summaryrefslogtreecommitdiffstats
path: root/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Implement automatic reseeding of DRBG after a specified time intervalDr. Matthias St. Pierre2017-12-172-15/+58
| | | | | | | | | | | Every DRBG now supports automatic reseeding not only after a given number of generate requests, but also after a specified time interval. Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4402)
* Add master DRBG for reseedingDr. Matthias St. Pierre2017-12-174-58/+195
| | | | | | | | | | | | | | | | | | | | A third shared DRBG is added, the so called master DRBG. Its sole purpose is to reseed the two other shared DRBGs, the public and the private DRBG. The randomness for the master DRBG is either pulled from the os entropy sources, or added by the application using the RAND_add() call. The master DRBG reseeds itself automatically after a given number of generate requests, but can also be reseeded using RAND_seed() or RAND_add(). A reseeding of the master DRBG is automatically propagated to the public and private DRBG. This construction fixes the problem, that up to now the randomness provided by RAND_add() was added only to the public and not to the private DRBG. Signed-off-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4402)
* Add comments to NULL func ptrs in bio_method_stDaniel Bevenius2017-12-1710-20/+20
| | | | | | | | | | | | This commit adds comments to bio_method_st definitions where the function pointers are defined as NULL. Most of the structs have comments but some where missing and not all consitent. CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4881)
* Fix invalid function type casts.Bernd Edlinger2017-12-1513-35/+31
| | | | | | | Rename bio_info_cb to BIO_info_cb. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4493)
* Fix 'make update'Todd Short2017-12-151-2/+2
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4931)
* Send supported_versions in an HRRMatt Caswell2017-12-141-0/+1
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Merge HRR into ServerHelloMatt Caswell2017-12-141-0/+1
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Drop CCS messages received in the TLSv1.3 handshakeMatt Caswell2017-12-141-1/+3
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Implement session id TLSv1.3 middlebox compatibility modeMatt Caswell2017-12-141-0/+1
| | | | | | | Clients will send a "fake" session id and servers must echo it back. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Update ServerHello to new draft-22 formatMatt Caswell2017-12-141-0/+3
| | | | | | | | | | The new ServerHello format is essentially now the same as the old TLSv1.2 one, but it must additionally include supported_versions. The version field is fixed at TLSv1.2, and the version negotiation happens solely via supported_versions. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
* Minor cleanup of the rsa mp limits codeBernd Edlinger2017-12-132-3/+5
| | | | | | | | | Reduce RSA_MAX_PRIME_NUM to 5. Remove no longer used RSA_MIN_PRIME_SIZE. Make rsa_multip_cap honor RSA_MAX_PRIME_NUM. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4905)
* Fix more OCSP_resp_get0_signer() nitsBen Kaduk2017-12-121-1/+1
| | | | | | | Fix a typo for "retrieve" and some indentation. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4919)
* crypto/bio/bss_dgram.c: annotate fallthrough (-Wimplicit-fallthrough)Patrick Steuer2017-12-121-0/+1
| | | | | | | | Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4916)
* Fix leak in ERR_get_state() when OPENSSL_init_crypto() isn't called yetRichard Levitte2017-12-121-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If OPENSSL_init_crypto() hasn't been called yet when ERR_get_state() is called, it need to be called early, so the base initialization is done. On some platforms (those who support DSO functionality and don't define OPENSSL_USE_NODELETE), that includes a call of ERR_set_mark(), which calls this function again. Furthermore, we know that ossl_init_thread_start(), which is called later in ERR_get_state(), calls OPENSSL_init_crypto(0, NULL), except that's too late. Here's what happens without an early call of OPENSSL_init_crypto(): => ERR_get_state(): => CRYPTO_THREAD_get_local(): <= NULL; # no state is found, so it gets allocated. => ossl_init_thread_start(): => OPENSSL_init_crypto(): # Here, base_inited is set to 1 # before ERR_set_mark() call => ERR_set_mark(): => ERR_get_state(): => CRYPTO_THREAD_get_local(): <= NULL; # no state is found, so it gets allocated!!!!! => ossl_init_thread_start(): => OPENSSL_init_crypto(): # base_inited is 1, # so no more init to be done <= 1 <= => CRYPTO_thread_set_local(): <= <= <= <= 1 <= => CRYPTO_thread_set_local() # previous value removed! <= Result: double allocation, and we have a leak. By calling the base OPENSSL_init_crypto() early, we get this instead: => ERR_get_state(): => OPENSSL_init_crypto(): # Here, base_inited is set to 1 # before ERR_set_mark() call => ERR_set_mark(): => ERR_get_state(): => OPENSSL_init_crypto(): # base_inited is 1, # so no more init to be done <= 1 => CRYPTO_THREAD_get_local(): <= NULL; # no state is found, so it gets allocated # let's assume we got 0xDEADBEEF => ossl_init_thread_start(): => OPENSSL_init_crypto(): # base_inited is 1, # so no more init to be done <= 1 <= 1 => CRYPTO_thread_set_local(): <= <= <= <= 1 => CRYPTO_THREAD_get_local(): <= 0xDEADBEEF <= 0xDEADBEEF Result: no leak. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4913)
