summaryrefslogtreecommitdiffstats
path: root/crypto (follow)
Commit message (Collapse)AuthorAgeFilesLines
* CMP client: fix error response on -csr without private key, also in docsDr. David von Oheimb2023-05-123-4/+9
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20832)
* ecp_nistp256.c: Fix exponent in commentJonas Lindstrøm2023-05-111-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20926)
* Fixed TLS1.3 handshake issue for legacy engine API.Yuan, Shuai2023-05-111-0/+4
| | | | | | | | Signed-off-by: Yuan, Shuai <shuai.yuan@intel.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20922)
* Fix a typo found by codespell in a variable nameDimitri Papadopoulos2023-05-111-5/+5
| | | | | | | | | | | The change is limited to a single C file. CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20912)
* Fix memory leak in engine_cleanup_add_first()Kovalev Vasiliy2023-05-091-2/+3
| | | | | | | | | Fixes #20870 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20880)
* aes-gcm-armv8_64 asm support bigdianJerryDevis2023-05-091-206/+581
| | | | | | | | Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20489) (cherry picked from commit 32344a74b7ee2693a5bfda361c40ec60ab5be624)
* Prevent a fuzzing timeout in the conf fuzzerMatt Caswell2023-05-081-0/+17
| | | | | | | | | | | | | The fuzzer was creating a config file with large numbers of includes which are expensive to process. However this should not cause a security issue, and should never happen in normal operation so we can ignore it. Fixes ossfuzz issue 57718. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20839)
* Add libctx to x931 keygen.slontis2023-05-051-4/+3
| | | | | | | | | Added coverage test that failed without the change. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19677)
* Add negative integer check when using ASN1_BIT_STRINGmlitre2023-05-041-0/+6
| | | | | | | | | | | The negative integer check is done to prevent potential overflow. Fixes #20719. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20862)
* rand: trust user supplied entropy when configured without a random sourcePauli2023-05-021-0/+6
| | | | | | | | Fixes #20841 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/20843)
* param->ctrl translation: Fix evp_pkey_ctx_setget_params_to_ctrl()Richard Levitte2023-05-011-0/+1
| | | | | | | | Ensure that ctx.ctrl_cmd defaults to translation->cmd_num Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20780)
* param->ctrl translation: Fix fix_ec_paramgen_curve_nid()Richard Levitte2023-05-011-1/+14
| | | | | | | | | | | This function didn't prepare space to get the param string, which causes the default_fixup_args() call to fail. Fixes #20161 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20780)
* x509: sort stacks before findsPauli2023-05-017-0/+24
| | | | | | | | | | | | | | x509_trust.c, x509_vpm.c and v3_lib.c don't have a lock for their sorts. This is no worse than the existing code which sorted silently without locks. Addition is quadratic time in by_dir.c and v3_purp.c. However, this is an improvement over the older O(n^2 log n) code where each find also sorted the stack. Also note that v3_purp.c is limited to a maximum of 10 items, so quadratic behaviour isn't terrible. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20842)
* provider_core: sort provider stack on findPauli2023-05-011-4/+1
| | | | | | | | | | Adding all providers is quadratic time because each provider is checked for being in the stack before adding it. However, this is an improvement over the older O(n^2 log n) code where each find also sorted the stack. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20842)
* pbe: sort stack before using findPauli2023-05-011-0/+2
| | | | | | | | | There is no lock for the sort. This is no worse than the existing code which sorted silently without a lock. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20842)
* asn1: sort stacks before using findPauli2023-05-012-2/+10
| | | | | | | | | a_strnid.c doesn't have a lock for the sort. This is no worse than the existing code which sorted silently without a lock. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20842)
* Avoid generating RSA keys with p < qrkarmaka982023-04-281-0/+9
| | | | | | | | | | | We swap p and q in that case except when ACVP tests are being run. Fixes #20823 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20833)
* fix md5 bug on aarch64 big-endian plantform.Liu-ErMeng2023-04-282-15/+35
| | | | | | | | | Signed-off-by: Liu-ErMeng <liuermeng2@huawei.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20829)
