checked correctly, and that we no longer use RAND_pseudo_bytes. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-27OPENSSL_NO_xxx cleanup: SHARich Salz1-22/+8
Remove support for SHA0 and DSS0 (they were broken), and remove the ability to attempt to build without SHA (it didn't work). For simplicity, remove the option of not building various SHA algorithms; you could argue that SHA_224/256/384/512 should be kept, since they're like crypto algorithms, but I decided to go the other way. So these options are gone: GENUINE_DSA OPENSSL_NO_SHA0 OPENSSL_NO_SHA OPENSSL_NO_SHA1 OPENSSL_NO_SHA224 OPENSSL_NO_SHA256 OPENSSL_NO_SHA384 OPENSSL_NO_SHA512 Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell1-627/+644
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-08remove OPENSSL_FIPSAPIDr. Stephen Henson1-1/+1
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-08remove FIPS module code from crypto/dsaDr. Stephen Henson1-105/+0
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-08Remove fips_constseg references.Dr. Stephen Henson1-1/+0
Reviewed-by: Tim Hudson <tjh@openssl.org>
2011-11-25return error if counter exceeds limit and seed value suppliedDr. Stephen Henson1-0/+6
2011-11-25check counter value against 4 * L, not 4096Dr. Stephen Henson1-1/+1
2011-10-16L=3072, N=256 provides 128 bits of security not 112.Dr. Stephen Henson1-1/+1
2011-09-14Allow for dynamic base in Win64 FIPS module.Andy Polyakov1-0/+1
2011-08-27Add support for DSA2 PQG generation of g parameter.Dr. Stephen Henson1-12/+17
2011-08-26Add support for canonical generation of DSA parameter g.Dr. Stephen Henson1-11/+107
Modify fips_dssvs to support appropriate file format.
2011-05-11Rename FIPS_mode_set and FIPS_mode. Theses symbols will be defined inDr. Stephen Henson1-2/+2
the FIPS capable OpenSSL.
2011-04-24Fix warning.Dr. Stephen Henson1-1/+2
2011-04-24fips_check_dsa_prng() should only be built when OPENSSL_FIPS is defined.Richard Levitte1-0/+2
2011-04-23Add PRNG security strength checking.Dr. Stephen Henson1-8/+60
2011-04-04check RAND_pseudo_bytes return valueDr. Stephen Henson1-2/+6
2011-02-11Return security strength for supported DSA parameters: will be usedDr. Stephen Henson1-7/+10
later.
2011-02-01fixes for DSA2 parameter generationDr. Stephen Henson1-4/+5
2011-01-31Provisional, experimental support for DSA2 parameter generation algorithm.Dr. Stephen Henson1-2/+266
Not properly integrated or tested yet.
2011-01-27Change OPENSSL_FIPSEVP to OPENSSL_FIPSAPI as it doesn't just referDr. Stephen Henson1-1/+1
to EVP any more. Move locking #define into fips.h. Set FIPS locking callbacks at same time as OpenSSL locking callbacks.
2011-01-26FIPS mode DSA changes:Dr. Stephen Henson1-0/+21
Check for selftest failures. Pairwise consistency test for RSA key generation. Use some EVP macros instead of EVP functions. Use minimal FIPS EVP where needed. Key size restrictions.
2011-01-19Add additional parameter to dsa_builtin_paramgen to output the generatedDr. Stephen Henson1-1/+4
seed to: this doesn't introduce any binary compatibility issues as the function is only used internally. The seed output is needed for FIPS 140-2 algorithm testing: the functionality used to be in DSA_generate_parameters_ex() but was removed in OpenSSL 1.0.0
2010-06-12Fix warnings.Ben Laurie1-2/+1
2009-09-23Audit libcrypto for unchecked return values: fix all cases enounteredDr. Stephen Henson1-3/+7
2008-12-26Remove misleading dead code. Constify. (Coverity ID 142)Ben Laurie1-7/+2
generated by cgit v1.1 at 2024-08-11 11:16:12 +0000