aboutsummaryrefslogtreecommitdiff
path: root/crypto
AgeCommit message (Collapse)AuthorFilesLines
2018-07-07Remove a memsetMatt Caswell1-2/+0
Also avoids calling EVP_MD_size() and a missing negative result check. Issue found by Coverity. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
2018-07-07Check a return value for success in ec_field_size()Matt Caswell1-1/+2
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
2018-07-07Fix some Coverity issues in sm2_encrypt()Matt Caswell1-9/+10
Check for a negative EVP_MD_size(). Don't dereference group until we've checked if it is NULL. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
2018-07-07Check md_size isn't negative before we use itMatt Caswell1-5/+6
Issue found by Coverity Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6592)
2018-07-06evp/e_chacha20_poly1305.c: further improve small-fragment TLS performance.Andy Polyakov2-8/+150
Improvement coefficients vary with TLS fragment length and platform, on most Intel processors maximum improvement is ~50%, while on Ryzen - 80%. The "secret" is new dedicated ChaCha20_128 code path and vectorized xor helpers. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6638)
2018-07-04[crypto/ec] disable SCA mitigations for curves with incomplete parametersBilly Brumley1-22/+24
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6648)
2018-07-03chacha/asm/chacha-x86_64.pl: add dedicated path for 128-byte inputs.Andy Polyakov1-74/+221
The 128-byte vectors are extensively used in chacha20_poly1305_tls_cipher and dedicated code path is ~30-50% faster on most platforms. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6626)
2018-07-03perlasm/x86_64-xlate.pl: refine symbol recognition in .xdata.Andy Polyakov1-1/+1
Hexadecimals were erroneously recognized as symbols in .xdata. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6626)
2018-07-03Check for NULL conf in NCONF_get_numberPauli1-4/+7
The problematic case falls back to a NULL conf which returns the result of getenv(2). If this returns NULL, everything was good. If this returns a string an attempt to convert it to a number is made using the function pointers from conf. This fix uses the strtol(3) function instead, we don't have the configuration settings and this behaves as the default would. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6632)
2018-07-02Remove development artifacts.Pauli2-2/+0
The issue was discovered on the x86/64 when attempting to include libcrypto inside another shared library. A relocation of type R_X86_64_PC32 was generated which causes a linker error. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6595)
2018-07-01rand/rand_unix.c: address macro redifinition warning.Andy Polyakov1-1/+3
Occasionally, e.g. when compiling for elderly glibc, you end up passing -D_GNU_SOURCE on command line, and doing so triggered warning... Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6616)
2018-07-01modes/asm/ghash-armv4.pl: address "infixes are deprecated" warnings.Andy Polyakov1-5/+2
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6615)
2018-06-29evp/e_chacha20_poly1305.c: improve performance for short TLS records.Andy Polyakov1-10/+148
Inputs not longer than 64 bytes are processed ~10% faster, longer lengths not divisble by 64, e.g. 255, up to ~20%. Unfortunately it's impossible to measure with apps/speed.c, -aead benchmarks TLS-like call sequence, but not exact. It took specially crafted code path... Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6597)
2018-06-28Zero-fill IV by default.Rich Salz1-0/+1
Fixes uninitialized memory read reported by Nick Mathewson Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6603)
2018-06-27Return a fatal error if application data is encountered during shutdownMatt Caswell1-0/+2
Currently if you encounter application data while waiting for a close_notify from the peer, and you have called SSL_shutdown() then you will get a -1 return (fatal error) and SSL_ERROR_SYSCALL from SSL_get_error(). This isn't accurate (it should be SSL_ERROR_SSL) and isn't persistent (you can call SSL_shutdown() again and it might then work). We change this into a proper fatal error that is persistent. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6340)
2018-06-27Modify the DEVRANDOM source so that the files are kept open persistently.Pauli5-16/+214