* http proxy handling: Use ossl_safe_getenv() instead of getenv()Mukesh Bharsakle2023-04-281-5/+4
| | | | | | | | CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20810)
* x509: sort stacks prior to searchingPauli2023-04-281-0/+6
| | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20782)
* stack: fix searching when the stack isn't sorted.Pauli2023-04-281-13/+28
| | | | | | | | | | | More specifically, don't sort the stack when searching when it isn't sorted. This avoids a race condition. Fixes #20135 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20782)
* fix aes-xts bug on aarch64 big-endian env.Liu-ErMeng2023-04-281-12/+12
| | | | | | | | Signed-off-by: Liu-ErMeng <liuermeng2@huawei.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20797)
* params: add helper functions to allocate & copy paramsPauli2023-04-261-0/+107
| | | | | | | | | | | Added a function to allocate a buffer and copy a maching param. Added a function to allocate a buffer and concatenate all matching params. Fixes #20717 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20724)
* Fix calling pthread_key_delete on uninitialized dataPetr Mikhalicin2023-04-241-2/+17
| | | | | | | | | | | | | | | | default_context_do_init may be never called and CRYPTO_THREAD_init_local inside it may be never called too. But corresponding CRYPTO_THREAD_cleanup_local is always called at cleanup stage. This lead to undefined behavior. So, add flag to check that default_context_do_init will be called successfully or not. Fix: #20697 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20801)
* Replaced '{ 0, NULL }' with OSSL_DISPATCH_END in OSSL_DISPATCH arraysIrak Rigia2023-04-211-1/+1
| | | | | | | | | Fixes #20710 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20745)
* Fix checking return code of EVP_PKEY_get_int_param at check_curvePetr Mikhalicin2023-04-211-1/+1
| | | | | | | | | | | According to docs, EVP_PKEY_get_int_param should return 1 on Success, and 0 on Failure. So, fix checking of this return value at check_curve CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20770)
* aesv8-armx.pl: Avoid buffer overrread in AES-XTS decryptionTomas Mraz2023-04-201-1/+3
| | | | | | | | | | | | Original author: Nevine Ebeid (Amazon) Fixes: CVE-2023-1255 The buffer overread happens on decrypts of 4 mod 5 sizes. Unless the memory just after the buffer is unmapped this is harmless. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20759)
* crmf_lib.c: clean up coments on OSSL_CRMF_CERTTEMPLATE*()Dr. David von Oheimb2023-04-181-6/+2
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20736)
* OSSL_CRMF_CERTTEMPLATE_get0_publicKey(): fix return type and docDr. David von Oheimb2023-04-181-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20736)
* crypto/cmp: fix CertReqId to use in p10cr transactions acc. to RFC 4210Dr. David von Oheimb2023-04-184-26/+48
| | | | | | | Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20298)
* bn_local: remove unused `PTR_SIZE_INT` definitionAlois Klink2023-04-161-18/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* bn_nist: remove unused type-punning union `u`Alois Klink2023-04-161-21/+12
| | | | | | | | We no longer need to cast function pointers to PTR_SIZE_INT. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* bn_nist: replace pointer bit-fiddling with ternaryAlois Klink2023-04-161-45/+19
| | | | | | | | | | | | | | | | | | | | | | | | | Bit-fiddling pointers is technically implementation defined behavior in the C specification so the following code is not supported in all platforms: PTR_SIZE_INT mask; void * a, b, c; int boolean_flag; mask = 0 - boolean_flag; /* Not guaranteed to be a valid ptr to a or b on all platforms */ a = (void *) ((((PTR_SIZE_INT) b & ~mask) | (((PTR_SIZE_INT)) c & mask))); Using a ternary conditional operator is supported on all platforms (i.e. `a = boolean_flag ? b : c;`). On most modern compilers/CPUs, this will be faster, since it will get converted to a CMOV instruction. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748)
* Fix a HPKE API to put libctx, propq as last (optional parameters).slontis2023-04-141-6/+4
| | | | | | | | | This keeps the interface consistent with other HPKE API's. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20583)
* Fix the LCM computation in the RSA multiprime key checkTomas Mraz2023-04-131-6/+10
| | | | | | | | Fixes #20693 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20708)