* rsa: Do not allow less than 512 bit RSA keysSebastian Andrzej Siewior2017-12-113-6/+3
| | | | | | | | | | | | | | | | | | | | As per documentation, the RSA keys should not be smaller than 64bit (the documentation mentions something about a quirk in the prime generation algorithm). I am adding check into the code which used to be 16 for some reason. My primary motivation is to get rid of the last sentence in the documentation which suggest that typical keys have 1024 bits (instead updating it to the now default 2048). I *assume* that keys less than the 2048 bits (say 512) are used for education purposes. The 512 bits as the minimum have been suggested by Bernd Edlinger. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4547)
* Make BIO_METHOD struct definitions consistentDaniel Bevenius2017-12-096-6/+12
| | | | | | | | | | | | | | I noticed that some of the BIO_METHOD structs are placing the name on the same line as the type and some don't. This commit places the name on a separate line for consistency (which looks like what the majority do) CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4878)
* Convert the remaining functions in the record layer to use SSLfatal()Matt Caswell2017-12-081-0/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4841)
* Address some code-analysis issues.FdaSilvaYY2017-12-086-35/+27
| | | | | | | | | Expression '...' is always true. The 'b->init' variable is assigned values twice successively Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4753)
* Fix an incoherent test.FdaSilvaYY2017-12-081-6/+13
| | | | | | | | | | Pointer 'o' is set inside a local buffer, so it can't be NULL. Also fix coding style and add comments Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4754)
* Add missing range checks on number of multi primes in rsa_ossl_mod_expBernd Edlinger2017-12-081-2/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4862)
* chacha/asm/chacha-x86_64.pl: add AVX512VL code path.Andy Polyakov2017-12-081-4/+588
| | | | | | | | 256-bit AVX512VL was estimated to deliver ~50% improvement over AVX2 and it did live up to the expectations. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4838)
* crypto/x86_64cpuid.pl: suppress AVX512F flag on Skylake-X.Andy Polyakov2017-12-081-0/+8
| | | | | | | | | | It was observed that AVX512 code paths can negatively affect overall Skylake-X system performance. But we are talking specifically about 512-bit code, while AVX512VL, 256-bit variant of AVX512F instructions, is supposed to fly as smooth as AVX2. Which is why it remains unmasked. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4838)
* Consistent formatting for sizeof(foo)Rich Salz2017-12-0823-47/+47
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4872)
* bn/asm/rsaz-avx2.pl: fix digit correction bug in rsaz_1024_mul_avx2.Andy Polyakov2017-12-061-8/+7
| | | | | | | | Credit to OSS-Fuzz for finding this. CVE-2017-3738 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix minor typo in comment in rsa_stDaniel Bevenius2017-12-051-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4845)
* Update eng_fat.cMerQGh2017-12-041-0/+1
| | | | | | | | | | | | This line will allow use private keys, which created by Crypto Pro, to sign with OpenSSL. CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4836)
* modes/asm/ghashv8-armx.pl: handle lengths not divisible by 4x.Andy Polyakov2017-12-041-9/+137
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* modes/asm/ghashv8-armx.pl: optimize modulo-scheduled loop.Andy Polyakov2017-12-041-31/+28
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* modes/asm/ghashv8-armx.pl: modulo-schedule loop.Andy Polyakov2017-12-041-3/+70
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* modes/asm/ghashv8-armx.pl: implement 4x aggregate factor.Andy Polyakov2017-12-041-12/+171
| | | | | | | | This initial commit is unoptimized reference version that handles input lengths divisible by 4 blocks. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4830)
* Add some more cleanupsMatt Caswell2017-12-041-0/+2
| | | | | | | | | | Follow up from the conversion to use SSLfatal() in the state machine to clean things up a bit more. [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Add some sanity checks for the fatal error conditionMatt Caswell2017-12-041-0/+1