This allows operation inside a chroot environment without having the random device present. A new call, RAND_keep_random_devices_open(), has been introduced that can be used to control file descriptor use by the random seed sources. Some seed sources maintain open file descriptors by default, which allows such sources to operate in a chroot(2) jail without the associated device nodes being available. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6432)
2018-06-26Respect SSL_OP_NO_TICKET in TLSv1.3Matt Caswell1-0/+3
Implement support for stateful TLSv1.3 tickets, and use them if SSL_OP_NO_TICKET is set. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6563)
2018-06-25store/loader_file.c: fix char-subscripts warning.Andy Polyakov1-3/+3
This happens on systems that perform is* character classifictions as array lookup, e.g. NetBSD. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6584)
2018-06-25PA-RISC assembly pack: make it work with GNU assembler for HP-UX.Andy Polyakov7-17/+88
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6583)
2018-06-25rand/rand_unix.c: mask getentropy ELF detection on HP-UX.Andy Polyakov1-1/+1
Unlike other ELF systems, HP-UX run-time linker fails to detect symbol availability through weak declaration. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6583)
2018-06-25ec/ec_pmeth.c: minor cleanups and readability fixes.Andy Polyakov1-23/+30
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6562)
2018-06-25Use ec_group_do_inverse_ord() in SM2Nicola Tuveri1-1/+2
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6521)
2018-06-25Add inter-module private header for EC functionsNicola Tuveri2-3/+46
Internal submodules of libcrypto may require non-public functions from the EC submodule. In preparation to use `ec_group_do_inverse_ord()` (from #6116) inside the SM2 submodule to apply a SCA mitigation on the modular inversion, this commit moves the `ec_group_do_inverse_ord()` prototype declaration from the EC-local `crypto/ec/ec_lcl.h` header to the `crypto/include/internal/ec_int.h` inter-module private header. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6521)
2018-06-24Fix a new gcc-9 warning [-Wstringop-truncation]Bernd Edlinger1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6581)
2018-06-22ecdsa_ossl: address coverity nitBenjamin Kaduk1-1/+2
BN_CTX_end() does not handle NULL input, so we must manually check before calling from the cleanup handler. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6502)
2018-06-22sha/asm/sha{256|512}-armv4.pl: harmonize thumb2 support with the rest.Andy Polyakov2-3/+3
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-06-22Remove __cplusplus preamble from internal headersNicola Tuveri12-90/+0
These headers are internal and never exposed to a cpp compiler, hence no need for the preamble. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6554)
2018-06-22enable-ec_nistp_64_gcc_128: Fix function prototype warning [-Wstrict-prototypes]Nicola Tuveri3-3/+3
Fix prototype warnings triggered by -Wstrict-prototypes when configuring with `enable-ec_nistp_64_gcc_128` Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6556)
2018-06-22Fixed range of random produced in BN_is_prime_fasttest_ex() to be 1 < rand < ↵Shane Lontis1-15/+13
w-1. It was using 1<= rand < w (which is wrong by 1 on both ends) Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6547)
2018-06-21[crypto/ec] default to FLT or errorBilly Brumley4-35/+41
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6116)
2018-06-21[crypto/ec] remove blinding to support even ordersBilly Brumley1-30/+11
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6116)
2018-06-21make EC_GROUP_do_inverse_ord more robustBilly Brumley2-35/+75
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6116)
2018-06-21Add -Wstrict-prototypes option to --strict-warningsBernd Edlinger2-2/+2
[extended tests] Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6542)
2018-06-21Remove some inline assembler and non-standard constructs.Andy Polyakov2-168/+10
The goal is to minimize maintenance burden by eliminating somewhat obscure platform-specific tweaks that are not viewed as critical for contemporary applications. This affects Camellia and digest implementations that rely on md32_common.h, MD4, MD5, SHA1, SHA256. SHA256 is the only one that can be viewed as critical, but given the assembly coverage, the omission is considered appropriate. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6508)
2018-06-21[crypto/ec] don't assume points are of order group->orderBilly Brumley1-14/+15
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6535)