* Fix UEFI support on win32Aidan Khoury2023-04-133-4/+4
| | | | | | Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20714)
* Fixes #19580 ECX keygenYuan, Shuai2023-04-121-1/+1
| | | | | | | | Signed-off-by: Yuan, Shuai <shuai.yuan@intel.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20680)
* Alternative fix for CVE-2022-4304Bernd Edlinger2023-04-045-69/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Revert "Fix Timing Oracle in RSA decryption"Bernd Edlinger2023-04-045-664/+22
| | | | | | | | | | This reverts commit b1892d21f8f0435deb0250f24a97915dc641c807. Except for the moving derive_kdk to a separate function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Erase temporary buffer in EVP_PKEY_get_bn_param()Anatolii Lishchynskyi2023-04-041-1/+8
| | | | | | | | | | | | | | Function EVP_PKEY_get_bn_param() uses temporary buffer (on stack or heap allocated) to store serialized bignum, but after deserializing it into BIGNUM*, the buffer is not erased and may contain sensitive data. This change makes sure the buffer is erased if it was successfully filled before. Unfortunately, it does not distinguish between public and private key components, and will always erase the buffer. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20639)
* Don't call OPENSSL_init_crypto from inside a RUN_ONCEMatt Caswell2023-04-041-3/+2
| | | | | | | | | | | | | | | | | | Calling OPENSSL_init_crypto from inside a RUN_ONCE seems like a bad idea. This is especially bad if OPENSSL_init_crypto can recursively end up attempting to call the RUN_ONCE that we're already inside. The initialisation in OPENSSL_init_crypto is already "run once" protected. There is no need to protect it "twice". Fixes #20653 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20662) (cherry picked from commit a9745427cd5d44a76b31690b4a2c6bef2ee677c4)
* FFC cleanupsslontis2023-04-035-76/+50
| | | | | | | | | | | | | | | | | Discovered during coverage testing. Remove unneccesary check when using ossl_dh_get0_params() and ossl_dsa_get0_params(). These point to addresses and can not fail for any existing calls. Make dsa keygen tests only available in the FIPS module - as they are not used in the default provider. Change ossl_ffc_set_digest() to return void as it cannot fail. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20359)
* Avoid calling into provider with the same iv_len or key_lenTomas Mraz2023-04-031-0/+8
| | | | | | | | | Fixes #20625 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20664)
* Fix compilation error when using clang-cl 16 or higherAnthony Roberts2023-04-031-1/+1
| | | | | | | | | | | | Fixes a "Incompatible function pointer types" error. In prior versions, this was a warning, but is now an error. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20654)
* Make DSA_sign() test for negative p,q,g values.slontis2023-03-312-2/+5
| | | | | | | | | | | | | | | | | | | | | | Related to #20268 DSA_sign() assumes that the signature passed in is related to DSA_size(). If q is negative then DSA_size() actually fails and returns 0. A test that tries to allocate the signature buffer using DSA_size() and then pass it to DSA_sign() will then either. (1) Have a signature buffer of NULL. In this case it was leaking data returned via i2d_DSA_SIG. (2) Cause a seg fault because we created a buffer that was not large enough to hold the signature. As it already checked zero we also now check for negative values also. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20553)
* Incorrect null pointer checkafshinpir2023-03-311-1/+1
| | | | | | | | | | CLA: trivial There is an incorrect null pointer check and this ccommit resolves it. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20646)
* Fix mem leak in ECDSA_sign().slontis2023-03-312-3/+3
| | | | | | | | | | | | | | Similiar to the issue found in PR #20553 for DSA_sign(). ECDSA_sign() leaked memory if the signature was NULL when i2d_ECDSA_SIG was called. Note that this does not affect the higher level EVP functions as they correctly handle NULL. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20554)
* Coverity 1524597: null pointer dereferencePauli2023-03-301-7/+11
| | | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20629)
* Use correct function to wait for condvarHugo Landau2023-03-302-8/+7
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20348)
* Revise build.infoHugo Landau2023-03-301-2/+9
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20348)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 12:50:08 +0100