| | | | | | | | | Sometimes at the top level of the state machine code we know we are supposed to be in a fatal error condition. This commit adds some sanity checks to ensure that SSLfatal() has been called. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Fix up a few places in the state machine that got missed with SSLfatal()Matt Caswell2017-12-041-0/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert more functions in ssl/statem/statem.c to use SSLfatal()Matt Caswell2017-12-041-0/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert remaining functions in statem_srvr.c to use SSLfatal()Matt Caswell2017-12-041-0/+8
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert remaining functions in statem_clnt.c to use SSLfatal()Matt Caswell2017-12-041-0/+12
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* Convert the state machine code to use SSLfatal()Matt Caswell2017-12-041-0/+47
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4778)
* A missing semicolon prevents compilation with ENGINE_REF_COUNT_DEBUG enabled.Pauli2017-11-281-1/+1
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4816)
* Fix chacha-armv4.pl with clang -fno-integrated-as.David Benjamin2017-11-281-1/+3
| | | | | | | | | | | The __clang__-guarded #defines cause gas to complain if clang is passed -fno-integrated-as. Emitting .syntax unified when those are used fixes this. This matches the change made to ghash-armv4.pl in 6cf412c473d8145562b76219ce3da73b201b3255. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/3694)
* rsa/rsa_gen.c: harmonize keygen's ability with RSA_security_bits.Andy Polyakov2017-11-282-30/+9
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4791)
* rsa/rsa_lib.c: make RSA_security_bits multi-prime aware.Andy Polyakov2017-11-283-1/+25
| | | | | | | | | | | | | | | | Multi-prime RSA security is not determined by modulus length alone, but depends even on number of primes. Too many primes render security inadequate, but there is no common amount of primes or common factors' length that provide equivalent secuity promise as two-prime for given modulus length. Maximum amount of permitted primes is determined according to following table. <1024 | >=1024 | >=4096 | >=8192 ------+--------+--------+------- 2 | 3 | 4 | 5 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4791)
* Check for malloc failureRich Salz2017-11-271-2/+4
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4805)
* Fix SOURCE_DATE_EPOCH bug; use UTCRich Salz2017-11-271-27/+8
| | | | | | | Thanks to Juro Bystricky for the suggestion and prototype. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4644)
* chacha/asm/chacha-x86_64.pl: fix sporadic crash in AVX512 code path.Andy Polyakov2017-11-251-1/+1
| | | | | | | | Only chacha_internal_test is affected, since this path is not used from EVP. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4758)
* poly1305/asm/poly1305-x86_64.pl: switch to pure AVX512F.Andy Polyakov2017-11-251-68/+72
| | | | | | | | | | | | Convert AVX512F+VL+BW code path to pure AVX512F, so that it can be executed even on Knights Landing. Trigger for modification was observation that AVX512 code paths can negatively affect overall Skylake-X system performance. Since we are likely to suppress AVX512F capability flag [at least on Skylake-X], conversion serves as kind of "investment protection". Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4758)
* Pretty-print large INTEGERs and ENUMERATEDs in hex.David Benjamin2017-11-253-2/+43
| | | | | | | | | | | | | This avoids taking quadratic time to pretty-print certificates with excessively large integer fields. Very large integers aren't any more readable in decimal than hexadecimal anyway, and the i2s_* functions will parse either form. Found by libFuzzer. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4790)
* Create a prototype for OPENSSL_rdtscKurt Roeckx2017-11-252-4/+6
| | | | | | | | | | Switch to make it return an uint32_t instead of the various different types it returns now. Fixes: #3125 Reviewed-by: Andy Polyakov <appro@openssl.org> GH: #4757
* rsa/rsa_gen.c: ensure backward compatibility with external rsa->meth.Andy Polyakov2017-11-231-1/+14
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4770)
* crypto/x86_64cpuid.pl: fix AVX512 capability masking.Andy Polyakov2017-11-231-4/+5
| | | | | | | | Originally it was thought that it's possible to use AVX512VL+BW instructions with XMM and YMM registers without kernel enabling ZMM support, but it turned to be wrong assumption. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Support multi-prime RSA (RFC 8017)Paul Yang2017-11-2113-66/+819
| | | | | | | | | | | | | | | | | | | | | * Introduce RSA_generate_multi_prime_key to generate multi-prime RSA private key. As well as the following functions: RSA_get_multi_prime_extra_count RSA_get0_multi_prime_factors RSA_get0_multi_prime_crt_params RSA_set0_multi_prime_params RSA_get_version * Support EVP operations for multi-prime RSA * Support ASN.1 operations for multi-prime RSA * Support multi-prime check in RSA_check_key_ex * Support multi-prime RSA in apps/genrsa and apps/speed * Support multi-prime RSA manipulation functions * Test cases and documentation are added * CHANGES is updated Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4241)
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-24 05:11:02 +0100