2018-06-21Use DEPRECATEDIN_1_2_0 macro for DSA_sign_setup declarationNicola Tuveri1-0/+2
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6467)
2018-06-21Add blinding to a DSA signatureMatt Caswell2-24/+56
This extends the recently added ECDSA signature blinding to blind DSA too. This is based on side channel attacks demonstrated by Keegan Ryan (NCC Group) for ECDSA which are likely to be able to be applied to DSA. Normally, as in ECDSA, during signing the signer calculates: s:= k^-1 * (m + r * priv_key) mod order In ECDSA, the addition operation above provides a sufficient signal for a flush+reload attack to derive the private key given sufficient signature operations. As a mitigation (based on a suggestion from Keegan) we add blinding to the operation so that: s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order Since this attack is a localhost side channel only no CVE is assigned. This commit also tweaks the previous ECDSA blinding so that blinding is only removed at the last possible step. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6522)
2018-06-20Update copyright yearMatt Caswell18-18/+18
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6538)
2018-06-19Implement coordinate blinding for EC_POINTSohaib ul Hassan12-7/+111
This commit implements coordinate blinding, i.e., it randomizes the representative of an elliptic curve point in its equivalence class, for prime curves implemented through EC_GFp_simple_method, EC_GFp_mont_method, and EC_GFp_nist_method. This commit is derived from the patch https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley. Coordinate blinding is a generally useful side-channel countermeasure and is (mostly) free. The function itself takes a few field multiplicationss, but is usually only necessary at the beginning of a scalar multiplication (as implemented in the patch). When used this way, it makes the values that variables take (i.e., field elements in an algorithm state) unpredictable. For instance, this mitigates chosen EC point side-channel attacks for settings such as ECDH and EC private key decryption, for the aforementioned curves. For EC_METHODs using different coordinate representations this commit does nothing, but the corresponding coordinate blinding function can be easily added in the future to extend these changes to such curves. Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com> Co-authored-by: Billy Brumley <bbrumley@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6501)
2018-06-19Move SM2 algos to SM2 specific PKEY methodJack Lloyd14-126/+300
Use EVP_PKEY_set_alias_type to access Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6443)
2018-06-19Add EVP_PKEY_set_alias_typeJack Lloyd4-3/+25
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6443)
2018-06-19Convert our own check of OPENSSL_NO_DEPRECATEDRichard Levitte1-1/+1
... to the check OPENSSL_API_COMPAT < 0x10100000L, to correspond with how it's declared. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6470)
2018-06-18ec/asm/ecp_nistz256-avx2.pl: harmonize clang version detection.Andy Polyakov1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6499)
2018-06-18{chacha|poly1305}/asm/*-x64.pl: harmonize clang version detection.Andy Polyakov2-2/+2
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6499)
2018-06-18sha/asm/sha{1|256}-586.pl: harmonize clang version detection.Andy Polyakov2-2/+2
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6499)
2018-06-18bn/asm/rsaz-avx2.pl: harmonize clang version detection.Andy Polyakov1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6499)
2018-06-18Fix error number clashMatt Caswell1-2/+2
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6511)
2018-06-18add 'unsupported cipher mode' diagnostics to evp_lib.c and genpkey.cDavid von Oheimb7-5/+26
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6217)
2018-06-18remove needless and misleading malloc failure error messages of ↵David von Oheimb1-10/+2
PKCS12_SAFEBAG_create_pkcs8_encrypt Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6217)
2018-06-15RAND_POOL: Add missing implementations for djgppDr. Matthias St. Pierre1-4/+5
Calling the functions rand_pool_add_{additional,nonce}_data() in crypto/rand/rand_lib.c with no implementation for djgpp/MSDOS causees unresolved symbols when linking with djgpp. Reported and fixed by Gisle Vanem Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6421)
generated by cgit v1.1 at 2024-07-14 02:40:32 +0000